# presigned url unmatching signature

Hello,

Apologize me if the question seemed noob. I wasted hours trying to debug it.

If I copy a **presigned put url** from Tigris web interface, the following works:

```
curl -X PUT --upload-file ~/Pictures/profile.jpg $URL
```

However, if I generate a **presigned url** from AWS CLI I get a signature failure:

```
<Error><Code>SignatureDoesNotMatch</Code><Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message><Resource>/hidden-resonance-7222/cover-auc.jpg</Resource><RequestId>1765142028485770133</RequestId><Key>cover-auc.jpg</Key><BucketName>hidden-resonance-7222</BucketName></Error>
```

It is generated by:

```
URL=$(aws s3 presign s3://hidden-resonance-7222/cover-auc.jpg --expires-in 3600 --endpoint-url https://t3.storage.dev)
```

Running `aws configure` yields:

```
AWS Access Key ID [****************_lvN]:
AWS Secret Access Key [****************0yEe]:
Default region name [auto]:
Default output format [json]:
```

and the access key matches the one shown in the Tigris web interface.

I saw [this](https://community.fly.io/t/signaturedoesnotmatch-when-using-pre-signed-url-with-aws-sdk/23549) but it does not seem relevant.

**P.S.** The working URL generated from the web interface looks like:

```
https://hidden-resonance-7222.t3.storage.dev/cover-auc.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=tid_..._lvN%2F20251207%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20251207T213238Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=...
```

The failed URL generated by AWS CLI looks like:

```
https://t3.storage.dev/hidden-resonance-7222/cover-auc.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=tid_..._lvN%2F20251207%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20251207T213420Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=...
```

I’m getting SignatureDoesNotMatch when creating a presigned-url for PUT. const url = await getSignedUrl( s3Client, new PutObjectCommand({ Bucket: config.AWS_BUCKET, Key: key, }), { expiresIn: dayjs.duration(10, 'minutes').asSeconds(), } ); Log output for debugging purposes: [3:12:26 ...

### Solution

Update. Python’s SDK works.

Update. I used curl’s built‑in _aws sig v4_ and the following did successfully work:

```
curl  --user "$AWS_ACCESS_KEY_ID":"$AWS_SECRET_ACCESS_KEY" \
      --aws-sigv4 "aws:amz:auto:s3" \
      --header "Content-Type: application/vnd.sqlite3" \
      --request PUT \
      --upload-file $BK_PATH \
      "https://${BUCKET_NAME}.t3.storage.dev/${OBJECT_KEY}"
```

Note. For the record, a developer may deploy a python app which generates presigned URLs for generic HTTP requests.

Note. I still don’t know why AWS CLI does not generate a correct signature.

#### Tigris

AWS CLI doesn’t support generating pre‑signed URL for **PUT** operation. You can use other programming language SDKs to generate it.

> AWS CLI doesn’t support generating pre‑signed URL for PUT operation. You can use other programming language SDKs to generate it.

Thank you for the note.