---
name: AnalyticsEngine-cos-credentials-serverless
title: Understanding the Object Storage credentials
description: ''
last-updated: 2022-02-28
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/AnalyticsEngine?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

{:new_window: target="_blank"}
{:shortdesc: .shortdesc}
{:codeblock: .codeblock}
{:screen: .screen}
{:pre: .pre}

# Understanding the Object Storage credentials
{: #cos-credentials-in-iae-serverless}

IBM Cloud Object Storage access credentials are configured as key-value pair parameters in IBM Analytics Engine.
These parameters start with the prefix `fs.cos.` followed by an identifier, which you can define, and end with the name of the credential.

Note that you can configure one IBM Analytics Engine service instance to work with multiple Object Storage instances or multiple Object Storage credentials. To differentiate between the different sets of credentials, you use separate identifiers or literals, which you can defined.

The following diagram shows how the Object Storage credentials are used in IBM Analytics Engine.

![Authentication to Object Storage resources from IBM Analytics Engine](images/cos-credentials-in-iae.svg){: caption="A description of the read and read-write credential options in Cloud Object Storage" caption-side="bottom"}

The diagram shows two Object Storage instances with two different data buckets `b1` and `b2`. To distinguish between the two instances, two identifiers are used, `cosInstance1` and `cosInstance2`. Note that the bucket names (`b1` and `b2`) that you use must be the actual names of the existing buckets in Object Storage. You can only choose the name of the identifier so that you can distinguish between Object Storage instances.

## Structure of HMAC credentials
{: #cos-credentials-in-1}

For HMAC style authentication, you must define the following parameters in IBM Analytics Engine:
```bash
fs.cos.<identifier>.access.key=<Access Key ID>
fs.cos.<identifier>.endpoint=<EndPoint URL>
fs.cos.<identifier>.secret.key=<Secret Access Key>
```

Note that the endpoint URL has the format `s3.direct.us.cloud-object-storage.appdomain.cloud` and doesn't require the prefix `https://`.

## Structure of API key credentials
{: #cos-credentials-in-2}

For IAM API key style authentication, you must define the following parameters in IBM Analytics Engine:
```bash
fs.cos.<identifier>.iam.api.key=<IAM API Key>
fs.cos.<identifier>.endpoint=<EndPoint URL>
```

Like for HMAC credentials, the endpoint URL has the format `s3.direct.us.cloud-object-storage.appdomain.cloud` and doesn't require the prefix `https://`.