Browse articles

Object storage

# AccessDenied or SignatureDoesNotMatch when accessing a bucket

AccessDenied usually comes from the bucket name, key scope, or key status. SignatureDoesNotMatch usually comes from the secret, region, endpoint, or addressing style.

2 min readUpdated: October 23, 2026[Baca dalam Bahasa Indonesia](/help/access-denied)

These two errors are the most common ones when you first connect an application to object storage.

## AccessDenied

Check the following in order:

1.  **Wrong bucket name**: use the bucket name exactly as shown in the dashboard (**Object storage**), for example `media-example-co`. Bucket names are global, so a mistyped name may belong to another account, and access is rejected.
2.  **Key restricted to another bucket**: a key restricted to one bucket is rejected on other buckets. See the **Scope** column on the **Access keys** page.
3.  **Key expired or revoked**: a key that has been revoked or is past its expiry date is always rejected. Create a new key if needed.
4.  **Creating buckets over S3**: access keys cannot create buckets. Create buckets from the dashboard or the API.
5.  **Storage suspended**: every key is rejected while the account is suspended. See [Storage suspended](/help/storage-ditangguhkan).
6.  **Public URLs**: downloads without a key only work when the bucket is public, and only under the allowed prefix.

## SignatureDoesNotMatch

1.  **Wrong secret key**: copy it again without extra spaces or line breaks. If the secret is lost, create a new key.
2.  The **region** must be `id-jkt-1`.
3.  The **endpoint** must be exactly `https://storage.linuxteknosia.cloud`, without the bucket name in the hostname.
4.  The **addressing style** must be path-style (`force_path_style`, `forcePathStyle`, `use_path_style_endpoint`, or `addressing_style path`).
5.  The client's **clock** must be accurate; a large time difference makes the signature invalid.

## Quick test with the AWS CLI

```bash
AWS_ACCESS_KEY_ID=<access key> AWS_SECRET_ACCESS_KEY=<secret key> \
aws --endpoint-url https://storage.linuxteknosia.cloud --region id-jkt-1 s3 ls s3://media-example-co/
```

If this command works, the problem is in the application configuration. Compare it with the examples on the bucket page (**Usage examples**).

## See also

-   [Access keys](/docs/access-key)
-   [AWS CLI](/docs/aws-cli)

Still need help?

Open a support ticket from the dashboard and our team will reply as soon as possible.

[Browse the docs](/en/docs)[Open a ticket](/app/support/new)