---
title: "Generate an access key"
description: "Create an E2E Object Storage access key, attach it to a bucket with a role, and lock, unlock, or delete it later."
content_type: "how-to"
product: "object-storage"
platform: "MyAccount"
url: "/myaccount/object-storage/how-to/generate-an-access-key/"
topic: ["create-and-connect"]
relationships: {"requires":["/myaccount/object-storage/how-to/create-a-bucket/"]}
---

# Generate an access key

An access key is what an app, a script, or a CLI tool uses to reach your bucket instead of your
own dashboard login. After you create it, attach it to each bucket it
needs and choose its role there.

## Create the key

Open **Storage > Object Storage** and click **Manage Access Keys**, then **Create Access Key**.
Give it a name of 3 to 50 characters, letters and numbers only, no hyphens or spaces, so you
recognize it later in every command that uses it. Click **Generate Keys**.

The secret key shows only once, right here. Copy both the access key and the secret key
somewhere safe before closing the dialog. If you lose the secret key, create a new key.

## Attach the access key to a bucket

Open the bucket, go to its **Permissions** tab, and click **Attach Access Key**. Choose the key
you created and assign it a role:

| Role          | Permissions                        |
| ------------- | ---------------------------------- |
| Bucket Admin  | Read, write, and manage the bucket |
| Bucket Writer | Read and write                     |
| Bucket Reader | Read only                          |

Click **Attach**. The key now appears on the bucket's **Permissions** tab, by name under
**Access Key name** and with its role under **Access Role**. The same key can be attached to more
than one bucket, with a different role on each.

Give each key the smallest role it needs: **Bucket Reader** for a tool that only downloads,
**Bucket Writer** for one that uploads, and **Bucket Admin** only where the tool must manage the
bucket as well.

## Lock, unlock, or delete a key

From **Manage Access Keys**, find the key by name and use the actions next to it:

- **Lock** blocks the key from working right away, without deleting it. Use this if a key may
  be compromised, or while you are not using it.
- **Unlock** restores a locked key.
- **Delete** removes the key everywhere at once, including every bucket it had a role on. This
  cannot be undone, and anything still using the key stops working.

To put the key to use, connect a tool:
[Connect with the mc client](/myaccount/object-storage/how-to/connect-with-the-mc-client/),
[Connect with s3cmd](/myaccount/object-storage/how-to/connect-with-s3cmd/), or
[Use the S3-compatible API](/myaccount/object-storage/how-to/use-the-s3-compatible-api/).