Fix error 02-AUTH0002-00000431: request signature mismatch in OSS-Object Storage Service(OSS)-阿里云帮助中心

Problem description

The request signature does not match.

Cause

The request uses an Amazon S3-compatible V4 signature but includes unsigned x-amz-* headers.

Example

You send a request with an Amazon S3-compatible V4 signature. The request includes x-amz-acl or other x-amz-* headers, but these headers are not listed in the SignedHeaders field of the Authorization header.

Solution

Include all x-amz-* request headers in the SignedHeaders for signature calculation.
Use an OSS SDK to send requests. The SDK handles signing automatically. For more information, see Overview.

If the error persists after you switch to an SDK, follow these troubleshooting steps.
1. Check whether the endpoint is in the correct format.
  
  For the China (Hangzhou) region, the correct endpoint is http://oss-cn-hangzhou.aliyuncs.com. For more information about the endpoints of other regions, see Regions and endpoints.
2. Check whether the AccessKey ID and AccessKey secret are valid.
  
  The AccessKey ID and AccessKey secret cannot start or end with spaces.
3. Make sure that the bucket name and ObjectKey meet the naming conventions.
  - The naming conventions for bucket names are as follows:
    - Bucket names must be globally unique in OSS.
    - The name can contain only lowercase letters, digits, and hyphens (-).
    - The name must start and end with a lowercase letter or a digit.
    - The name must be 3 to 63 characters in length.
  - The naming conventions for object keys are as follows:
    - Use UTF-8 encoding.
    - The length must be from 1 to 1023 bytes.
    - The name cannot start with a forward slash (/) or a backslash (\).
    - The name is case-sensitive.
4. Check the signature method.
  - If you calculate signatures yourself in an environment that supports SDKs, use the signature method provided by the OSS SDK. For more information, see Overview of initiating requests using SDKs.
  - If you calculate signatures yourself in an environment that does not support SDKs, you must write code to calculate signatures and add them to REST API requests. For more information, see Overview.
5. Check whether additional headers are added to the proxy.
Use an Amazon S3-compatible SDK to send requests. For more information, see Access OSS with an AWS SDK.