--- title: "DigitalOcean Spaces file manager for teams: keys, CORS, and setup" seoTitle: "DigitalOcean Spaces File Manager: Keys & CORS" description: "Browser access to DigitalOcean Spaces for your team, without the control panel. Create a per-bucket key, fix CORS errors, and set folder permissions." publishDate: 2026-02-04 updatedDate: 2026-09-15 tags: ["Getting Started", "DigitalOcean Spaces", "S3-Compatible", "Storage"] image: "/blog-images/DigitalOcean-spaces-quicks3.jpg" draft: false --- DigitalOcean Spaces is easy to use if you own the DigitalOcean account. It's harder to share. A teammate who browses a Space in the control panel needs a seat on your DigitalOcean team, and an access key pasted into a desktop client opens the whole bucket to whoever holds it. Neither lets you say "this person gets the `invoices/` folder and nothing else." This guide connects a Space to quickS3 so your team gets a browser file manager instead. Each person signs in to quickS3 and sees only the buckets and folders their role allows. Your Spaces key stays in one place, and files move straight between the browser and DigitalOcean. ## What you'll set up - A Spaces access key limited to the buckets your team needs - A quickS3 connection that works out the endpoint from your region - CORS on the Space, so uploads work in the browser (quickS3 does this for you) - Roles that give each person the right buckets and folders ## Ways to give your team access to Spaces | | DigitalOcean control panel | Desktop client (Cyberduck, rclone) | quickS3 | |---|---|---|---| | Each person needs | A seat on your DigitalOcean team | A copy of an access key | A quickS3 login | | Access to one folder only | No | Only with bucket policies you write | Yes, set per role | | Removing one person | Remove them from the team | Rotate the key for everyone | Remove them from the role | | File data goes through | DigitalOcean | DigitalOcean | DigitalOcean (quickS3 only signs requests) | | AI agents (Claude, Codex) | No | No | Yes, over MCP, with the same roles | ## Step 1: Create a Space 1. Log in to the [DigitalOcean control panel](https://cloud.digitalocean.com/). 2. Open **Spaces Object Storage** and click **Create Bucket**. 3. Choose a **region** (for example `nyc3`, `ams3`, or `sfo3`) and a unique name. Note the region. quickS3 needs it to find the right endpoint. ## Step 2: Create a limited-access Spaces key Spaces keys come in two kinds. A **full access** key can read and write every Space in your account. A **limited access** key only works on the buckets you pick, with the permission you pick. Use a limited key for quickS3. 1. In **Spaces Object Storage**, open the **Access Keys** tab and click **Create Access Key**. 2. Choose **Limited Access**. 3. Select each Space quickS3 should see, and its permission: **Read** if your team only downloads, **Read/Write/Delete** if they also upload. 4. Name the key (for example `quicks3`) and click **Create Access Key**. 5. Copy the **Access Key ID** and **Secret Key**. DigitalOcean shows the secret only once. ## Step 3: Connect the Space to quickS3 1. In quickS3, go to **Storage Providers** and click **Add Provider**. 2. Choose **DigitalOcean Spaces**. 3. Fill in the form: - **Region**: where your Space lives, such as `nyc3`. Type it or pick it from the suggestions. quickS3 shows the endpoint it will use, so you don't enter one yourself. - **Bucket scopes**: a limited-access key can't list buckets, so enter the Space names here, comma-separated (for example `assets, backups`). With a full access key you can leave this blank and quickS3 lists every Space in the account. - **Access key ID** and **Secret key**: from Step 2. 4. Leave **Allow quickS3 to update bucket CORS settings (recommended)** on. When you save or test the connection, quickS3 adds its origin to the Space's CORS policy. 5. Leave **Allow uploads through quickS3** off. Uploads go straight from the browser to DigitalOcean, and file data never passes through quickS3. 6. Save. quickS3 tests the connection before storing it. ## Step 4: Give your team access A quickS3 role is a list of rules. Each rule names a connection, a bucket, and optionally a prefix (a folder), and says whether it allows reading or writing. Deny rules always win over allow rules. For example, a **Clients** role might allow reading `deliverables/` in your `projects` Space and nothing else. A **Design** role might allow writing to the whole `assets` Space. Create the roles under **Permissions**, then invite people and assign them a role. You can change or remove a role at any time without touching the Spaces key. To send a file to someone outside your team, open it in quickS3 and create a share link that expires after 1 hour, 6 hours, 1 day, 7 days, or 30 days. ## CORS for DigitalOcean Spaces Browsers block requests from one site to another unless the second site allows it. When you upload in quickS3, your browser sends the file from `https://quicks3.com` straight to `https://.digitaloceanspaces.com`, so the Space must allow that origin. With CORS updates switched on, quickS3 sets this up when you save the connection. You normally do not need to configure this by hand. quickS3's automatic update uses the Spaces S3 API, preserves unrelated rules, and includes exposed `ETag` support for multipart uploads. Leave it enabled and use **Test connection** to repair and verify the policy. If your team deliberately manages CORS outside quickS3, or the limited key cannot update the policy, follow the maintained [DigitalOcean Spaces documentation](/docs/connections/digitalocean-spaces/#manual-cors-is-a-fallback). DigitalOcean's control-panel editor cannot set `ExposeHeader`, so a complete manual rule must use its XML procedure or another S3-compatible policy tool. It should allow the exact `https://quicks3.com` origin, `GET`, `HEAD`, and `PUT`, request headers, and expose `ETag`. `DELETE` is not required because quickS3 deletion goes through its authorised API. Testing an app of your own on your machine? Add a second rule for `http://localhost:`, since the origin must match exactly, port included. ## Spaces endpoints and regions quickS3 builds the endpoint from the region you pick: - **Endpoint**: `https://.digitaloceanspaces.com`, for example `https://nyc3.digitaloceanspaces.com` Supported regions include nyc1, nyc2, nyc3, ams3, sfo2, sfo3, sgp1, lon1, fra1, tor1, blr1, syd1, and atl1. The Space's name goes in the request, not the endpoint, so one connection can cover several Spaces in the same region. Spaces in another region need a second connection. ## Troubleshooting **`AccessDenied` or `403 Forbidden`** - The key is limited to other Spaces, or it's read-only and you tried to upload. Check the key under **Access Keys**. - If you set bucket scopes, check the Space name is spelled correctly. **`SignatureDoesNotMatch`** - The secret key was pasted with a missing character or a trailing space. Create a new key if you can't be sure. - The region in quickS3 doesn't match the Space's region. **`NoSuchBucket`** - The Space is in a different region from the one on the connection. **"blocked by CORS policy" or "No 'Access-Control-Allow-Origin' header"** - Turn **Allow quickS3 to update bucket CORS settings** on and click **Test connection** again. - If quickS3 can't update CORS with a limited-access key, set CORS in the control panel as shown above. - If you manage CORS yourself, check the origin is exactly `https://quicks3.com` and that `PUT` is an allowed method. ## Let Claude or Codex use your Space quickS3 is also a remote MCP server, at `https://quicks3.com/mcp`. Once your Space is connected, Claude, Claude Code, Codex, or another MCP client that supports OAuth can list folders, fetch files, and upload results. The agent doesn't get a key. It only gets the quickS3 roles you pick when you approve it, it has no delete tool, and file data goes straight between the agent and DigitalOcean through short-lived links. See [Connect Claude Code to S3](/blog/connect-claude-code-to-s3-with-quicks3/) or [Connect Codex to S3](/blog/connect-codex-to-s3-with-quicks3/). ## What Spaces costs As of September 2026, Spaces costs $5 a month, which includes 250 GiB of storage and 1 TiB of outbound transfer across all your Spaces. Beyond that, storage is $0.02 per GiB and transfer is $0.01 per GiB. Inbound transfer is free. Check [DigitalOcean's pricing page](https://docs.digitalocean.com/products/spaces/details/pricing/) for current rates. --- Using another provider too? quickS3 also works with [Cloudflare R2](/blog/configuring-cloudflare-r2/), [Backblaze B2](/blog/configuring-backblaze-b2/), [Wasabi](/blog/using-wasabi-storage/), and [AWS S3](/blog/getting-started-aws-s3/). Ready to try it? [Sign up for quickS3](/app/) and connect your Space. For maintained setup steps and current limits, use the [DigitalOcean Spaces documentation](/docs/connections/digitalocean-spaces/).