DigitalOcean Spaces is S3-compatible storage with a monthly allowance of storage and outbound transfer included. If you already host on DigitalOcean, it’s a natural fit for Dropbucket. Check DigitalOcean’s pricing page for the current allowance and overage rates.

Spaces needs one extra step compared with other providers: its CORS rule has to expose the ETag header, and the control panel’s CORS form can’t do that. This guide shows two easy ways around it.

Allow about fifteen minutes.

What you need

  • A DigitalOcean account.
  • A Dropbucket account. The free plan works with Spaces.

Step 1: Create a Spaces bucket

  1. In the DigitalOcean control panel, open Spaces Object Storage and create a new bucket.
  2. Pick a datacenter region close to you and your clients, for example Sydney (syd1). Note the region code.
  3. Enter a name. Use lowercase letters, numbers and dashes, for example agency-transfers. Dropbucket won’t accept capitals or underscores.
  4. Leave file listing restricted. Dropbucket uses short-lived signed links, so the bucket never needs public access.
  5. Create the bucket.

Your endpoint is the region code in this pattern:

https://<REGION>.digitaloceanspaces.com

For Sydney that’s https://syd1.digitaloceanspaces.com. Don’t put the bucket name in the endpoint.

Step 2: Set the CORS rule

Files travel from your client’s browser straight into Spaces. The browser only allows that if the bucket has a CORS rule that permits Dropbucket’s pages. Dropbucket also needs the bucket to expose the ETag header, because it reads it after every chunk of a large upload.

Here’s the catch. A Limited access key (the safe kind, scoped to one bucket) can’t change bucket settings, so Dropbucket can’t set the rule for you with it. And the control panel’s CORS form has no field for exposed headers. Use one of these options instead.

Option A: connect once with a Full access key, then swap

This needs no command line.

  1. In Spaces Object Storage, open the Access Keys tab and click Create Access Key.
  2. Choose Full access, name it dropbucket-setup and create it. Copy the Access Key ID and Secret Key.
  3. Connect it in Dropbucket as in Step 4 below and press Test and save. Dropbucket adds its CORS rule to the bucket.
  4. Then create the limited key in Step 3, enter it in Dropbucket and press Test and save again. The CORS rule stays in place.
  5. Back in DigitalOcean, delete the dropbucket-setup key.

Option B: set it from the command line

If you use the AWS CLI, you can apply the rule with any key that has full access. Save this as cors.json:

{
  "CORSRules": [
    {
      "AllowedOrigins": [
        "https://app.dropbucket.io"
      ],
      "AllowedMethods": [
        "GET",
        "PUT",
        "HEAD"
      ],
      "AllowedHeaders": [
        "*"
      ],
      "ExposeHeaders": [
        "ETag"
      ],
      "MaxAgeSeconds": 3600
    }
  ]
}

Then run, with your own region and bucket name:

aws s3api put-bucket-cors --bucket agency-transfers --cors-configuration file://cors.json --endpoint-url https://syd1.digitaloceanspaces.com

This is the same rule Dropbucket shows on its Storage page, wrapped in "CORSRules" because the AWS CLI expects it that way. DigitalOcean’s docs also describe an XML version for s3cmd setcors if you prefer that tool.

If you use your own domain for download and upload pages, add it as a second origin, such as "https://files.youragency.com". See Put your download pages on your own domain. With Option A, Dropbucket adds verified domains for you, but only while a key that can change CORS is connected.

Step 3: Create a limited access key

  1. In Spaces Object Storage, open the Access Keys tab and click Create Access Key.
  2. Under Select access scope, choose Limited access.
  3. Tick your bucket and set its Permissions to Read/Write/Delete.
  4. Name the key, for example dropbucket, and click Create Access Key.

Copy the Access Key ID and Secret Key. DigitalOcean shows the secret once only.

The exact menu may differ slightly as DigitalOcean updates its control panel.

Step 4: Connect Spaces in Dropbucket

  1. In Dropbucket, go to Settings → Storage.
  2. Under Provider, choose DigitalOcean Spaces.
  3. Endpoint: your region’s endpoint, for example https://syd1.digitaloceanspaces.com.
  4. Bucket: the bucket name.
  5. Region: the region code, for example syd1.
  6. Access key ID and Secret access key: from Step 3 (or the setup key, if you’re doing Option A).
  7. Folder inside the bucket (optional): leave blank, or enter a folder name like client-files.
  8. Leave Path-style URLs unticked. That’s the right setting for Spaces.

Test the connection

Press Test and save.

Dropbucket writes a tiny test file, reads it back and deletes it. When that works, the Status card shows a tick next to Keys work. It then tries to set the CORS rule and runs a real upload from your browser.

With a limited key you’ll see “We couldn’t set this automatically on your provider.” That’s expected. If the rule from Step 2 is in place, Browser uploads allowed (CORS) still ticks over. If not, wait a minute and press Check again.

Troubleshooting

“The storage provider refused these keys.” Check the key and secret were copied in full. Check the limited key includes this bucket with Read/Write/Delete, not Read.

“That bucket was not found at this endpoint.” The endpoint is for a different region, or the bucket name is in the endpoint. Use https://<REGION>.digitaloceanspaces.com only.

“Endpoint should be just the address, with no path.” Remove anything after .com.

Keys work, but the CORS check fails. The rule isn’t on the bucket yet, or the origin has a typo. It must be exactly https://app.dropbucket.io, with no trailing slash.

“Your storage didn’t return an ETag.” The bucket has a CORS rule from the control panel form, which doesn’t expose ETag. Replace it using Option A or B.

Uploads fail with 403. Usually CORS. If CORS passes, check the key hasn’t been deleted.

Path-style. Spaces works with Path-style URLs unticked. If you ticked it and see errors, untick it.

Next steps

Add your logo under Settings → Branding, then send a transfer or create a request link so clients can upload straight into Spaces.

Ready to try it? Create a free Dropbucket account and connect your bucket.