--- title: "Backblaze B2 web interface for teams: application keys, CORS, and setup" seoTitle: "Backblaze B2 Web Interface: Keys & CORS" description: "Give your team a web interface for Backblaze B2 without sharing your account. Create an S3-compatible application key, set CORS, and scope access by folder." publishDate: 2026-02-04 updatedDate: 2026-09-15 tags: ["Getting Started", "Backblaze B2", "S3-Compatible", "Storage"] image: "/blog-images/Backblaze-b2-quicks3.jpg" draft: false --- The Backblaze web console works well for the person who owns the account. Sharing a B2 bucket with a team is harder. Teammates need their own Backblaze logins (user groups need the Enterprise Web Console), or you hand out application keys that anyone can paste into a desktop client and keep. This guide connects B2 to quickS3 instead. Your team signs in to quickS3 and gets a web interface for the buckets and folders their role allows. The application key stays in one place, and files move straight between the browser and Backblaze. ## What you'll set up - A B2 application key that works with the S3-compatible API - A quickS3 connection to your B2 endpoint - CORS on the bucket, so uploads work in the browser (quickS3 does this for you) - Roles that give each person the right buckets and folders ## Ways to give your team access to B2 | | Backblaze web console | Desktop client (Cyberduck, rclone) | quickS3 | |---|---|---|---| | Each person needs | A Backblaze login | A copy of an application key | A quickS3 login | | Access to one folder only | Enterprise user groups only | Yes, with a prefix-limited key per person | Yes, set per role | | Removing one person | Remove their login | Delete their key | Remove them from the role | | File data goes through | Backblaze | Backblaze | Backblaze (quickS3 only signs requests) | | AI agents (Claude, Codex) | No | No | Yes, over MCP, with the same roles | ## Step 1: Create a B2 bucket 1. Log in to your [Backblaze account](https://secure.backblaze.com/user_signin.htm). 2. Under **B2 Cloud Storage**, open **Buckets** and click **Create a Bucket**. 3. Pick a unique name. Lowercase letters, numbers, and hyphens are safest with S3 tools. 4. Keep the bucket **Private**. quickS3 gives your team access, so the bucket doesn't need to be public. The bucket's page shows its **Endpoint**, for example `s3.us-west-004.backblazeb2.com`. You'll need it in Step 3. ## Step 2: Create an application key B2 uses application keys instead of AWS-style access keys. The **master application key** that Backblaze creates for you doesn't work with the S3-compatible API, so create a separate key. 1. Open **Application Keys** and click **Add a New Application Key**. 2. Fill in the form: - **Name of Key**: something like `quicks3`. - **Allow access to Bucket(s)**: pick one bucket, or **All** if quickS3 should see every bucket. - **Type of Access**: **Read and Write** if your team uploads, **Read Only** if they only download. - **Allow List All Bucket Names**: tick this if the key is limited to one bucket and you want quickS3 to find it for you. B2 needs it for the S3 `ListBuckets` call. If you leave it off, type the bucket name into quickS3's **Bucket scopes** field instead. - **File name prefix**: leave blank. You'll limit folders per person with quickS3 roles, which is easier to change than a key. - **Duration**: leave blank. A key with a duration stops working when it expires, and the quickS3 connection stops with it. 3. Click **Create New Key**. 4. Copy the **keyID** and **applicationKey**. Backblaze shows the application key only once. ## Step 3: Connect B2 to quickS3 1. In quickS3, go to **Storage Providers** and click **Add Provider**. 2. Choose **Backblaze B2**. 3. Fill in the form: - **Endpoint**: the bucket's endpoint with `https://` in front, for example `https://s3.us-west-004.backblazeb2.com`. - **Bucket scopes (optional)**: leave blank to let quickS3 list every bucket the key can reach, or enter bucket names, comma-separated. - **Key ID** and **Application key**: from Step 2. 4. Leave **Allow quickS3 to update bucket CORS settings (recommended)** on. When you save or test the connection, quickS3 adds its origin to the bucket's CORS rules. 5. Leave **Allow uploads through quickS3** off. Uploads go straight from the browser to Backblaze, and file data never passes through quickS3. 6. Save. quickS3 tests the connection before storing it. ## Step 4: Give your team access A quickS3 role is a list of rules. Each rule names a connection, a bucket, and optionally a prefix (a folder), and says whether it allows reading or writing. Deny rules always win over allow rules. For example, an **Accounting** role might allow writing to `invoices/` in your `finance` bucket, while a **Contractor** role allows reading `handoff/` and nothing else. Create the roles under **Permissions**, then invite people and assign them. Changing someone's access never means creating or deleting B2 keys. To send a file to someone outside your team, open it in quickS3 and create a share link that expires after 1 hour, 6 hours, 1 day, 7 days, or 30 days. ## CORS for Backblaze B2 Browsers block requests from one site to another unless the second site allows it. When you upload in quickS3, your browser sends the file from `https://quicks3.com` straight to your B2 endpoint, so the bucket must allow that origin for the **S3-compatible API**. With CORS updates switched on, quickS3 sets this up when you save the connection. Afterwards, the bucket's **CORS Rules** dialog in Backblaze may say custom rules are in place. That's expected. To set CORS yourself in the Backblaze web console: 1. On the **Buckets** page, click **CORS Rules** under your bucket. 2. Choose **Share everything in this bucket with this one origin** and enter `https://quicks3.com`. 3. Under **Apply CORS rules to the following APIs**, choose **S3 Compatible API** or **Both**. Rules applied only to the B2 Native API don't help quickS3. 4. Click **Update CORS Rules**. Changes take about a minute. For rules with several origins, such as `http://localhost:` for testing your own app, use the [B2 command-line tool](https://www.backblaze.com/docs/cloud-storage-command-line-tools). ## B2 endpoints Every B2 account lives in one region, and all its buckets share one S3 endpoint: - **Endpoint**: `https://s3..backblazeb2.com`, for example `https://s3.us-west-004.backblazeb2.com` or `https://s3.eu-central-003.backblazeb2.com` Copy it from the bucket page rather than guessing the region number. A wrong number fails with a signature or bucket error. ## Troubleshooting **`InvalidAccessKeyId`** - You used the master application key. Create a separate key as in Step 2. - The key was deleted, or it had a duration and has expired. **`AccessDenied` when quickS3 lists buckets** - The key is limited to one bucket and **Allow List All Bucket Names** is off. Enter the bucket name in **Bucket scopes**, or create a key with that option ticked. **`SignatureDoesNotMatch`** - The application key was pasted with a missing character or a trailing space. - The endpoint's region doesn't match your account's region. **"blocked by CORS policy"** - Turn **Allow quickS3 to update bucket CORS settings** on and click **Test connection** again. - If you set CORS in the web console, check the rule applies to the **S3 Compatible API**, not only the B2 Native API. ## Let Claude or Codex use your B2 bucket quickS3 is also a remote MCP server, at `https://quicks3.com/mcp`. Once B2 is connected, Claude, Claude Code, Codex, or another MCP client that supports OAuth can list folders, fetch files, and upload results. The agent doesn't get an application key. It only gets the quickS3 roles you pick when you approve it, it has no delete tool, and file data goes straight between the agent and Backblaze through short-lived links. See [Connect Claude Code to S3](/blog/connect-claude-code-to-s3-with-quicks3/) or [Connect Codex to S3](/blog/connect-codex-to-s3-with-quicks3/). ## What B2 costs As of September 2026, B2 pay-as-you-go storage is $6.95 per TB per month, and the first 10 GB are free. Downloads are free up to three times your average monthly storage, then $0.01 per GB. There's no minimum storage duration. For 1 TB stored and 1 TB downloaded in a month: | Provider | Storage | Downloads | Total | |----------|---------|-----------|-------| | AWS S3 Standard (us-east-1) | ~$24 | ~$83 | ~$107 | | Backblaze B2 | ~$7 | $0 | ~$7 | AWS figures assume the first 100 GB of transfer out is free. Check [Backblaze's pricing page](https://www.backblaze.com/cloud-storage/pricing) for current rates. One thing to watch: B2 buckets keep every version of a file by default. If your team overwrites files often, add a lifecycle rule in Backblaze that keeps only the last version, or you'll pay for the old ones too. --- Using another provider too? quickS3 also works with [Cloudflare R2](/blog/configuring-cloudflare-r2/), [DigitalOcean Spaces](/blog/configuring-digitalocean-spaces/), [Wasabi](/blog/using-wasabi-storage/), and [AWS S3](/blog/getting-started-aws-s3/). Ready to try it? [Sign up for quickS3](/app/) and connect your B2 bucket. For maintained setup steps and current limits, use the [Backblaze B2 documentation](/docs/connections/backblaze-b2/).