The security token included in the request is invalid

TL;DR — Your AWS credentials are wrong, expired, or the SDK is reading a different set than you think. Refresh/verify the access key + secret (and session token if using temporary credentials), and confirm which profile/source the SDK is actually using.

What it means

UnrecognizedClientException: The security token included in the request is invalid.

AWS rejected your credentials at authentication — before checking permissions. This is different from AccessDeniedException, which means the credentials are valid but lack permission. Here the credentials themselves aren't accepted.

Why it happens

• Expired temporary credentials — an STS/SSO session or assumed-role token timed out, or you have an access key without the required AWS_SESSION_TOKEN.
• Wrong or partial keys — a typo, a rotated/deleted access key, or AWS_ACCESS_KEY_ID set without a matching AWS_SECRET_ACCESS_KEY.
• A stale AWS_SESSION_TOKEN left in the environment from a previous session.
• Pointing real credentials at DynamoDB Local (or vice-versa) — Local accepts any dummy keys but a real endpoint won't accept placeholders.
• Clock skew on the machine large enough to invalidate the request signature.

How to fix it

1. Verify the credentials work: aws sts get-caller-identity. If that fails too, it's the credentials, not DynamoDB.
2. Refresh temporary credentials — re-run aws sso login / re-assume the role, and make sure AWS_SESSION_TOKEN is set for temporary keys.
3. Clear stale env vars — an old AWS_SESSION_TOKEN/AWS_ACCESS_KEY_ID in your shell overrides your profile. Unset them or set the right profile.
4. For DynamoDB Local, use placeholder creds and point at the local endpoint:

   const client = new DynamoDBClient({
     region: 'local',
     endpoint: 'http://localhost:8000',
     credentials: {accessKeyId: 'local', secretAccessKey: 'local'}
   });

5. Check the machine clock is accurate (NTP-synced) if everything else looks right.

Related errors

• AccessDeniedException — valid credentials, missing permission.
• Missing region in config