Problem description
The signature in the request does not match the signature calculated by OSS when using an Amazon S3-compatible Signature Version 2 request.
Causes
The request uses an Amazon S3-compatible V2 signature, but the signature in the request does not match the signature calculated by OSS.
Examples
The following request uses Signature Version 2 with an incorrect signature value:
GET /test.txt?AWSAccessKeyId=nz2p****&Expires=1141889120&Signature=WrongSignature HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
x-oss-s3-compat: trueSolutions
Use an SDK to avoid manual signing
The fastest fix is to let an SDK handle signature generation automatically:
Alibaba Cloud SDKs: generate OSS-native signatures automatically. See Overview.
Amazon S3 SDKs: supported for S3-compatible access to OSS. See Use Amazon S3 SDKs to access OSS.
If you are already using an SDK and still see this error, work through the checklist below.
Diagnose and fix the mismatch
Check each item in order until the error is resolved.
1. Verify the endpoint format
The endpoint must follow the pattern http://oss-<region-id>.aliyuncs.com. For the China (Hangzhou) region, the correct endpoint is:
http://oss-cn-hangzhou.aliyuncs.comFor endpoints in other regions, see Regions and endpoints.
2. Check your credentials
Your AccessKey ID and AccessKey secret must not start or end with a space. Copy them directly from the Alibaba Cloud console and confirm there are no leading or trailing whitespace characters.
3. Confirm bucket and object naming
Naming violations cause requests to fail signature verification. Check that your names meet these requirements:
*Bucket naming:*
Unique across OSS
Contains only lowercase letters, digits, and hyphens (-)
Starts and ends with a lowercase letter or a digit
Between 3 and 63 characters long
*Object naming:*
Encoded in UTF-8
Between 1 and 1,023 bytes long
Does not start with a forward slash (/) or a backslash (\\)
Case-sensitive
4. Review your signing implementation
If you are signing requests manually:
If your environment supports OSS SDKs, switch to the SDK signing method. See Overview.
If your environment does not support OSS SDKs, write code to calculate and attach signatures to REST API requests. See Overview.
5. Check for proxy-added headers
If requests pass through a proxy server, check whether the proxy is injecting additional headers. Extra headers change the string-to-sign and cause the recalculated signature to differ from the one in the request.