Skip to content
AMZScratchpad

InvalidToken (UnauthorizedException): Amazon Creators API error

HTTP 401UnauthorizedExceptionAuthentication (401)Documented by Amazon

What it means

The access token in the Authorization header is broken, incomplete or in the wrong format.

Message returned by the API: The authentication token is invalid or malformed.

Typical causes

  • The header is not Authorization: Bearer <access_token>.
  • Legacy v2.x credential: the header must be Bearer <token>, Version 2.x (observed 2026-11-04; the official SDK does the same).
  • The token was truncated or copied with whitespace.
  • You sent the Credential Secret instead of a token.

How to fix it

  1. Fetch a token from the token endpoint of your credential version and send it unchanged.
  2. For v2.1 to v2.3, append , Version <version> to the header value. For v3.x, do not.
  3. Better: create a v3.x credential, because v2.x credentials are being phased out.

Not sure which part fails? Run Test credentials in the Scratchpad. It checks the token, the API access and the partner tag separately.

Example response

{
  "type": "UnauthorizedException",
  "message": "The authentication token is invalid or malformed",
  "reason": "InvalidToken"
}

Related errors

  • TokenExpired: Your access token is older than one hour. Fetch a new one and try again.
  • MissingCredential: The request has no Authorization header, so Amazon does not know who you are.
  • InvalidIssuer: The token comes from the wrong token endpoint for your credential version.