diff --git a/src/main.rs b/src/main.rs
index e391117..d391967 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -98,6 +98,7 @@ fn process_config_item(options: &Options, config_item: &OSSBackupdConfigItem,
         debugging!("Access key id: {}", access_key_id);
     }
     let access_key_secret = oss_config.access_key_secret.as_ref().ok_or_else(|| "oss_config#access_key_secret".to_owned())?;
+    let security_token = None::<String>; // TODO deal with STS token ...
 
     let bucket = &oss_config.bucket.as_ref().ok_or_else(|| "oss_config#bucket".to_owned())?;
     if options.verbose {
@@ -111,7 +112,7 @@ fn process_config_item(options: &Options, config_item: &OSSBackupdConfigItem,
         debugging!("Path: {}", path);
     }
 
-    let oss_client = OSSClient::new(endpoint, access_key_id, access_key_secret);
+    let oss_client = OSSClient::new(endpoint, access_key_id, access_key_secret, security_token.as_deref());
     let backup_count = config_item.get_safe_backup_count();
     let meta_file_name = &format!("{}/ossbackupd_meta_{}_{}.json", &oss_backupd_config.get_prefix(), &oss_backupd_config.get_host(), &config_item.get_file_name());
 
diff --git a/src/oss_util.rs b/src/oss_util.rs
index 72f3ede..d91135e 100644
--- a/src/oss_util.rs
+++ b/src/oss_util.rs
@@ -22,14 +22,16 @@ pub struct OSSClient {
     pub endpoint: String,
     pub access_key_id: String,
     pub access_key_secret: String,
+    pub security_token: Option<String>,
 }
 
 impl OSSClient {
-    pub fn new(endpoint: &str, access_key_id: &str, access_key_secret: &str) -> OSSClient {
+    pub fn new(endpoint: &str, access_key_id: &str, access_key_secret: &str, security_token: Option<&str>) -> OSSClient {
         OSSClient {
             endpoint: endpoint.into(),
             access_key_id: access_key_id.into(),
             access_key_secret: access_key_secret.into(),
+            security_token: security_token.map(String::from),
         }
     }