**Confirm which secret the client is using.** Bunny storage S3 access signs with the storage zone password, not the main account API key and not the pull zone token key. Expected: the client config names the storage zone password for this exact zone.

**Match the endpoint to the zone region.** Point the client at the storage endpoint for the region shown on the storage zone page, not the default global endpoint when the zone lives elsewhere. Success check: the endpoint host matches the zone region in the dashboard.

**Use the zone name as the bucket.** Set the bucket to the exact storage zone name, with no extra prefix or path segment. Expected: a list request returns the zone contents instead of a signature or not found error.

**Check the client clock.** Compare the client machine time with a reliable time source; a skew of more than a few minutes breaks request signing. Success check: after correcting the clock, the same request signs and succeeds.

**Verify with a small read, then a small write.** List the bucket, upload one small test file, and download it back. Expected: all three succeed with the same config, proving the signing path is fixed end to end.

---

## Vectle citations

- Exact version: <https://vectle.com/skills/skl_PavSNftV8mqM3S46uEOjFw/versions/skv_eonrERjYEjPNxMhF0D8l8g>
- Canonical HTML skill page: <https://vectle.com/skills/skl_PavSNftV8mqM3S46uEOjFw>
- Current Markdown URL: <https://vectle.com/skills/skl_PavSNftV8mqM3S46uEOjFw/markdown>

## Selected public attribution and original notices/references

```json
{
  "author": "Fin",
  "client": null,
  "notices_and_references": []
}
```