Your first FTP/SFTP to Wasabi service

This guide walks you through creating a Simple FTP Service (SFS) backed by Wasabi. When you are done you will have an FTP/FTPS/SFTP hostname and a user account whose uploads and downloads go straight to a bucket in your own Wasabi account. DocEvent connects through Wasabi's S3-compatible API, so you need three things from Wasabi: the bucket, the endpoint for its region, and an access key.

Before you start - in Wasabi

1. Pick or create a bucket and note the region it is in, for example eu-central-1.

2. Find the endpoint for that region. It follows the pattern s3.<region>.wasabisys.com, except US East 1, which is s3.wasabisys.com:

   Bucket region	Endpoint
   us-east-1	s3.wasabisys.com
   us-west-1	s3.us-west-1.wasabisys.com
   eu-central-1	s3.eu-central-1.wasabisys.com
   ap-southeast-2	s3.ap-southeast-2.wasabisys.com

   Wasabi publishes the full list of service URLs.

3. Create a user just for DocEvent. In the Wasabi console, create a user with programmatic (API) access, and save its access key and secret key when Wasabi shows them. Avoid using your root account's keys.

4. Limit that user to the one bucket. Attach a policy like this, with your bucket name in place of my-bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject*", "s3:PutObject*", "s3:DeleteObject"],
      "Resource": ["arn:aws:s3:::my-bucket/*"]
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetBucketLocation", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my-bucket"]
    }
  ]
}

This is the same minimum DocEvent needs on Amazon S3: read, write and delete files, and list the bucket. Wasabi's own bucket-level example grants more, because it also lets the user work in the Wasabi console.

Step 1 - Create a new service

Sign in to the DocEvent console, open Simple FTP Service in the top menu and click Create new. Choose S3 Compatible Storage as the backend.

Step 2 - Provide access to your bucket

Fill in the S3 Compatible Credentials with the values from Wasabi:

Always fill in Bucket region, even though the form lets you leave it empty. Empty does not mean "detected": DocEvent then signs its requests for its own hosting region instead of your bucket's, and a mismatched region is a common cause of signature errors.

Leave Use path style URLs unticked unless your bucket name contains dots (files.acme.com). A dotted name breaks the certificate check on Wasabi's default URLs, and path style avoids it.

Click Verify Access. DocEvent round-trips a small test file to prove the key really can read and write the bucket before anything is saved. If your policy limits the user to a folder rather than the whole bucket, set Test path under Advanced to a folder it can write to.

Step 3 - Name the service and add the first user

Give the service a name, then set up its first user - you can add more later.

1. Service name - how the service appears in your console
2. Username - the first FTP/SFTP user. It gets the service ID as a prefix once created, e.g. abcd1234/ftpuser
3. Password - the user's password
4. Home directory - where this user lands inside the bucket. / is the bucket root; a path like /acme confines them to that folder. See Home directories and keeping each user isolated

Click Create Service.

Step 4 - Done: your login details

The final screen has everything you need to connect: the username with its service-ID prefix, the FTP/FTPS and SFTP hostnames, ready-to-paste command-line examples, and the SSH host keys for verifying the SFTP server - see SSH host keys for SFTP and SCP.

Every file uploaded over FTP, FTPS or SFTP lands in your Wasabi bucket, and every file already in the bucket is available to download. You can also browse it from a browser with SFS Drive.

Worth knowing: Wasabi bills a minimum storage duration

Wasabi charges every file for a minimum time in storage: 90 days on its pay-as-you-go pricing, 30 days on reserved capacity. A file deleted sooner is still billed for the remaining days, as Timed Deleted Storage. See Wasabi's pricing FAQ.

That matters for a drop folder that is emptied as soon as files are picked up: on pay-as-you-go, a file that sits in the bucket for a day costs the same as one kept for 90. For long-lived archives, it makes no difference.

If Verify Access fails

• "Please enter a valid HTTP URL" - the endpoint needs https:// in front.
• An access or signature error - check that the endpoint and Bucket region both match the region the bucket is actually in, and that the keys belong to the user with the bucket policy.
• Access denied writing the test file - the policy may not cover the whole bucket. Widen it, or set Test path to a folder the user can write to.
• A certificate or connection error - if the bucket name contains dots, tick Use path style URLs.

Other storage providers

The S3 Compatible Storage tile also covers Backblaze B2, Cloudflare R2, MinIO, Hetzner Object Storage and Supabase - see Your first FTP/SFTP to Cloudflare R2 service and Your first FTP/SFTP to Backblaze B2 service. For Amazon S3 itself, follow Your first FTP/SFTP to Amazon S3 service.