[BUG] API Error (403 The security token included in the request is invalid.) · Retrying in 1 seconds… (attempt 1/10)

[cachatj]

I am aware of https://github.com/anthropics/claude-code/issues/2260, and attempted all of those steps - still not resolved.

I have ran claude update, running the latest version. when I tried to pass my API key to it, it said it was a different profile.

wondering how: 1) I just determine what account claude code is attempting to access the model from, 2) log that one out & 2) log back in...I think this would resolve my issue - but dont see anything like that in the docs or / command help. /config didnt work, /doctor didnt report any issues.

so how can I figure out what account claude code is trying to use, log that account out and then log it back in??

[github-actions[bot]]

Found 2 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/4229
2. https://github.com/anthropics/claude-code/issues/4505

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[ant-kurt]

Are you passing AWS_PROFILE env var (or in your Claude Code settings.json)?

[benarent]

I ran into the same issue, passing it in via ENV worked, the docs in setting.json didn't work

[cachatj]

when I loaded API keys into ENV, claude code prompted me about ~"hey this is different from how your cuttentl my logged in" & do you want to switch to API keys, which was the not recommended option.

this was the step that made me realize it's not just an API key login & that maybe I set it up with dev teams AWS bedrock account - which is fine & probably preferred.

thus, i'm after 1) how to determine which accountIm logged in with & 2) how to simply log out & log back in, esp if it's authorized via AWS.

[cachatj]

Are you passing AWS_PROFILE env var (or in your Claude Code settings.json)?

will determine & follow up

[cachatj]

it looks like I am using AWS Bedrock for the connection, as I have the following in my settings.json

{
  "model": "us.anthropic.claude-sonnet-4-20250514-v1:0",
  "provider": "bedrock",
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "true",
    "ANTHROPIC_MODEL": "us.anthropic.claude-sonnet-4-20250514-v1:0",
    "CLAUDE_CODE_MAX_OUTPUT_TOKENS": 2048
  },
...

It also has permissions to run aws configure in bash, which is fine. However, I have ran this before already - its all already configured. My IDE and Terminal are all good per aws sts get-caller-identity - so not sure about next steps, and still think a "logout" & "login" cycle would be helpful...anyone aware how to do that?

another question would be - if I am using AWS Bedrock, as configured in settings.json - where is the security token its attempting to use being store? ~/.aws/ in my User Directory, or in the repo directory??

[ant-kurt]

Setting CLAUDE_CODE_USE_BEDROCK should be all you need - /logout or /login shouldn't be necessary. You can confirm that Bedrock is being used via /status.

Claude Code doesn't execute its own AWS auth unless you have set awsAuthHelper or awsCredentialExport. The security token should be located at its typical location, usually ~/.aws.

Double-check that your AWS_PROFILE and AWS_REGION are set if needed. Can you also try issuing a call via the AWS CLI to Bedrock, to confirm those credentials are valid? Something like this:

aws bedrock-runtime invoke-model \
    --model-id "us.anthropic.claude-sonnet-4-20250514-v1:0" \
    --body '{"anthropic_version": "bedrock-2023-05-31", "max_tokens": 1024, "messages": [{"role": "user", "content": [{"type": "text", "text": "Hello world"}]}]}' \
    --cli-binary-format raw-in-base64-out \
    output.txt

[cachatj]

I was able to resolve this by cleaning up my aws cli profiles, and essentially loading claude code with AWS_PROFILE=default claude code in Terminal or VSCode - its slightly bothering to not have it completely resolved, but at least its no longer blocking me from work.

[cachatj]

Setting CLAUDE_CODE_USE_BEDROCK should be all you need - /logout or /login shouldn't be necessary. You can confirm that Bedrock is being used via /status.

Claude Code doesn't execute its own AWS auth unless you have set awsAuthHelper or awsCredentialExport. The security token should be located at its typical location, usually ~/.aws.

Double-check that your AWS_PROFILE and AWS_REGION are set if needed. Can you also try issuing a call via the AWS CLI to Bedrock, to confirm those credentials are valid? Something like this:

aws bedrock-runtime invoke-model
--model-id "us.anthropic.claude-sonnet-4-20250514-v1:0"
--body '{"anthropic_version": "bedrock-2023-05-31", "max_tokens": 1024, "messages": [{"role": "user", "content": [{"type": "text", "text": "Hello world"}]}]}'
--cli-binary-format raw-in-base64-out
output.txt

@ant-kurt - was able to execute the CLI command for bedrock, and model responded to "Hello world" in output.txt - so access and CLI are authorized as expected - its just claude code that is hanging, and unable to grab those credentials for some reason?

[cachatj]

wanted to add that both the API response and [BashTool] Preflight Check are taking 10-20s before generating tokens or a response, it seems like this issue is pretty wide spread being reported here and in reddit recently. wondering if anyone at Anthropic is working on it?

[msmygit]

I'm the original submitter of #2260 ;-)

I can confirm that I'm also facing this same exact error when using Claude Code with AWS Bedrock.

Version:

% claude update
Current version: 1.0.84
Checking for updates...
Claude Code is up to date (1.0.84)

on macOS Sequioa 15.5; Apple M4 Pro. This worked fine at least 5 days before

Running claude -> /status gives below,

 Claude Code v1.0.84
  L Session ID: 42e61d32-554e-4c34-8089-4ef5264042e6

 Working Directory 
  L /Users/path/to/directory

 API Configuration 
  L API Provider: AWS Bedrock
  L AWS Region: us-east-1

 Memory • /memory
  L user: ~/.claude/CLAUDE.md

 Model • /model
  L us.anthropic.claude-3-7-sonnet-20250219-v1:0

Something is broken for sure [somewhere in local setup/code] in this version 1.0.84.

export CLAUDE_CODE_USE_BEDROCK=1
export DISABLE_PROMPT_CACHING=1
export ANTHROPIC_MODEL='us.anthropic.claude-3-7-sonnet-20250219-v1:0'
export ANTHROPIC_SMALL_FAST_MODEL='us.anthropic.claude-3-5-haiku-20241022-v1:0'
export AWS_REGION='us-east-1'
export AWS_PROFILE=bedrock

and I've the below credentials along with above env vars,

~/.aws/credentials

[bedrock]
aws_access_key_id=
aws_secret_access_key=
sso_session=

[cachatj]

looking for updates here, #2260 is closed & this issue is still happening.

@msmygit did you figure anything out?

@ant-kurt - any input on your end?

[alexef]

having the same issue

[github-actions[bot]]

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.