All Products
Search

This Product

    Object Storage Service:Log on to ossbrowser 2.0

    Document Center

    Object Storage Service:Log on to ossbrowser 2.0

    Last Updated:Mar 20, 2026

    ossbrowser 2.0 supports four logon methods. Choose one based on who needs access and how long they need it.

    Prerequisites

    Before you begin, make sure the account you use has the required permissions:

    • Alibaba Cloud account: Full permissions on all resources by default. No additional configuration needed.

    • RAM user: At least oss:ListBuckets, oss:ListObjects, and oss:GetBucketInfo permissions for all buckets.

    • Security Token Service (STS) temporary access credential: At least oss:ListObjects and oss:GetBucketInfo permissions for the target bucket.

    • Authorization code: Permissions configured by the Alibaba Cloud account owner or a Resource Access Management (RAM) administrator using the File Authorization operation.

    Choose a logon method

    Logon methodBest forCredential requiredLimitations
    Log On With AKResource owners or team members who need long-term, persistent accessAccessKey ID + AccessKey secret—
    Log On With AccountResource owners or team members who prefer daily security verification (QR code scan or verification code)Alibaba Cloud account / RAM user account / mobile phoneDoes not support File Authorization
    Log on with STSTeam members who need temporary access to your OSS resourcesSTS temporary access credential—
    Log On With Authorization CodeTeam members who need temporary or permanent access to specific OSS resources you have authorizedAuthorization code—

    Log on

    Log on with AK

    Use the AccessKey information of an Alibaba Cloud account or a RAM user. For improved security, log on using a RAM user's AccessKey.

    Log on with an Alibaba Cloud account

    1. Get your AccessKey pair.

      • Already have one: Use the AccessKey ID and AccessKey secret saved when you created the pair.

      • Need to create one: Go to the Create AccessKey page. Click Create AccessKey and follow the instructions. After creation, click Download CSV File to save the credentials locally.

    2. Click Log On With AK. Enter the AccessKey ID and AccessKey secret.

    image

    Create and log on with a new RAM user

    To create a RAM user, use an account with RAM management permissions, such as an Alibaba Cloud account.

    1. Create a RAM user.

      1. Go to the Create User page and follow the console instructions to create a RAM user. > Note: For detailed steps, see Create a RAM user.

      2. Click Download CSV File to save the AccessKey information. Keep this file secure.

    2. Grant permissions to the RAM user.

      1. On the Users page, find the user and click Permission Management > Add Permissions.

      2. Search for and add the required ossbrowser 2.0 operation permissions, along with AliyunRAMFullAccess and AliyunSTSAssumeRoleAccess. > Note: For more information, see Grant permissions to a RAM user and Create custom policies.

    3. Click Log On With AK. Enter the AccessKey ID and AccessKey secret from the CSV file.

    image

    Log on with an existing RAM user

    1. Get the RAM user's AccessKey pair.

      • Already have one: Use the AccessKey ID and AccessKey secret saved locally.

      • Need to create one: Log on to the Alibaba Cloud console as the target RAM user. Go to the Users page, click the user, and click Create AccessKey. After creation, click Download CSV File to save the credentials.

    2. Confirm OSS permissions.

      1. On the Users page, select the user and click Permission Management to check OSS access.

      2. If OSS permissions are missing, click Add Permissions and add AliyunOSSFullAccess, AliyunRAMFullAccess, and AliyunSTSAssumeRoleAccess. > Note: For more information, see Grant permissions to a RAM user and Create custom policies.

    3. Click Log On With AK. Enter the RAM user's AccessKey ID and AccessKey secret.

    image

    Log on with Account

    1. Click Log On With Account.

      image

    2. On the Alibaba Cloud Logon Page, switch to full screen mode. In the upper-right corner, select alibabacloud.com (international site), then choose your preferred logon method: scan a QR code using the Alibaba Cloud app, Alipay, or DingTalk, or log in with an Alibaba Cloud account, RAM user account, or mobile phone verification code.

    Log on with STS

    Important

    The STS Token field appears only when the AccessKeyID value matches the STS.***** format.

    1. Get an STS temporary access credential. For details, see Use an STS temporary access credential to access OSS.

    2. Click Log On With AK. Enter the AccessKey ID, AccessKey secret, and SecurityToken from the temporary access credential.

      image

    Log on with Authorization Code

    1. Get an authorization code from the resource owner. For details, see File Authorization.

    2. Click Log On With Authorization Code and enter the authorization code.

      image

    Configure the endpoint

    Important

    Accelerated domain names are not supported for logging on to ossbrowser 2.0.

    Select the endpoint type that matches your environment.

    EndpointUse caseLimitationsScreenshot
    Public EndpointLocal machine access—image
    Internal Same-region EndpointAlibaba Cloud internal network (e.g., ECS). The ECS instance and target bucket must be in the same region. See Create an ECS instance.—image
    Specified Domain NameAccess via a specific domain name, such as a Transfer Acceleration Endpoint. See Enable transfer acceleration.Cannot switch to other buckets after logon.image
    Custom Domain NameAccess OSS resources through a custom domain name attached to OSS. See Attach a custom domain name.—image
    PrivateLinkSecure private connection from an ECS instance. The ECS instance and endpoint must be in the same virtual private cloud (VPC), and the ECS instance and target bucket must be in the same region. Enter the Endpoint Service Domain Name. See Create an endpoint.Cannot switch to other buckets after logon — specify the preset OSS path before logging on.image
    CloudBoxCloudBox environment. Enter the data endpoint of your CloudBox.File Authorization is not supported.image

    Configure the preset OSS path

    If you have permissions on only some resources in a bucket, specify the OSS resource path.

    Access scopePath formatExample
    Entire bucketbucketnameimage
    Specific folderbucketname/folderimage
    Specific filebucketname/folder/fileimage

    Configure the bucket region

    Important

    Configure the preset OSS path before setting the bucket region when accessing a specific bucket.

    Endpoint typeHow to set the region
    Public Endpoint / Internal Same-region EndpointClick Advanced Settings in the upper-right corner of the logon page, then select the region under Default Region. See image image
    Specified Domain Name / Custom Domain Name / PrivateLinkSelect the region from the Default Region drop-down list. See image

    Other settings

    SettingDescription
    Pay-by-requester ModeEnable this if the bucket has pay-by-requester mode enabled and you are not the bucket owner. Go to Advanced Settings to turn it on. Without this setting, accessing the preset OSS path returns an AccessDenied error. When enabled, you (the requester) are charged for traffic, requests, and other access fees. For details, see Pay by requester.
    Keep Me Logged Inossbrowser 2.0 keeps you logged in automatically on next launch.
    Save SessionSaves the AccessKey pair. On next logon, click AK History to select a saved key.
    Warning

    Do not use this on a shared or temporary computer.

    Verify the result

    After a successful logon, you'll see the ossbrowser 2.0 main interface.

    image

    To get started with common tasks, see Common operations.

    Required permissions by operation

    After logging on with a RAM user or STS credential, configure the appropriate access policies for each operation. For help creating policies, see Create custom policies and Grant permissions to a RAM user.

    OperationPermissionNotes
    Log on — list all bucketsoss:ListBucketsNot required if accessing only a specific bucket, but the bucket list won't be visible.
    Log on — view file listoss:ListObjectsRequired to see files in a bucket.
    Log on — access via preset pathoss:GetBucketInfoRequired for preset path access. Without it, manually specify the bucket region instead.
    Manage buckets — view listoss:ListBuckets—
    Manage buckets — createoss:PutBucket—
    Manage buckets — view detailsoss:GetBucketInfo—
    Manage buckets — deleteoss:DeleteBucketConfigure with caution.
    File listoss:ListObjects—
    Uploadoss:PutObject—
    Download filesoss:GetObject—
    Download foldersoss:ListObjects—
    Copy / move across bucketsoss:ListBucketsRequired when copying and moving objects across buckets.
    Copy / move / rename foldersoss:ListObjectsRequired when copying, moving, and renaming folders.
    Copy / move — read sourceoss:GetObjectRequired for the source bucket.
    Copy / move — write destinationoss:PutObjectRequired for the destination bucket.
    Move / rename — delete sourceoss:DeleteObjectRequired for the source bucket; without it, source files cannot be deleted.
    Copy / move — versioning checkoss:GetBucketInfoossbrowser 2.0 calls GetBucketInfo to check versioning status. Without this permission, an error appears — close the dialog to continue. If versioning is enabled, Skip and Ask policies have no effect; files are always overwritten.
    Delete filesoss:DeleteObjectConfigure with caution.
    Delete foldersoss:ListObjects + oss:DeleteObjectListObjects is required to enumerate folder contents before deletion.
    Fragmentation management — viewoss:ListParts—
    Fragmentation management — deleteoss:ListMultipartUploads—
    File restorationoss:RestoreObjectFor Archive Storage, Cold Archive, or Deep Cold Archive storage classes.

    What's next