Starting January 8, 2026, to ensure business security and stability, Volcano Engine Torch Object Storage will prohibit users from accessing APK and IPA objects via a default domain name or pre-signed URL.

Estimated Change Time

2026-01-08. Please refer to the console for the specific time.

Change Description

For buckets created on or after January 8, 2026, accessing objects with content-type metadata of application/vnd.android.package-archive or application/iphone (i.e., APK and IPA objects) via a default domain name or pre-signed URL will no longer be permitted. Attempting direct access will result in the following error:

HTTP/1.1 400 Bad Request​
​
{​
    "Code": "ApkDownloadForbidden",​
    "RequestId": "c35016853c8ceec656853c8-ac11c259-1r8dDM-LB-cb-tos-front-****",​
    "HostId": "TQHYhZZTikZoNVVNxzQdLLRFyBLz****",​
    "Message": "The APK file is not allowed to be distributed in a public network using the TOS endpoint, please use CNAME instead."​
}​

Impacts

If you want to download objects with content-type metadata of application/vnd.android.package-archive or application/iphone, you need to access them through a custom domain. For more information, see Associating a custom domain.

The changes do not affect buckets created before January 8, 2026. However, we recommend using custom domain names to access objects in these buckets.

Last updated: 2025.12.18 14:44:32

Public security network record in Beijing: No. 11010802032137