Can't properly set auth-key from rclone rc serve/start call

What is the problem you are having with rclone?

Trying to use rclone rc serve/start to setup an authenticated s3 server by setting the auth_key value which comparing the response from the rclone serve s3 … call and the rclone rc serve/start call from the rcd command logs I can’t see its incorrectly parsing the auth-key as 2 different pairs rather than the single pair the serve s3 needs. I tried via json and via the cli I was unable to make it work. I tried so many different shapes I’m out of ideas. from wrapping in [“foobar,example”] to backslash to try and escape the comma to replacing the comma with a space to placing extra commas to using _config options. could not get it to accept the passed auth-key pair and so it always created the s3 serve without authentication… I know authentication works properly because the rclone serve s3… call implements authentication ok so its something else. likely just don’t know how to encode the auth-key to the rcd server. please advise.

Run the command 'rclone version' and share the full output of the command.

➜ rclone --version
rclone v1.72.1

  • os/version: darwin 26.2 (64 bit)
  • os/kernel: 25.2.0 (arm64)
  • os/type: darwin
  • os/arch: arm64 (ARMv8 compatible)
  • go/version: go1.25.5
  • go/linking: dynamic
  • go/tags: none
    ~

Which cloud storage system are you using? (eg Google Drive)

pcloud

The command you were trying to run (eg rclone copy /tmp remote:tmp)

rclone serve s3 --auth-key "foobar-example" pcloud:
rclone rcd --rc-no-auth --rc-serve -vv
rclone rc serve/start type=s3 fs=pcloud: addr=:4321 auth_key=foobar,example

The rclone config contents with secrets removed.

it happens with any remote...

A log from the command with the -vv flag

➜ rclone rcd --rc-no-auth --rc-serve -vv
2026/01/04 00:03:22 DEBUG : rclone: Version "v1.72.1" starting with parameters ["rclone" "rcd" "--rc-no-auth" "--rc-serve" "-vv"]
2026/01/04 00:03:22 NOTICE: Serving remote control on http://127.0.0.1:5572/
2026/01/04 00:03:44 DEBUG : rc: "serve/start": with parameters map[addr:127.0.0.1:8876 auth_key:foobar,example fs:pcloud: type:s3]
2026/01/04 00:03:44 DEBUG : Creating backend with remote "pcloud:"
2026/01/04 00:03:44 DEBUG : Using config file from "/Users/blainemiller/.config/rclone/rclone.conf"
2026/01/04 00:03:44 DEBUG : pcloud root '': Using hash md5 for ETag
2026/01/04 00:03:44 INFO  : Ignored: invalid auth pair foobar
2026/01/04 00:03:44 INFO  : Ignored: invalid auth pair example
2026/01/04 00:03:44 INFO  : pcloud root '': poll-interval is not supported by this remote
2026/01/04 00:03:44 NOTICE: pcloud root '': --vfs-cache-mode writes or full is recommended for this remote as it can't stream
2026/01/04 00:03:44 INFO  : Ignored: invalid auth pair foobar
2026/01/04 00:03:44 INFO  : Ignored: invalid auth pair example
2026/01/04 00:03:44 NOTICE: pcloud root '': Starting s3 server on [http://127.0.0.1:8876/]
2026/01/04 00:03:45 DEBUG : pcloud root '': Started serve s3 on 127.0.0.1:8876
2026/01/04 00:03:45 DEBUG : rc: "serve/start": reply map[addr:127.0.0.1:8876 id:s3-ca12f58c]: <nil>
2026/01/04 00:05:34 DEBUG : rc: "serve/start": with parameters map[addr::4321 auth_key:foobar,example fs:pcloud: type:s3]
2026/01/04 00:05:34 DEBUG : pcloud root '': Using hash md5 for ETag
2026/01/04 00:05:34 INFO  : Ignored: invalid auth pair foobar
2026/01/04 00:05:34 INFO  : Ignored: invalid auth pair example
2026/01/04 00:05:34 DEBUG : pcloud root '': Reusing VFS from active cache
2026/01/04 00:05:34 INFO  : Ignored: invalid auth pair foobar
2026/01/04 00:05:34 INFO  : Ignored: invalid auth pair example
2026/01/04 00:05:34 NOTICE: pcloud root '': Starting s3 server on [http://[::]:4321/]
2026/01/04 00:05:34 DEBUG : pcloud root '': Started serve s3 on [::]:4321
2026/01/04 00:05:34 DEBUG : rc: "serve/start": reply map[addr:[::]:4321 id:s3-5926a258]: <nil>

I can’t edit it but there was a typo in the rclone serve s3 command that worked, corrected it below:

rclone serve s3 --auth-key "foobar,example" pcloud:

still can’t seem to set the auth key pair values from an rc serve/start call though.