AWS

Create an AWS key with an endpoint (such as s3.us-east-1.amazonaws.com), a region and a signing name (s3, dynamodb, bedrock…). Paste the real key as ACCESS_KEY_ID:SECRET_ACCESS_KEY. In your app, use the ghost key as the access key id and any text as the secret: Vallkey throws away your app's signature and signs the request again with the real credentials.

1const s3 = new S3Client({2  region: 'us-east-1',3  endpoint: 'https://api.vallkey.com',4  forcePathStyle: true,5  credentials: { accessKeyId: process.env.AWS_GHOST_KEY, secretAccessKey: 'vallkey' },6});

Endpoints must be AWS hostnames. Presigned URLs and chunk-signed uploads are refused. Many AWS services put the action in a header rather than the path, so also limit the real key with an IAM policy: Vallkey adds the kill switch, rate limits and alerts on top.

Services such as DynamoDB, SQS, SNS and STS send every request to the root path. For those, allow POST / in the key's rules; /** covers every path below the root, not the root itself.