Skip to content
Back to the playbook

Fixing R2 SignatureDoesNotMatch on presigned URLs

Cloudflare R2revision 1

Diagnostic tree

  1. In progressPresigned R2 URL fails with SignatureDoesNotMatchR2 returns HTTP 403 with S3 error code SignatureDoesNotMatch (R2 error code 10035): the request signature it calculated does not match the one in the URL. Note this is a different error code from ExpiredRequest (10018) — if the code is ExpiredRequest instead, the URL simply expired and needs regenerating; that's not what this playbook covers.
View the whole map (7 more steps)
  • Check whether the URL was modified in transit
  • Keep the URL byte-for-byte unmodified end-to-end
  • Check whether the signing key still matches
  • Update the secret used for signing
  • Not a URL-mangling or key-rotation issue — escalate
  • Generate a fresh URL and use it immediately, unmodified
  • Resolved

What to test

Presigned R2 URL fails with SignatureDoesNotMatch

R2 returns HTTP 403 with S3 error code SignatureDoesNotMatch (R2 error code 10035): the request signature it calculated does not match the one in the URL. Note this is a different error code from ExpiredRequest (10018) — if the code is ExpiredRequest instead, the URL simply expired and needs regenerating; that's not what this playbook covers.

What happened?

Passed