Connection profile
export AWS_ACCESS_KEY_ID=PCAK00EXAMPLEKEYID00
export AWS_SECRET_ACCESS_KEY=<your secret access key>
export AWS_ENDPOINT_URL=https://s3.canada.popcloud.ca
export AWS_REGION=canada
export POPCLOUD_BUCKET=pc-your-org-mediaThese are example values. Sign in and every snippet on this site fills in with your own endpoint, key and bucket.
The five facts
| Fact | Value | What it is |
|---|---|---|
| Endpoint | https://s3.canada.popcloud.ca | One host per region. Every SDK calls this an "endpoint" or "endpoint URL"; a few call it a "host" or "server" and want it without the scheme. |
| Region | canada | The edge verifies your signature against the scope you signed with, so any region string authenticates. Use the real one anyway — tooling, logs and support all assume it. |
| Access key ID | PCAK00EXAMPLEKEYID00 | PopCloud-minted, always prefixed PCAK. It identifies you at the edge; it is not an infrastructure key and never signs storage requests outside PopCloud. |
| Secret access key | <your secret access key> | Shown exactly once, when the credential is created. If you lose it, rotate the credential — there is no way to read it back. |
| Addressing style | path (recommended) or virtual-hosted | Both path-style (https://s3.<region>.<root>/<bucket>/<key>) and virtual-hosted-style (https://<bucket>.s3.<region>.<root>/<key>) requests are supported. Path-style is the safest choice for bucket names containing dots and clients without a nested wildcard certificate. |
Addressing style, specifically
S3 has two ways to name a bucket in a request. Virtual-hosted style puts it in the hostname — bucket.s3.amazonaws.com/key — and path style puts it in the path: s3.canada.popcloud.ca/bucket/key. PopCloud supports both.
Path style is the safest default for dotted bucket names and clients that cannot validate a nested wildcard certificate. The table shows each integration’s path-style setting when you choose that mode; it is not a platform requirement:
| Integration | Setting |
|---|---|
| AWS CLI | s3.addressing_style = path |
| Django | OPTIONS.addressing_style = path |
| boto3 | Config(s3={'addressing_style': 'path'}) = path |
| rclone | force_path_style = true |
| AWS SDK for JavaScript v3 | forcePathStyle = true |
| Browser uploads | forcePathStyle = true |
| AWS SDK for Go v2 | o.UsePathStyle = true |
| AWS SDK for Java v2 | forcePathStyle = true |
| AWS SDK for PHP | use_path_style_endpoint = true |
| AWS SDK for Ruby | force_path_style = true |
What you do not have to configure
- Signature: AWS Signature Version 4, service name `s3`
- Session token: none — PopCloud credentials are long-lived, not STS
- TLS: required; there is no plaintext endpoint
- Checksums: the modern SDK defaults (CRC32, CRC32C, CRC64NVME, SHA-1, SHA-256) all work
In particular, there is no session token and no STS. A PopCloud credential is long-lived until you rotate, revoke or expire it — see credentials & scopes.
Regions and endpoints
One host per region, in the form https://s3.<region>.popcloud.ca. A bucket lives in exactly one region and is reachable at that region’s endpoint.
The current production rollout enables canada. Additional region codes are not usable merely because they exist in an SDK; the dashboard only offers regions with deployed edge and storage capacity.
The region string in your configuration is used for signing. The edge verifies your signature against the scope you signed with, so a mismatched region string still authenticates — but use the real one anyway: your logs, our logs and every support conversation assume it matches the bucket.