Step 1Create a DigitalOcean account

Create an account at cloud.digitalocean.com/registrations/new. DigitalOcean asks for a payment method before you can create a bucket.

DigitalOcean bills you directly for storage; Dropbucket doesn't charge for it. Prices change, so check DigitalOcean's pricing page for current rates.

Still choosing a provider? We recommend iDrive e2. See how to set up iDrive e2.

Step 2Create a private bucket and pick a region

  1. In the DigitalOcean control panel, open Spaces Object Storage and create a new bucket.
  2. Pick a datacenter region close to you and your clients, for example Sydney (syd1). Note the region code.
  3. Enter a name using lowercase letters, numbers and dashes, for example agency-transfers. Dropbucket won't accept capitals or underscores.
  4. Leave file listing restricted. Dropbucket uses short-lived signed links, so the bucket never needs public access.
  5. Create the bucket.

Step 3Create an access key for that bucket only

  1. In Spaces Object Storage, open the Access Keys tab and click Create Access Key.
  2. Under Select access scope, choose Limited access.
  3. Tick your bucket and set its Permissions to Read/Write/Delete.
  4. Name the key, for example dropbucket, and click Create Access Key.

Copy the Access Key ID and Secret Key. DigitalOcean shows the secret once only.

The exact menus may differ slightly as DigitalOcean updates its control panel.

Step 4Find your endpoint and region

Your endpoint is the region code in this pattern:

https://<REGION>.digitaloceanspaces.com

For Sydney that's https://syd1.digitaloceanspaces.com, and the region is syd1. Don't put the bucket name in the endpoint.

Step 5Enter the details in Dropbucket

  1. In Dropbucket, go to Settings → Storage.
  2. Provider: choose DigitalOcean Spaces. Dropbucket fills in the endpoint https://<REGION>.digitaloceanspaces.com and region syd1 for you.
  3. Endpoint: replace <REGION> with your region code, for example https://syd1.digitaloceanspaces.com.
  4. Bucket: the bucket name from Step 2.
  5. Region: the region code, for example syd1. Dropbucket fills in syd1 by default.
  6. Access key ID and Secret access key: the Access Key ID and Secret Key from Step 3 (or the setup key, if you're using Option A in Step 6).
  7. Folder inside the bucket (optional): leave it blank, or enter a folder such as client-files if the bucket holds other things too.
  8. Path-style URLs: leave it unticked. That's the right setting for DigitalOcean Spaces.

Read Step 6 before you press Test and save. Your keys are encrypted before they're stored, and Dropbucket only uses them to sign uploads and downloads. Files never pass through Dropbucket's servers.

Step 6Add the CORS rule

Files travel from your client's browser straight into your bucket. The browser only allows that if the bucket says Dropbucket's pages may upload to it. That permission is a CORS rule.

The Storage page in Dropbucket shows the exact rule under CORS rule, and tries to apply it for you when you save.

Spaces needs one extra step. A Limited access key can't change bucket settings, so Dropbucket can't set the rule with it. And the control panel's CORS form has no field for exposed headers, so it can't expose ETag, which Dropbucket needs. Use one of these options instead.

Option A: connect once with a Full access key, then swap

This needs no command line.

  1. In Spaces Object Storage → Access Keys, click Create Access Key, choose Full access, name it dropbucket-setup and copy both values.
  2. Enter that key in Dropbucket as in Step 5 and press Test and save. Dropbucket adds its CORS rule to the bucket.
  3. Enter the limited key from Step 3 instead and press Test and save again. The CORS rule stays in place.
  4. Back in DigitalOcean, delete the dropbucket-setup key.

Option B: set it from the command line

If you use the AWS CLI, apply the rule with any key that has full access. Save this as cors.json:

{
  "CORSRules": [
    {
      "AllowedOrigins": [
        "https://app.dropbucket.io"
      ],
      "AllowedMethods": [
        "GET",
        "PUT",
        "HEAD"
      ],
      "AllowedHeaders": [
        "*"
      ],
      "ExposeHeaders": [
        "ETag"
      ],
      "MaxAgeSeconds": 3600
    }
  ]
}

Then run, with your own region and bucket name:

aws s3api put-bucket-cors --bucket agency-transfers --cors-configuration file://cors.json --endpoint-url https://syd1.digitaloceanspaces.com

This is the same rule Dropbucket shows on its Storage page, wrapped in "CORSRules" because the AWS CLI expects that.

Using your own domain for download and upload pages? Add it as a second origin, for example "https://files.youragency.com", with a comma after the first. No trailing slash. The Storage page in Dropbucket shows the rule with your verified domains already filled in, so copying it from there is safest. See Put your download pages on your own domain. With Option A, Dropbucket only adds verified domains while a key that can change CORS is connected.

Step 7Run the connection check

  1. Press Test and save.
  2. Dropbucket writes a tiny test file to the bucket, reads it back and deletes it. When that works, the Status card shows a tick next to Keys work.
  3. It then tries to add the CORS rule and runs a real test upload from your browser. When that works, Browser uploads allowed (CORS) shows a tick.

With a limited key you'll see "We couldn't set this automatically on your provider." That's expected. If the rule from Step 6 is in place, Browser uploads allowed (CORS) still ticks. If not, wait a minute and press Check again.

Two ticks means you're connected. Send a small test transfer to yourself to see the whole thing working.

Step 8Fix common errors

The messages below are exactly what Dropbucket shows on the Storage page.

Permissions

“The storage provider refused these keys. Check the access key, secret and bucket permissions.”Check the key and secret were copied in full. Check the limited key includes this bucket with Read/Write/Delete, not Read.

“Wrote a test file but could not read it back”The key can write but not read. Give it read and write access to the bucket, then press Test and save again.

Keys work, but uploads fail with a 403 errorUsually CORS. If CORS passes, check the key hasn't been deleted. Keep Path-style URLs unticked for Spaces.

Region and endpoint

“That bucket was not found at this endpoint.”The endpoint is for a different region, or the bucket name is in the endpoint. Use https://<REGION>.digitaloceanspaces.com only.

“Wrong region or endpoint for this bucket.”The Region field should be the same code that's in the endpoint, such as syd1.

“We couldn't reach your storage with these settings. Check the endpoint and region.”The endpoint has a typo or the region code is wrong. Copy the endpoint again from your provider's console.

“Endpoint should be just the address, with no path”Remove everything after the domain, including any bucket name. The endpoint must also start with https://.

“Custom S3 endpoints come with a lifetime plan. Pick one of the listed providers, or upgrade.”On the free plan the endpoint has to be one of the listed providers' own addresses. This usually means a typo in the domain part of the endpoint.

CORS

Keys work, but Browser uploads allowed (CORS) doesn't tickThe CORS rule is missing, was saved on a different bucket, or has a typo in the origin. The origin must be exactly https://app.dropbucket.io, with no slash at the end. Fix it, wait a minute, then press Check again.

“Your storage didn't return an ETag. Check its CORS settings (expose ETag).”The bucket has a CORS rule from the control panel form, which can't expose ETag. Replace it using Option A or B in Step 6.

Still stuck? Email support@dropbucket.io with the message you see. Never send us your secret key.