Common errors
When a connection fails, start here: the table lists the usual error codes per provider and what to do.
Look up the error code in this page to find the matching row.
Check these three first
The bucket name is complete (Tencent Cloud COS appends -APPID, which is part of the name).
The endpoint is the service endpoint, not the “access domain” the console shows; it holds the host only — no bucket name, no path.
The key covers this one bucket (never the root account's key).
Error codes and fixes
| Provider | Symptom / code | What it usually is | What to do |
|---|---|---|---|
| Any | 403 AccessDenied | the key has no permission, or the bucket name in the policy is wrong | read the “minimal policy” section of that provider's guide |
| Any | SignatureDoesNotMatch / InvalidAccessKeyId | the key was copied wrongly, or the secret was shown once and not saved | generate a new key pair and copy it whole |
| Any | Test connection & save passes, but uploads fail | only read permission was granted (list objects, get objects) | add permission to write and delete objects |
| Any | Will not connect, or times out, with no error code | the endpoint or the place is wrong | check the place and the endpoint in the app; make sure the endpoint has no bucket name and no path |
| Alibaba Cloud OSS | PublicEndpointForbidden | the bucket is in mainland China and the account activated OSS on or after 20 March 2025, but the default public endpoint was used | enter your domain with a completed ICP filing in the app's HTTPS endpoint (route 1; binding notes are under “Other cases” at the end of that page), or move the bucket to an overseas region |
| Alibaba Cloud OSS | Cannot connect after binding your own domain | DNS has not picked up the CNAME yet, or the certificate is wrong | wait for DNS (usually minutes); check the certificate matches the domain, and make sure that domain is entered in the app's HTTPS endpoint (the app will access it as your own domain) |
| Tencent Cloud COS | 403 AccessDenied (the key looks right) | the bucket name was copied without its -APPID suffix | copy the full bucket name from the console (e.g. my-photos-1234567890) |
| Tencent Cloud COS | The endpoint holds the console's “access domain” | that address already contains the bucket name and is meant for browsers | use https://cos.<region>.myqcloud.com as the endpoint and enter the bucket name separately |
| Tencent Cloud COS | The SecretKey was not saved | the secret is shown once, when the sub-user is created | generate a new key pair for that sub-user in CAM and replace both values in Guyun |
| AWS S3 | AuthorizationHeaderMalformed / PermanentRedirect (301) | the region in the endpoint is not the bucket's actual region | in the app, change the place to where the bucket actually lives — the endpoint updates with it |
| AWS S3 | InvalidAccessKeyId / SignatureDoesNotMatch although the key looks right | account and bucket are in different partitions (the global aws and China aws-cn are separate) | make sure the bucket and the account are in the same partition: a China-region bucket needs a key from a China account |
| AWS S3 | 403 AccessDenied even though the policy exists | a bucket name is misspelled in one of the two ARNs, or the bucket ARN has a trailing slash (bucket level is arn:aws:s3:::bucket, object level is …/bucket/*) | copy the policy from the AWS S3 guide: no slash at bucket level, /* at object level |
| Backblaze B2 | InvalidAccessKeyId / SignatureDoesNotMatch although the key is right | a character is missing from the keyID — B2 key IDs are exactly 25 characters | copy the keyID again with the console's copy button rather than retyping it, or generate a fresh application key |
| Backblaze B2 | 403 AccessDenied while the master key is in use | B2's S3-compatible API does not accept the master application key | switch to an Application Key limited to the single bucket (step 3 of the guide) |
Codes that are not listed here: check the provider's own error-code documentation, or report it from inside the Guyun app.