Problem description
Your request uses an AccessKey ID from an STS temporary credential, but does not include the corresponding security token. OSS cannot verify that STS authentication was intended, and the request fails.
Causes
STS temporary credentials consist of three required fields: an AccessKey ID, an AccessKey secret, and a security token. All three must be present in every request. Omitting the security token causes authentication to fail even when the AccessKey ID and AccessKey secret are correct.
Examples
A signed URL uses an STS AccessKey ID, but the URL does not include the
security-tokenquery parameter.A request uses an STS AccessKey ID in the signature header, but the request headers do not include the
x-oss-security-tokenheader.
Solutions
Follow these steps to send a request with STS temporary credentials.
Step 1: Get temporary credentials from STS
Call the AssumeRole API operation or use an STS SDK to get temporary credentials. The response contains all three required fields:
| Field | Description |
|---|---|
AccessKeyId | Temporary AccessKey ID |
AccessKeySecret | Temporary AccessKey secret |
SecurityToken | Security token — required in every request |
For instructions, see Use temporary credentials provided by STS to access OSS.
Step 2: Include all three credentials in the request
Use an OSS SDK or the RESTful API to send the request, and pass all three credential fields.
Signed URL example
A correctly constructed signed URL includes the security-token parameter:
https://examplebucket.oss-cn-hangzhou.aliyuncs.com/oss-api.pdf?OSSAccessKeyId=STS.****************&Expires=1141889120&Signature=vjby****************************&security-token=CAISowJ1q6Ft5B2yfSjIr5bgIOz31blR9oWmWBfCs3kDR/xm3Imc1zz2IHxMdHJsCeAcs/Q0lGFR5/sflqJIRoReREvCUcZr8szfWcsZos2T1fau5Jko1be0ewHKeQKZsebWZ+LmNpy/Ht6md1HDkAJq3LL+bk/Mdle5MJqP+/kFC9MMRVuAcCZhDtVbLRcYgq18D3bKMuu3ORPHm3fZCFES2jBxkmRi86+ysIP+phPVlw/90fRH5dazcJW0Zsx0OJo6Wcq+3+FqM6DQlTNM6hwNtoUO1fYUommb54nDXwQIvUjfbtC5qIM/cFVLAYEhALNBofTGkvl1h/fejYyfyWwWYbkFCHiPFNr9kJCUSbr4a4sjF6zyPnPWycyCLYXleLzhxPWd/2kagAGaXG69BqwYNvrKKI3W8weP3bNc1wQDMXQfiHpFCRG6lYhh3iXFtpwH90A3sTlxzRGvi8+9p63JwrluOHWs+Fj6S6s0cOhKvKRWYE8UuWeXIvv4l6DAGwHDE8BLjLC11f5prUJgI2wb+3hwuBod32Jx+us/1p996Glao725orcb****Signature header example
For requests that use a signature header, include the x-oss-security-token header alongside the Authorization header.