title: PUT request to google cloud storage signed URL generated by Shopify throws error MalformedSecurityHeader
body: <p>I'm trying to upload a .glb file to a product in a Shopify store through Shopify GraphQL Admin API. For that, it first returns a google cloud storage signed URL, to where I should upload my file through an HTTP PUT request. After uploading, I should attach the same URL to the product with another API call.</p>
  <p>This question is about that file uploading to the cloud storage signed URL. I include all these details to make this question easy to be getting answered. <strong>So, please read till the end</strong>.</p>
  <ol>
  <li>What data Shopify provides me with is mentioned below.</li>
  </ol>
  <pre><code>{
    &quot;data&quot;: {
      &quot;stagedUploadsCreate&quot;: {
        &quot;stagedTargets&quot;: [
          {
            &quot;parameters&quot;: [
              {
                &quot;name&quot;: &quot;GoogleAccessId&quot;,
                &quot;value&quot;: &quot;threed-model-service--6bgx7cbe@shopify-applications.iam.gserviceaccount.com&quot;
              },
              {
                &quot;name&quot;: &quot;key&quot;,
                &quot;value&quot;: &quot;models/a6436c066064bac3/windmill.glb&quot;
              },
              {
                &quot;name&quot;: &quot;policy&quot;,
                &quot;value&quot;: &quot;eyJleHBpcmF0aW9uIjoiMjAyMC0wNy0yMVQwOToxNjoxMFoiLCJjb25kaXRpb25zIjpbWyJlcSIsIiRidWNrZXQiLCJ0aHJlZWQtbW9kZWxzLXByb2R1Y3Rpb24iXSxbImVxIiwiJGtleSIsIm1vZGVscy9hNjQzNmMwNjYwNjRiYWMzL3dpbmRtaWxsLmdsYiJdLFsiY29udGVudC1sZW5ndGgtcmFuZ2UiLDE5NzE3MiwxOTcxNzJdXX0=&quot;
              },
              {
                &quot;name&quot;: &quot;signature&quot;,
                &quot;value&quot;: &quot;vz+OdcEmD9Kbv2FbXdxWNUk59XO2GmXzhvtDswXbDQNcyZpUufI85z5x2PFGv/XZ+tSBsl/S393pmy0Bu9xG7oVgOZcMIWEbOIm9kXgQunbjKQY3Ff3BBpMocB0xazzlYmckZozdJ8ZZkyox/c/gEe1QaxqW4+419iufuFHy4Bp3LL/aUr+ATNChwn9Dn8+XnHMOckZxDlbiggcF3dx+yBuTFia8FneaVSiU0M5DIWmHqHb2YDCV0KtEP6jfTj/PQVUjS8pn8EGhrRaMx7Q2A5G8Pycgc9H35hqJnnUKCTa3AYeyI45RbhddYnIWw9YrAADXuQYlVCo6LYBHjxsCWA==&quot;
              }
            ],
            &quot;resourceUrl&quot;: &quot;https://storage.googleapis.com/threed-models-production/models/a6436c066064bac3/windmill.glb?external_model3d_id=bW9kZWwzZC00MDg5Ng==&quot;,
            &quot;url&quot;: &quot;https://storage.googleapis.com/threed-models-production/models/a6436c066064bac3/windmill.glb?external_model3d_id=bW9kZWwzZC00MDg5Ng==&quot;
          }
        ],
        &quot;userErrors&quot;: []
      }
    }
  }
  </code></pre>
  <ol start="2">
  <li>Using these parameters, I construct a signed URL as follows.</li>
  </ol>
  <pre><code>resourceUrl+&quot;&amp;signature=&quot;+signature+&quot;&amp;key=&quot;+key+&quot;&amp;policy=&quot;+policy+&quot;&amp;GoogleAccessId=&quot;+GoogleAccessId
  </code></pre>
  <p>Eg:</p>
  <p><a href="https://storage.googleapis.com/threed-models-production/models/a6436c066064bac3/windmill.glb?external_model3d_id=bW9kZWwzZC00MDg5Ng==&amp;signature=vz+OdcEmD9Kbv2FbXdxWNUk59XO2GmXzhvtDswXbDQNcyZpUufI85z5x2PFGv/XZ+tSBsl/S393pmy0Bu9xG7oVgOZcMIWEbOIm9kXgQunbjKQY3Ff3BBpMocB0xazzlYmckZozdJ8ZZkyox/c/gEe1QaxqW4+419iufuFHy4Bp3LL/aUr+ATNChwn9Dn8+XnHMOckZxDlbiggcF3dx+yBuTFia8FneaVSiU0M5DIWmHqHb2YDCV0KtEP6jfTj/PQVUjS8pn8EGhrRaMx7Q2A5G8Pycgc9H35hqJnnUKCTa3AYeyI45RbhddYnIWw9YrAADXuQYlVCo6LYBHjxsCWA==&amp;key=models/a6436c066064bac3/windmill.glb&amp;policy=eyJleHBpcmF0aW9uIjoiMjAyMC0wNy0yMVQwOToxNjoxMFoiLCJjb25kaXRpb25zIjpbWyJlcSIsIiRidWNrZXQiLCJ0aHJlZWQtbW9kZWxzLXByb2R1Y3Rpb24iXSxbImVxIiwiJGtleSIsIm1vZGVscy9hNjQzNmMwNjYwNjRiYWMzL3dpbmRtaWxsLmdsYiJdLFsiY29udGVudC1sZW5ndGgtcmFuZ2UiLDE5NzE3MiwxOTcxNzJdXX0=&amp;GoogleAccessId=threed-model-service--6bgx7cbe@shopify-applications.iam.gserviceaccount.com" rel="nofollow noreferrer">https://storage.googleapis.com/threed-models-production/models/a6436c066064bac3/windmill.glb?external_model3d_id=bW9kZWwzZC00MDg5Ng==&amp;signature=vz+OdcEmD9Kbv2FbXdxWNUk59XO2GmXzhvtDswXbDQNcyZpUufI85z5x2PFGv/XZ+tSBsl/S393pmy0Bu9xG7oVgOZcMIWEbOIm9kXgQunbjKQY3Ff3BBpMocB0xazzlYmckZozdJ8ZZkyox/c/gEe1QaxqW4+419iufuFHy4Bp3LL/aUr+ATNChwn9Dn8+XnHMOckZxDlbiggcF3dx+yBuTFia8FneaVSiU0M5DIWmHqHb2YDCV0KtEP6jfTj/PQVUjS8pn8EGhrRaMx7Q2A5G8Pycgc9H35hqJnnUKCTa3AYeyI45RbhddYnIWw9YrAADXuQYlVCo6LYBHjxsCWA==&amp;key=models/a6436c066064bac3/windmill.glb&amp;policy=eyJleHBpcmF0aW9uIjoiMjAyMC0wNy0yMVQwOToxNjoxMFoiLCJjb25kaXRpb25zIjpbWyJlcSIsIiRidWNrZXQiLCJ0aHJlZWQtbW9kZWxzLXByb2R1Y3Rpb24iXSxbImVxIiwiJGtleSIsIm1vZGVscy9hNjQzNmMwNjYwNjRiYWMzL3dpbmRtaWxsLmdsYiJdLFsiY29udGVudC1sZW5ndGgtcmFuZ2UiLDE5NzE3MiwxOTcxNzJdXX0=&amp;GoogleAccessId=threed-model-service--6bgx7cbe@shopify-applications.iam.gserviceaccount.com</a></p>
  <ol start="3">
  <li>Then I try to make a PUT request to this URL with the .glb file in POSTman as shown in this image --&gt;
  <a href="https://i.stack.imgur.com/pRZW9.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pRZW9.png" alt="enter image description here" /></a></li>
  </ol>
  <p>with the following headers.</p>
  <p><a href="https://i.stack.imgur.com/mMP1u.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/mMP1u.png" alt="enter image description here" /></a></p>
  <ol start="4">
  <li>But I don't get a success response. In fact, I get a 400 error with the following message.</li>
  </ol>
  <pre><code>&lt;?xml version='1.0' encoding='UTF-8'?&gt;
  &lt;Error&gt;
      &lt;Code&gt;MalformedSecurityHeader&lt;/Code&gt;
      &lt;Message&gt;Your request has a malformed header.&lt;/Message&gt;
      &lt;ParameterName&gt;signature&lt;/ParameterName&gt;
      &lt;Details&gt;Signature was not base64 encoded&lt;/Details&gt;
  &lt;/Error&gt;
  </code></pre>
  <p>Can someone point me out what I'm doing wrong here? I have been dealing with this error for days and read a lot of questions and articles, but couldn't get this to work. Therefore, any helpful suggestion is highly appreciated.</p>