How to configure access credentials for the C++ SDK-Object Storage Service(OSS)-阿里云帮助中心

To send Object Storage Service (OSS) requests with the C++ SDK, you must configure access credentials for identity authentication. Choose a credential type based on your security and authorization requirements. Both temporary and long-term credentials are supported.

Prerequisites

Before you can configure access credentials, you must install the OSS C++ SDK. For more information, see Installation (C++ SDK).

Initialize a credential provider

Select a credential provider

OSS supports multiple ways to initialize a credential provider. Choose a method based on your authentication and authorization requirements.

Credential provider initialization method	Scenarios	Requires a pre-configured AccessKey pair or STS token?	Underlying credential type	Credential validity	Credential rotation or refresh method
Method 1: Use an AccessKey pair	Applications that run in a secure, stable environment and require long-term access without frequent credential rotation.	Yes	AccessKey pair	Long-term	Manual rotation
Method 2: Use an STS token	Applications that run in an untrusted environment and require fine-grained control over access duration and permissions.	Yes	STS token	Temporary	Manual refresh
Method 3: Use custom access credentials	When the preceding methods do not meet your requirements, you can define a custom method to obtain credentials.	Custom	Custom	Custom	Custom

Method 1: Use an AccessKey pair

If your application runs in a secure, stable environment and requires long-term access to OSS without frequent credential rotation, you can use the AccessKey pair (AccessKey ID and AccessKey Secret) of an Alibaba Cloud account or a RAM user to initialize the credential provider. This method requires you to manually maintain an AccessKey pair, which poses security risks and increases maintenance complexity. For information about how to obtain an AccessKey pair, see CreateAccessKey.

Environment variables

Warning

An Alibaba Cloud account has full permissions on all resources. A leaked AccessKey pair poses significant security risks. We recommend that you use the AccessKey pair of a RAM user with the minimum required permissions instead.

Set environment variables using the AccessKey pair.

Mac OS X/Linux/Unix

export OSS_ACCESS_KEY_ID=<ALIBABA_CLOUD_ACCESS_KEY_ID>
export OSS_ACCESS_KEY_SECRET=<ALIBABA_CLOUD_ACCESS_KEY_SECRET>

Windows

set OSS_ACCESS_KEY_ID=<ALIBABA_CLOUD_ACCESS_KEY_ID>
set OSS_ACCESS_KEY_SECRET=<ALIBABA_CLOUD_ACCESS_KEY_SECRET>

Pass the credential information using the environment variables.

auto credentialsProvider = std::make_shared<EnvironmentVariableCredentialsProvider>();
OssClient client(Endpoint, credentialsProvider, conf);

Static credentials

You can reference credentials through variables in your code. At runtime, these variables are populated from environment variables, configuration files, or other external sources.

After you configure the credential information, use the following sample code to pass the information.

std::string accessKeyId = std::getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
std::string accessKeySecret = std::getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");

auto credentialsProvider = std::make_shared<SimpleCredentialsProvider>(accessKeyId, accessKeySecret, "");
OssClient client(Endpoint, credentialsProvider, conf);

Method 2: Use an STS token

If your application requires temporary access to OSS, you can use temporary identity credentials (AccessKey ID, AccessKey Secret, and a security token) obtained from Security Token Service (STS) to initialize the credential provider. This method requires you to manually maintain and refresh the STS token, which poses security risks and increases maintenance complexity. For information about how to obtain an STS token, see AssumeRole.

Set environment variables using the temporary identity credentials.

Mac OS X/Linux/Unix

export OSS_ACCESS_KEY_ID=<ALIBABA_CLOUD_ACCESS_KEY_ID>
export OSS_ACCESS_KEY_SECRET=<ALIBABA_CLOUD_ACCESS_KEY_SECRET>
export OSS_SESSION_TOKEN=<ALIBABA_CLOUD_SECURITY_TOKEN>

Windows

set OSS_ACCESS_KEY_ID=<ALIBABA_CLOUD_ACCESS_KEY_ID>
set OSS_ACCESS_KEY_SECRET=<ALIBABA_CLOUD_ACCESS_KEY_SECRET>
set OSS_SESSION_TOKEN=<ALIBABA_CLOUD_SECURITY_TOKEN>

Pass the credential information using the environment variables.

auto credentialsProvider = std::make_shared<EnvironmentVariableCredentialsProvider>();
OssClient client(Endpoint, credentialsProvider, conf);

Method 3: Use custom access credentials

If the preceding methods do not meet your requirements, implement the `Credential Providers` interface to define a custom credential provider.

#include <alibabacloud/oss/OssClient.h>
using namespace AlibabaCloud::OSS;

class CustomCredentialsProvider : public CredentialsProvider
{
public:
    CustomCredentialsProvider()
    {
    }
    ~CustomCredentialsProvider()
    {
    }

    Credentials getCredentials() override
    {
        std::string accessKeyId;
        std::string accessKeySecret;
        //std::string token;

        //TODO
        // Custom method to obtain access credentials.

         // Return long-term credentials: accessKeyId, accessKeySecret
        auto cred = Credentials(accessKeyId, accessKeySecret, "");

        // Return temporary credentials: accessKeyId, accessKeySecret, token
        // For temporary credentials, you must refresh them based on their expiration time.        
        // auto cred = Credentials(accessKeyId, accessKeySecret, token);
        
        return cred;
    }
private:
};


ClientConfiguration conf;
auto credentialsProvider = std::make_shared<CustomCredentialsProvider>();
OssClient client(Endpoint, credentialsProvider, conf);

What to do next

After you configure access credentials, initialize the `OssClient`. For more information, see Initialization (C++ SDK).