Skip to navigation

Configuration

Set up your AWS SDK client to connect to Object Storage
View as Markdown

Dropbox Object Storage is S3-compatible, which means you can use any AWS CLI or SDK to interact with your buckets over the internet.

Prerequisites

Before you begin, you’ll need:

  • Access Key ID
  • Secret Access Key
  • Endpoint URL - https://seal.dropboxapi.com
  • Region - Use us-east-1 for all requests

The Access Key ID and Secret Access Key can be created on the Dropbox Developer Console. The Access Key ID and Secret Access Key credentials are used to provide access to buckets and objects associated with your account. These credentials grant full read, write, and delete access across all buckets owned by your team. Console-created credentials cannot be restricted to a single bucket or read-only access. See Managing and Rotating Credentials for more details.

Configure Credentials

First, install the AWS CLI if you haven’t already. See AWS CLI installation instructions for your platform.

Then configure your credentials:

aws configure

When prompted, enter:

  • AWS Access Key ID: Your Dropbox-provided access key
  • AWS Secret Access Key: Your Dropbox-provided secret key
  • Default region name: us-east-1
  • Default output format: json (or press enter)

This creates ~/.aws/credentials and ~/.aws/config files that all AWS SDKs will automatically use.

Alternative methods:

Any method supported by AWS SDKs for configuring Access Key ID and Secret Access Key will work, including:

  • Environment variables: Set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_DEFAULT_REGION (typically loaded from a file or secrets manager, not exported directly in shell)
  • Credentials file: Manually edit ~/.aws/credentials to add a profile

Using the SDKs

Once credentials are configured, your code only needs to specify the Object Storage endpoint. The SDK automatically reads credentials from ~/.aws/credentials or environment variables.

import boto3
from botocore.config import Config
# Create S3 client pointing to Object Storage
# Explicitly specify SigV4 for compatibility
# when generating pre-signed URLs
s3_client = boto3.client(
    's3',
    endpoint_url='https://seal.dropboxapi.com',
    region_name='us-east-1',
    config=Config(signature_version='s3v4')
)
# Test the connection
s3_client.head_bucket(Bucket='your-bucket-name')
print("Connected successfully!")

Managing and Rotating Credentials

Credentials for Dropbox Object Storage can be managed on the Dropbox Developer Console.

Credential Scope and Permissions

The credentials created are an Access Key ID and a Secret Access Key. These credentials are used to validate every request made to Dropbox Object Storage. Buckets and objects are tied to a team’s account, and only keys associated with that account will be able to perform operations, such as bucket creation, uploading objects, and downloading objects, within the account. Any set of credentials grants full API access, including read, write, and delete operations on objects and buckets, for all buckets, objects, and other resources owned by your team.

Managing Credentials in the Console

On the Credentials tab of the console users can perform the following actions on credentials:

  • Create
  • Deactivate
  • Reactivate (if deactivated)
  • Delete (WARNING: This action cannot be undone)

Store the Secret Access Key securely. It is only shown when new credentials, consisting of an Access Key ID and Secret Access Key, are created.

Rotating Credentials

Users can use the Dropbox Developer Console Credentials tab to rotate their own credentials by following the process below:

  1. Create new credentials
  2. Migrate all existing applications to use the new credentials
  3. Deactivate the old, no longer used, credentials
  4. After confirming the old credentials are no longer necessary, delete them.

Next Steps