# UnrecognizedClientException: The security token included in the request is invalid

**Code:** `UnrecognizedClientException` · **Category:** AWS · **Seen on:** AWS

The access key or session token isn’t recognised — wrong/deleted key, a session token missing for temporary credentials, or a region not enabled for the account.

## Meaning

Temporary credentials need all three values (key ID, secret, session token). Copying only two, using deleted keys, stale environment variables overriding the profile, or calling an opt-in region that isn’t enabled all produce this.

## Common causes

- AWS_SESSION_TOKEN missing or stale for temporary keys
- Access key deleted/deactivated
- Old env vars overriding ~/.aws profile
- Opt-in region not enabled

## Quick fix

1. Check identity: aws sts get-caller-identity
2. Unset stale AWS_* env vars or refresh them
3. Enable the region in Account settings if opt-in

## Detailed fix by platform

### Shell

1. 

```bash
env | grep ^AWS_
unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
aws sts get-caller-identity --profile prod
```


## How to diagnose

1. **Credentials** — Where are they coming from (env, profile, role)?
2. **Token** — Session token present?
3. **Region** — Opt-in region?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/aws/unrecognizedclientexception)