From 63392357811f9a298fc177ae3aa8486bc982a467 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 14 Aug 2026 13:20:59 +0000 Subject: [PATCH] Correct B2 application key guidance: use "All" bucket access, not one bucket MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Confirmed live and cross-checked against a real, documented Kopia issue (kopia/kopia#5329): the walkthrough previously told the operator to scope the Application Key to just the bucket they created — the more security-conservative default, and correct for B2's own S3-compatible API in general. But Kopia specifically needs the listBuckets capability even though it only ever touches the one configured bucket, and B2's basic "Add a New Application Key" web form doesn't expose a way to grant listBuckets on a bucket-restricted key — only an account-wide ("All") key gets it through that form. Without it, the connection fails with B2's unhelpful "Cannot access bucket" error, which doesn't point at the actual missing capability at all. Updated the guidance to "All" with the reasoning inline, and a note that single-bucket scoping is still possible for anyone willing to create the key via B2's CLI/API directly (b2_create_key with an explicit capabilities list including listBuckets) rather than the basic web form this walkthrough is written for. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn --- services/backup.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/services/backup.sh b/services/backup.sh index 543c778..54d6e57 100644 --- a/services/backup.sh +++ b/services/backup.sh @@ -727,7 +727,13 @@ install_backup() { echo " e.g. s3.us-west-004.backblazeb2.com — you'll need it below." echo "" echo " 2) Account → App Keys → Add a New Application Key" - echo " - Allow access to: the bucket you just created (not 'All')" + echo " - Allow access to: All — confirmed live (kopia/kopia issue #5329): a key" + echo " restricted to one bucket via this basic form doesn't get the" + echo " 'listBuckets' capability Kopia needs even though it only ever touches" + echo " that one bucket, and B2 fails the connection with an unhelpful 'Cannot" + echo " access bucket' error. Restricting to one bucket only works if you add" + echo " listBuckets via the B2 CLI/API's own key-creation call instead of this" + echo " form — not something this walkthrough covers." echo " - Type: Read and Write" echo " - B2 shows the application key ONLY once — copy both values now," echo " you can't retrieve the key itself again afterward."