tencent cloud


Generating and Using Temporary Keys

Last updated: 2022-02-26 09:45:52

    • When authorizing access with a temporary key, ensure that you follow the principle of the least privilege as needed. If you grant excessive permissions, such as granting permissions to all resources (resource: *) or all operations (action: *), data security risks may arise.
    • If you have specified a permission scope for the temporary key when applying for it, you can only use the key within the scope. For example, if you have limited the permissions to only uploading objects to the examplebucket-1-1250000000, you can’t upload objects to the examplebucket-2-1250000000 bucket or download objects from the examplebucket-1-1250000000 bucket.

    Temporary Key

    The temporary key (access credential) obtains limited permissions using Tencent Cloud CAM APIs.
    To call the COS API, you use temporary keys to calculate a signature for identity authentication.
    When a COS API request uses a temporary key to calculate the signature for authentication, the following three fields in the message returned by the temporary key API are required:

    • TmpSecretId
    • TmpSecretKey
    • Token

    Benefits to Use a Temporary Key

    When using COS on web, iOS, and Android applications, fixed keys are less ideal for permission management and less secure if stored in your client-side code, as the key may be disclosed. In this case, you can use a temporary key.
    For example, when applying for a temporary key, you can specify the action and resource by setting the policy field to grant limited access permissions.

    For COS API authorization policies, see:

    Getting a Temporary Key

    You can get a temporary key via COS STS SDK, or by calling the STS API directly.


    The Java SDK is used as an example in this document. To use it, you need to get the SDK code (version number) on GitHub. If you cannot find the SDK version number, check whether this SDK version is available on GitHub.


    COS provides SDKs and samples in various languages (e.g., Java, Node.js, PHP, Python, and Go) for STS. For more information, please see COS STS SDK. To learn about how to use each SDK, see the README files and samples on GitHub by referring to the following table:

    Language Download Address Sample
    Java Download View Sample
    .NET Download View Sample
    Go Download View Sample
    Node.js Download View Sample
    PHP Download View Sample
    Python Download View Sample

    To avoid the differences between versions of the STS API, STS SDKs take a return parameters structure that may be different from that of the STS API. For more information, see Java SDK documentation.

    Here is an example to obtain a temporary key using the downloaded Java SDK:

    Sample codes

    // Import `java sts sdk` using the integration method with Maven as described on GitHub, with v3.1.0 or later required.
    public class Demo {
       public static void main(String[] args) {
           TreeMap config = new TreeMap();
            try {
               // `SecretId` and `SecretKey` represent permanent identities (root account, sub-account) for applying for a temporary key. If it is a sub-account, it must have permission to operate buckets.
               // Replace it with your Cloud API key SecretId
               config.put("secretId", "SecretId");
               // Replace it with your Cloud API key SecretKey
               config.put("secretKey", "SecretKey");
                // Set a domain: 
               // If you use Tencent Cloud CVMs, you can set an internal domain.
               //config.put("host", "sts.internal.tencentcloudapi.com");
                // Validity period of the key, in seconds (default: 1800). The value can be up to 7200 (2 hours) for the root account, and 129600 (36 hours) for a sub-account.
               config.put("durationSeconds", 1800);
                // Replace it with your own bucket
               config.put("bucket", "examplebucket-1250000000");
               // Replace it with the region where your bucket resides
               config.put("region", "ap-guangzhou");
                // Change it to an allowed path prefix. You can determine the upload path based on your login status.
               // Examples of several typical prefix authorization scenarios:
               // 1. Allow access to all objects: "*"
               // 2. Allow access to specified objects: "a/a1.txt", "b/b1.txt"
               // 3. Allow access to objects with specified prefixes: "a*", "a/*", "b/*"
               // If "*" is entered, you allow the user to access all resources. Unless otherwise necessary, grant the user only the limited permissions that are needed following the principle of least privilege.
               config.put("allowPrefixes", new String[] {
                // A list of permissions needed for the key (required)
               // The following permissions are required for simple upload, upload using a form, and multipart upload. For other permissions, visit https://www.tencentcloud.com/document/product/436/30580
               String[] allowActions = new String[] {
                        // Simple upload
                       // Upload using a form or WeChat Mini Program
                       // Multipart upload
               config.put("allowActions", allowActions);
                Response response = CosStsClient.getCredential(config);
           } catch (Exception e) {
               throw new IllegalArgumentException("no valid secret !");


    What should I do if NoSuchMethodError occurs due to JSONObject package conflict?

    Use 3.1.0 or a later version.

    Accessing COS using a temporary key

    When a COS API accesses COS with a temporary key, it passes the temporary sessionToken through the x-cos-security-token field, and calculates the signature using the temporary SecretId and SecretKey.

    The following example shows how to use a temporary key obtained by use of COS Java SDK to access COS:


    Before you run the sample, go to the GitHub project to download the Java SDK installation package.

    // Import `cos xml java sdk` using the integration method with Maven as described on GitHub.
    import com.qcloud.cos.*;
    import com.qcloud.cos.auth.*;
    import com.qcloud.cos.exception.*;
    import com.qcloud.cos.model.*;
    import com.qcloud.cos.region.*;
    public class Demo {
      public static void main(String[] args) throws Exception {
           // Basic user information
          String tmpSecretId = "COS_SECRETID";   // Replace it with the temporary SecretId returned by the STS API. 
          String tmpSecretKey = "COS_SECRETKEY";  // Replace it with the temporary SecretKey returned by the STS API.
          String sessionToken = "Token";  // Replace it with the temporary token returned by the STS API.
           // 1. Initialize user authentication information (secretId, secretKey).
          COSCredentials cred = new BasicCOSCredentials(tmpSecretId, tmpSecretKey);
          // 2. Set the bucket region. For COS regions, see https://www.tencentcloud.com/document/product/436/6224?from_cn_redirect=1.
          ClientConfig clientConfig = new ClientConfig(new Region("ap-guangzhou"));
          // 3. Generate a COS client.
          COSClient cosclient = new COSClient(cred, clientConfig);
          // The bucket name must contain `appid`.
          String bucketName = "examplebucket-1250000000";
           String key = "exampleobject";
          // Upload an object. You are advised to call this API to upload objects smaller than 20 MB.
          File localFile = new File("src/test/resources/text.txt");
          PutObjectRequest putObjectRequest = new PutObjectRequest(bucketName, key, localFile);
           // Set the `x-cos-security-token` header field.
          ObjectMetadata objectMetadata = new ObjectMetadata();
           try {
              PutObjectResult putObjectResult = cosclient.putObject(putObjectRequest);
              // Success: PutObjectResult returns the file ETag.
              String etag = putObjectResult.getETag();
          } catch (CosServiceException e) {
        //Failure: CosServiceException is thrown.
          } catch (CosClientException e) {
        //Failure: CosClientException is thrown.
           // Shut down the client.
    Contact Us

    Contact our sales team or business advisors to help your business.

    Technical Support

    Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

    7x24 Phone Support