Supabase Storage S3 API: AWS Go SDK v2 uploads fail with 403 SignatureDoesNotMatch

Supabase Storage S3 API: AWS Go SDK v2 uploads fail with 403 SignatureDoesNotMatch

Whats going on

Using the AWS SDK for Go v2 (aws-sdk-go-v2) against Supabase Storage's S3-compatible endpoint, PutObject fails with: operation error S3: PutObject, https response error StatusCode: 403, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method. Access key, secret, region, and endpoint are all correct, and the same config works with SDK v1 and with boto3. The Go SDK v2 appends SDK-internal query parameters (e.g. ?x-id=PutObject) to the URL before signing, which Supabase's signature validation did not handle. This broke LiveKit Egress and other tools that moved to Go SDK v2.

What actually fixes it

This was a Supabase-side S3 signature compatibility bug with the Go SDK v2's signing format. Maintainer itslenny confirmed on the thread that it is fully resolved in production, so the latest SDK works without any workaround. Before the fix, the workaround was to remove the DisableAcceptEncodingGzip middleware from the SDK's middleware stack via APIOptions. If you still hit SignatureDoesNotMatch, make sure you are not pinned to an old workaround and that your endpoint is https://PROJECT_REF.supabase.co/storage/v1/s3 with path-style addressing.

Original thread

https://vectle.com/threads/thr_aHUvdmeuHmZHQvL2qsl2ng

In the thread https://vectle.com/threads/thraHUvdmeuHmZHQvL2qsl2ng, the question was: Using the AWS SDK for Go v2 (aws-sdk-go-v2) against Supabase Storage's S3-compatible endpoint, PutObject fails with: operation error S3: PutObject, https response error StatusCode: 403, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method. Access key, secret, region, and endpoint are all correct, and the same config works with SDK v1 and with boto3. The Go SDK v2 appends SDK-internal query parameters (e.g. ?x-id=PutObject) to the URL before signing, which Supabase's signature validation did not handle. This broke LiveKit Egress and other tools that moved to Go SDK v2. The verified resolution was: This was a Supabase-side S3 signature compatibility bug with the Go SDK v2's signing format. Maintainer itslenny confirmed on the thread that it is fully resolved in production, so the latest SDK works without any workaround. Before the fix, the workaround was to remove the DisableAcceptEncodingGzip middleware from the SDK's middleware stack via APIOptions. If you still hit SignatureDoesNotMatch, make sure you are not pinned to an old workaround and that your endpoint is https://PROJECTREF.supabase.co/storage/v1/s3 with path-style addressing.