> ## Documentation Index
> Fetch the complete documentation index at: https://docs.minerva.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Minerva SFTP

> Standard SFTP access to your Minerva data area. Same files as the SDK — reached over SSH from any client.

Minerva's SFTP endpoint gives you a standard file-transfer interface to
the same per-organization data area the [SDK](/sdk/introduction) uses.
Files you upload via SFTP appear in `mc.storage.list(...)`, and anything
Minerva delivers to `Outgoing/` is available via the SDK too — one data
area, two interfaces.

## Connect

| Setting  | Value                                                             |
| -------- | ----------------------------------------------------------------- |
| Host     | `sftp.minerva.io`                                                 |
| Port     | `22`                                                              |
| Protocol | SFTP over SSH v2                                                  |
| Username | any string — not validated (`sftp-user`, your team name, etc.)    |
| Password | your Minerva API key ([same key as the SDK](/sdk/authentication)) |

Quick connect (macOS / Linux):

```bash theme={null}
sftp -o PasswordAuthentication=yes \
     -o PubkeyAuthentication=no \
     sftp-user@sftp.minerva.io
```

Once connected:

```
sftp> ls
Incoming  Outgoing

sftp> put customers.csv Incoming/
sftp> get Outgoing/results.csv
```

## Directory layout

| Folder      | Direction     | Contents                        |
| ----------- | ------------- | ------------------------------- |
| `Incoming/` | You → Minerva | Files you upload for processing |
| `Outgoing/` | Minerva → You | Deliverables placed by Minerva  |

## Client compatibility

All modern SFTP clients connect successfully — this table lists the versions
that negotiate **post-quantum key exchange** (`mlkem768x25519-sha256`). Older
clients still connect over strong classical KEX (Curve25519, ECDH); the only
difference is "store-now-decrypt-later" resistance.

| Client            | Min. version to connect | Post-quantum KEX from  |
| ----------------- | ----------------------- | ---------------------- |
| OpenSSH           | 6.5                     | **9.9+**               |
| FileZilla         | 3.10                    | **3.72+**              |
| WinSCP            | 5.15                    | **6.4+**               |
| Cyberduck         | 7.0                     | *(classical KEX only)* |
| PuTTY / PSFTP     | 0.75                    | *(classical KEX only)* |
| Paramiko (Python) | 2.10                    | *(classical KEX only)* |

## Supported algorithms

Published so you can cross-check your client's supported algorithms
against ours. Server preference order:

**Key exchange**

* `mlkem768x25519-sha256` *(PQ hybrid — typically negotiated with modern clients)*
* `mlkem768nistp256-sha256`
* `mlkem1024nistp384-sha384`
* `ecdh-sha2-nistp256`, `ecdh-sha2-nistp384`, `ecdh-sha2-nistp521`
* `curve25519-sha256`, `curve25519-sha256@libssh.org`
* `diffie-hellman-group18-sha512`, `diffie-hellman-group16-sha512`
* `diffie-hellman-group-exchange-sha256`

**Ciphers**

* `aes128-gcm@openssh.com` *(typically negotiated)*
* `aes256-gcm@openssh.com`
* `aes128-ctr`, `aes192-ctr`, `aes256-ctr`

**MACs** (used with CTR ciphers; GCM has built-in integrity)

* `hmac-sha2-256-etm@openssh.com` *(typically negotiated)*
* `hmac-sha2-512-etm@openssh.com`

**Host key**: RSA-2048

**Not accepted**: SHA-1 MACs, non-ETM MACs, CBC ciphers, 3DES, Blowfish, RC4, SSH v1.

To see what your session negotiated:

```bash theme={null}
ssh -v -o PasswordAuthentication=yes sftp-user@sftp.minerva.io 2>&1 \
  | grep -E 'kex: algorithm|cipher|MAC'
```