ExpiredToken AWS Origin: Platform & cloud Last updated 15 Oct 2026

AWS: ExpiredToken — The security token included in the request is expired

Temporary AWS credentials (STS/SSO/assumed role) have expired.

Exact message you may see The security token included in the request is expiredToken has expired and refresh failed
Seen on: AWS

Meaning

Session credentials last from 15 minutes to 12 hours. Once expired, every call fails until you refresh them.

Common causes

  • SSO session expired
  • Assumed-role credentials exported as env vars and not refreshed
  • Long-running scripts outliving their session
  • Stale AWS_SESSION_TOKEN overriding a profile

⚡ Quick fix

  1. aws sso login --profile <name>
  2. Unset stale env vars: unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
  3. Use SDK credential providers that refresh automatically instead of copying keys

Detailed fix by platform

AWS

  1. On EC2/ECS/Lambda, rely on the instance/task role — the SDK refreshes credentials automatically.

How to diagnose

  1. Source — Where do credentials come from (env, profile, role)?
  2. Expiry — When were they issued?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

AccessDenied — AWS S3: AccessDenied (403) when calling GetObject / PutObject (AWS)AccessDeniedECR token expired — denied: Your authorization token has expired. Reauthenticate and try again. (Amazon ECR) (AWS)ECR token expiredFailed to serialize user into session — Passport.js: Error: Failed to serialize user into session (Authentication)Failed to serialize u…invalid csrf token — ForbiddenError: invalid csrf token (EBADCSRFTOKEN) (Authentication)invalid csrf tokenkubectl connection refused — kubectl: The connection to the server localhost:8080 was refused — did you specify the right host or port? (Kubernetes)kubectl connection re…login_required — OIDC Error: login_required / interaction_required / consent_required (silent authentication failed) (Authentication)login_requiredNoCredentialsError — AWS: Unable to locate credentials / Could not load credentials from any providers (AWS)NoCredentialsErrorSameSite cookie blocked — This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure (Authentication)SameSite cookie block…ExpiredTo…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.