Docs

Torch Object Storage

Object operations

Creating an authorization code

With TOS Browser, you can create authorization codes that limit users' access time and permissions to TOS resources. These codes automatically expire after their validity period ends. You can share these codes with others, allowing them to log in to TOS Browser and access TOS resources without extra credentials. This topic describes how to create an authorization code.

Supported permissions

TOS Browser restricts the permissions that authorization codes can grant, and any permissions exceeding the allowed range will not take effect. The following permissions can be assigned:

ListBucket

ListBucketVersions

ListBucketMultipartUploads

HeadBucket

GetBucketACL

GetBucketVersioning

GetBucketLocation

GetObject

PutObject

RestoreObject

GetObjectAcl

PutObjectAcl

PutObjectTagging

DeleteObjectTagging

GetObjectTagging

GetObjectVersion

ListMultipartUploadParts

AbortMultipartUpload

Notes

Authorization code permissions are limited to read and write. They do not support delete or rename permissions.

Steps

Step 1: Create an Identity and Access Management (IAM) permission policy

In the left navigation pane, click Permission policy.

On the Permission policy page, click Create Policy.

On the Create Policy page, enter your Policy name. Then, click the JSON editor tab and enter the policy content.

tip

Permission policies determine which operations one can perform on objects or folders in TOS Browser after logging in with an authorization code. When creating a permission policy, you can only configure a specific set of permissions. Any permissions outside of this range will be ignored. For more information on assignable permissions, see Supported permissions.

The following example policy grants a user read and write permissions for the "bucketname" bucket.

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"tos:Get*",
"tos:ListBucket",
"tos:Put*",
"tos:HeadBucket"
],
"Resource": [
"trn:tos:::bucketname",
"trn:tos:::bucketname/*"
]
}
]
}

Once you have finished configuring, click Submit.

Step 2: Create an IAM role

In the left navigation pane, click Role Management.

On the Role Management page, click Create New Role.

In the Select trust identity wizard, set the trusted identity to Account, and the identity to The current account. Then, click Next.

In the Configure role wizard, enter a Role name, Display name, and Description. Then, click Next.

In the Authorize wizard, select the permission policy created in Step 1 and click Submit.

Step 3: Create an authorization code

warning

TOS Browser only allows you to create authorization codes when you log in with AK/SK. Other login methods are not supported.

On the Buckets page, click the bucket you want to manage.

On the Objects page, select ··· > Share in the Actions column of the object or folder.

In the Share dialog, configure the following parameters.

Parameter	Description
Permission	Select read/write.
Role	Select the role created in Step 2.
Authorization code valid period	The validity period of the authorization code, after which it expires. Valid range: 900 to 43,200 seconds.
Authorization Policy	Displays the permissions that can be assigned via the authorization code. This field cannot be modified.

Once you have finished configuring, click Create share.

Then, you can view and copy the authorization code in the Share dialog.

Next steps

Share the authorization code with others so they can log in to TOS Browser and read and write to the corresponding object or folder in the "bucketname" bucket. For instructions, see Logging in to TOS Browser with an authorization code.

Last updated: 2026.03.18 18:48:58