Problem description
The signature in your request includes access address restrictions but does not match the signature calculated by Object Storage Service (OSS).
Causes
This error has two distinct causes:
Wrong IP address: The request was not sent from the IP address segment specified in the signature.
Incorrect signature: The signature was calculated incorrectly.
Identify which cause applies before following the troubleshooting steps below.
Examples
The following request triggers this error when sent from an IP address outside the allowed subnet, or when the signature value is wrong:
GET /oss.jpg?x-oss-ac-forward-allow=true&Expires=1647730289&x-oss-ac-subnet-mask=32&Signature=d38L***&OSSAccessKeyId=u8r***n6m HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMTSolutions
Fix IP address issues
Confirm that the request originates from the IP address segment embedded in the signature. If the client IP is outside that range, either update the allowed IP segment in the signature or send the request from an allowed address.
Fix signature calculation issues
Use Alibaba Cloud SDKs to generate signatures automatically. SDKs handle signature calculation without manual implementation. See Overview for SDK options.
If the error persists after switching to an SDK, or if your environment does not support SDKs, work through the following checks.
1. Check the endpoint format
Confirm the endpoint follows the format http://oss-{region}.aliyuncs.com. For China (Hangzhou), the valid endpoint is http://oss-cn-hangzhou.aliyuncs.com. For endpoints in other regions, see Regions and endpoints.
2. Check the AccessKey ID and AccessKey secret
Confirm that neither the AccessKey ID nor the AccessKey secret starts or ends with a space.
3. Check bucket and object names
Signature calculation includes the bucket name and object key. Confirm they meet the following requirements:
Bucket names:
Must be unique within OSS
Contain only lowercase letters, digits, and hyphens (-)
Start and end with a lowercase letter or digit
3–63 characters in length
Object names:
Encoded in UTF-8
1–1,023 bytes in length
Do not start with a forward slash (/) or backslash (\\)
Case-sensitive
4. Check the signature method
5. Check for proxy-added headers
If requests pass through a proxy server, confirm the proxy is not injecting additional headers. Extra headers change the string that OSS uses to calculate the expected signature.
6. Compare StringToSign values (self-signed mode)
When using self-signed mode, the OSS error response includes a StringToSign parameter. Compare this value against the string your code constructs before signing — any difference reveals the exact mismatch. Common sources of divergence include header ordering, encoding differences, or missing canonical headers.