Step 1Create a Wasabi account

Create an account at wasabi.com/sign-up, then sign in to the Wasabi console at console.wasabisys.com.

Wasabi bills you directly for storage; Dropbucket doesn't charge for it. Prices change, so check Wasabi's pricing page for current rates.

Still choosing a provider? We recommend iDrive e2. See how to set up iDrive e2.

Step 2Create a private bucket and pick a region

  1. Open Buckets and choose Create Bucket.
  2. Enter a name using lowercase letters, numbers and dashes, for example agency-transfers. Dropbucket won't accept capitals or underscores.
  3. Pick a region close to you and your clients, for example AP Southeast 2 (Sydney). Note which one you chose.
  4. Create the bucket and keep it private. Dropbucket uses short-lived signed links, so the bucket never needs public access.

Step 3Create an access key for that bucket only

Your account's root access key can reach every bucket you own. A sub-user that can only touch this bucket is safer. First create a policy, then a user with that policy.

Create the policy

  1. Open Policies and choose Create Policy.
  2. Name it dropbucket-agency-transfers.
  3. Paste this policy, replacing agency-transfers with your bucket name in both places, and save it.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketCORS",
        "s3:PutBucketCORS"
      ],
      "Resource": "arn:aws:s3:::agency-transfers"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": "arn:aws:s3:::agency-transfers/*"
    }
  ]
}

The two CORS actions let Dropbucket add its browser-upload rule for you. The multipart actions let big uploads resume and clean up after themselves.

Create the sub-user

  1. Open Users and choose Create User.
  2. Enter a name, like dropbucket, and tick Programmatic access. Leave console access off.
  3. Click Next through the groups step.
  4. On the policies step, attach the policy you just made.
  5. Review and choose Create User.

Wasabi shows the Access Key and Secret Key at the end. Copy both, or download the file. The secret is shown once only.

The exact menus may differ slightly as Wasabi updates its console.

Step 4Find your endpoint and region

Wasabi uses a different address for each region:

https://s3.<REGION>.wasabisys.com
  • US East 1 (N. Virginia): https://s3.us-east-1.wasabisys.com
  • EU Central 1 (Amsterdam): https://s3.eu-central-1.wasabisys.com
  • AP Southeast 2 (Sydney): https://s3.ap-southeast-2.wasabisys.com

The region code is the middle part, such as ap-southeast-2. Wasabi lists every region on its service URLs page. The endpoint must match the region your bucket is in.

Step 5Enter the details in Dropbucket

  1. In Dropbucket, go to Settings → Storage.
  2. Provider: choose Wasabi. Dropbucket fills in the endpoint https://s3.<REGION>.wasabisys.com and region us-east-1 for you.
  3. Endpoint: your region's endpoint from Step 4.
  4. Bucket: the bucket name from Step 2.
  5. Region: the same region code that's in the endpoint, for example ap-southeast-2. Dropbucket fills in us-east-1 by default.
  6. Access key ID and Secret access key: the Access Key and Secret Key from Step 3.
  7. Folder inside the bucket (optional): leave it blank, or enter a folder such as client-files if the bucket holds other things too.
  8. Path-style URLs: leave it ticked. That's the right setting for Wasabi.

Read Step 6 before you press Test and save. Your keys are encrypted before they're stored, and Dropbucket only uses them to sign uploads and downloads. Files never pass through Dropbucket's servers.

Step 6Add the CORS rule

Files travel from your client's browser straight into your bucket. The browser only allows that if the bucket says Dropbucket's pages may upload to it. That permission is a CORS rule.

The Storage page in Dropbucket shows the exact rule under CORS rule, and tries to apply it for you when you save.

With the policy from Step 3, Dropbucket adds its rule for you when you press Test and save, so most Wasabi buckets need nothing here. Wasabi also allows browser access by default.

If you ever need to set it by hand, open the bucket's settings in the Wasabi console, find the CORS section and add this rule:

[
  {
    "AllowedOrigins": [
      "https://app.dropbucket.io"
    ],
    "AllowedMethods": [
      "GET",
      "PUT",
      "HEAD"
    ],
    "AllowedHeaders": [
      "*"
    ],
    "ExposeHeaders": [
      "ETag"
    ],
    "MaxAgeSeconds": 3600
  }
]

Using your own domain for download and upload pages? Add it as a second origin, for example "https://files.youragency.com", with a comma after the first. No trailing slash. The Storage page in Dropbucket shows the rule with your verified domains already filled in, so copying it from there is safest. See Put your download pages on your own domain.

Keep ETag in ExposeHeaders. Dropbucket reads it after every chunk of a large upload, and uploads stop without it.

Step 7Run the connection check

  1. Press Test and save.
  2. Dropbucket writes a tiny test file to the bucket, reads it back and deletes it. When that works, the Status card shows a tick next to Keys work.
  3. It then tries to add the CORS rule and runs a real test upload from your browser. When that works, Browser uploads allowed (CORS) shows a tick.

On Wasabi the CORS rule is usually added for you, so both steps should tick. If Browser uploads allowed (CORS) doesn't, wait a minute and press Check again.

Two ticks means you're connected. Send a small test transfer to yourself to see the whole thing working.

Step 8Fix common errors

The messages below are exactly what Dropbucket shows on the Storage page.

Permissions

“The storage provider refused these keys. Check the access key, secret and bucket permissions.”Check the key and secret were copied in full. Check the policy is attached to the user and names the right bucket. A typo in the bucket name inside the policy is easy to miss.

“Wrote a test file but could not read it back”The key can write but not read. Give it read and write access to the bucket, then press Test and save again.

Keys work, but uploads fail with a 403 errorCheck CORS first. Then check the policy includes s3:PutObject on the /* resource line.

Region and endpoint

“That bucket was not found at this endpoint.”The endpoint is for a different region from the bucket. Match them up.

“Wrong region or endpoint for this bucket.”The Region field and the endpoint should both use the code of the bucket's region.

“We couldn't reach your storage with these settings. Check the endpoint and region.”The endpoint has a typo or the region code is wrong. Copy the endpoint again from your provider's console.

“Endpoint should be just the address, with no path”Remove everything after the domain, including any bucket name. The endpoint must also start with https://.

“Custom S3 endpoints come with a lifetime plan. Pick one of the listed providers, or upgrade.”On the free plan the endpoint has to be one of the listed providers' own addresses. This usually means a typo in the domain part of the endpoint.

CORS

Keys work, but Browser uploads allowed (CORS) doesn't tickSomeone may have set a CORS rule on the bucket earlier that doesn't include https://app.dropbucket.io. Add Dropbucket's rule as shown in Step 6, then press Check again.

“Your storage didn't return an ETag. Check its CORS settings (expose ETag).”A custom CORS rule on the bucket is hiding the ETag header. Add ETag to its exposed headers.

Still stuck? Email support@dropbucket.io with the message you see. Never send us your secret key.