S3-Compatible Storage

Connect S3-Compatible Storage to store and reuse Drip Drop attachments in a bucket you manage on any service that uses the S3 API, including self-hosted MinIO and Ceph. You can also use the bucket for public email-image copies after separate public-access setup. This guide explains the required credentials, connection settings, and verification steps.

  • Your storage service uses the S3 API but has no first-class Drip Drop integration. Examples include a self-hosted MinIO or Ceph deployment and regional or niche providers.
  • You need to point Drip Drop at a specific Endpoint URL rather than one Drip Drop derives for you, because the host is not known in advance.
  • Your service needs a non-default Addressing Style or a specific Encryption posture that the vendor-specific integrations do not expose.

If your provider is Amazon S3, Cloudflare R2, Backblaze B2, DigitalOcean Spaces, Wasabi Hot Cloud, or Telnyx Storage, use that integration instead. Those connectors already know the endpoint and addressing rules for their service, so there is less to configure and less to get wrong. S3-Compatible Storage is the fallback for everything else.

  • Confirm you have an S3-compatible bucket and know its Bucket Name.
  • Have the service's S3 API Endpoint URL. It must be an https:// address that resolves on the public internet. A bucket on a private network or localhost cannot be reached from Drip Drop.
  • Have an Access Key ID and Secret Access Key for that bucket.
  • Confirm the key pair allows the bucket operations Drip Drop needs: upload, read, delete, and list.
  • Know the Region value your service expects, and whether it expects virtual-hosted or path-style addressing.
  • Confirm your role can create integrations. Without that permission, New Integration is not shown.
  • Optionally decide on a Key Prefix to keep Drip Drop's stored attachments under a dedicated path.

Unlike the vendor-specific storage integrations, this connector does not know your service in advance. That is why it asks for an Endpoint URL, an Addressing Style, and an Encryption setting: those are the three things that vary between S3-compatible services and cannot be inferred.

  1. Open Integrations → Storage.
  2. Select New Integration and choose S3-Compatible Storage.
Choose S3-Compatible Storage in the integration wizard.
  1. Review or change the Name.
  2. Enter your Access Key ID and Secret Access Key.
  3. Enter the Bucket Name.
  4. Enter the Region your service expects.
  5. Optionally enter a Key Prefix to keep Drip Drop's stored attachments under a dedicated path.
  6. Expand Endpoint, addressing and encryption and enter the service's Endpoint URL.
  7. Set the Addressing Style to Virtual-hosted (default) or Path, whichever your service documents.
  8. Choose an Encryption mode: Provider default or Request AES-256 (SSE-S3).
  9. Select Save & Continue.

Endpoint URL is the host Drip Drop uses for S3 API requests. Leave it blank only if the bucket is on Amazon S3 itself. It must start with https:// because Drip Drop rejects plain HTTP, and the host must resolve publicly. An internal-only or localhost address will not work.

Addressing Style controls where the bucket name goes in the request. With Virtual-hosted (default), the bucket becomes the leftmost part of the hostname (bucket.endpoint-host). With Path, it becomes the first segment of the URL path. Amazon S3, Cloudflare R2, and DigitalOcean Spaces use virtual-hosted addressing. Choose Path for MinIO, most self-hosted S3 gateways, and legacy bucket names that are not valid hostname labels, such as names containing uppercase letters or underscores. If saving reports that the bucket name cannot be used with virtual-hosted addressing, switch to Path.

Encryption controls the server-side encryption request sent with uploads. Provider default sends no encryption header and leaves encryption to your bucket settings. Request AES-256 (SSE-S3) requests SSE-S3 and requires provider support.

Region is a text field rather than a fixed list. Enter the value your service documents; an incorrect value can cause a signature error.

For attachment storage, Drip Drop generates object keys beneath the configured Key Prefix and confines attachment reads, writes, deletes, and listings to that prefix. Public email images use the separate Public Folder. Drip Drop does not set object ACLs; your bucket policy controls access. Configure anonymous read access only for the Public Folder.

Enter the S3-Compatible Storage connection settings, then select Save & Continue. The example-invalid-bucket value is deliberately nonfunctional and shown only for documentation.
Configure the endpoint URL, addressing style, and encryption options for your storage service. The https://storage.example.invalid endpoint is deliberately nonfunctional and shown only for documentation.
  1. On the Verify step, select Check credentials.
  2. After the check succeeds, select Done.
  3. Confirm that the integration you named appears as Active on the Storage page.
  4. Open a message template, find the Attachments section, then select Browse files → Connected storage.
  5. Choose that integration and an object beneath the configured Key Prefix, then select Attach.

When you select Check credentials, Drip Drop checks the bucket, creates a temporary object beneath the configured Key Prefix, reads it, and deletes it. A successful result confirms that the credentials can reach the endpoint and perform the required operations. A connection that can list objects but cannot write them does not pass.

Use the public object address supplied by your storage service as the Public Base URL. This address may differ from the Endpoint URL used for S3 API requests.

Images embedded in emails must remain publicly readable without signing in. Keep public access limited to a folder that is separate from the private attachment prefix.

  1. Open the saved integration and expand Serve email images from this bucket.
  2. Enter the Public Base URL and a separate Public Folder.
  3. Configure your storage service to allow anonymous read access to the Public Folder.
  4. Select Verify public access.
  5. After Publicly readable appears, enable Available as a public media location.
  6. Return to Storage. Under Email image location, choose the verified bucket.

If connection or public-media settings change, verification becomes stale. Select Verify public access again before using the bucket.

Changing Email image location affects only newly published images. Existing published images stay at their original location.

Endpoint URL rejected or unreachable
  • Confirm the Endpoint URL starts with https://. Drip Drop rejects plain HTTP so credentials are never sent in the clear.
  • Confirm the host resolves on the public internet. A bucket on a private network, a VPN-only host, or localhost cannot be reached from Drip Drop.
  • Enter only the service’s S3 API endpoint. Do not include a bucket name, path, or query string.
Wrong addressing style
  • If saving reports that the bucket name cannot be used with virtual-hosted addressing, set Addressing Style to Path. Names with uppercase letters, underscores, or more than 63 characters are not valid hostname labels.
  • Choose Path for MinIO and most self-hosted S3 gateways; choose Virtual-hosted (default) for Amazon S3, Cloudflare R2, and DigitalOcean Spaces.
  • Changing the style changes the host Drip Drop connects to, so re-save and re-verify after switching.
Region or signature mismatch
  • Enter exactly the Region value your service documents. Against a custom endpoint, the region is a signing token. Cloudflare R2 uses auto, and a self-hosted MinIO uses the value its operator configured.
  • A wrong value usually surfaces as a signature or authorization error rather than a clear region message, so check it before re-issuing credentials.
Invalid or insufficient credentials
  • Confirm the Access Key ID and Secret Access Key are active and belong to an account that can reach the bucket.
  • Confirm the key pair allows upload, read, delete, and list. Verification writes, reads, and deletes a temporary object, so list-only access fails even though the bucket exists.
A file is not visible under the Key Prefix
  • Confirm the object is in the configured Bucket Name and beneath the configured Key Prefix.
  • Changing the Key Prefix changes which objects are visible; files stored under an earlier prefix no longer appear.
  • Storage: choose and manage storage for Drip Drop attachments and images.
  • Message Templates: add stored files as attachments or use them as images in email designs.