mc admin accesskey

Server 20261018 authorization change: Self inspection/cleanup must respect explicit denies, session restrictions and authorization-plugin decisions. Built-in authorization rejects service-account creation/update by restricted derived credentials and protects root-derived credentials. Ordinary users retain established self rights; bulk self aliases resolve to the parent. No new action or storage migration is required. Review the Admin authorization contract and SN-2026-017. Older client command names do not change Server authorization rules.

These commands replace the MinIO IDP functionality of the mc admin user svcacct command and its subcommands.

Description

The mc admin accesskey command and its subcommands create and manage Access Keys for internally managed users on a MinIO deployment.

Each access key is linked to a user identity and inherits the policies attached to its parent user or those groups in which the parent user has membership. Each access key also supports an optional inline policy which further restricts access to a subset of actions and resources available to the parent user.

mc admin user svcacct only supports creating access keys for MinIO-managed accounts.

To create access keys for Active Directory/LDAP-managed accounts, use mc idp ldap accesskey and its subcommands. To manage access keys for OpenID Connect-managed users, log into the MinIO Console and generate the access keys through the UI.

mc admin accesskey command has the following subcommands: