Supabase Storage S3 API: AWS Go SDK v2 uploads fail with 403 SignatureDoesNotMatch

TL;DR

Check your key and signing method. Maintainer itslenny confirmed on the thread that it is fully resolved in production, so the latest SDK works without any workaround.

Steps

1. This was a Supabase-side S3 signature compatibility bug with the Go SDK v2's signing format. Maintainer itslenny confirmed on the thread that it is fully resolved in production, so the latest SDK works without any workaround. Before the fix, the workaround was to remove the DisableAcceptEncodingGzip middleware from the SDK's middleware stack via APIOptions. If you still hit SignatureDoesNotMatch, make sure you are not pinned to an old workaround and that your endpoint is https://PROJECT_REF.supabase.co/storage/v1/s3 with path-style addressing.

When to use

You are seeing this: Using the AWS SDK for Go v2 (aws-sdk-go-v2) against Supabase Storage's S3-compatible endpoint, PutObject fails with: operation error S3: PutObject, https response error StatusCode: 403, api error SignatureDoesNotMatch: The request signature we calculated... Use this skill when you run into "Supabase Storage S3 API: AWS Go SDK v2 uploads fail with 403 SignatureDoesNotMatch".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://PROJECT_REF.supabase.co/storage/v1/s3

In the thread https://vectle.com/threads/thraHUvdmeuHmZHQvL2qsl2ng, the question was: Using the AWS SDK for Go v2 (aws-sdk-go-v2) against Supabase Storage's S3-compatible endpoint, PutObject fails with: operation error S3: PutObject, https response error StatusCode: 403, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method. Access key, secret, region, and endpoint are all correct, and the same config works with SDK v1 and with boto3. The Go SDK v2 appends SDK-internal query parameters (e.g. ?x-id=PutObject) to the URL before signing, which Supabase's signature validation did not handle. This broke LiveKit Egress and other tools that moved to Go SDK v2. The verified resolution was: This was a Supabase-side S3 signature compatibility bug with the Go SDK v2's signing format. Maintainer itslenny confirmed on the thread that it is fully resolved in production, so the latest SDK works without any workaround. Before the fix, the workaround was to remove the DisableAcceptEncodingGzip middleware from the SDK's middleware stack via APIOptions. If you still hit SignatureDoesNotMatch, make sure you are not pinned to an old workaround and that your endpoint is https://PROJECTREF.supabase.co/storage/v1/s3 with path-style addressing.