Skip to content
AMZScratchpad

InvalidIssuer (UnauthorizedException): Amazon Creators API error

HTTP 401UnauthorizedExceptionAuthentication (401)Documented by Amazon

What it means

The token comes from the wrong token endpoint for your credential version.

Message returned by the API: The token issuer is invalid or does not match the expected issuer.

Typical causes

  • Wrong token endpoint for the credential version (e.g. a 3.2 credential against api.amazon.com).
  • A token from another Amazon/LWA product, not from the Creators API scope.

How to fix it

  1. Pick the token endpoint by Version: 3.1 → api.amazon.com, 3.2 → api.amazon.co.uk, 3.3 → api.amazon.co.jp.
  2. Use scope creatorsapi::default for v3.x.

Not sure which part fails? Run Test credentials in the Scratchpad. It checks the token, the API access and the partner tag separately.

Example response

{
  "type": "UnauthorizedException",
  "message": "The token issuer is invalid or does not match the expected issuer.",
  "reason": "InvalidIssuer"
}

Related errors

  • InvalidToken: The access token in the Authorization header is broken, incomplete or in the wrong format.
  • invalid_client: Amazon’s token endpoint rejected your Credential ID or Secret, so no access token was issued.