Wasabi file manager for teams: access keys, endpoints, and sharing

Wasabi’s flat pricing makes it a good home for large files, but its console is built for administrators. To let a teammate browse a bucket there, you create a Wasabi user for them and write an IAM policy. Handing out access keys for a desktop client is quicker, but a key opens whatever its policy allows to anyone who has a copy.

This guide connects Wasabi to quickS3 instead. Your team signs in to quickS3 and gets a web file manager for the buckets and folders their role allows. The access key stays in one place, and files move straight between the browser and Wasabi.

A quick thank-you while we’re here: Wasabi kindly supports quickS3 with a complimentary VIP account. We’re grateful for it, and it’s part of why we’re able to test and maintain the Wasabi integration properly. It doesn’t change any of the steps below.

What you’ll set up

• A Wasabi user and access key limited to the buckets your team needs
• A quickS3 connection that works out the endpoint from your region
• CORS on the bucket, so uploads work in the browser (quickS3 does this for you)
• Roles that give each person the right buckets and folders

Ways to give your team access to Wasabi

	Wasabi console	Desktop client (Cyberduck, rclone)	quickS3
Each person needs	A Wasabi user	A copy of an access key	A quickS3 login
Access to one folder only	Only with IAM policies you write	Only with IAM policies you write	Yes, set per role
Removing one person	Delete their user	Rotate the key for everyone	Remove them from the role
Sharing a file	Presigned link	Depends on the client	Share link, 1 hour to 30 days
AI agents (Claude, Codex)	No	No	Yes, over MCP, with the same roles

Step 1: Create a bucket

1. Sign in to the Wasabi console.
2. Click Create Bucket, pick a unique name, and choose a region, for example us-east-1 or eu-central-1.

Note the region. quickS3 needs it to find the right endpoint.

Step 2: Create an access key for quickS3

Access keys created on your root account can reach every bucket. A safer option is a dedicated Wasabi user with a policy that covers only the buckets quickS3 should see.

1. In the Wasabi console, open Users and click Create User.
2. Name it quicks3 and choose Programmatic access (API keys only, no console login).
3. Attach a policy. For one bucket called team-files, a policy like this works:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketCors", "s3:PutBucketCors"],
      "Resource": "arn:aws:s3:::team-files"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload"
      ],
      "Resource": "arn:aws:s3:::team-files/*"
    }
  ]
}

What each part is for:

• s3:ListAllMyBuckets lets quickS3 find your buckets. Drop it if you enter the bucket names in Bucket scopes.
• s3:GetBucketCors and s3:PutBucketCors let quickS3 set up CORS for you. Drop them if you set CORS yourself.
• s3:ListMultipartUploadParts and s3:AbortMultipartUpload are for files of 256 MB or more, which upload in parts. quickS3 uses them to finish, resume, or cancel those uploads.
• For read-only access, keep only s3:ListBucket and s3:GetObject.
• To create buckets from quickS3, also allow s3:CreateBucket on arn:aws:s3:::*.

4. Create the user and copy the Access Key and Secret Key. Wasabi shows the secret only once.

If you just want to try quickS3 on a test bucket, a root key from Access Keys → Create New Access Key also works. Switch to a dedicated user before real data goes in.

Step 3: Connect Wasabi to quickS3

1. In quickS3, go to Storage Providers and click Add Provider.
2. Choose Wasabi Hot Cloud Storage.
3. Fill in the form:
   • Region: where your bucket lives, such as us-east-1 or eu-central-1. Type it or pick it from the suggestions. quickS3 shows the endpoint it will use, so you don’t enter one yourself.
   • Bucket scopes (optional): leave blank to let quickS3 list every bucket the key can reach. If the key can’t list buckets, enter names, comma-separated (for example marketing-assets, backups).
   • Access key ID and Secret key: from Step 2.
4. Leave Allow quickS3 to update bucket CORS settings (recommended) on so quickS3 can add its origin for browser uploads.
5. Leave Allow uploads through quickS3 off. Uploads go straight from the browser to Wasabi, and file data never passes through quickS3.
6. Save. quickS3 tests the connection before storing it.

Step 4: Give your team access

A quickS3 role is a list of rules. Each rule names a connection, a bucket, and optionally a prefix (a folder), and says whether it allows reading or writing. Deny rules always win over allow rules.

For example, an Editors role might allow writing to raw-footage/ and exports/ in your video bucket, while a Client review role allows reading exports/ only. Create the roles under Permissions, then invite people and assign them. No IAM policies to edit when someone joins or leaves.

Sharing Wasabi files

To send a file to someone outside your team, open it in quickS3 and create a share link. Pick how long it lasts: 1 hour, 6 hours, 1 day, 7 days, or 30 days. The recipient downloads straight from Wasabi and doesn’t need an account. Downloads count toward Wasabi’s free egress allowance, covered below.

Wasabi endpoints

quickS3 builds the endpoint from the region you pick:

• us-east-1 → https://s3.wasabisys.com
• Any other region → https://s3.<region>.wasabisys.com, for example https://s3.eu-central-1.wasabisys.com

Supported regions include us-east-1, us-east-2, us-central-1, us-west-1, us-west-2, ca-central-1, eu-central-1, eu-west-1, ap-northeast-1, ap-northeast-2, ap-southeast-1, and ap-southeast-2. Buckets in different regions need one connection per region.

CORS for Wasabi

Browsers block requests from one site to another unless the second site allows it. When you upload in quickS3, your browser sends the file from https://quicks3.com straight to the Wasabi endpoint, so the bucket must allow that origin. With CORS updates switched on, quickS3 sets this up when you save the connection.

To set it yourself, save this as cors.json:

{
  "CORSRules": [
    {
      "AllowedOrigins": ["https://quicks3.com"],
      "AllowedMethods": ["GET", "PUT", "HEAD", "DELETE"],
      "AllowedHeaders": ["*"],
      "ExposeHeaders": ["ETag"],
      "MaxAgeSeconds": 3600
    }
  ]
}

Then apply it with the AWS CLI, pointed at your bucket’s regional endpoint:

aws s3api put-bucket-cors --bucket team-files --cors-configuration file://cors.json --endpoint-url https://s3.eu-central-1.wasabisys.com

Troubleshooting

AccessDenied

• The user’s policy doesn’t cover the bucket, or it doesn’t allow the action. Uploads need s3:PutObject.
• If quickS3 can’t list buckets, add s3:ListAllMyBuckets to the policy or enter the bucket name in Bucket scopes.

Redirect or SignatureDoesNotMatch errors

• The region on the connection doesn’t match the bucket’s region, so the request goes to the wrong endpoint.
• The secret key was pasted with a missing character or a trailing space.

“blocked by CORS policy”

• Turn Allow quickS3 to update bucket CORS settings on and click Test connection again. If the policy doesn’t allow s3:PutBucketCors, set CORS yourself as shown above.

Let Claude or Codex use your Wasabi bucket

quickS3 is also a remote MCP server, at https://quicks3.com/mcp. Once Wasabi is connected, Claude, Claude Code, Codex, or another MCP client that supports OAuth can list folders, fetch files, and upload results. The agent doesn’t get an access key. It only gets the quickS3 roles you pick when you approve it, it has no delete tool, and file data goes straight between the agent and Wasabi through short-lived links. See Connect Claude Code to S3 or Connect Codex to S3.

What Wasabi costs

Since July 1, 2026, Wasabi pay-as-you-go storage is $7.99 per TB per month, with no charges for egress or API requests. For 1 TB stored and 1 TB downloaded in a month:

Provider	Storage	Downloads	Total
AWS S3 Standard (us-east-1)	~$24	~$83	~$107
Wasabi	~$8	$0	~$8

AWS figures assume the first 100 GB of transfer out is free. Check Wasabi’s pricing FAQ for current terms.

The flat price comes with conditions worth knowing before you move data:

• 1 TB minimum. You pay for at least 1 TB a month, even if you store less.
• 90-day minimum storage. Delete a file sooner and you’re billed for the rest of the 90 days.
• Free egress has a limit. Monthly downloads should stay at or below the amount you store. Regularly downloading more can get your service limited.
• Versioning costs storage. Wasabi supports versioning and object lock, and every kept version counts toward your bill.

That makes Wasabi a strong fit for large libraries that stay put and get read back regularly, like video, images, and archives. It suits frequently rewritten files, or data you serve to the public many times over, less well.

---

Using another provider too? quickS3 also works with Cloudflare R2, Backblaze B2, DigitalOcean Spaces, and AWS S3. Ready to try it? Sign up for quickS3 and connect your Wasabi bucket.

For maintained setup steps and current limits, use the Wasabi documentation.