---
url: /en/docs/media/scaleway-object-storage.md
description: >-
  Use Scaleway Object Storage as an external media storage provider in Sveltia
  CMS for S3-compatible cloud storage across European and global regions.
---

# Scaleway Object Storage Integration

[Scaleway Object Storage](https://www.scaleway.com/en/object-storage/) is an S3-compatible object storage service with multi-region availability. Sveltia CMS supports Scaleway Object Storage as a media storage backend with direct browser-to-storage uploads using AWS Signature Version 4 — no backend proxy is required.

## Requirements

* A Scaleway account with a bucket created.
* A Scaleway API key pair (see [Credentials](#credentials) below).

### CSP

If your site uses a Content Security Policy (CSP), you need to allow the Scaleway endpoint. See [Content Security Policy](#content-security-policy) below for details.

## Setup

### Credentials

Scaleway uses IAM API keys for authentication. Generate a key pair via **Scaleway Console > IAM > API Keys**.

The resulting **Access Key ID** goes in `access_key_id` in your config. The **Secret Access Key** is entered by users in the CMS UI when they access the media library for the first time — it is never stored in config.

### Public Read Access

Asset preview and download URLs are unsigned direct storage URLs, so objects must be publicly readable. Objects are private by default, even in a bucket whose **Visibility** is **Public**, as that setting only controls whether anyone can list them. Sveltia CMS therefore gives every file it uploads or renames, and every folder it creates, the `public-read` ACL, so the bucket can stay private. The API key’s IAM policy needs the `ObjectStorageObjectsWrite` or `ObjectStorageFullAccess` permission set, both of which include the `PutObjectAcl` permission. If the bucket has a bucket policy, it must allow `s3:PutObjectAcl` as well.

Objects uploaded by other means, such as the console, stay private unless you make them public, or add a bucket policy that grants `s3:GetObject` to everyone. Their previews won’t load in the CMS until you do.

### CORS

Configure CORS via AWS CLI. See the [documentation](https://www.scaleway.com/en/docs/object-storage/api-cli/setting-cors-rules/) for details. CORS is required because Sveltia CMS sends custom AWS Signature v4 headers that trigger a preflight request. Make sure to allow the necessary HTTP methods (`GET`, `PUT` and `DELETE`) and all headers (`*`), as Sveltia CMS sends the `Authorization`, `x-amz-*` and `Content-Type` headers. The `DELETE` method and the `x-amz-copy-source` header are needed to delete and rename files from the [Asset Library](/en/docs/ui/asset-library); if you configured CORS before these operations became available, add them to your existing rule.

## Configuration

Here’s an example configuration for Scaleway Object Storage:

::: code-group

```yaml [YAML]
media_libraries:
  scaleway_object_storage:
    access_key_id: SCWXXXXXXXXXXXXXXXXXX
    bucket: my-bucket
    region: fr-par
    prefix: cms-uploads/ # Optional
    public_url: https://my-cdn.example.com # Optional, see CDN / Custom Domain below
```

```toml [TOML]
[media_libraries.scaleway_object_storage]
access_key_id = "SCWXXXXXXXXXXXXXXXXXX"
bucket = "my-bucket"
region = "fr-par"
prefix = "cms-uploads/"
public_url = "https://my-cdn.example.com"
```

```json [JSON]
{
  "media_libraries": {
    "scaleway_object_storage": {
      "access_key_id": "SCWXXXXXXXXXXXXXXXXXX",
      "bucket": "my-bucket",
      "region": "fr-par",
      "prefix": "cms-uploads/",
      "public_url": "https://my-cdn.example.com"
    }
  }
}
```

```js [JavaScript]
{
  media_libraries: {
    scaleway_object_storage: {
      access_key_id: 'SCWXXXXXXXXXXXXXXXXXX',
      bucket: 'my-bucket',
      region: 'fr-par',
      prefix: 'cms-uploads/', // Optional
      public_url: 'https://my-cdn.example.com', // Optional
    },
  },
}
```

:::

::: warning

Do not write your Secret Access Key in the configuration file, as it should be kept confidential and not exposed in client-side code. Users will be prompted to enter the key when they use the storage for the first time, which will be stored securely in the browser’s local storage.

:::

### Configuration Properties

| Property | Required | Description |
| --- | --- | --- |
| `access_key_id` | Yes | Scaleway IAM Access Key ID. Safe to store in config. |
| `bucket` | Yes | The bucket name. |
| `region` | Yes | Scaleway region: `fr-par`, `nl-ams`, `pl-waw`, or `it-mil`. |
| `prefix` | No | Path prefix within the bucket, e.g. `uploads/`. A trailing slash is added if missing. |
| `public_url` | No | CDN or custom domain URL for asset previews. See [CDN / Custom Domain](#cdn-custom-domain) below. |

## CDN / Custom Domain

By default, asset URLs use the virtual-hosted storage endpoint (`https://{bucket}.s3.{region}.scw.cloud/{key}`). To serve assets via a CDN or custom domain, set `public_url` to the base URL of your CDN or domain:

```yaml
public_url: 'https://my-cdn.example.com'
```

::: warning

Do **not** set `public_url` to a CDN URL and rely on it for API operations. The CDN endpoint does not support the S3 ListObjects API, so browsing the asset library would stop working. The storage endpoint is always used for listing and uploading; only the asset URLs shown in the CMS change.

:::

## Content Security Policy

API calls (list, upload) go to `https://s3.{region}.scw.cloud`. Asset URLs use `https://{bucket}.s3.{region}.scw.cloud` by default:

```
connect-src https://s3.fr-par.scw.cloud
            https://my-bucket.s3.fr-par.scw.cloud;
img-src     https://my-bucket.s3.fr-par.scw.cloud;
```

If using a CDN or custom domain via `public_url`:

```
connect-src https://s3.fr-par.scw.cloud
            https://my-cdn.example.com;
img-src     https://my-cdn.example.com;
```

Replace `fr-par` and `my-bucket` with your actual region and bucket name.

The asset host must be in `connect-src` because the Download and Copy buttons and the text preview in the [Asset Library](/en/docs/ui/asset-library) fetch the file from its public URL. For the same reason, a CDN or custom domain must also send CORS headers that allow the CMS origin, otherwise downloads fail.

See the [CSP documentation](/en/docs/security#setting-up-content-security-policy) for more details.

## Accessing the Storage

There are two ways to use Scaleway Object Storage in Sveltia CMS:

### File and Image Fields

When editing content entries, users can use [File](/en/docs/fields/file) and [Image](/en/docs/fields/image) fields to upload and select media on Scaleway Object Storage directly within the entry editor. After entering the Secret Access Key in the CMS UI when prompted, users can upload new media directly to your bucket or select existing media.

### Asset Library

Scaleway Object Storage also appears under **External Locations** in the [Asset Library](/en/docs/ui/asset-library), where users can browse, search, sort and filter the files in your bucket, and upload, rename, replace, download or delete them without leaving the CMS. The files and folders are browsed [folder by folder](/en/docs/ui/asset-library#folders-on-external-locations): subfolders are listed ahead of the files, uploads go to the folder being viewed, and folders can be created, renamed and deleted.