Credential should be scoped to a valid region

TL;DR — Signature Version 4 bakes a region into each request's credential scope. This error means the region in that scope doesn't match the region of the endpoint you actually hit — you signed for one region and sent the request to another (or used an invalid region code). Make the client's configured region match the endpoint you call.

What it means

InvalidSignatureException: Credential should be scoped to a valid region, not 'us-west-1'.

Every signed AWS request carries a credential scope — a YYYYMMDD/region/service/aws4_request string the signature is computed over (the region and service codes must be lowercase). AWS re-derives the expected signature from the endpoint that received the request. If the region embedded in your scope isn't the region serving the request, verification fails with this message. It's an HTTP 400, client-side, and not retryable until the region is corrected.

Why it happens

• Signed for one region, sent to another — the SDK's configured region differs from a hard-coded or overridden endpoint pointing at a different region.
• A custom endpoint without a matching region — you set endpoint: https://dynamodb.eu-west-2.amazonaws.com but left the client region at eu-west-1.
• An invalid or empty region string — a typo or an unset env var yields a scope AWS can't accept as valid.
• A proxy or gateway that forwards the request to a different regional endpoint than the one it was signed for.

How to fix it

1. Match the client region to the endpoint. If you point at dynamodb.<region>.amazonaws.com, set the client's region to that same <region>.
2. Prefer setting only the region and let the SDK build the endpoint — drop manual endpoint overrides unless you truly need one (e.g. DynamoDB Local).
3. Verify the region code is valid (us-east-1, eu-west-2, …) and actually set — check AWS_REGION/AWS_DEFAULT_REGION and any config file.
4. For assumed-role or cross-region setups, confirm the request is signed with the region you intend to send it to, not a default inherited elsewhere.

For DynamoDB Local, point the endpoint at http://localhost:8000 and give the client any consistent region — the region just has to match what the client signs with.

Check first in DynoTable

DynoTable signs every request with the region stored on the active profile. Settings → Profiles shows region and optional custom endpoint on one form — change them together, then Test Connection. That removes the classic SDK failure mode where endpoint points at eu-west-2 while region stays eu-west-1.

Press ⌘P to confirm which profile (and therefore which credential scope) is live before you debug application code. For Local, keep endpoint http://localhost:8000 and any matching region on the same profile. Once the profile connects, use the query builder to prove reads succeed with that scope.

Sources

• Troubleshoot Signature Version 4 signing (verified 2026-07-13)
• Create a signed AWS API request (verified 2026-07-13)

Related errors

• The request signature we calculated does not match — a broader SigV4 signature mismatch (bad secret key or canonicalization).
• The security token included in the request is invalid — bad or expired credentials rather than a region scope.
• You must specify a region — no region configured at all.
• Learn: Connect to DynamoDB Local & LocalStack

References

• Troubleshoot Signature Version 4 signing for AWS API requests — IAM User Guide (credential scope errors)
• Create a signed AWS API request — IAM User Guide (credential scope format)
• Elements of an AWS API request signature — IAM User Guide
• Error handling with DynamoDB — Amazon DynamoDB Developer Guide

Last verified 2026-07-13 against the official AWS documentation linked above.