Problem description
The Authorization request header contains an invalid format.
Causes
The request uses the V2 signature, but the Authorization header is malformed. The header contains an unrecognized key in the signature information field.
Examples
The following request triggers this error. The Authorization header includes an unrecognized key-value pair (UnknownKey:ABC):
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS2 AccessKeyId:44**07,Signature:n7I**I0=,UnknownKey:ABCThe Authorization header uses the following structure:
Authorization: <signature_version> <signature_information>| Component | Description |
|---|---|
| Signature version | Must be OSS2. No other value is accepted. |
| Signature information | Comma-separated key-value pairs in key:value format. |
The signature information supports only these keys:
| Key | Required | Description |
|---|---|---|
AccessKeyId | Yes | Your AccessKey ID. |
Signature | Yes | The computed signature string. |
AdditionalHeaders | No | An optional field for additional signed headers. For example: host. |
Any key outside this set causes the error.
Solutions
Fix the Authorization header so it conforms to the V2 signature format. Remove any unrecognized key-value pairs. Example:
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS2 AccessKeyId:44**07,AdditionalHeaders:host,Signature:n7I**I0=Formatting rules:
Separate the signature version from the signature information with a single space.
Separate key-value pairs with commas (
,).Separate keys from values with colons (
:).Only
AccessKeyId,Signature, andAdditionalHeadersare valid keys.
If you cannot identify the cause, compare the StringToSign value the server used with the string you computed before signing. A mismatch indicates where the signature construction diverged. The server returns StringToSign in the error response when it is available.
References
SDK (recommended): Overview — use Alibaba Cloud SDKs to sign requests without constructing the
Authorizationheader manually.Self-signed — V2 signature calculation: OSS SDK for Python auth.py
Self-signed — V2 signature specification: Overview