DigitalOcean Spaces file manager for teams: keys, CORS, and setup

DigitalOcean Spaces is easy to use if you own the DigitalOcean account. It’s harder to share. A teammate who browses a Space in the control panel needs a seat on your DigitalOcean team, and an access key pasted into a desktop client opens the whole bucket to whoever holds it. Neither lets you say “this person gets the invoices/ folder and nothing else.”

This guide connects a Space to quickS3 so your team gets a browser file manager instead. Each person signs in to quickS3 and sees only the buckets and folders their role allows. Your Spaces key stays in one place, and files move straight between the browser and DigitalOcean.

What you’ll set up

• A Spaces access key limited to the buckets your team needs
• A quickS3 connection that works out the endpoint from your region
• CORS on the Space, so uploads work in the browser (quickS3 does this for you)
• Roles that give each person the right buckets and folders

Ways to give your team access to Spaces

	DigitalOcean control panel	Desktop client (Cyberduck, rclone)	quickS3
Each person needs	A seat on your DigitalOcean team	A copy of an access key	A quickS3 login
Access to one folder only	No	Only with bucket policies you write	Yes, set per role
Removing one person	Remove them from the team	Rotate the key for everyone	Remove them from the role
File data goes through	DigitalOcean	DigitalOcean	DigitalOcean (quickS3 only signs requests)
AI agents (Claude, Codex)	No	No	Yes, over MCP, with the same roles

Step 1: Create a Space

1. Log in to the DigitalOcean control panel.
2. Open Spaces Object Storage and click Create Bucket.
3. Choose a region (for example nyc3, ams3, or sfo3) and a unique name.

Note the region. quickS3 needs it to find the right endpoint.

Step 2: Create a limited-access Spaces key

Spaces keys come in two kinds. A full access key can read and write every Space in your account. A limited access key only works on the buckets you pick, with the permission you pick. Use a limited key for quickS3.

1. In Spaces Object Storage, open the Access Keys tab and click Create Access Key.
2. Choose Limited Access.
3. Select each Space quickS3 should see, and its permission: Read if your team only downloads, Read/Write/Delete if they also upload.
4. Name the key (for example quicks3) and click Create Access Key.
5. Copy the Access Key ID and Secret Key. DigitalOcean shows the secret only once.

Step 3: Connect the Space to quickS3

1. In quickS3, go to Storage Providers and click Add Provider.
2. Choose DigitalOcean Spaces.
3. Fill in the form:
   • Region: where your Space lives, such as nyc3. Type it or pick it from the suggestions. quickS3 shows the endpoint it will use, so you don’t enter one yourself.
   • Bucket scopes: a limited-access key can’t list buckets, so enter the Space names here, comma-separated (for example assets, backups). With a full access key you can leave this blank and quickS3 lists every Space in the account.
   • Access key ID and Secret key: from Step 2.
4. Leave Allow quickS3 to update bucket CORS settings (recommended) on. When you save or test the connection, quickS3 adds its origin to the Space’s CORS policy.
5. Leave Allow uploads through quickS3 off. Uploads go straight from the browser to DigitalOcean, and file data never passes through quickS3.
6. Save. quickS3 tests the connection before storing it.

Step 4: Give your team access

A quickS3 role is a list of rules. Each rule names a connection, a bucket, and optionally a prefix (a folder), and says whether it allows reading or writing. Deny rules always win over allow rules.

For example, a Clients role might allow reading deliverables/ in your projects Space and nothing else. A Design role might allow writing to the whole assets Space. Create the roles under Permissions, then invite people and assign them a role. You can change or remove a role at any time without touching the Spaces key.

To send a file to someone outside your team, open it in quickS3 and create a share link that expires after 1 hour, 6 hours, 1 day, 7 days, or 30 days.

CORS for DigitalOcean Spaces

Browsers block requests from one site to another unless the second site allows it. When you upload in quickS3, your browser sends the file from https://quicks3.com straight to https://<region>.digitaloceanspaces.com, so the Space must allow that origin. With CORS updates switched on, quickS3 sets this up when you save the connection.

You normally do not need to configure this by hand. quickS3’s automatic update uses the Spaces S3 API, preserves unrelated rules, and includes exposed ETag support for multipart uploads. Leave it enabled and use Test connection to repair and verify the policy.

If your team deliberately manages CORS outside quickS3, or the limited key cannot update the policy, follow the maintained DigitalOcean Spaces documentation. DigitalOcean’s control-panel editor cannot set ExposeHeader, so a complete manual rule must use its XML procedure or another S3-compatible policy tool. It should allow the exact https://quicks3.com origin, GET, HEAD, and PUT, request headers, and expose ETag. DELETE is not required because quickS3 deletion goes through its authorised API.

Testing an app of your own on your machine? Add a second rule for http://localhost:<port>, since the origin must match exactly, port included.

Spaces endpoints and regions

quickS3 builds the endpoint from the region you pick:

• Endpoint: https://<region>.digitaloceanspaces.com, for example https://nyc3.digitaloceanspaces.com

Supported regions include nyc1, nyc2, nyc3, ams3, sfo2, sfo3, sgp1, lon1, fra1, tor1, blr1, syd1, and atl1. The Space’s name goes in the request, not the endpoint, so one connection can cover several Spaces in the same region. Spaces in another region need a second connection.

Troubleshooting

AccessDenied or 403 Forbidden

• The key is limited to other Spaces, or it’s read-only and you tried to upload. Check the key under Access Keys.
• If you set bucket scopes, check the Space name is spelled correctly.

SignatureDoesNotMatch

• The secret key was pasted with a missing character or a trailing space. Create a new key if you can’t be sure.
• The region in quickS3 doesn’t match the Space’s region.

NoSuchBucket

• The Space is in a different region from the one on the connection.

“blocked by CORS policy” or “No ‘Access-Control-Allow-Origin’ header”

• Turn Allow quickS3 to update bucket CORS settings on and click Test connection again.
• If quickS3 can’t update CORS with a limited-access key, set CORS in the control panel as shown above.
• If you manage CORS yourself, check the origin is exactly https://quicks3.com and that PUT is an allowed method.

Let Claude or Codex use your Space

quickS3 is also a remote MCP server, at https://quicks3.com/mcp. Once your Space is connected, Claude, Claude Code, Codex, or another MCP client that supports OAuth can list folders, fetch files, and upload results. The agent doesn’t get a key. It only gets the quickS3 roles you pick when you approve it, it has no delete tool, and file data goes straight between the agent and DigitalOcean through short-lived links. See Connect Claude Code to S3 or Connect Codex to S3.

What Spaces costs

As of September 2026, Spaces costs $5 a month, which includes 250 GiB of storage and 1 TiB of outbound transfer across all your Spaces. Beyond that, storage is $0.02 per GiB and transfer is $0.01 per GiB. Inbound transfer is free. Check DigitalOcean’s pricing page for current rates.

---

Using another provider too? quickS3 also works with Cloudflare R2, Backblaze B2, Wasabi, and AWS S3. Ready to try it? Sign up for quickS3 and connect your Space.

For maintained setup steps and current limits, use the DigitalOcean Spaces documentation.