Problem description
The Authorization header in the request has an invalid format.
Causes
The request uses V4 signature, but the Authorization header is missing required fields or has an incorrect format.
Examples
The following request uses V4 signature, but the Authorization header is invalid — only the Signature field is present. The required Credential field is missing.
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Signature=18**0a
x-oss-content-sha256: UNSIGNED-PAYLOADThe Authorization header consists of two parts separated by a space: the signature version, followed by the signature information.
| Component | Required | Format | Description |
|---|---|---|---|
OSS4-HMAC-SHA256 | Yes | Fixed string | The only supported signature version. |
Credential | Yes | <access-key-id>/<date>/<region>/oss/aliyun_v4_request | The access key ID and signing scope. |
AdditionalHeaders | No | Header names | Lists additional headers included in the signature. |
Signature | Yes | Hex string | The computed HMAC-SHA256 signature. |
The signature information fields (Credential, AdditionalHeaders, Signature) are key-value pairs joined by = and separated by ,. The header must include two or three key-value pairs — Credential and Signature are required; AdditionalHeaders is optional.
Solutions
Include all required fields in the correct format:
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Credential=AK**ID/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host,Signature=18**0a
x-oss-content-sha256: UNSIGNED-PAYLOADIf the header format is correct but the error persists, check whether the StringToSign value you computed matches what the server used. If the server returns a response that contains the StringToSign parameter, compare it with the string before calculation.