Docs / Work with files
Upload a file. Get the same file back.Upload a file. Get the same file back.
Connect an S3 client, upload a file and verify the downloaded bytes match. Run the steps on your own computer.
Before you begin
You need a provisioned customer service and its private credentials. Never enter secret keys into this documentation page.
1
An active customer service
Open your storage service in the WHMCS client area. Its Keldra panel shows the endpoint and service credentials.
2
A private bucket
If your product includes a starting bucket, use that bucket. Otherwise open Create a bucket in the Keldra service panel and choose Create private bucket. Note its exact name.
3
Your chosen S3 client
For command-line steps, install AWS CLI v2 or curl with AWS Signature Version 4 support. Use a local shell; these commands use POSIX shell syntax.
1. Configure your client
Set the endpoint and bucket, then enter your service’s S3 access key and secret into your local shell. The secret prompt does not echo the value. These instructions require Bash and curl 7.75 or newer with --aws-sigv4 support.
export S3_ENDPOINT='https://eu-west-1.keldra.store'
export BUCKET='your-private-bucket'
read -r -p 'S3 access key: ' AWS_ACCESS_KEY_ID
read -r -s -p 'S3 secret key: ' AWS_SECRET_ACCESS_KEY; printf '\n'
export AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
Expected: the variables are set in your local shell. Do not paste your credentials into a public terminal recording or share their values.
2. Upload a file
Create a small file and send a signed S3 PUT request. This uses the service’s S3 credentials, not a website account password.
printf 'Hello from Keldra\n' > hello.txt
curl --fail-with-body --aws-sigv4 'aws:amz:eu-west-1:s3' \
--user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
--upload-file hello.txt "$S3_ENDPOINT/$BUCKET/hello.txt"
Expected: curl exits successfully. --fail-with-body makes an HTTP error fail rather than look like a successful transfer.
3. Download it
Send a signed GET request and save the response as downloaded.txt. Keep the original hello.txt unchanged.
curl --fail-with-body --aws-sigv4 'aws:amz:eu-west-1:s3' \
--user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
--output downloaded.txt "$S3_ENDPOINT/$BUCKET/hello.txt"
Expected: downloaded.txt exists and curl exits with status 0. If access is denied, check the credential pair and bucket name.
4. Verify the result
Compare the downloaded file with the original on your own computer.
cmp hello.txt downloaded.txt
Expected: no output and exit status 0 from cmp. Remove shell credentials with unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY when finished.
Your completion checklist
Mark what you have verified yourself. These page-local checkboxes do not run commands or inspect your storage.
Need help?
Access denied or unable to connect?
Check the complete endpoint, eu-west-1 region and exact bucket name. Confirm the service is active and the key pair belongs to that service. Review configured bucket permissions. Do not make the bucket public to work around a credential error.
The files differ?
Confirm you downloaded the same object key into downloaded.txt, not an error response or an older local file. Repeat the download and compare again. Keep both files until you understand the difference.
Next goal: move an existing bucket
Inventory the source first, configure destination permissions and indexes, and check transfer charges. To export current originals from your configured bucket to a local directory, use the command below. Version history and permission/index configuration need separate migration steps.
aws --profile keldra --endpoint-url "$S3_ENDPOINT" \
s3 sync "s3://$BUCKET/" ./export/
Next goal: control who can access data
Start private. Give each service its own credentials, then configure groups, roles and resource permissions for applications that need finer-grained access. Test both an allowed and denied identity.
Manage customer services
Use the module’s service controls in WHMCS to suspend, restore or terminate access. Suspension blocks new authentication; existing sessions can last until expiry. Termination revokes service credentials without automatically deleting stored files.
Your goal
Upload a file to your private bucket and get the same file back. Complete the checklist only after checking the results on your computer.
Where are my credentials?
Open your storage service in the WHMCS client area. Use that service’s S3 credentials, not your WHMCS login. For AWS CLI, configure them locally with:
aws configure --profile keldra
Troubleshoot this tutorial →