0002-00000228-Object Storage Service(OSS)-阿里云帮助中心

Problem description

This error occurs when a Signature Version 4 (SigV4) request specifies an invalid region in the Credential parameter of the Authorization header. OSS validates the region as part of the signature binding mechanism, which ties each signature to a specific date, region, and service. A request fails if the region in the signature does not exist or does not match the bucket's actual region.

Causes

This error is triggered when any of the following conditions are met:

The region ID in the Credential parameter is incorrect or unsupported.
The region ID does not exist.
The region in the signature does not match the bucket's actual region.

The Credential parameter in the Authorization header follows this format:

<AccessKeyID>/<Date>/<RegionID>/oss/aliyun_v4_request

Field	Description	Example
`<AccessKeyID>`	Your Alibaba Cloud AccessKey ID	`YourAccessKeyID`
`<Date>`	Request date in `YYYYMMDD` format	`20250601`
`<RegionID>`	The region ID of the bucket	`cn-hangzhou`
`oss`	The service name, always `oss` for OSS requests	`oss`
`aliyun_v4_request`	The signing suffix, always `aliyun_v4_request`	`aliyun_v4_request`

The <RegionID> field must exactly match the region where the bucket is located. This is the most common source of this error.

Examples

Example 1: Invalid region ID

The following request fails because InvalidRegion is not a supported OSS region ID:

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Sun, 01 Jun 2025 16:38:30 GMT
Authorization: OSS4-HMAC-SHA256 Credential=YourAccessKeyID/20250601/InvalidRegion/oss/aliyun_v4_request, SignedHeaders=host;x-amz-date, Signature=YourSignature

Example 2: Mismatched region

The following request fails because the bucket is in cn-hangzhou (China (Hangzhou)), but the Credential parameter specifies cn-beijing (China (Beijing)):

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Sun, 01 Jun 2025 16:38:30 GMT
Authorization: OSS4-HMAC-SHA256 Credential=YourAccessKeyID/20250601/cn-beijing/oss/aliyun_v4_request, SignedHeaders=host;x-amz-date, Signature=YourSignature

Solutions

Find the bucket's region. In the OSS console, go to the bucket overview page. The region is displayed in the Basic Settings section. Note the region ID — for example, cn-hangzhou or cn-beijing. For a full list of region IDs, see Regions and endpoints.
Update the `Credential` parameter. Set the <RegionID> field to the bucket's region ID. Make sure the region ID uses the correct format, such as cn-hangzhou or cn-beijing.

Verify the request. Confirm that the region in the Credential parameter matches the region in the Host header. The following example shows a correctly formed request for a bucket in cn-hangzhou:

   GET /oss.jpg HTTP/1.1
   Host: oss-example.oss-cn-hangzhou.aliyuncs.com
   Date: Sun, 01 Jun 2025 16:38:30 GMT
   Authorization: OSS4-HMAC-SHA256 Credential=YourAccessKeyID/20250601/cn-hangzhou/oss/aliyun_v4_request, SignedHeaders=host;x-amz-date, Signature=YourSignature

In this request, the Credential region (cn-hangzhou) matches the region in the Host header.