> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tape.network/llms.txt
> Use this file to discover all available pages before exploring further.

# S3 Gateway

The S3-compatible gateway lets existing S3 tooling talk to Tapedrive without custom integration code. Point the AWS CLI, rclone, or an S3 SDK at a gateway endpoint and work with buckets and objects the way you already do.

S3 support is part of `tape-gateway`, served on its own listener. Any gateway operator can enable it, and workloads that outgrow a hosted offering can [run their own gateway](https://docs.tape.network/protocol/node-setup/gateway.md).

![Terminal recording of an S3 client working against the Tapedrive gateway](https://mintcdn.com/tapedrive/IVlwjOpRsvR7xk5g/images/s3.gif?s=dcbe9413cf54bfb28f6947b1c7a34e18)

An S3 client against the gateway: configure it, put an object, list, get it back.

## Key concepts

| S3 term | On Tapedrive |
| - | - |
| Bucket | A tape. Creating a bucket means reserving a tape ([objects](https://docs.tape.network/protocol/architecture/objects.md)). |
| Object | A named track on that tape. |
| Access key / secret key | A real SigV4 credential, issued by the gateway's operator. |
| ETag | The object's on-chain commitment. Opaque and identical everywhere ([compatibility](https://docs.tape.network/tools/s3-gateway/compatibility.md)). |
| Region | Ignored by the gateway. Any label works; these pages use `solana`. |

Writes have one extra rule: the gateway writes to your tape as an on-chain **delegate**. The tape must delegate to the gateway's key before any S3 write succeeds ([delegation](https://docs.tape.network/protocol/architecture/tapes.md)).

## How access works

Three levels:

1. **Anonymous** requests can read and list, subject to the gateway's metering ([rate limits](https://docs.tape.network/apis/rate-limits.md)).
2. **Signed** requests use SigV4 credentials scoped to specific buckets or to your own tape.
3. **Writes** additionally require the on-chain delegation.

Credentials come from the gateway operator's admin API: issued, scoped, budgeted, and revocable ([configuration](https://docs.tape.network/tools/s3-gateway/configuration.md)).

## Set up a bucket

Every S3 tool needs the same two things: a bucket and a credential. Four steps, once per bucket.

For Tapenet, complete the [wallet and funding setup](https://docs.tape.network/tapenet/access.md) before
reserving a tape.

**1. Reserve a tape.** Size it for what you will store, and pick how long it should live. `--duration` buys enough epochs to cover that time; epochs last one hour on Tapenet ([epochs](https://docs.tape.network/protocol/architecture/epochs.md)). Add `--dry-run` to see the cost and your balance first.

```bash theme={null}
tape create --capacity 100m --duration 7d
```

```text Output theme={null}
tape address:     E79y5bh5zTLq9h7SgPGRsDpcmTB1oa7YGscFFFiojy2D
label:            yk5y3rg6cwclvyz7sv763kttt2d2sinpzdm3chuzw72th45s2c3a
capacity:         104857600 bytes
epochs:           active=241 expiry=410
epoch duration:   1h
expires:          ~2026-09-23 22:00 UTC (in 7d)
cost:             0.0161226 TAPE + ~0.00564372 SOL
```

The label on the second line is the bucket name S3 tools use. It is the address in a lowercase form, because S3 bucket names cannot carry uppercase letters.

**2. Delegate it to the gateway.** The gateway writes to your tape as a delegate, so it never holds your key. Ask the gateway for its delegate address, then set it on the tape:

```bash theme={null}
curl -s https://gw.example.com/v1/s3
```

```json Output theme={null}
{ "endpoint": "https://s3.example.com", "delegate": "9WzDXwBbmkg8ZTbNMqUxvQRAyrZzDsGYdLVL9zYtAWWM", "max_object_bytes": 5368709120 }
```

`max_object_bytes` is the largest single upload the gateway accepts. Set the delegate on the tape:

```bash theme={null}
tape delegate 9WzDXwBbmkg8ZTbNMqUxvQRAyrZzDsGYdLVL9zYtAWWM
```

```text Output theme={null}
tape address:     E79y5bh5zTLq9h7SgPGRsDpcmTB1oa7YGscFFFiojy2D
delegate:         9WzDXwBbmkg8ZTbNMqUxvQRAyrZzDsGYdLVL9zYtAWWM
```

You can take the delegation back at any time with `tape revoke`.

**3. Get a credential.** The gateway operator issues an access key pair scoped to your bucket through the gateway's admin API ([configuration](https://docs.tape.network/tools/s3-gateway/configuration.md)). If you run the gateway, that is you.

**4. Use the label as the bucket name.** `tape info` prints it again whenever you need it:

```bash theme={null}
tape info
```

```text Output theme={null}
tape address:      E79y5bh5zTLq9h7SgPGRsDpcmTB1oa7YGscFFFiojy2D
label:             yk5y3rg6cwclvyz7sv763kttt2d2sinpzdm3chuzw72th45s2c3a
id:                4077
authority:         5ywthAPoHfzWKhrVNSbo5GFdPDcJy7gbmkyZQ8zSKFzY
capacity:          104857600 bytes (562 used, 104857038 free)
tracks:            4
next track number: 4
epochs:            active=241 expiry=410 current=243 remaining=167
epoch duration:    1h
expires:           ~2026-09-23 22:00 UTC (in 6d 22h)
```

That label is `my-bucket` on every S3 page. The base58 address works too with clients that accept it.

Then pick your tool from the [quickstarts](https://docs.tape.network/tools/quickstarts.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.