AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
Exact message you may see
The security token included in the request is expiredToken has expired and refresh failed
Seen on:
AWS
Meaning
Session credentials last from 15 minutes to 12 hours. Once expired, every call fails until you refresh them.
Common causes
- SSO session expired
- Assumed-role credentials exported as env vars and not refreshed
- Long-running scripts outliving their session
- Stale
AWS_SESSION_TOKENoverriding a profile
⚡ Quick fix
aws sso login --profile <name>- Unset stale env vars:
unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN - Use SDK credential providers that refresh automatically instead of copying keys
Detailed fix by platform
AWS
- On EC2/ECS/Lambda, rely on the instance/task role — the SDK refreshes credentials automatically.
How to diagnose
- Source — Where do credentials come from (env, profile, role)?
- Expiry — When were they issued?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
Most viewed in AWS
Other ways to find it
Where this error sits
Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Did this fix work for you?
Report a correction or suggest an improvement
Last updated 15 Oct 2026