What causes "access-key not set." in dutchcoders/transfer.sh?

Add --aws-access-key to the command line next to --provider s3

access-key not set.

Error message

access-key not set.

What it means

Thrown by the transfer.sh CLI when --provider s3 is selected but the --aws-access-key flag is empty. S3 storage requires credentials to sign requests, and the startup code validates all mandatory S3 flags (access key, secret key, bucket) in order before constructing the storage backend. The command exits immediately with this validation error instead of starting the server.

Source

Thrown at cmd/cmd.go:488

		if ipWhitelist := c.String("ip-whitelist"); ipWhitelist != "" {
			applyIPFilter = true
			ipFilterOptions.AllowedIPs = strings.Split(ipWhitelist, ",")
			ipFilterOptions.BlockByDefault = true
		}

		if ipBlacklist := c.String("ip-blacklist"); ipBlacklist != "" {
			applyIPFilter = true
			ipFilterOptions.BlockedIPs = strings.Split(ipBlacklist, ",")
		}

		if applyIPFilter {
			options = append(options, server.FilterOptions(ipFilterOptions))
		}

		switch provider := c.String("provider"); provider {
		case "s3":
			if accessKey := c.String("aws-access-key"); accessKey == "" {
				return errors.New("access-key not set.")
			} else if secretKey := c.String("aws-secret-key"); secretKey == "" {
				return errors.New("secret-key not set.")
			} else if bucket := c.String("bucket"); bucket == "" {
				return errors.New("bucket not set.")
			} else if store, err := storage.NewS3Storage(c.Context, accessKey, secretKey, bucket, purgeDays, c.String("s3-region"), c.String("s3-endpoint"), c.Bool("s3-no-multipart"), c.Bool("s3-path-style"), logger); err != nil {
				return err
			} else {
				options = append(options, server.UseStorage(store))
			}
		case "gdrive":
			chunkSize := c.Int("gdrive-chunk-size") * 1024 * 1024

			if clientJSONFilepath := c.String("gdrive-client-json-filepath"); clientJSONFilepath == "" {
				return errors.New("gdrive-client-json-filepath not set.")
			} else if localConfigPath := c.String("gdrive-local-config-path"); localConfigPath == "" {
				return errors.New("gdrive-local-config-path not set.")
			} else if basedir := c.String("basedir"); basedir == "" {
				return errors.New("basedir not set.")

View on GitHub (pinned to c37bfd9579)

Solutions

Add --aws-access-key <your-key> to the command line next to --provider s3
Also provide --aws-secret-key and --bucket since they are validated next and will fail with their own errors
If using env vars, export them explicitly into the flags or wrapper script (e.g. --aws-access-key "$AWS_ACCESS_KEY_ID")
Check the actual process arguments (ps, Docker inspect, systemd ExecStart) to confirm the flag is present and not empty due to shell quoting

Example fix

// before
transfer.sh --provider s3 --aws-secret-key secret --bucket uploads
// after
transfer.sh --provider s3 --aws-access-key AKIAXXXXXXXX --aws-secret-key secret --bucket uploads

Defensive patterns

Strategy: validation

Validate before calling

# verify required S3 flags before launch
: "${AWS_ACCESS_KEY_ID:?aws access key required}"
args+=(--aws-access-key "$AWS_ACCESS_KEY_ID")

Try / catch

if err := cmd.Root.Execute(); err != nil {
  if strings.Contains(err.Error(), "access-key not set") {
    log.Fatalf("S3 provider selected but --aws-access-key is missing")
  }
  os.Exit(1)
}

Prevention

When using --provider s3, always set access key, secret key, and bucket together
Inject credentials from a secret manager into the process args at startup
Lint deployment manifests for the presence of all three s3 flags

When it happens

Trigger: Running with --provider s3 but no --aws-access-key value — omitted from the command line, missing in the systemd unit/Dockerfile, or supplied via an environment variable (e.g. AWS_ACCESS_KEY_ID) that the CLI does not consult.

Common situations: Container deployments where AWS env vars are present so the operator assumed credentials were configured; shared config snippets where the access-key line was removed for a gist; rotating credentials where the new key was never added to the service config.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

Related errors

AI-assisted analysis of dutchcoders/transfer.sh@c37bfd9579 (2026-09-05). Data as JSON: /api/errors/27e6672101f13803. Report an issue: GitHub.