V4 signing is a process you can use to generate signatures for authentication in Cloud Storage XML API requests. This page describes how to use gsutil and Cloud Storage client libraries to create signed URLs. Signed URLs give time-limited read or write access to a specific Cloud Storage resource. If you want to make your own program for creating signed URLs, read V4 signing with your own program instead.
Create a signed URL to download an object
To create a signed URL that can get an object from a bucket, complete the following steps:
gsutil
Generate a new private key, or use an existing private key for a service account. The key can be in either JSON or PKCS12 format.
For more information on private keys and service accounts, see Service Accounts.
Use the
gsutil signurl
command, passing in the path to the private key from the previous step as well as the bucket and object name.For example, using a key stored in the folder
Desktop
, the following command generates a signed URL for users to view the objectcat.jpeg
for 10 minutes.gsutil signurl -d 10m Desktop/private-key.json gs://example-bucket/cat.jpeg
If successful, your response should look like:
URL HTTP Method Expiration Signed URL gs://example-bucket/cat.jpeg GET 2018-10-26 15:19:52 https://storage.googleapis. com/example-bucket/cat.jpeg?x-goog-signature=2d2a6f5055eb004b8690b9479883292ae74 50cdc15f17d7f99bc49b916f9e7429106ed7e5858ae6b4ab0bbbdb1a8ccc364dad3a0da2caebd308 87a70c5b2569d089ceb8afbde3eed4dff5116f0db5483998c175980991fe899fbd2cd8cb813b0016 5e8d56e0a8aa7b3d7a12ee1baa8400611040f05b50a1a8eab5ba223fe5375747748de950ec7a4dc5 0f8382a6ffd49941c42498d7daa703d9a414d4475154d0e7edaa92d4f2507d92c1f7e811a7cab64d f68b5df4857589259d8d0bdb5dc752bdf07bd162d98ff2924f2e4a26fa6b3cede73ad5333c47d146 a21c2ab2d97115986a12c28ff37346d6c2ca83e5618ec8ad95632710b489b75c35697d781c38e& x-goog-algorithm=GOOG4-RSA-SHA256&x-goog-credential=example%40example-project. iam.gserviceaccount.com%2F20181026%2Fus%2Fstorage%2Fgoog4_request&x-goog-date= 20201026T211942Z&x-goog-expires=3600&x-goog-signedheaders=host
The signed URL is the string beginning with
https://storage.googleapis.com
and will likely extend for several lines. This URL can be used by any person to access the associated resource (in this casecat.jpeg
) for the designated time frame (in this case, 10 minutes).
Client libraries
For more information, see the
Cloud Storage C++ API
reference documentation.
For more information, see the
Cloud Storage C# API
reference documentation.
For more information, see the
Cloud Storage Go API
reference documentation.
For more information, see the
Cloud Storage Java API
reference documentation.
For more information, see the
Cloud Storage Node.js API
reference documentation.
For more information, see the
Cloud Storage PHP API
reference documentation.
For more information, see the
Cloud Storage Python API
reference documentation.
For more information, see the
Cloud Storage Ruby API
reference documentation.
C++
C#
Go
Java
Node.js
PHP
Python
Ruby
Create a signed URL to upload an object
To create a signed URL that can upload an object to a bucket, complete the following steps:
gsutil
Generate a new private key, or use an existing private key for a service account. The key can be in either JSON or PKCS12 format.
For more information on private keys and service accounts, see Service Accounts.
Use
gcloud auth activate-service-account
to authenticate with the service account:gcloud auth activate-service-account --key-file KEY_FILE_LOCATION/KEY_FILE_NAME
Where:
KEY_FILE_LOCATION
is the local path to the file that contains the file with your service account credentials. For example,Desktop
.KEY_FILE_NAME
is the name of the file that contains your service account credentials. For example,key.txt
.
Use the
gsutil signurl
command with the-u
option to reference the service account credentials.For example, the following command creates a signed url that allows users to upload an image file:
gsutil signurl -m PUT -d 1h -c CONTENT_TYPE -u gs://BUCKET_NAME/OBJECT_NAME
Where:
CONTENT_TYPE
is the object's content type. For example,image/png
.BUCKET_NAME
is the name of the bucket where the object is being uploaded. For example,example-bucket
.OBJECT_NAME
is the name to assign to the uploaded object. For example,cat.png
.
If successful, your response should look like:
URL HTTP Method Expiration Signed URL gs://example-bucket/cat.png PUT 2021-01-09 00:28:11 https://storage.googleapis. com/example-bucket/cat.png?x-goog-signature=2d2a6f5055eb004b8690b9479883292ae74 50cdc15f17d7f99bc49b916f9e7429106ed7e5858ae6b4ab0bbbdb1a8ccc364dad3a0da2caebd308 87a70c5b2569d089ceb8afbde3eed4dff5086f0db5483998c175980991fe899fbd2cd8cb813b0016 5e8d56e0a8aa7b3d7215ee1baa8400611040f05b50a1a8eab5ba223fe1375747748de950ec7i6dc5 0f8382a6ffd4994ac42498d7daa703d9a414d4475154d0e7edaa92d4f2507d92c1f7e8efa7cab64d f68b5df48575b9259d8d0bdb5dc752bdf07bd162d98ff2924f2p4a26fa6b3cede73ad5333c47d146 a21c2ab2d97b15986a12c68ff3734696c2ca83e56b8ec8ad95632710b488b75c35697d781c38e& x-goog-algorithm=GOOG4-RSA-SHA256&x-goog-credential=example%40example-project. iam.gserviceaccount.com%2F20181026%2Fus%2Fstorage%2Fgoog4_request&x-goog-date= 20201026T211942Z&x-goog-expires=3600&x-goog-signedheaders=host
The signed URL is the string beginning with
https://storage.googleapis.com
and will likely extend for several lines. This URL can be used by any person to upload a resource (in this casecat.png
) to the specified Cloud Storage bucket for the designated time frame (in this case, 1 hour).
Client libraries
For more information, see the
Cloud Storage C++ API
reference documentation.
For more information, see the
Cloud Storage C# API
reference documentation.
For more information, see the
Cloud Storage Go API
reference documentation.
For more information, see the
Cloud Storage Java API
reference documentation.
For more information, see the
Cloud Storage Node.js API
reference documentation.
For more information, see the
Cloud Storage PHP API
reference documentation.
For more information, see the
Cloud Storage Python API
reference documentation.
For more information, see the
Cloud Storage Ruby API
reference documentation.
C++
C#
Go
Java
Node.js
PHP
Python
Ruby
What's next
- Learn how to sign URLs with your own program.
- See available options for signed URLs.
- Learn more about signed URLs.
- Learn about uploading an object with the XML API.
- Learn about uploading objects.