A pre-signed URL enables others to access your objects temporarily without exposing your credentials. During its validity period, anyone can download objects using the pre-signed URL. Use the presign command to create a pre-signed URL for downloading objects and securely and conveniently share private objects.

Command syntax

Linux/macOS

Windows

Generate a pre-signed URL for a single object

./tosutil presign tos://bucket/key [-vp=xxx] [-qp=xxx] [-versionId=xxx] [-e=xxx] [-re=xxx] [-i=xxx] [-k=xxx] [-t=xxx] [-conf=xxx]

Generate pre-signed URLs for objects with a specified prefix in batches

./tosutil presign tos://bucket/[prefix] -r [-vp=xxx] [-qp=xxx] [-include=*.xxx] [-exclude=*.xxx] [-d] [-v] [-marker=xxx] [-versionIdMarker=xxx] [-limit=1] [-bt=xxx] [-e=xxx] [-re=xxx] [-i=xxx] [-k=xxx] [-t=xxx] [-conf=xxx]

Description

For descriptions of common optional parameters, see Global options.

Name	Type	Description
-vp	String	Sets how long the pre-signed URL will be valid. After the specified time, the URL will automatically expire. The valid range is from 1 minute to 30 days. If you use temporary access credentials to configure tosutil, the authorization code's validity period must match the credentials' expiration time. The default value is 1 day, indicating that the generated authorization code will expire after 1 day. This parameter supports the following configuration formats: w: Week(s). d: Day(s). h: Hour(s). min: Minute(s). s: Second(s). For example, 1d means a validity period of 1 day; 1w, 1 week; and 1h, 1 hour. tip If no time unit is specified, the default unit is seconds. For example, 2400 means a validity period of 2,400 seconds.
-qp	String	The query parameter included in the pre-signed URL.
-versionId	String	The version ID of the object for which the pre-signed URL will be generated. The default is the latest version of the object.
-r	String	Generate pre-signed URLs for objects with the specified prefix.
-include	String	The object matching pattern used to include objects when generating pre-signed URLs in batches. The following characters have special behavior: ? : Matches any single character within an object name. : Matches zero or more characters within an object name. #: Serves as a delimiter. For example, -include=.png#*.txt includes all objects ending in .png and .txt. tip To avoid parsing failures caused by the operating system escaping special characters, enclose the object matching pattern in quotes.
-exclude	String	The object matching pattern used to exclude objects when generating pre-signed URLs in batches. The following characters have special behavior: ? : Matches any single character within an object name. : Matches zero or more characters within an object name. #: Serves as a delimiter. For example, -exclude=.png#*.txt excludes all objects ending in .png and .txt. tip To avoid parsing failures caused by the operating system escaping special characters, enclose the object matching pattern in quotes.
-d	String	Generate pre-signed URLs only for the objects in the current directory, rather than generating them recursively for all objects.
-v	String	Generate pre-signed URLs for objects with multiple versions, including the latest versions and the historical versions.
-marker	String	Sets the starting position when generating pre-signed URLs for objects in batches. The system first sorts objects by name in lexicographical order. Then, it generates pre-signed URLs for each object.
-versionIdMarker	String	Sets the starting position for generating pre-signed URLs for objects with multiple versions in batches. This parameter must be used in conjunction with the -marker parameter. The system first sorts objects by name and version ID in lexicographical order. Then, it generates pre-signed URLs for each object.
-limit	String	The maximum number of pre-signed URLs that will be returned when generating them in batches. The default value is 1,000.
-bt	String	The type of the bucket. The options are as follows: fns: A flat namespace (FNS) bucket. hns: A hierarchical namespace (HNS) bucket. If the bucket type is not specified, the default will be the type obtained from the bucket metadata.

Examples

Generate a pre-signed URL valid for 2 hours for the "object.png" object in the "bucketname" bucket

Command

./tosutil presign tos://bucketname/object.png -vp=2h

Output

https://bucketname.tos-cn-beijing.volces.com/object.png?X-Tos-Algorithm=TOS4-HMAC-SHA256&X-Tos-Credential=AKLTYWFkMGU0YjJkZGFjNGUwMTkxNTEwMzQzYzk0YzFmMWM%2F20250916%2Fcn-beijing%2Ftos%2Frequest&X-Tos-Date=20250916T071704Z&X-Tos-Expires=7200&X-Tos-Signature=76403344452b78c7e933fe54f109fb78bab6b233c53f9118dd29036****&X-Tos-SignedHeaders=host

Generate a pre-signed URL valid for 2 hours for objects with the "prefix" prefix in the "bucketname" bucket

Command

./tosutil presign tos://bucketname/prefix -r -vp=2h

Output

tos://bucketname/prefix-new.png
https://bucketname.tos-cn-beijing.volces.com/prefix-new.png?X-Tos-Algorithm=TOS4-HMAC-SHA256&X-Tos-Credential=AKLTYWFkMGU0YjJkZGFjNGUwMTkxNTEwMzQzYzk0YzFmMWM%2F20250916%2Fcn-beijing%2Ftos%2Frequest&X-Tos-Date=20250916T071945Z&X-Tos-Expires=7200&X-Tos-Signature=3dc7be30794ee2ad5543fd194bbf18ca3f70a26da96b4567b9da32011****&X-Tos-SignedHeaders=host

tos://bucketname/prefix-new.pptx
https://bucketname.tos-cn-beijing.volces.com/prefix-new.pptx?X-Tos-Algorithm=TOS4-HMAC-SHA256&X-Tos-Credential=AKLTYWFkMGU0YjJkZGFjNGUwMTkxNTEwMzQzYzk0YzFmMWM%2F20250916%2Fcn-beijing%2Ftos%2Frequest&X-Tos-Date=20250916T071945Z&X-Tos-Expires=7200&X-Tos-Signature=137a2b25c6dab44c8c0e1dad93f8dbdbd50e2340b0b17a94bf68f426****&X-Tos-SignedHeaders=host

Torch Object Storage