> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/object-storage-stook/manage-access-keys.md).
# Manage Access Keys
Create and manage Stook access keys, permissions, and authenticators for controlled access to Stook Buckets.
Create access keys to provide applications and users with controlled access to [Stook Object Storage](/products/object-storage-stook/stook-cloud-object-storage.md).
Each storage region provides a **master key pair** with full access. For client applications, S3-compatible tools, and custom integrations, create dedicated credentials and grant only the permissions required for their operations.
## Create Stook Access Keys
{% stepper %}
{% step %}
### **Open Stook Credentials**
In the [Medianova Control Panel](https://cloud.medianova.com), select **Stook Object Storage → Credentials**.
{% endstep %}
{% step %}
### **Create credentials**
Create Stook credentials with granular permissions
On the **Stook Credentials** page, select **Create Credential**.
{% endstep %}
{% step %}
### **Configure the credential scope**
Enter a descriptive **Credential Name** and select the target **Stook Bucket**.
Optionally, specify a **Path** to restrict access to a specific path within the Stook Bucket.
{% endstep %}
{% step %}
### **Configure permissions**
Use **Filter Actions** to find specific S3 actions or **Expand All** and **Collapse All** to browse the available permission categories.
Select **All S3 Actions** to grant all available S3 permissions, or select only the individual actions required by the application.
{% endstep %}
{% step %}
### **Create the credentials**
Select **Submit**.
The new credentials appear on the **Stook Credentials** page.
{% endstep %}
{% endstepper %}
## View Stook Access Keys
Open the credential details to view its connection information, including:
* **Access Key**
* **Secret Key**
* **Endpoint**
To display the **Secret Key**, re-enter your Medianova Control Panel password.
Stook credential details
## Configure Stook Access Key Permissions
Use granular permissions to restrict an access key to the S3 operations required by the application.
Some bucket features require specific permissions:
| Operation | Required permission |
| ------------------------------------ | ------------------------- |
| List object versions | **All S3 Actions** |
| Download an earlier object version | **All S3 Actions** |
| Permanently delete an object version | **Delete Object Version** |
| Configure Versioning for MFA Delete | **Put Bucket Versioning** |
{% hint style="info" %}
The **Versioning** permission category does not include the actions required to list object versions or download earlier versions. These operations require the master key or an access key with **All S3 Actions**.
{% endhint %}
{% hint style="info" %}
For object version operations, see [Versioning](/products/object-storage-stook/bucket-configuration/versioning.md).
{% endhint %}
## Set Up an Authenticator
An authenticator can be configured on a created access key and used for operations protected by MFA Delete.
Authenticators cannot be configured on the master key.
To use an access key with MFA Delete, the access key must:
* Have an authenticator configured.
* Have access to the applicable Stook Bucket.
* Include the **Put Bucket Versioning** permission to enable, disable, or manage Versioning-related MFA Delete operations.
* Include **Delete Object Version** when it is used to permanently delete an object version.
Configure the authenticator from **Stook Object Storage → Credentials** for the access key you want to use.
The authenticator provides a six-digit code for protected operations. The authenticator serial is also used when performing MFA-protected operations through compatible S3 clients such as the AWS CLI.
{% hint style="warning" %}
If MFA Delete is enabled and you lose the authenticator device without another applicable access key, contact . Access can only be restored by Medianova Support.
{% endhint %}
## Use Authenticator Codes
Authenticator codes have the following behavior:
* A new code is generated every 30 seconds.
* A code is accepted for approximately one minute.
* Each code can be used only once.
* Code validation depends on the time configured on the authenticator device.
If a code is rejected, wait for the next code and verify that automatic time synchronization is enabled on the device.
{% hint style="info" %}
For MFA-protected version deletion and Versioning behavior, see [MFA Delete](/products/object-storage-stook/bucket-configuration/mfa-delete.md).
{% endhint %}
## Related Topics
* [Getting Started with Stook](/products/object-storage-stook/getting-started-with-stook.md)
* [Bucket Configuration](/products/object-storage-stook/bucket-configuration.md)
* [Versioning](/products/object-storage-stook/bucket-configuration/versioning.md)
* [MFA Delete](/products/object-storage-stook/bucket-configuration/mfa-delete.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://clients.medianova.com/products/object-storage-stook/manage-access-keys.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
