Get an access key

This operation returns one access key of your account: its name, the buckets and object prefix it is limited to, its permissions, where it was created, and the regions it is ready in. The secret stays out of the answer - it is shown exactly once, when the key is created - so the response is safe to log or print.

The calling key can look up any access key of the account, itself included, whatever its own buckets and permissions. A deleted key answers 404, and so do the keys STRG looks after for you - the dashboard's own key and the assistant's.

When you'd use it

• Waiting for a new key to be ready. A deploy script that has just created a key can look at its regions until every region it needs reads active, and only then hand the key on.
• Checking what a key can do. Before a tool is given a key id, a quick look at its permissions, bucketScope and keyPrefix shows exactly what it will reach.
• A key describing itself. A long-running job can look up its own key id, $AWS_ACCESS_KEY_ID, to log the permissions and buckets it was given when it starts.

Request

GET /v1/access-keys/{id} HTTP/1.1
Host: api.strg.com
Authorization: Bearer <access key id>:<secret>

Path parameters

Name	Type	Required	Description
id	string	Yes	The access key id, as an S3 client sends it - 20 uppercase letters and digits. Any other value answers 404 not_found

Request headers

Name	Type	Required	Description
Authorization	string	Yes	Bearer <access key id>:<secret> of an access key holding Manage access keys through the API (api:access-management) - Authentication has the details

The request has no query parameters and no body.

Response

200 OK, with Content-Type: application/json and Cache-Control: no-store.

{
  "id": "STRG7K2Q9XWM4BHT3NPA",
  "label": "ci-uploads",
  "bucketScope": ["my-bucket"],
  "keyPrefix": "builds/",
  "permissions": ["objects:list", "objects:read", "objects:write"],
  "origin": "api",
  "createdAt": "2026-10-18T09:14:03.512Z",
  "regions": {
    "eu-central-1": "active"
  }
}

Field	Type	Description
id	string	The access key id, as an S3 client sends it
label	string or null	The key's name
bucketScope	array of strings or null	The buckets the key reaches, by name - null for every bucket, including buckets created later. Scope explains how it works
keyPrefix	string or null	The object key prefix the key is limited to, or null for none. Object prefix explains how it works
permissions	array of strings	The key's permissions, by name - Permissions describes each one
origin	string	Where the key was created: dashboard, mcp (an MCP client) or api (this API)
createdAt	string	When the key was created - ISO 8601, in UTC
regions	object	One entry per region the key is set up in, keyed by region (us-east-1, eu-central-1): pending until the key works there, then active. A region with no entry is one the key is not set up in - yet, or because you have no bucket there. When a key starts working has the details

Within /v1, fields may be added to this response but are never removed or changed, so a client can safely skip any field it does not know.

Errors

This table lists every error this operation can answer, so a client knows what to branch on. Each one is an application/problem+json body carrying a code; Errors has its shape.

Status	code	When
401	unauthenticated	The Authorization header is missing or malformed, the key is unknown or deleted, the secret is wrong, your account is closed, or the key does not hold Manage access keys through the API. The response carries WWW-Authenticate: Bearer realm="strg.com"
404	not_found	No active key of your account has this id: it never existed, it was deleted, it belongs to another account, it is one STRG manages for you, or the id is not a well-formed access key id
429	rate_limited	Too many authentication attempts for this key or from this address. The Retry-After header says how many seconds to wait before the next attempt, as Rate limits describes
500	internal_error	Something went wrong on STRG's side. The same request can be sent again a moment later

Examples

Each example looks up the key STRG7K2Q9XWM4BHT3NPA, which stands in for one of your own key ids. The calling key's id, $AWS_ACCESS_KEY_ID, works too: it returns the calling key itself.

curl

curl -sS https://api.strg.com/v1/access-keys/STRG7K2Q9XWM4BHT3NPA \
  -H "Authorization: Bearer $AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY"

Python (requests)

import os

import requests

key_id = os.environ["AWS_ACCESS_KEY_ID"]
secret = os.environ["AWS_SECRET_ACCESS_KEY"]

response = requests.get(
    "https://api.strg.com/v1/access-keys/STRG7K2Q9XWM4BHT3NPA",
    headers={"Authorization": f"Bearer {key_id}:{secret}"},
)
if response.status_code == 404:
    print("No such access key")
else:
    response.raise_for_status()
    key = response.json()
    print(key["label"], key["permissions"], key["regions"])

JavaScript (fetch)

const keyId = process.env.AWS_ACCESS_KEY_ID;
const secret = process.env.AWS_SECRET_ACCESS_KEY;

const response = await fetch("https://api.strg.com/v1/access-keys/STRG7K2Q9XWM4BHT3NPA", {
  headers: { Authorization: `Bearer ${keyId}:${secret}` },
});
if (response.status === 404) {
  console.log("No such access key");
} else if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
} else {
  const key = await response.json();
  console.log(key.label, key.permissions, key.regions);
}

Related

• List access keys - every key of the account, one page at a time
• Create an access key
• Delete an access key
• REST API overview - authentication, errors, rate limits
• Access keys - scope, prefixes and every permission