Static Credential Mode

static is Crab's default auth provider. In this mode, Crab does not run crab login and does not store long-lived cloud access keys in Crab config. It builds an object-store client from environment variables or the cloud SDK default credential chain.

Use static credentials for local development, CI, S3-compatible stores, and small-team deployments where cloud IAM already controls bucket access.

CLI Credential Order

When you run crab directly in a terminal or from Git, Crab resolves static credentials in this order:

1. Existing process environment variables.
2. .env in the Git repository root.
3. .env or .crab/.env while walking up from the current directory.
4. ~/.config/crab/.env.
5. The cloud SDK default credential chain used by the object-store provider.

Earlier sources win. Crab only fills in missing variables from later .env files, so an explicit shell export overrides project and user-global files.

Common AWS/S3 Variables

For AWS S3 or an S3-compatible service, the usual static setup is:

export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_REGION=us-west-2

For temporary credentials, also set:

export AWS_SESSION_TOKEN=...

For S3-compatible endpoints such as MinIO, R2, or RustFS, set:

export AWS_ENDPOINT_URL=http://localhost:9000
export AWS_ALLOW_HTTP=true

You can also use AWS profiles instead of explicit keys:

export AWS_PROFILE=ml-team

GCS and Azure Variables

For Google Cloud Storage, use Application Default Credentials or a service account JSON file:

gcloud auth application-default login
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json

For Azure Blob Storage, use one of the supported Azure SDK environment shapes:

export AZURE_STORAGE_ACCOUNT_NAME=myaccount
export AZURE_STORAGE_ACCOUNT_KEY=...

or:

export AZURE_STORAGE_CONNECTION_STRING="DefaultEndpointsProtocol=https;..."

Selecting the Storage Provider

crab:// remotes default to S3-compatible storage. To force a provider, set auth.storage_provider or CRAB_STORAGE_PROVIDER:

crab config set auth.storage_provider s3
crab config set auth.storage_provider gcs
crab config set auth.storage_provider azure

or:

export CRAB_STORAGE_PROVIDER=s3

Use auto when the same config should run in different environments and the provider is supplied by environment.

What Crab Stores

Crab repository config stores the remote URL and auth mode, not secret values. Do not put cloud access keys in .crab/config.toml, .crab.toml, Git config, or committed docs.

For static mode, any long-lived secret storage is owned by your shell, .env files, cloud SDK config, CI secret store, or OS credential store. Crab only reads the resolved values at runtime to build the cloud client.

For federated providers such as aws-oidc, gcp-workload-identity, azure-entra, and crab-auth, Crab stores encrypted login tokens under the configured token cache path. Those tokens are separate from static cloud access keys.

Desktop Keychain Boundary

Crab Desktop can store bucket credentials in the OS keychain using account names like:

crab-storage.<bucket>.aws.access_key_id
crab-storage.<bucket>.aws.secret_access_key
crab-storage.<bucket>.aws.region

The direct crab CLI does not query those keychain entries. They are read by the Desktop sidecar. When Desktop launches a Crab subprocess, the sidecar may convert those keychain values into environment variables such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

If AWS variables are already present in the process environment, Desktop leaves them alone and skips the keychain lookup for AWS credentials.

Verifying Credential Resolution

Run:

crab doctor

For static mode, a healthy credential check looks like:

✓ auth                     static (no crab-managed auth)
✓ credentials              bucket 'my-bucket' reachable
✓ credential discovery     AWS_ACCESS_KEY_ID=****

Use crab env to inspect which relevant environment variables are set in the current shell. Avoid pasting raw AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, service account JSON, SAS tokens, or connection strings into logs or bug reports.

Troubleshooting

Related

• Environment Info
• Enterprise Authentication
• AWS OIDC
• Self-Hosted Auth Server