The AccessKeyId field in the x-oss-credential query parameter contains an invalid value.
Problem description
The value of the AccessKeyId field in the x-oss-credential parameter is invalid.
Causes
When using V4 signature (OSS4-HMAC-SHA256), the x-oss-credential parameter must follow a strict format. If the AccessKeyId field contains invalid characters or is malformed, OSS rejects the request with this error.
Examples
The following request fails because \rabc is not a valid AccessKeyId — it contains the invalid character \r:
GET /oss.jpg?x-oss-signature-verion=OSS4-HMAC-SHA256&x-oss-credential=\rabc/20221220/cn-hangzhou/oss/aliyun_v4_request&x-oss-expires=1141889120&x-oss-additional-headers=host&x-oss-signature=8u**a3 HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMTThe query parameters in a V4 presigned URL are:
| Parameter | Description |
|---|---|
x-oss-signature-verion | The signing algorithm. Must be OSS4-HMAC-SHA256. |
x-oss-credential | The credential string. Contains your AccessKeyId, signing date, region, service, and request type. |
x-oss-expires | How long the presigned URL remains valid. |
x-oss-additional-headers | (Optional) Additional request headers included in the signature. |
x-oss-signature | The computed V4 signature. |
Solutions
Construct x-oss-credential using this format:
<AccessKeyId>/<SignDate>/<Region>/oss/aliyun_v4_request| Field | Description | Example |
|---|---|---|
AccessKeyId | Your Alibaba Cloud AccessKey ID. | LTAI**************** |
SignDate | The signing date in YYYYMMDD format. | 20221220 |
Region | The region ID of the OSS bucket. | cn-hangzhou |
oss | Fixed value. Always oss. | oss |
aliyun_v4_request | Fixed value. Always aliyun_v4_request. | aliyun_v4_request |
The following request uses a valid credential string:
GET /oss.jpg?x-oss-signature-verion=OSS4-HMAC-SHA256&x-oss-credential=LTAI****************/20221220/cn-hangzhou/oss/aliyun_v4_request&x-oss-expires=1141889120&x-oss-additional-headers=host&x-oss-signature=8u**a3 HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMTThex-oss-additional-headersparameter is optional. Includex-oss-signature-verion,x-oss-credential,x-oss-expires, andx-oss-signaturein every V4 presigned URL.
If the server returns a StringToSign value in its error response, check whether the value of the StringToSign parameter on the server is the same as the string before calculation.