diff --git a/bitbucket/bitbucket.go b/bitbucket/bitbucket.go
index d3471cb..eca2666 100644
--- a/bitbucket/bitbucket.go
+++ b/bitbucket/bitbucket.go
@@ -121,7 +121,7 @@ func Get(conf *types.Conf) ([]types.Repo, bool) {
 					Name:          r.Name,
 					URL:           r.Links["clone"].([]interface{})[0].(map[string]interface{})["href"].(string),
 					SSHURL:        r.Links["clone"].([]interface{})[1].(map[string]interface{})["href"].(string),
-					Token:         "",
+					Token:         repo.Token,
 					Defaultbranch: r.Mainbranch.Name,
 					Origin:        repo,
 					Owner:         user,
@@ -142,7 +142,7 @@ func Get(conf *types.Conf) ([]types.Repo, bool) {
 					Name:          r.Name,
 					URL:           r.Links["clone"].([]interface{})[0].(map[string]interface{})["href"].(string),
 					SSHURL:        r.Links["clone"].([]interface{})[1].(map[string]interface{})["href"].(string),
-					Token:         "",
+					Token:         repo.Token,
 					Defaultbranch: r.Mainbranch.Name,
 					Origin:        repo,
 					Owner:         user,
diff --git a/local/local.go b/local/local.go
index c3718af..5e38a33 100644
--- a/local/local.go
+++ b/local/local.go
@@ -102,7 +102,7 @@ func Locally(repo types.Repo, l types.Local, dry bool) bool {
 			}
 		} else {
 			auth = &http.BasicAuth{
-				Username: "xyz",
+				Username: repo.Origin.User,
 				Password: repo.Token,
 			}
 		}
@@ -528,7 +528,7 @@ func TempClone(repo types.Repo, tempdir string) (*git.Repository, error) {
 			}
 		} else {
 			auth = &http.BasicAuth{
-				Username: "xyz",
+				Username: repo.Origin.User,
 				Password: repo.Token,
 			}
 		}
diff --git a/main.go b/main.go
index 888048f..6dc67c0 100644
--- a/main.go
+++ b/main.go
@@ -237,7 +237,10 @@ func backup(repos []types.Repo, conf *types.Conf) {
 				if err != nil {
 					log.Error().Str("stage", "s3").Str("endpoint", d.Endpoint).Str("bucket", d.Bucket).Msg(err.Error())
 				}
-
+				d.Token, err = d.GetKey(d.Token)
+				if err != nil {
+					log.Error().Str("stage", "s3").Str("endpoint", d.Endpoint).Str("bucket", d.Bucket).Msg(err.Error())
+				}
 				err = s3.UploadDirToS3(tempdir, d)
 				if err != nil {
 					log.Error().Str("stage", "s3").Str("endpoint", d.Endpoint).Str("bucket", d.Bucket).Msg(err.Error())
diff --git a/s3/s3.go b/s3/s3.go
index aa85ba2..2f63998 100644
--- a/s3/s3.go
+++ b/s3/s3.go
@@ -20,7 +20,7 @@ var (
 func UploadDirToS3(directory string, s3repo types.S3Repo) error {
 	// Initialize minio client object.
 	client, err := minio.New(s3repo.Endpoint, &minio.Options{
-		Creds:  credentials.NewStaticV4(s3repo.AccessKey, s3repo.SecretKey, ""),
+		Creds:  credentials.NewStaticV4(s3repo.AccessKey, s3repo.SecretKey, s3repo.Token),
 		Secure: s3repo.UseSSL,
 		Region: s3repo.Region,
 	})
@@ -69,7 +69,7 @@ func DeleteObjectsNotInRepo(directory, bucketdir string, s3repo types.S3Repo) er
 	sub = logger.CreateSubLogger("stage", "s3", "endpoint", s3repo.Endpoint, "bucket", s3repo.Bucket)
 	// Initialize minio client object.
 	client, err := minio.New(s3repo.Endpoint, &minio.Options{
-		Creds:  credentials.NewStaticV4(s3repo.AccessKey, s3repo.SecretKey, ""),
+		Creds:  credentials.NewStaticV4(s3repo.AccessKey, s3repo.SecretKey, s3repo.Token),
 		Secure: s3repo.UseSSL,
 		Region: s3repo.Region,
 	})
diff --git a/types/types.go b/types/types.go
index e2cd2e8..fefb75d 100644
--- a/types/types.go
+++ b/types/types.go
@@ -539,6 +539,7 @@ type S3Repo struct {
 	Endpoint   string `yaml:"endpoint"`
 	AccessKey  string `yaml:"accesskey"`
 	SecretKey  string `yaml:"secretkey"`
+	Token      string `yaml:"token"`
 	Region     string `yaml:"region"`
 	UseSSL     bool   `yaml:"usessl"`
 	Structured bool   `yaml:"structured"`