# tigris access-keys create

Create a new access key, optionally scoped to buckets, and export its credentials to a dotenv file or your shell. Returns the key ID and secret (shown only once). Without `--bucket` or `--admin`, the key uses the `standard` scope and gets the [default allowed operations](/docs/iam/manage-access-key/.md#default-allowed-operations).

**Alias:** `c`

## Usage[​](#usage "Direct link to Usage")

```
tigris access-keys create <name> [flags]

t3 keys c <name> [flags]
```

## Flags[​](#flags "Direct link to Flags")

| Name             | Required | Default  | Description                                                                                                                                                                                                          |
| ---------------- | -------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--bucket`, `-b` | No       | —        | Bucket to grant access to (comma-separated for several). Each bucket is paired positionally with a `--role` value                                                                                                    |
| `--role`, `-r`   | No       | —        | Role to assign (comma-separated for several). Each role pairs with the corresponding `--bucket` value. See [`access-keys assign`](/docs/cli/access-keys/assign/.md) for the roles                                    |
| `--admin`        | No       | —        | Grant admin access to all buckets in the organization                                                                                                                                                                |
| `--env`          | No       | —        | Write the credentials to a dotenv file, merging into it when it already exists. Defaults to `./.env`. The secret is then not printed                                                                                 |
| `--export`       | No       | —        | Print the credentials as shell `export` lines and nothing else on stdout, for `eval "$(tigris access-keys create <name> --export)"`                                                                                  |
| `--for`          | No       | `tigris` | Which SDK the credentials are for; `--env` and `--export` then use that SDK's variable names. `tigris` writes `TIGRIS_STORAGE_*`, `aws` writes `AWS_*` plus the Tigris endpoint and region. Options: `tigris`, `aws` |

## Examples[​](#examples "Direct link to Examples")

```
# A key with the default allowed operations

tigris access-keys create my-ci-key



# Scoped to one bucket

tigris access-keys create my-ci-key --bucket my-app-bucket --role Editor



# Different roles on different buckets, paired in order

tigris access-keys create my-ci-key --bucket bucket-a,bucket-b --role Editor,ReadOnly



# Admin access to every bucket

tigris access-keys create my-admin-key --admin



# Save the credentials to .env instead of printing the secret

tigris access-keys create my-app-key --bucket my-app-bucket --role Editor --env



# Put the credentials straight into the current shell

eval "$(tigris access-keys create my-app-key --export)"



# Name the variables for the AWS SDK

tigris access-keys create my-app-key --for aws --env
```