Compatible Signature Authentication
Updated at：2025-11-03
Compatible with the latest AWS Signature Version 4. For the signing method, refer to Authenticating Requests (AWS Signature Version 4).
Signature Header example
The following is an example of accessing BOS using the S3 signature authentication method, providing authentication information via the Authorization Request Header, with details as follows:
Plain Text
1Authorization: AWS4-HMAC-SHA256
2Credential=82fa964ae**********0dfeea44c0683/20230216/bj/s3/aws4_request,
3SignedHeaders=host;x-amz-content-sha256;x-amz-date,
4Signature=98afff082015a6490a50567b2fa9a0e64f0ae81105a3a62da86bc50806c293fbNote
- AWS4-HMAC-SHA256 represents the algorithm used for signature calculations. This string indicates the AWS signature version, AWS4, and the specific signature algorithm HMAC-SHA256.
- Credential: It includes the Access Key, date, region and service used to calculate the signature, in the format:
<access-key>/<date>/<bos-region>/s3/aws4_request, Where<date>uses the date formatYYYYMMDD, and<bos-region>corresponds to the BOS regions as follows:
| Region | Region |
|---|---|
| Beijing | bj |
| Baoding | bd |
| Suzhou | su |
| Guangzhou | gz |
| Wuhan | fwh |
| Hong Kong | hkg |
For detailed descriptions, refer to sigv4-auth-using-authorization-header.
- Currently, signature calculations only support Transfer Payload in a Single Chunk or Transfer Payload in Multiple Chunks.
Complete request example:
Plain Text
1GET / HTTP/1.1
2Host: s3.bj.bcebos.com
3Accept-Encoding: identity
4User-Agent: Boto3/1.26.72 Python/3.9.6 Darwin/22.1.0 Botocore/1.29.72 Resource
5X-Amz-Date: 20230216T025415Z
6X-Amz-Content-SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
7Authorization: AWS4-HMAC-SHA256 Credential=82fa964ae**********0dfeea44c0683/20230216/bj/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=98afff082015a6490a50567b2fa9a0e64f0ae81105a3a62da86bc50806c293fb
8amz-sdk-invocation-id: d2f1690c-ea14-4298-8bf5-052f797d4b4d
9amz-sdk-request: attempt=1
10HTTP/1.1 200 OK
11Date: Thu, 16 Feb 2023 02:54:16 GMT
12Content-Type: application/xml
13Content-Length: 9061
14Connection: keep-alive
15Server: BceBos
16X-Amz-Id-2: vl7FafIEg8tsAO58XjrWu/PAaxp5HdsDsBHYVzKdQM/Dz0M6Xk1zqL5ckWgBdMcwhQC3fHuZqNA3S1FrzeM/PA==
17X-Amz-Request-Id: 05fb9355-e743-4900-be4d-e1be627d1ce2Access BOS using AWS STS
BOS supports STS authentication when using the S3 method. Similar to the S3 signature, this requires the X-Amz-Security-Token to be added to the header. Details are as follows:
Plain Text
1Authorization: AWS4-HMAC-SHA256
2Credential=82fa964ae**********0dfeea44c0683/20230216/bj/s3/aws4_request,
3SignedHeaders=host;x-amz-content-sha256;x-amz-date,
4Signature=98afff082015a6490a50567b2fa9a0e64f0ae81105a3a62da86bc50806c293fb
5X-Amz-Security-Token=IQoJb3JpZ2luX2VjEMv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCIBSUbVdj9YGs2g0HkHsOHFdkwOozjARSKHL987NhhOC8AiBPepRU1obMvIbGU0T%2BWphFPgK%2Fqpxaf5Snvm5M57XFkCqlAgjz%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDQ3MjM4NTU0NDY2MCIM83pULBe5%2F%2BNm1GZBKvkBVslSaJVgwSef7SsoZCJlfJ56weYl3QCwEGr2F4BmCZZyFpmWEYzWnhNK1AnHMj5nkfKlKBx30XAT5PZGVrmq4Vkn9ewlXQy1Iu3QJRi9Tdod8Ef9%2FyajTaUGh76%2BF5u5a4O115jwultOQiKomVwO318CO4l8lv%2F3HhMOkpdanMXn%2B4PY8lvM8RgnzSu90jOUpGXEOAo%2F6G8OqlMim3%2BZmaQmasn4VYRvESEd7O72QGZ3%2BvDnDVnss0lSYjlv8PP7IujnvhZRnj0WoeOyMe1lL0wTG%2Fa9usH5hE52w%2FYUJccOn0OaZuyROuVsRV4Q70sbWQhUvYUt%2B0tUMKzm8vsFOp4BaNZFqobbjtb36Y92v%2Bx5kY6i0s8QE886jJtUWMP5ldMziClGx3p0mN5dzsYlM3GyiJ%2FO1mWkPQDwg3mtSpOA9oeeuAMPTA7qMqy9RNuTKBDSx9EW27wvPzBum3SJhEfxv48euadKgrIX3Z79ruQFSQOc9LUrDjR%2B4SoWAJqK%2BGX8Q3vPSjsLxhqhEMWd6U4TXcM7ku3gxMbzqfT8NDg%3DNotes
- STS requires the use of Baidu AI Cloud's STS system. Refer to Baidu AI Cloud STS. Calculate the signature using the AK, SK and STS-Token generated by Baidu STS Client. Calculate the signature string using AK and SK according to the S3 signature authentication method and fill into Signature, and then fill the STS-Token into the field X-Amz-Security-Token
Example using the S3 Python SDK is as follows:
Python
1import boto3
2import botocore
3from botocore.client import Config
4s3_client = boto3.client(
5 's3',
6 aws_access_key_id='xxx', # AK generated by Baidu AI Cloud using STS
7 aws_secret_access_key='xxx', # SK generated by Baidu AI Cloud using STS
8 aws_session_token='xxx', # Token generated by Baidu AI Cloud using STS
9 region_name='gz',
10 endpoint_url='http://s3.gz.bcebos.com',
11 config=Config(signature_version='s3v4', s3={
12 'addressing_style': 'path',
13 }),
14)
15response = s3_client.list_buckets()
16print(response)