Object Storage Service:OSS SDK for PHP 2.0

Quick integration

Prerequisites

Requires PHP 7.4+. Download Composer for package management.

Run the php -version command to check the PHP version. If PHP is not installed or the version is earlier than 7.4, download and install PHP.

Install the SDK

1. Create a project directory and run the following command to install OSS SDK for PHP 2.0 via Composer. Use the latest version to ensure sample code compatibility.

   mkdir oss-php-example && cd oss-php-example && composer require alibabacloud/oss-v2

2. Import the OSS SDK for PHP 2.0 package:

   require_once __DIR__ . '/../vendor/autoload.php';
   
   use AlibabaCloud\Oss\V2 as Oss;

Configure access credentials

Configure access credentials using a RAM user's AccessKey pair.

1. In the RAM console, create a RAM user with a permanent AccessKey Pair. Save the AccessKey pair and grant AliyunOSSFullAccess to the RAM user.

2. Use the AccessKey pair of the RAM user to configure environment variables.

   Linux

   1. Run the following commands to append the environment variable settings to the ~/.bashrc file.

      echo "export OSS_ACCESS_KEY_ID='YOUR_ACCESS_KEY_ID'" >> ~/.bashrc
      echo "export OSS_ACCESS_KEY_SECRET='YOUR_ACCESS_KEY_SECRET'" >> ~/.bashrc

      1. Run the following command to apply the changes.

         source ~/.bashrc

      2. Run the following commands to check whether the environment variables are configured.

         echo $OSS_ACCESS_KEY_ID
         echo $OSS_ACCESS_KEY_SECRET

   macOS

   1. Run the following command in the terminal to view the default shell type.

      echo $SHELL

      1. Perform the following steps based on the default shell type.

         Zsh

         1. Run the following commands to append the environment variable settings to the ~/.zshrc file.

            echo "export OSS_ACCESS_KEY_ID='YOUR_ACCESS_KEY_ID'" >> ~/.zshrc
            echo "export OSS_ACCESS_KEY_SECRET='YOUR_ACCESS_KEY_SECRET'" >> ~/.zshrc

         2. Run the following command to apply the changes.

            source ~/.zshrc

         3. Run the following commands to check whether the environment variables are configured.

            echo $OSS_ACCESS_KEY_ID
            echo $OSS_ACCESS_KEY_SECRET

         Bash

         1. Run the following commands to append the environment variable settings to the ~/.bash_profile file.

            echo "export OSS_ACCESS_KEY_ID='YOUR_ACCESS_KEY_ID'" >> ~/.bash_profile
            echo "export OSS_ACCESS_KEY_SECRET='YOUR_ACCESS_KEY_SECRET'" >> ~/.bash_profile

         2. Run the following command to apply the changes.

            source ~/.bash_profile

         3. Run the following commands to check whether the environment variables are configured.

            echo $OSS_ACCESS_KEY_ID
            echo $OSS_ACCESS_KEY_SECRET

   Windows

   CMD

   1. Run the following commands in the Command Prompt window.

      setx OSS_ACCESS_KEY_ID "YOUR_ACCESS_KEY_ID"
      setx OSS_ACCESS_KEY_SECRET "YOUR_ACCESS_KEY_SECRET"

      1. Run the following commands to check whether the environment variables are configured.

         echo %OSS_ACCESS_KEY_ID%
         echo %OSS_ACCESS_KEY_SECRET%

   PowerShell

   1. Run the following commands in PowerShell.

      [Environment]::SetEnvironmentVariable("OSS_ACCESS_KEY_ID", "YOUR_ACCESS_KEY_ID", [EnvironmentVariableTarget]::User)
      [Environment]::SetEnvironmentVariable("OSS_ACCESS_KEY_SECRET", "YOUR_ACCESS_KEY_SECRET", [EnvironmentVariableTarget]::User)

      1. Run the following commands to check whether the environment variables are configured.

         [Environment]::GetEnvironmentVariable("OSS_ACCESS_KEY_ID", [EnvironmentVariableTarget]::User)
         [Environment]::GetEnvironmentVariable("OSS_ACCESS_KEY_SECRET", [EnvironmentVariableTarget]::User)

Initialize the client

Before you run the sample code, replace placeholders such as <region-id> with your actual region and endpoint, such as ap-southeast-1.

<?php

/**
 * Complete guide to OSS SDK for PHP 2.0 client configuration
 *
 * ===========================================
 * V4 signature and region configuration
 * ===========================================
 * • OSS SDK for PHP 2.0 uses the V4 signature algorithm by default.
 * • You must specify an Alibaba Cloud region ID when initializing the client.
 * • For a list of region IDs, see Regions and endpoints.
 *
 * ===========================================
 * Endpoint configuration
 * ===========================================
 * • The SDK lets you customize the service endpoint by using the endpoint parameter.
 * • If you omit the endpoint, the SDK automatically constructs a public endpoint from the region information.
 * • For example, if the region is '<region-id>', the constructed endpoint is 'https://oss-<region-id>.aliyuncs.com'.
 *
 * ===========================================
 * Protocol selection
 * ===========================================
 * • The SDK uses HTTPS by default to construct endpoints, which is the recommended protocol.
 * • To use the HTTP protocol, include http:// in the endpoint.
 * • HTTPS example: 'https://oss-<region-id>.aliyuncs.com'
 * • HTTP example: 'http://oss-<region-id>.aliyuncs.com'
 */

// Import the autoloader to correctly load dependencies.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// EnvironmentVariableCredentialsProvider reads the AccessKey ID and AccessKey Secret from environment variables.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

# Load the default SDK configurations and set the credential provider.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider(credentialsProvider: $credentialsProvider);

// Method 1: Specify only the region (recommended). The SDK automatically constructs an HTTPS endpoint.
$cfg->setRegion(region: "<region-id>");

// // Method 2: Specify both the region and the endpoint.
// $cfg->setRegion(region: '<region-id>')->setEndpoint(endpoint: 'https://oss-<region-id>.aliyuncs.com');

// Create an OSS client instance.
$client = new Oss\Client($cfg);

// The data to upload.
$data = 'Hello OSS';

// Create a PutObjectRequest object to upload an object.
$request = new Oss\Models\PutObjectRequest(
                bucket: "Your Bucket Name",
                key: "Your Object Key",
            );
$request->body = Oss\Utils::streamFor($data); // Set the request body to a data stream.

// Perform the upload operation.
$result = $client->putObject($request);

// Print the upload result.
printf(
    'status code: %s' . PHP_EOL . // The HTTP status code.
    'request id: %s' . PHP_EOL .  // The request ID.
    'etag: %s' . PHP_EOL,         // The ETag of the object.
    $result->statusCode,
    $result->requestId,
    $result->etag
);

Expected output on successful upload:

status code: 200
request id: 687F2BEEDC44E0313527BA07
etag: "F0F18C2C66AE1DD512BDCD4366F76DA3"

Client configurations

Use a custom domain name

To enable browser file preview and CDN acceleration, bind a custom domain name to your bucket.

<?php

// Include the autoloader file to load dependencies.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Use EnvironmentVariableCredentialsProvider to obtain the AccessKey ID and AccessKey Secret from environment variables. $credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider(); // Load the default SDK configuration and set the credential provider. $cfg = Oss\Config::loadDefault(); $cfg->setCredentialsProvider(credentialsProvider: $credentialsProvider); // Specify your custom domain name, such as www.example-***.com. // Note: setUseCname must be set to true to use a custom domain name. // Calling the PutCname operation requires PHP 8 or later. $cfg->setRegion('<region-id>')->setEndpoint('www.example-***.com')->setUseCname(true); // Create an OSS client instance. $client = new Oss\Client($cfg); // Use the created client for subsequent operations...

Timeout control

<?php

// Load dependencies from the autoload file.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Read the AccessKey ID and AccessKey secret from environment variables.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

# Load the default SDK configuration.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider(credentialsProvider: $credentialsProvider); // Set the credential provider.

$cfg->setRegion(region: "<region-id>");

# Set the connection timeout.
$cfg->setConnectTimeout(connectTimeout: 30);

# Set the read/write timeout.
$cfg->setReadwriteTimeout(readwriteTimeout:30);

// Create an OSS client instance.
$client = new Oss\Client($cfg);

// Use the created client for subsequent operations...

Maximum retry attempts

The OSSClient retries failed requests 3 times by default.

For high-concurrency or unstable network scenarios, increase retries with setRetryMaxAttempts.

<?php

// Include the autoload file to ensure that dependencies are correctly loaded.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Use EnvironmentVariableCredentialsProvider to read the AccessKey ID and AccessKey secret from environment variables.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

# Load the default SDK configuration and set the credential provider.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider(credentialsProvider: $credentialsProvider);

$cfg->setRegion(region: "<region-id>");

// Set the maximum number of attempts for an HTTP request. The default value is 3.
$cfg->setRetryMaxAttempts(5);

// Create an OSS client instance.
$client = new Oss\Client($cfg);

// Use the created client for subsequent operations...

HTTP/HTTPS protocol

You can use setDisableSSL(true) to disable the HTTPS protocol.

<?php

// Import the autoload file to load dependencies.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Create a credential provider that reads the Access Key ID and Access Key Secret from environment variables.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

// Load the default configuration and set the credential provider.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider(credentialsProvider: $credentialsProvider);

$cfg->setRegion(region: "<region-id>");

// Disable SSL.
$cfg->setDisableSSL(true);

// Create an OSS client instance.
$client = new Oss\Client($cfg);

// Use the client for OSS operations.

Use coroutines in the Swoole framework

The following code provides an example of how to create an OSS client that supports coroutines based on the Swoole framework.

<?php
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;
use GuzzleHttp\HandlerStack;
use Hyperf\Guzzle\CoroutineHandler;
use function Hyperf\Coroutine\co;

// Configure the OSS client.
$region = '<region-id>'; // The OSS region.
$bucket = 'bucket-name'; // The destination bucket.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider(); // Load credentials from environment variables.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider(credentialsProvider: $credentialsProvider); // Set the credential provider.
$cfg->setRegion(region: $region); // Set the region.
$cfg->setEndpoint(endpoint: 'http://oss-<region-id>.aliyuncs.com'); // Set the endpoint.

// Create an OSS client that supports coroutines.
$client = new Oss\Client(config: $cfg, options: ['handler' => HandlerStack::create(handler: new CoroutineHandler())]);

// Coroutine task 1: Upload swoole.txt.
co(function () use ($client, $bucket) {
    try {
        $key = 'swoole.txt'; // The object name.
        $data = 'Hello OSS'; // The object content.
        $request = new Oss\Models\PutObjectRequest($bucket, $key); // Create an upload request.
        $request->body = Oss\Utils::streamFor($data); // Set the request body.
        $result = $client->putObject(request: $request); // Perform the upload.
        echo "Task 1 Result:\n" . var_export($result, true) . "\n"; // Print the result.
    } catch (\Exception $e) {
        echo "Task 1 Error: " . $e->getMessage() . "\n"; // Catch the exception.
    }
});

// Coroutine task 2: Upload hyperf.txt.
co(function () use ($client, $bucket) {
    try {
        $key = 'hyperf.txt'; // The object name.
        $data = 'Hello OSS'; // The object content.
        $request = new Oss\Models\PutObjectRequest($bucket, $key); // Create an upload request.
        $request->body = Oss\Utils::streamFor($data); // Set the request body.
        $result = $client->putObject($request); // Perform the upload.
        echo "Task 2 Result:\n" . var_export($result, true) . "\n"; // Print the result.
    } catch (\Exception $e) {
        echo "Task 2 Error: " . $e->getMessage() . "\n"; // Catch the exception.
    }
});

Use an internal endpoint

If your application is deployed on an Alibaba Cloud ECS instance and needs to frequently access OSS resources in the same region, you can use an internal endpoint to reduce traffic costs and improve access speed.

<?php

// Include the autoload file to load dependencies correctly.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Create a credential provider that reads the AccessKey ID and AccessKey Secret from environment variables.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

# Load the default SDK config and set the credential provider.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider(credentialsProvider: $credentialsProvider);

// Method 1: Specify the region and set setUseInternalEndpoint to true.
$cfg->setRegion('<region-id>')->setUseInternalEndpoint(true);

// // Method 2: Directly specify the region and endpoint.
// // Specify the internal endpoint for the region where the bucket is located.
// // To use the HTTP protocol, set the endpoint to 'http://oss-<region-id>-internal.aliyuncs.com'.
// $cfg->setRegion('<region-id>')->setEndpoint('https://oss-<region-id>-internal.aliyuncs.com');

// Create an OSS client instance.
$client = new Oss\Client($cfg);

// Use the created client for subsequent operations...

Use an acceleration endpoint

<?php

// Load project dependencies.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Read the AccessKey ID and AccessKey Secret from environment variables.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

# Load the default SDK configuration and set the credential provider.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider(credentialsProvider: $credentialsProvider);

// Method 1: Specify the region and set setUseAccelerateEndpoint to true.
$cfg->setRegion('<region-id>')->setUseAccelerateEndpoint(true);

// // Method 2: Directly specify the region and endpoint.
// // Specify the regional acceleration endpoint.
// $cfg->setRegion('<region-id>')->setEndpoint('https://oss-accelerate.aliyuncs.com');

// Create an OSS client.
$client = new Oss\Client($cfg);

// Use this client for subsequent operations.

Use a private domain

<?php

// Import the autoload file to load dependencies.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Create a credential provider that reads the AccessKey ID and AccessKey Secret from environment variables.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

# Load the default SDK configurations and set the credential provider.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider(credentialsProvider: $credentialsProvider);

// Specify the region and set the endpoint to your private domain.
$cfg->setRegion('<region-id>')->setEndpoint('https://service.corp.example.com');

// Create an OSS client instance.
$client = new Oss\Client($cfg);

// Use the created client for subsequent operations...

Use an Alibaba Gov Cloud endpoint

The following code provides an example of how to configure the OSSClient using an Government cloud endpoint.

<?php

// Import the autoload file to ensure that dependencies are correctly loaded.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Use EnvironmentVariableCredentialsProvider to read the AccessKey ID and AccessKey secret from environment variables.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

# Load the default SDK configurations and set the credential provider.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider(credentialsProvider: $credentialsProvider); // Set the credential provider.

// Specify the region where the bucket is located. For example, for China (Beijing) Alibaba Gov Cloud 1, set the region to cn-north-2-gov-1.
// Specify the internal endpoint of the bucket's region. For example, for China (Beijing) Alibaba Gov Cloud 1, set the endpoint to 'https://oss-cn-north-2-gov-1-internal.aliyuncs.com'.
// To use the HTTP protocol, set the endpoint to 'http://oss-cn-north-2-gov-1-internal.aliyuncs.com'.
$cfg->setRegion('cn-north-2-gov-1')->setEndpoint('https://oss-cn-north-2-gov-1-internal.aliyuncs.com');

// Create an OSS client instance.
$client = new Oss\Client($cfg);

// Use the created client for subsequent operations.

Access credential configurations

Select a credential method based on your authentication requirements.

Use the AccessKey pair of a RAM user

Initialize the credential provider with the AccessKey pair of an Alibaba Cloud account or a RAM user. Suitable for secure environments that require long-term OSS access without frequent credential rotation. This method requires manual AccessKey maintenance, which increases security risks.

<?php

// Include the autoload file to ensure that dependencies are correctly loaded.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

$region = "<region-id>";

# Create a static credential provider and set your RAM user's AccessKey ID and AccessKey secret.
$credentialsProvider = new Oss\Credentials\StaticCredentialsProvider("RAM AccessKey ID","RAM AccessKey Secret");

// Use the default SDK configurations.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider($credentialsProvider); // Set the credential provider.
$cfg->setRegion($region); // Set the bucket's region.

// Create an OSS client instance.
$client = new Oss\Client($cfg);

// Use the created client for subsequent operations...

Use an STS token

If your application requires temporary access to OSS, you can initialize the credential provider using the temporary identity credentials (AccessKey ID, AccessKey secret, and Security Token Service (STS) token) obtained from STS. Note that this method requires you to manually maintain an STS token, which increases security risks and maintenance complexity. In addition, if you want to temporarily access OSS multiple times, you must manually refresh the STS token.

<?php

// Import the autoload file to ensure that dependencies are correctly loaded.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

$region = "<region-id>";

# Specify your temporary AccessKey ID and AccessKey secret. Do not use the AccessKey pair of your Alibaba Cloud account.
# The AccessKey ID from STS starts with "STS.".
$stsAccessKeyId = 'STS.****************';
$stsAccessKeySecret = 'yourAccessKeySecret';
# Specify your security token.
$stsSecurityToken = 'yourSecurityToken';

# Create a static credential provider and explicitly set the temporary AccessKey ID, AccessKey secret, and security token.
$credentialsProvider = new Oss\Credentials\StaticCredentialsProvider($stsAccessKeyId, $stsAccessKeySecret, $stsSecurityToken);

// Use the default SDK configuration.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider($credentialsProvider); // Set the credential provider.
$cfg->setRegion($region); // Set the region where the bucket is located.

// Create an OSS client instance.
$client = new Oss\Client($cfg);

// Use the created client for subsequent operations...

Use a RAM role ARN

For cross-account access or delegated authorization, initialize the credential provider with a RAM role ARN. The Credentials tool automatically obtains and refreshes STS tokens by calling AssumeRole. You can optionally assign a policy parameter to restrict the role's permissions.

1. Add the Alibaba Cloud credentials library credentials-php.

   composer require alibabacloud/credentials

2. Configure the AccessKey pair and RAM role ARN as access credentials.

   <?php
   
   // Include the autoload file to ensure that dependencies are loaded correctly.
   require_once __DIR__ . '/../vendor/autoload.php';
   
   use AlibabaCloud\Oss\V2 as Oss;
   use AlibabaCloud\Credentials\Credential;
   
   // Create a configuration object to define the credential type and related information.
   $config = new Credential\Config([
       // Specify the credential type. In this example, the RAM role ARN type is used.
       'type' => 'ram_role_arn',
   
       // The AccessKey ID of the Alibaba Cloud account.
       'accessKeyId' => 'AccessKeyId',
   
       // The AccessKey secret of the Alibaba Cloud account.
       'accessKeySecret' => 'AccessKeySecret',
   
       // The ARN of the RAM role. Example: acs:ram::USER_Id:role/ROLE_NAME.
       'roleArn' => 'RoleArn',
   
       // The role session name, used to identify the session.
       'roleSessionName' => 'yourRoleSessionName',
   
       // Optional. The policy used to limit the permissions of the STS token.
       'policy' => 'Policy',
   ]);
   
   // Initialize a credential instance with the configuration object.
   $credential = new Credential($config);
   
   // Load the default SDK configuration.
   $cfg = Oss\Config::loadDefault();
   
   // Set the credential provider to dynamically generate credentials with a callback function.
   $cfg->setCredentialsProvider(new Oss\Credentials\CredentialsProviderFunc(function () use ($credential) {
       // Obtain the temporary credentials (STS token).
       $cred = $credential->getCredential();
   
       // Return a credential object containing the AccessKey ID, AccessKey secret, and security token.
       return new Oss\Credentials\Credentials(
           accessKeyId: $cred->getAccessKeyId(),       // The temporary AccessKey ID.
           accessKeySecret: $cred->getAccessKeySecret(),   // The temporary AccessKey secret.
           securityToken: $cred->getSecurityToken()      // The security token (STS token).
       );
   }));
   
   $region = '<region-id>';
   $cfg->setRegion($region);
   
   // Create an OSS client instance.
   $client = new Oss\Client($cfg);
   
   // Use the client for subsequent operations...

Use an instance RAM role

For applications on ECS instances, ECI instances, or Container Service for Kubernetes worker nodes, use an instance RAM role. This method automatically refreshes STS tokens within your Container Service for Kubernetes instance without requiring an AccessKey pair. CreateRole.

1. Add the Alibaba Cloud credentials library credentials-php.

   composer require alibabacloud/credentials

2. Configure the instance RAM role as the access credential.

   <?php
   
   // Import the autoload file to ensure that dependencies are correctly loaded.
   require_once 'vendor/autoload.php';
   
   use AlibabaCloud\Oss\V2 as Oss;
   use AlibabaCloud\Credentials\Credential;
   
   // Create a configuration object for the credential type.
   $config = new Credential\Config([
       // Set the credential type. For an instance RAM role, this value must be 'ecs_ram_role'.
       'type' => 'ecs_ram_role',
   
       // The name of the RAM role attached to the instance.
       'roleName' => "<role_name>",  // Replace with your actual RAM role name.
   ]);
   
   // Initialize the credential instance.
   $credential = new Credential($config);
   
   // Load the default OSS configuration.
   $cfg = Oss\Config::loadDefault();
   
   // Set the credential provider to a function that dynamically generates credentials.
   $cfg->setCredentialsProvider(new Oss\Credentials\CredentialsProviderFunc(function () use ($credential) {
       // Get the temporary STS token.
       $cred = $credential->getCredential();
   
       // Return a new credential object with the AccessKey ID, AccessKey secret, and security token.
       return new Oss\Credentials\Credentials(
           accessKeyId: $cred->getAccessKeyId(),       // Temporary AccessKey ID
           accessKeySecret: $cred->getAccessKeySecret(), // Temporary AccessKey secret
           securityToken: $cred->getSecurityToken()   // Security token
       );
   }));
   
   $region = '<region-id>';
   $cfg->setRegion($region);
   
   // Create an OSS client instance.
   $client = new Oss\Client($cfg);
   
   // Use the created client for subsequent operations...
   

Use an OIDC role ARN

For untrusted applications in Container Service for Kubernetes (ACK) pods that should not access the worker node's instance RAM role, use RAM Roles for Service Account (RRSA). ACK mounts an OIDC token file per pod and injects configuration into environment variables. The Credentials tool reads these variables and calls AssumeRoleWithOIDC to obtain an STS token with minimal permissions. No AccessKey pair required. Use RRSA to configure RAM permissions for a ServiceAccount and isolate pod permissions.

Use custom access credentials

If the preceding credential configuration methods do not meet your requirements, you can customize the method to obtain credentials. The SDK supports multiple implementation methods.

1. Use Oss\Credentials\CredentialsProviderFunc

   Oss\Credentials\CredentialsProviderFunc is a usability wrapper for Oss\Credentials\CredentialsProvider.

   <?php
   
   // Import the autoload file to ensure that dependencies are correctly loaded.
   require_once 'vendor/autoload.php';
   
   // Import the necessary namespaces.
   use AlibabaCloud\Oss\V2 as Oss;
   use AlibabaCloud\Oss\V2\Credentials\Credentials;
   
   // Create a credential provider that dynamically generates a credential by using an anonymous function.
   $provider = new Oss\Credentials\CredentialsProviderFunc(
       function () {
           // Return a long-term credential, which contains only an AccessKey ID and an AccessKey secret.
           return new Credentials(
               accessKeyId: 'id',         // Replace with the actual RAM AccessKey ID.
               accessKeySecret: 'secret'  // Replace with the actual RAM AccessKey secret.
           );
   
           // To return a temporary credential, which includes a security token, uncomment the following code and replace the values.
           /*
           return new Credentials(
               accessKeyId: 'id',          // Replace with the actual STS temporary credential AccessKey ID.
               accessKeySecret: 'secret', // Replace with the actual STS temporary credential AccessKey secret.
               securityToken: 'token'     // Replace with the actual STS security token.
           );
           */
       }
   );
   
   // Load the default configuration and get the OSS configuration object.
   $cfg = Oss\Config::loadDefault();
   
   // Set the credential provider to the dynamically generated provider.
   $cfg->setCredentialsProvider($provider);
   
   $region = '<region-id>';
   $cfg->setRegion($region);
   
   // Create an OSS client instance.
   $client = new Oss\Client($cfg);
   
   // Use the created client for subsequent operations...
   

2. Implement Oss\Credentials\CredentialsProvider

   <?php
   
   // Import the autoload file to ensure that dependencies are correctly loaded.
   require_once 'vendor/autoload.php';
   
   // Import the necessary namespaces.
   use AlibabaCloud\Oss\V2 as Oss;
   use AlibabaCloud\Oss\V2\Credentials\Credentials;
   
   // Custom credential provider class that implements the CredentialsProvider interface.
   class CustomerCredentialsProvider implements Oss\Credentials\CredentialsProvider
   {
       /**
        * Gets the credential object.
        *
        * @return Credentials Returns a credential object.
        */
       public function getCredentials(): Credentials
       {
           // Return a long-term credential, which contains only an AccessKey ID and an AccessKey secret.
           return new Credentials(
               accessKeyId: 'id',         // Replace with the actual RAM AccessKey ID.
               accessKeySecret: 'secret'  // Replace with the actual RAM AccessKey secret.
           );
   
           // To return a temporary credential, which includes a security token, uncomment the following code and replace the values.
           /*
           return new Credentials(
               accessKeyId: 'id',          // Replace with the actual STS temporary credential AccessKey ID.
               accessKeySecret: 'secret', // Replace with the actual STS temporary credential AccessKey secret.
               securityToken: 'token'     // Replace with the actual STS security token.
           );
           */
       }
   }
   
   // Instantiate the custom credential provider.
   $provider = new CustomerCredentialsProvider();
   
   // Load the default configuration and get the OSS configuration object.
   $cfg = Oss\Config::loadDefault();
   
   // Set the credential provider to the custom provider instance.
   $cfg->setCredentialsProvider($provider);
   
   $region = '<region-id>';
   $cfg->setRegion($region);
   
   // Create an OSS client instance.
   $client = new Oss\Client($cfg);
   
   // Use the created client for subsequent operations...
   

Troubleshoot errors

When an error occurs, OSS returns an HTTP status code, message, request ID, and error code (EC). Use the EC to diagnose the issue.

Sample code

The following table lists sample code for common operations.