fix: pass PGTHUMBOR_S3_ACCESS_KEY/SECRET_KEY credentials to boto3

Without explicit credentials, boto3 only uses its default chain
(AWS_ACCESS_KEY_ID etc.), ignoring the pgthumbor-specific env vars.
Fixes #2.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jensens

CHANGES.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.4.2 (2026-04-02)
+
+- Fix: S3 loader now reads `PGTHUMBOR_S3_ACCESS_KEY` and `PGTHUMBOR_S3_SECRET_KEY`
+  env vars and passes them to boto3. Previously credentials were only picked up
+  via boto3's default chain (`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`).
+  Fixes [#2](https://github.com/bluedynamics/zodb-pgjsonb-thumborblobloader/issues/2).
+
 ## 0.4.1 (2026-04-02)
 
 - Fix: Docker image missing `boto3` — S3 blob loading failed with

README.md

@@ -97,6 +97,8 @@ The image is automatically rebuilt weekly when a new Thumbor version appears on
 | `PGTHUMBOR_S3_BUCKET` | `""` | S3 bucket for blob fallback (empty = disabled) |
 | `PGTHUMBOR_S3_REGION` | `us-east-1` | S3 region |
 | `PGTHUMBOR_S3_ENDPOINT` | `""` | S3 endpoint for MinIO/Ceph (empty = AWS) |
+| `PGTHUMBOR_S3_ACCESS_KEY` | `""` | S3 access key (empty = boto3 default chain) |
+| `PGTHUMBOR_S3_SECRET_KEY` | `""` | S3 secret key (empty = boto3 default chain) |
 | `THUMBOR_AUTO_WEBP` | `"true"` | Auto-convert to WebP when browser supports it |
 | `THUMBOR_AUTO_AVIF` | `"false"` | Auto-convert to AVIF when browser supports it |
 | `THUMBOR_DETECTORS` | `""` | Comma-separated Thumbor detector modules for `/smart/` URLs (empty = disabled) |

src/zodb_pgjsonb_thumborblobloader/s3.py

@@ -10,6 +10,7 @@
 
 import asyncio
 import logging
+import os
 
 
 logger = logging.getLogger(__name__)
@@ -30,6 +31,11 @@ def _get_s3_client(bucket: str, region: str, endpoint: str = ""):
     kwargs: dict = {"region_name": region}
     if endpoint:
         kwargs["endpoint_url"] = endpoint
+    access_key = os.environ.get("PGTHUMBOR_S3_ACCESS_KEY", "")
+    secret_key = os.environ.get("PGTHUMBOR_S3_SECRET_KEY", "")
+    if access_key and secret_key:
+        kwargs["aws_access_key_id"] = access_key
+        kwargs["aws_secret_access_key"] = secret_key
     _s3_client = boto3.client("s3", **kwargs)
     _s3_config = key
     return _s3_client