Connect to Files.com with an S3 client or SDK that supports a custom endpoint and the supported S3 operations. The site-wide S3-compatible endpoint must be enabled. Configure the client's endpoint, addressing style, region, and access credentials as described below.

URL Addressing Style

The URL path to S3-compatible storage can be either path-style or virtual-hosted-style. Path-style is the original standard, and virtual-hosted-style is becoming more widely adopted.

Path-style puts the bucket name in the URL path, after the host: https://s3.files.com/my-bucket/path/to/file

Virtual-hosted-style puts the bucket name as a subdomain of the host: https://my-bucket.s3.files.com/path/to/file

Files.com supports both styles for connections to our S3-compatible endpoint.

Endpoint and Region Configuration

Use the dedicated Files.com S3-compatible endpoint when configuring your client. The endpoint uses HTTPS for all requests. The region value does not control file storage; use us-east-1 when your client requires one.

Endpoint URL

For path-style, the endpoint URLs for S3-compatible connections to your Files.com site are:

https://s3-<your_custom_subdomain>.files.com
https://s3.files.com

In the above example, replace <your_custom_subdomain> with the value of your site's Custom Subdomain.

For virtual-hosted-style, the endpoint URL is:

https://s3.files.com

Using a Custom Domain as Your Endpoint

You can reach the S3-compatible endpoint through a domain of your own by adding a Custom Domain record with Inbound S3 as its destination. Once configured, use that domain directly as your endpoint URL in place of s3.files.com or s3-<your_custom_subdomain>.files.com. Your existing Access Key ID and Secret Access Key work without any changes.

Region

The region value is part of the S3 client's AWS-compatible signing format. Files.com uses the supplied value to verify the request signature, but it does not use it to select a storage location. Your site's Regional Storage settings control where Files.com stores your files.

The client region can be set to any value. Most S3 clients use a default region of us-east-1.

Access Keys

The S3-compatible endpoint uses an Access Key ID and Secret Access Key generated from a user-associated S3-compatible API key. The connection signs in as that user and uses their access to files and folders. A site-wide REST API key has no user identity for this login, so it cannot be used for S3 access. Choose a user whose folder permissions and restrictions match the work the client needs to perform.

The user must also have S3-Compatible Endpoint protocol access, either directly or through a group. On sites that manage protocol access only through groups, a group grant is required. The separate Web, Desktop App, and API permission is not required for S3 connections.

You can manage API Keys at any time. When replacing keys, update your automation scripts, SDK configurations, or application secrets.

S3 Authentication Support

Files.com supports the AWS Signature Version 4 (SigV4) authentication model. Your client must support SigV4, a custom endpoint, and the S3 operations supported by Files.com.

Buckets, Folders, and Namespaces

For path-style, your Files.com site presents a single bucket named default. This bucket represents the top-level folder of your site. When used in the URL address, it looks like this:

https://s3-mysite.files.com/default/path/to/file

or this:

https://s3.files.com/default/path/to/file

For virtual-hosted-style, your site's Custom Subdomain is presented as the bucket name. This bucket represents the top-level folder of your site. When used in the URL address, it looks like this:

https://mysite.s3.files.com/path/to/file

Do not specify the bucket name in the endpoint URL. Your S3 client automatically applies the bucket name to the connection URL based on its URL addressing style.

Users only see objects they have permission to access.

Folders inside a bucket appear as object key prefixes. Listing or filtering objects shows only content your user is authorized to access.

S3-Compatible Connection Settings and Authentication