Your files. Your S3 tools.
Use S3-compatible cloud storage for your scripts, media archives and file workflows. Connect to Dosya with a custom endpoint, verify a sample transfer, then put your tools to work.
Generate S3 Keys
Profile → API keys → S3 credentials Configure Client
endpoint: api.dosya.dev/s3 Verify a sample
Upload → download → compare Connect with S3 credentials
Open Profile → API keys, create a key with S3 access, then enable its S3 credentials. Use the generated access ID and secret with AWS Signature V4; the dos_… API token is not the S3 secret. Save the secret securely when it is generated; it is shown only once.
https://api.dosya.dev/s3
DOSYAXXXXXXXXXXXXXXXX
your_s3_secret_key
us-east-1
ws_your_workspace_id
Required (forcePathStyle: true)
Copy the bucket ID from Integrations → S3.
S3 paths have no WebDAV All/ prefix. A folder-restricted key starts inside its allowed folder; do not prepend that folder's name again.
Choose only the access your workflow needs. The full upload/download check below needs a key and role that allow both operations.
Configure AWS CLI
Use AWS CLI v2 with a dedicated named profile. Run aws configure list-profiles first and choose an unused name. Enter the S3 pair at the prompts; keep the local credential files private.
# Choose an unused profile name; keep it on every command below
$ aws configure --profile dosya-guide
AWS Access Key ID: DOSYAXXXXXXXXXXXXXXXX
AWS Secret Access Key: your_s3_secret_key
Default region name: us-east-1
Default output format: json
# Require path-style URLs for this profile
$ aws configure set s3.addressing_style path --profile dosya-guide
# Use multipart above 64 MB, with 16 MB parts for ordinary large files
$ aws configure set s3.multipart_threshold 64MB --profile dosya-guide
$ aws configure set s3.multipart_chunksize 16MB --profile dosya-guide
Keep --profile dosya-guide and --endpoint-url https://api.dosya.dev/s3 on each remote command.
See AWS named profiles and
S3 transfer settings for configuration details.
Try one file before a whole project
Use a disposable sample, your copied bucket ID and an unused object name. Run one line at a time and stop on an error. Uploading to an existing path can replace its current content.
# macOS / Linux shell: create a fresh local sample folder
$ dosya_check_dir=$(mktemp -d)
$ dosya_check_key="dosya-check-$(basename "$dosya_check_dir").txt"
$ printf 'Dosya connection check\n' > "$dosya_check_dir/source.txt"
# Replace the bucket ID; check the generated key is unused before uploading
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3api put-object \
--bucket ws_your_workspace_id --key "$dosya_check_key" --body "$dosya_check_dir/source.txt"
# Stop on any command error. Download to a separate local file
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3api get-object \
--bucket ws_your_workspace_id --key "$dosya_check_key" "$dosya_check_dir/download.txt"
$ cmp "$dosya_check_dir/source.txt" "$dosya_check_dir/download.txt" && printf 'Bytes match\n'A successful comparison prints Bytes match. Confirm the same file in Dosya Files, then remove only that known sample when you finish. A successful listing alone does not verify upload or download. Multipart ETags are not ordinary MD5 hashes.
These are commands to run in your own workspace. For Windows and detailed troubleshooting, follow the AWS CLI walkthrough.
Use with AWS CLI
Common object operations include listing, upload, download, copy, delete and multipart. Replace the sample paths with your own, and check the compatibility limits before adapting an existing job.
Upload only keys can put objects, but cannot list, inspect, or download them. Use the direct PutObject example below to test an Upload only key; aws s3 ls and aws s3 sync require listing access.
# List all buckets (workspaces)
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 ls
# List files in a workspace
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 ls s3://ws_your_workspace_id/
# List files in a subfolder
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 ls s3://ws_your_workspace_id/Documents/ # Upload a single file
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 cp \
./report.pdf s3://ws_your_workspace_id/Documents/report.pdf
# Direct PutObject test (works with an Upload only key)
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 --region us-east-1 s3api put-object \
--bucket ws_your_workspace_id --key test.txt --body ./test.txt
# Upload an entire folder
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 cp \
./my-folder/ s3://ws_your_workspace_id/my-folder/ --recursive
# Sync a local directory (upload only new/changed files)
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 sync \
./backups/ s3://ws_your_workspace_id/backups/ # Download a single file
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 cp \
s3://ws_your_workspace_id/Documents/report.pdf ./report.pdf
# Download an entire folder
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 cp \
s3://ws_your_workspace_id/Documents/ ./docs/ --recursive # Delete a file
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 rm \
s3://ws_your_workspace_id/old-file.txt
# Copy a file within a workspace
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 cp \
s3://ws_your_workspace_id/report.pdf \
s3://ws_your_workspace_id/Archive/report-backup.pdf
# Move a file (copy + delete)
$ aws --profile dosya-guide --endpoint-url https://api.dosya.dev/s3 s3 mv \
s3://ws_your_workspace_id/temp.txt \
s3://ws_your_workspace_id/Archive/temp.txt Connect an S3 SDK
These Node.js and Python examples read the named profile configured above. Install @aws-sdk/client-s3 plus @aws-sdk/credential-providers for Node.js, or boto3 for Python. Use a custom endpoint and path-style addressing.
// Node.js / TypeScript with @aws-sdk/client-s3
import { S3Client, ListObjectsV2Command, PutObjectCommand } from "@aws-sdk/client-s3";
import { fromIni } from "@aws-sdk/credential-providers";
import { readFileSync } from "fs";
const client = new S3Client({
endpoint: "https://api.dosya.dev/s3",
region: "us-east-1",
credentials: fromIni({ profile: "dosya-guide" }),
forcePathStyle: true,
});
// List files
const list = await client.send(new ListObjectsV2Command({
Bucket: "ws_your_workspace_id",
Prefix: "Documents/",
}));
// Upload a small file (use a multipart uploader for large files)
await client.send(new PutObjectCommand({
Bucket: "ws_your_workspace_id",
Key: "Documents/report.pdf",
Body: readFileSync("./report.pdf"),
})); # Python with boto3
import boto3
from botocore.config import Config
session = boto3.Session(profile_name="dosya-guide")
client = session.client("s3",
endpoint_url="https://api.dosya.dev/s3",
config=Config(s3={"addressing_style": "path"}),
region_name="us-east-1",
)
# List files
response = client.list_objects_v2(
Bucket="ws_your_workspace_id",
Prefix="Documents/",
)
# Upload a file
client.upload_file(
"./report.pdf",
"ws_your_workspace_id",
"Documents/report.pdf",
) Use with rclone
For rclone, start with the native Dosya remote. Use the S3 configuration below when your workflow specifically needs an S3 backend.
# rclone.conf
[dosya-s3]
type = s3
provider = Other
access_key_id = DOSYAXXXXXXXXXXXXXXXX
secret_access_key = your_s3_secret_key
region = us-east-1
endpoint = https://api.dosya.dev/s3
force_path_style = true
upload_cutoff = 64Mi
chunk_size = 16Mi
sign_accept_encoding = false
# sign_accept_encoding is required: the Accept-Encoding header is rewritten
# in front of the gateway, so a signature computed over the original value
# cannot match and you get SignatureDoesNotMatch.
# Then use like any other rclone remote
$ rclone ls dosya-s3:ws_your_workspace_id/
$ rclone copy ./backups dosya-s3:ws_your_workspace_id/backups/
$ rclone sync ./docs dosya-s3:ws_your_workspace_id/docs/ --dry-run rclone sync can delete destination files. Review the --dry-run output, confirm the source is mounted and populated, and keep an independent backup before scheduling it. The sample configuration uses multipart above 64 MiB; see the rclone S3 options.
Large files: use multipart uploads
Send a video or archive in parts, then complete it into one file in Dosya. A single PutObject request sends the entire body at once.
Choose a transfer tool
AWS CLI s3 cp uses its multipart settings; s3api put-object does not split files. Boto3 upload_file supports managed multipart transfer. For large Node.js files, use a multipart uploader instead of the small-file readFileSync example.
Check the whole workflow
Storage and file-size restrictions still apply. Each part must fit the gateway's request-body limit; a part limit in the S3 protocol is not the gateway limit. Test your intended sizes and a restore. If a transfer fails, inspect and abort unfinished multipart uploads through your client.
See Dosya limits and Boto3 transfer configuration. A mount or recurring sync is not an independent backup.
Check what your client needs
S3 support alone does not guarantee every workflow. Your client must accept the complete endpoint, including /s3, use path-style addressing, and work with existing workspace buckets.
Good starting points: a script that lists, uploads and downloads files, or a transfer tool that supports custom S3 endpoints and multipart uploads. Verify the small sample above before trusting a scheduled job.
Check first: clients that create buckets, configure ACLs, use AWS IAM, or require S3 version IDs. Those workflows need features beyond Dosya's object gateway.
Requires another target: backups that depend on S3 Object Lock, retention policies or legal hold. Dosya's S3 gateway does not implement those guarantees.
For a visual client, check its endpoint and path-style options against these settings. Field names differ by application; the Cyberduck S3 documentation is one starting point.
Supported operations
Core S3 API operations for managing objects and multipart uploads.
ListBuckets List workspaces visible to the key and your membership.
ListObjectsV2 List files with prefix, delimiter, and pagination support.
GetObject Download files with ETag and conditional request support.
HeadObject Get file metadata without downloading the body.
PutObject Upload files. Intermediate folders are created automatically.
DeleteObject Move permitted files to Trash. An absent key also returns 204; access restrictions can still refuse deletion.
CopyObject Duplicate files on the server without downloading.
Multipart Upload Upload large files in parts. Create, upload parts, complete or abort.
HeadBucket Check if a workspace exists and you have access.
API key scopes
Permission mapping
| Operation | read | upload | full |
|---|---|---|---|
| ListBuckets | ✓ | ✓ | ✓ |
| ListObjectsV2 | ✓ | ✕ | ✓ |
| GetObject (download) | ✓ | ✕ | ✓ |
| HeadObject | ✓ | ✕ | ✓ |
| PutObject (upload) | ✕ | ✓ | ✓ |
| DeleteObject | ✕ | ✕ | ✓ |
| CopyObject | ✕ | ✕ | ✓ |
| Multipart Upload | ✕ | ✓ | ✓ |
Limitations & notes
| Path style only | Virtual-hosted bucket style is not supported. Use path style (forcePathStyle: true). |
| Bucket = Workspace | S3 bucket names are your workspace IDs (ws_xxx). You cannot create or delete buckets. |
| Auto-create folders | Uploading to a/b/c.txt automatically creates folders a/ and a/b/ if needed. |
| Locked files | Files locked via the dashboard cannot be modified or deleted via S3. |
| Rate limiting | An abuse ceiling on request rate, on every plan: 600 requests per minute per user, 1,200 per minute per IP. It is not a usage quota and nothing is billed against it. Plan request and concurrency ceilings do not apply to this protocol; explicit credential restrictions and daily egress allowances still apply. |
| Batch delete | DeleteObjects (POST /bucket?delete) is supported, up to 1,000 keys per request. Each key reports its own result, so a locked object is an error entry beside the keys that did delete. |
| No versioning or Object Lock | Buckets are unversioned and objects cannot be retention-locked, so workflows that require immutable copies need another target. GetBucketVersioning and GetObjectLockConfiguration answer accordingly instead of failing. |
| Separate credentials | Enable the S3 credential pair on an API key. Use its S3 secret, not the dos_ API token. Revoking the parent key also refuses its S3 credentials. |
| Upload scope is write-only | A key scoped to upload can PutObject and run multipart uploads, but ListObjectsV2, GetObject and HeadObject all answer 403 AccessDenied. It is a drop box, not a read-write credential. Use read or full to download. |
S3 storage questions
Is Dosya a full replacement for Amazon S3?
Dosya provides an S3-compatible gateway to workspace files, with common object and multipart operations. It does not provide AWS IAM, bucket lifecycle rules, S3 version IDs or Object Lock. Check the operations your client needs before moving a workflow.
Can I use S3 on the Free plan?
Yes. Free includes S3 access within its storage allowance. Workspace permissions, file-size limits and any explicit credential restrictions still apply. Creating an S3 key does not add storage.
Can I upload large videos or project archives?
Use a client that supports S3 multipart uploads. It sends parts and completes them into one file in Dosya. Available storage, file-size restrictions and the gateway's per-request body limit still apply; choose a suitable part size and test your intended file size before scheduling transfers.
Why can my key upload but not list or download?
An Upload only key is deliberately write-only. Direct PutObject and multipart uploads are allowed, while object listing, HeadObject and download are refused. Use an appropriately authorized key for a round-trip check; a successful listing alone does not prove upload access.
Do I put All/ or my folder name in an S3 path?
S3 does not use WebDAV's virtual All/ prefix. Use the copied workspace ID as the bucket. A folder-anchored key starts inside its allowed folder, so do not prepend that folder's name again.
Can I use Dosya for an immutable S3 backup?
The S3 gateway does not support Object Lock, retention policies or legal hold. Choose another target when your backup software requires those features. A sync or mounted drive also needs an independent recovery copy and a tested restore procedure.
Can a client download without my S3 credentials?
For a recipient who should not receive storage credentials, create a Dosya share link. S3 connection settings are for authorized tools and applications; they do not create a public sharing link.