URL signature
You can use the signature tool in the Object Storage Service (OSS) console to generate a signed object URL for temporary access. When you generate a signed URL, you can specify the validity period of the URL to limit the period in which visitors can use the URL to access resources.
Usage notes
If the signature obtained from the signature tool is inconsistent with those obtained from OSS SDKs or other tools, you must verify the parameters yourself.
The signature tool does not provide identification and notification for incorrect parameters. In this case, the request signature that is generated may not pass the signature verification.
If you do not specify the required parameters of the signature tool, the signed object URL cannot be generated.
The signature tool supports only V1 signatures.
Procedure
To generate a signature using the signature tool in the OSS console, perform the following steps:
Log on to the OSS console.
In the navigation pane on the left, choose .
On the Signature Tool page, click the URL Signature tab.
In the URL Signing panel, configure the following parameters.
Parameter
Required
Sample value
Description
AccessKeyId
Yes
LTAI********
The AccessKey pair of the account that you want to use to access OSS resources. An AccessKey pair consists of an AccessKey ID and AccessKey secret.
For more information about how to obtain the AccessKey pair of an Alibaba Cloud account or a Resource Access Management (RAM) user, see Create an AccessKey pair.
For more information about how to obtain a temporary AccessKey pair from Security Token Service (STS), see Use temporary credentials provided by STS to access OSS.
AccessKeySecret
Yes
KZo1********
Security-Token
No
CAIS********
This parameter is required only if you use temporary access credentials to access OSS resources. Otherwise, you can leave this parameter empty. For more information about how to obtain a security token, see AssumeRole.
URL
Yes
https://example.oss-cn-hangzhou.aliyuncs.com/test.txt
The URL of the object that you want to access. You can enter multiple URLs at a time. Separate URLs with line feeds.
The object URL is in the following format: <Schema>://<Bucket>.<Endpoint>/<Object>.
Schema: Enter HTTP or HTTPS.
Bucket: enter the name of the bucket that you want to access.
Endpoint: Enter the public or internal endpoint of the region where the bucket is located. For more information, see Regions and endpoints.
Object: The full path of the object in the bucket.
Bucket Name
No
examplebucket
The name of the bucket. Enter the bucket name if a custom domain name is used.
Query Params
No
x-oss-process
Other request parameters. You can select other supported request parameters from the drop-down list of the Query Params parameter. For more information about GetObject, see GetObject.
Validity Period (Seconds)
Yes
3600
Enter the time-to-live (TTL), in seconds, for resource access.
Click Generate Link.
The generated signature link is displayed in the Result Feedback section on the right of the Signature Tool page.