Struct ConnectCredentials 

pub struct ConnectCredentials {
    pub worker_access_key_id: String,
    pub worker_secret: String,
    pub frontend_asset_access_key_id: String,
    pub frontend_asset_secret: String,
    pub purge_token: String,
}

The three long-lived credentials fn0 is given.

Fields

worker_access_key_id: String

Reaches the two object-storage buckets. The only R2 credential published to the worker fleet.

worker_secret: String

SHA-256 of the token, which is what R2 takes as an S3 secret access key. The token value never leaves the user’s machine: the hash is the only form fn0 needs, and unlike the token it cannot be replayed against the REST API.

frontend_asset_access_key_id: String

Reaches the frontend-asset bucket only, and stays in control. Asset GC runs on a schedule and deletes; holding a credential that cannot open a bucket of user data is what keeps a bug in it from being unbounded.

frontend_asset_secret: String

purge_token: String