Contents x
Application Key Capabilities
  • 08 Oct 2025
  • Print
  • Dark
    Light
Contents

Application Key Capabilities

  • Updated on 08 Oct 2025
  • Print
  • Dark
    Light
Article summary

Each application key (app key) is associated with a set of capabilities. Each of those capabilities provide access to Backblaze B2 Cloud Storage APIs.

listKeys

Enumerate the app keys in an account and their metadata.

The metadata for a key includes everything except the secret app key string.

This capability provides access to the following API:

writeKeys

Create new app keys.

This option does not impose any restrictions on what those keys can do. Enabling the writeKeys capability grants full access to the Backblaze B2 account.

This capability provides access to the following API:

deleteKeys

Delete any app key that belongs to the account.

This capability provides access to the following API:

listBuckets

List the buckets in the account and their metadata.

The metadata includes the bucket ID, bucket name, bucket type, bucket info, CORS rules, and lifecycle rules.

If an app key is restricted to one bucket, you must provide the bucket name or ID in the b2_list_buckets request.

This capability provides access to the following API:

listAllBucketNames

List the names and IDs of all of the buckets in the account, even app keys that are restricted to a bucket.

This capability provides access only to the S3-Compatible API List Buckets, as there is currently no Native API that lists only bucket names and IDs.

readBuckets

View additional information about a bucket such as access control lists, location, and versioning.

This capability provides access only to the relevant S3-Compatible API, as there is currently no Native API that provides this information.

writeBuckets

Create new buckets in the account. Also, update the bucket type, bucket info, and lifecycle rules for a bucket.

This option is not allowed for app keys that are restricted to a bucket.

This capability provides access to the following APIs:

deleteBuckets

Delete any bucket in the account.

This option is not allowed for app keys that are restricted to a bucket.

This capability provides access to the following API:

readBucketRetentions

Determine whether Object Lock is enabled for a bucket. Also, view the default lock mode and period (if configured) on a bucket that has Object Lock enabled.

This capability is used in the following APIs:

writeBucketRetentions

Create a bucket that has Object Lock enabled. Also, update the default lock mode and period on a bucket that has Object Lock enabled.

This capability is used in the following APIs:

readBucketEncryption

View the default encryption settings on a bucket.

This capability is used in the following APIs:

writeBucketEncryption

Enable or disable default encryption on a bucket.

This capability is used in the following APIs:

listFiles

List files and their metadata.

Metadata includes the file name, file id, file info, size, and content type.

For app keys that are restricted to a bucket, only the files in that bucket are listed.

For app keys that are restricted to a file name prefix, you must include a matching prefix in the list request. You can supply the same prefix as in the app key or a more restrictive one.

This capability provides access to the following APIs:

readFiles

View the metadata for files and download their contents.

Metadata includes the file name, file id, file info, size, and content type.

For app keys that are restricted to a bucket, only the files in that bucket are downloaded.

For app keys that are restricted to a file name prefix, only the files with a prefix in the name are downloaded.

This capability provides access to the following APIs:

shareFiles

Create authorization tokens for downloading files.

For app keys that are restricted to a bucket, only the files in that bucket are authorized.

For app keys that are restricted to a file name prefix, only the files with a prefix in the name are authorized.

This capability provides access to the following API:

writeFiles

Upload files to Backblaze B2, including both regular files and large files.

To support large file uploads, all of the APIs that are involved in uploading large files are allowed.

For app keys that are restricted to a bucket, files can be uploaded only to that bucket.

For app keys that are restricted to a file name prefix, only files with a prefix in the name are uploaded.

This capability provides access to the following APIs:

deleteFiles

Delete files.

For app keys that are restricted to a bucket, only files in that bucket are deleted.

For app keys that are restricted to a file name prefix, only files with a prefix in the name are deleted.

This capability provides access to the following API:

readFileLegalHolds

View the Object Lock legal hold status on a file.

These files must be located in a bucket that has Object Lock enabled.

This capability is used in the following APIs:

writeFileLegalHolds

Update the Object Lock legal hold status on a file.

These files must be located in a bucket that has Object Lock enabled.

This capability is used in the following APIs:

readFileRetentions

View the Object Lock retention settings (mode and expiration) on a file.

These files must be located in a bucket that has Object Lock enabled.

This capability is used in the following APIs:

writeFileRetentions

Update the Object Lock retention settings (mode and expiration) on a file.

These files must be located in a bucket that has Object Lock enabled.

This capability is used in the following APIs:

bypassGovernance

Delete governance mode-locked files. Also, shorten governance mode expiration and switch governance mode to compliance mode.

This capability is used in the following APIs:

readBucketReplications

View (but not change) bucket replication information. For more information, see Cloud Replication.

This capability is used in the following APIs:

writeBucketReplications

Write bucket replication information. For more information, see Cloud Replication.

This capability is used in the following APIs:

readBucketNotifications

Read the event notification rules for a bucket.

This capability is used in the following APIs:

writeBucketNotifications

Write event notification rule information for a bucket.

This capability is used in the following APIs:

readBucketLogging

Read the logging configuration of a bucket with Bucket Access Logs enabled.

This capability is used in the following APIs:

writeBucketLogging

Write Bucket Access Logs configuration for a bucket. 

This capability is used in the following APIs:

Was this article helpful?
Related articles
What's Next