AWSRunbook 0/2 done
InvalidClientTokenId
AWS Error InvalidClientTokenId: Invalid client token id
Error✕ Not retryable · fix the payloadHTTP 403 ForbiddenAPI Gateway
TL;DR · 10-second read
The access key id is unknown, deactivated, or temporary credentials are sent without their session token (or to a Region not enabled for the account). Rotate keys and check which profile is active.
Identify: does your log match?
What you see · exact log / response
An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid.
Fix
Being written
Copy-paste fixes for InvalidClientTokenId are in the enrichment queue
The summary above is verified. Paste your full trace into the decoder for a diagnosis now.
Open the decoder →Related errors
Last verified 2026-10-13 · Source: botocore service models (errors per operation) · Official docs ↗ · ~4,400 searches/mo