SignatureDoesNotMatch AWS Origin: Platform & cloud Last updated 13 Oct 2026

AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match

AWS rejected the request signature — wrong secret key, wrong region, clock skew, or a presigned URL used differently from how it was signed.

Exact message you may see The request signature we calculated does not match the signature you provided
Explore the map of this error Full error map →
Seen on: AWS JavaScript

Meaning

Every AWS request is signed with your secret key (SigV4) over the method, path, headers and timestamp. A wrong secret, an extra/changed header, the wrong region or a clock more than ~5 minutes off all break the signature. InvalidClientTokenId means the access key ID itself isn’t recognised.

Common causes

  • Secret key copied with extra spaces/characters
  • Access key and secret from different pairs / accounts
  • System clock skew
  • Wrong region for the endpoint
  • Presigned S3 URL used with different method or Content-Type than signed
  • Special characters in object keys not encoded consistently

⚡ Quick fix

  1. Re-copy or rotate the key pair
  2. Sync time (NTP)
  3. Use the bucket’s actual region
  4. For presigned PUTs, send exactly the Content-Type you signed

Detailed fix by platform

AWS

  1. Presigned PUT must match the signed Content-Type:
    javascript
    const url = await getSignedUrl(s3, new PutObjectCommand({ Bucket: 'uploads', Key: key, ContentType: 'image/png' }), { expiresIn: 300 });
await fetch(url, { method: 'PUT', headers: { 'Content-Type': 'image/png' }, body: file });

How to diagnose

  1. Key pair — ID and secret from the same pair?
  2. Clock — Server time correct?
  3. Region — Signing region = resource region?
  4. Presigned — Same method/headers as signed?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

AccessDenied — AWS S3: AccessDenied (403) when calling GetObject / PutObject (AWS)AccessDeniedApiException: 10 — Google Sign-In: com.google.android.gms.common.api.ApiException: 10 (DEVELOPER_ERROR) (Android)ApiException: 10AuthenticationFailed — Azure Storage: Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature (AuthenticationFailed) (Azure)AuthenticationFailedExpiredToken — AWS: ExpiredToken — The security token included in the request is expired (AWS)ExpiredTokengpg failed to sign — error: gpg failed to sign the data — fatal: failed to write commit object (Git)gpg failed to signINSTALL_PARSE_FAILED_NO_CERTIFICATES — INSTALL_PARSE_FAILED_NO_CERTIFICATES / App not installed as package appears to be invalid (Android)INSTALL_PARSE_FAILED_…NoSuchKey — AWS S3: NoSuchKey / NoSuchBucket — The specified key/bucket does not exist (AWS)NoSuchKeyPermanentRedirect — S3 PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint (AWS)PermanentRedirectSignature…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.