Backblaze B2 web interface for teams: application keys, CORS, and setup

The Backblaze web console works well for the person who owns the account. Sharing a B2 bucket with a team is harder. Teammates need their own Backblaze logins (user groups need the Enterprise Web Console), or you hand out application keys that anyone can paste into a desktop client and keep.

This guide connects B2 to quickS3 instead. Your team signs in to quickS3 and gets a web interface for the buckets and folders their role allows. The application key stays in one place, and files move straight between the browser and Backblaze.

What you’ll set up

• A B2 application key that works with the S3-compatible API
• A quickS3 connection to your B2 endpoint
• CORS on the bucket, so uploads work in the browser (quickS3 does this for you)
• Roles that give each person the right buckets and folders

Ways to give your team access to B2

	Backblaze web console	Desktop client (Cyberduck, rclone)	quickS3
Each person needs	A Backblaze login	A copy of an application key	A quickS3 login
Access to one folder only	Enterprise user groups only	Yes, with a prefix-limited key per person	Yes, set per role
Removing one person	Remove their login	Delete their key	Remove them from the role
File data goes through	Backblaze	Backblaze	Backblaze (quickS3 only signs requests)
AI agents (Claude, Codex)	No	No	Yes, over MCP, with the same roles

Step 1: Create a B2 bucket

1. Log in to your Backblaze account.
2. Under B2 Cloud Storage, open Buckets and click Create a Bucket.
3. Pick a unique name. Lowercase letters, numbers, and hyphens are safest with S3 tools.
4. Keep the bucket Private. quickS3 gives your team access, so the bucket doesn’t need to be public.

The bucket’s page shows its Endpoint, for example s3.us-west-004.backblazeb2.com. You’ll need it in Step 3.

Step 2: Create an application key

B2 uses application keys instead of AWS-style access keys. The master application key that Backblaze creates for you doesn’t work with the S3-compatible API, so create a separate key.

1. Open Application Keys and click Add a New Application Key.
2. Fill in the form:
   • Name of Key: something like quicks3.
   • Allow access to Bucket(s): pick one bucket, or All if quickS3 should see every bucket.
   • Type of Access: Read and Write if your team uploads, Read Only if they only download.
   • Allow List All Bucket Names: tick this if the key is limited to one bucket and you want quickS3 to find it for you. B2 needs it for the S3 ListBuckets call. If you leave it off, type the bucket name into quickS3’s Bucket scopes field instead.
   • File name prefix: leave blank. You’ll limit folders per person with quickS3 roles, which is easier to change than a key.
   • Duration: leave blank. A key with a duration stops working when it expires, and the quickS3 connection stops with it.
3. Click Create New Key.
4. Copy the keyID and applicationKey. Backblaze shows the application key only once.

Step 3: Connect B2 to quickS3

1. In quickS3, go to Storage Providers and click Add Provider.
2. Choose Backblaze B2.
3. Fill in the form:
   • Endpoint: the bucket’s endpoint with https:// in front, for example https://s3.us-west-004.backblazeb2.com.
   • Bucket scopes (optional): leave blank to let quickS3 list every bucket the key can reach, or enter bucket names, comma-separated.
   • Key ID and Application key: from Step 2.
4. Leave Allow quickS3 to update bucket CORS settings (recommended) on. When you save or test the connection, quickS3 adds its origin to the bucket’s CORS rules.
5. Leave Allow uploads through quickS3 off. Uploads go straight from the browser to Backblaze, and file data never passes through quickS3.
6. Save. quickS3 tests the connection before storing it.

Step 4: Give your team access

A quickS3 role is a list of rules. Each rule names a connection, a bucket, and optionally a prefix (a folder), and says whether it allows reading or writing. Deny rules always win over allow rules.

For example, an Accounting role might allow writing to invoices/ in your finance bucket, while a Contractor role allows reading handoff/ and nothing else. Create the roles under Permissions, then invite people and assign them. Changing someone’s access never means creating or deleting B2 keys.

To send a file to someone outside your team, open it in quickS3 and create a share link that expires after 1 hour, 6 hours, 1 day, 7 days, or 30 days.

CORS for Backblaze B2

Browsers block requests from one site to another unless the second site allows it. When you upload in quickS3, your browser sends the file from https://quicks3.com straight to your B2 endpoint, so the bucket must allow that origin for the S3-compatible API. With CORS updates switched on, quickS3 sets this up when you save the connection. Afterwards, the bucket’s CORS Rules dialog in Backblaze may say custom rules are in place. That’s expected.

To set CORS yourself in the Backblaze web console:

1. On the Buckets page, click CORS Rules under your bucket.
2. Choose Share everything in this bucket with this one origin and enter https://quicks3.com.
3. Under Apply CORS rules to the following APIs, choose S3 Compatible API or Both. Rules applied only to the B2 Native API don’t help quickS3.
4. Click Update CORS Rules. Changes take about a minute.

For rules with several origins, such as http://localhost:<port> for testing your own app, use the B2 command-line tool.

B2 endpoints

Every B2 account lives in one region, and all its buckets share one S3 endpoint:

• Endpoint: https://s3.<region>.backblazeb2.com, for example https://s3.us-west-004.backblazeb2.com or https://s3.eu-central-003.backblazeb2.com

Copy it from the bucket page rather than guessing the region number. A wrong number fails with a signature or bucket error.

Troubleshooting

InvalidAccessKeyId

• You used the master application key. Create a separate key as in Step 2.
• The key was deleted, or it had a duration and has expired.

AccessDenied when quickS3 lists buckets

• The key is limited to one bucket and Allow List All Bucket Names is off. Enter the bucket name in Bucket scopes, or create a key with that option ticked.

SignatureDoesNotMatch

• The application key was pasted with a missing character or a trailing space.
• The endpoint’s region doesn’t match your account’s region.

“blocked by CORS policy”

• Turn Allow quickS3 to update bucket CORS settings on and click Test connection again.
• If you set CORS in the web console, check the rule applies to the S3 Compatible API, not only the B2 Native API.

Let Claude or Codex use your B2 bucket

quickS3 is also a remote MCP server, at https://quicks3.com/mcp. Once B2 is connected, Claude, Claude Code, Codex, or another MCP client that supports OAuth can list folders, fetch files, and upload results. The agent doesn’t get an application key. It only gets the quickS3 roles you pick when you approve it, it has no delete tool, and file data goes straight between the agent and Backblaze through short-lived links. See Connect Claude Code to S3 or Connect Codex to S3.

What B2 costs

As of September 2026, B2 pay-as-you-go storage is $6.95 per TB per month, and the first 10 GB are free. Downloads are free up to three times your average monthly storage, then $0.01 per GB. There’s no minimum storage duration.

For 1 TB stored and 1 TB downloaded in a month:

Provider	Storage	Downloads	Total
AWS S3 Standard (us-east-1)	~$24	~$83	~$107
Backblaze B2	~$7	$0	~$7

AWS figures assume the first 100 GB of transfer out is free. Check Backblaze’s pricing page for current rates.

One thing to watch: B2 buckets keep every version of a file by default. If your team overwrites files often, add a lifecycle rule in Backblaze that keeps only the last version, or you’ll pay for the old ones too.

---

Using another provider too? quickS3 also works with Cloudflare R2, DigitalOcean Spaces, Wasabi, and AWS S3. Ready to try it? Sign up for quickS3 and connect your B2 bucket.

For maintained setup steps and current limits, use the Backblaze B2 documentation.