---
title: Generating an AWSv4 authentication signature
description: Generate AWS Signature Version 4 for authentication in Scaleway Object Storage.
tags: object-storage object storage awsv4 aws authentication
dates:
  validation: 2025-07-31
  posted: 2018-07-16
---
import Requirements from '@macros/iam/requirements.mdx'

Requests sent to the Object Storage API require an HTTP Authorization header. Scaleway Object Storage supports [AWS v4 signature](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html) protocol to add an authentication signature to API requests.

When using third-party tools such as [aws-cli](https://aws.amazon.com/cli/), [s3cmd](https://s3tools.org/s3cmd), [s3fs](https://github.com/s3fs-fuse/s3fs-fuse), or [MinIO Client](https://github.com/minio/mc), signatures are automatically generated for you.

<Requirements />

- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- A valid [API key](/iam/how-to/create-api-keys/)

An AWSv4 authentication signature consists of different parts:

AWS4-HMAC-SHA256
: Indicates AWS Signature Version 4 (AWS4) and the signing algorithm (HMAC-SHA256).

Credential
: Contains your access key and information about the request in the format: `${ACCESS_KEY}/${YYYMMDD}/${REGION_SLUG}/s3/aws4_request`

SignedHeaders
: A lower-cased list of the names of the request headers used when computing the signature. (e.g. `host;x-amz-acl;x-amz-content-sha256;x-amz-date`)

Signature
: A signed hash consisting of a hash of the request body, your secret key, and information about the request (i.e., the canonical request). |

The canonical request included in the signature is made up of:

- The HTTP request method used.
- The path component of the request URI.
- The query string parameters included in the request.
- The list of request headers and their values, newline separated, lower-cased, and trimmed of whitespace.
- The list of header names without their values, sorted alphabetically, lower-cased, and semicolon-separated.
- The SHA256 hash of the request body.

This means that the following example:

```bash
GET /?acl HTTP/1.1

Host: my-bucket.s3.ams-nl.scw.cloud
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
x-amz-date: 20190411T101653Z
```

Would be based on the following canonical code:

```bash
GET
/
acl=
host:my-bucket.s3.ams-nl.scw.cloud
x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
x-amz-date:20190411T101653Z

host;x-amz-content-sha256;x-amz-date
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
```

**Example authorization header**

```bash
Authorization: AWS4-HMAC-SHA256
Credential=SCWN63TF9BMCPVNARV5A/20190411/nl-ams/s3/aws4_request,
SignedHeaders=host;x-amz-acl;x-amz-content-sha256;x-amz-date,
Signature=6cab03bef74a80a0441ab7fd33c829a2cdb46bba07e82da518cdb78ac238fda5
```

**Signing example (pseudo code)**

```bash
canonicalRequest = `
${HTTPMethod}\n
${canonicalURI}\n
${canonicalQueryString}\n
${canonicalHeaders}\n
${signedHeaders}\n
${hashedPayload}
`

stringToSign = "AWS4-HMAC-SHA256" + "\n" +
    date(format=ISO08601) + "\n" +
    date(format=YYYYMMDD) + "/" + ${REGION} + "/" + "s3/aws4_request" + "\n" +
    Hex(SHA256Hash(canonicalRequest))

dateKey = HMAC-SHA256("AWS4" + ${SECRET_KEY}, date(format=YYYYMMDD))
dateRegionKey = HMAC-SHA256(dateKey, ${REGION})
dateRegionServiceKey = HMAC-SHA256(dateRegionKey, "s3")
signingKey = HMAC-SHA256(dateRegionServiceKey, "aws4_request")

signature = Hex(HMAC-SHA256(signingKey, stringToSign))
```