Missing Authentication Token

TL;DR — "Missing Authentication Token" means the request either carried no credentials or hit an endpoint/method AWS doesn't recognize — a request to a non-existent path or an unsupported HTTP method returns this rather than a 404. For DynamoDB it's almost always a wrong endpoint URL or a request that never got signed.

What it means

{"message":"Missing Authentication Token"}

AWS's SigV4 troubleshooting guide is blunt about the first cause: if the API request isn't signed, you might receive Missing Authentication Token. Counter-intuitively, the same message also comes back from API-Gateway-style endpoints (HTTP 403) when the path or HTTP method doesn't match any route — AWS looks for auth on a request it can't route and reports the missing token instead of a "not found". When DynamoDB itself rejects a request whose authorization header is missing or malformed, the exception is MissingAuthenticationTokenException — HTTP 400, not retryable, with the message "Request must contain a valid (registered) AWS Access Key ID."

Why it happens

• Wrong endpoint URL — hitting https://dynamodb.<region>.amazonaws.com/some/path in a browser or with a plain GET, instead of a properly signed SDK call to the service root.
• Unsigned request — a raw curl/fetch with no SigV4 Authorization header (the SDK normally adds it).
• Wrong HTTP method — DynamoDB's API expects POST to / with an X-Amz-Target header naming the operation; other shapes aren't recognized as signed operations.
• A typo'd custom endpoint — pointing at a URL that doesn't correspond to the DynamoDB service.
• DynamoDB Local without an access key configured — the SDKs require an access key and region value to be set even locally (any values work; Local only uses them to name its database file).

How to fix it

1. Use the AWS SDK, not a raw HTTP call. Let the SDK build the signed POST with the correct X-Amz-Target — don't hand-craft URLs.
2. Point at the service root (https://dynamodb.<region>.amazonaws.com), not a path, and set the client's region to match.
3. Confirm credentials are configured so the SDK actually signs the request (env vars, profile, or role).
4. For DynamoDB Local, set the endpoint to http://localhost:8000 and configure a dummy access key/secret (letters and numbers only) so the SDK signs normally — Local doesn't validate them.

Reproduce it

Send a well-formed DynamoDB request with no Authorization header at all:

import requests
requests.post(
    'https://dynamodb.us-east-1.amazonaws.com',
    headers={
        'X-Amz-Target': 'DynamoDB_20120810.ListTables',
        'Content-Type': 'application/x-amz-json-1.0',
    },
    data='{}',
)

Real output:

MissingAuthenticationTokenException: Request is missing Authentication Token
HTTP 400

Worth knowing when this reaches you through an SDK: it usually means the request was never signed, not that a credential was wrong. An unsigned request is what you get from a hand-rolled HTTP call, a proxy that strips headers, or an API Gateway route expecting IAM auth — so look at how the request was built rather than at the key.

DynoTable + Local

DynoTable signs every DynamoDB call through the AWS SDK — no hand-built Authorization headers (Connect an AWS account). For DynamoDB Local, add a profile with endpoint http://localhost:8000 and placeholder credentials so requests are signed normally; Local ignores the key values but still requires them (Running DynamoDB Local). If you see this against real AWS, confirm Settings → Profiles points at the correct regional endpoint and that Test Connection succeeds before opening tables. The DynamoDB Expression Builder confirms signed requests work once the endpoint is correct.

Related errors

• Unable to locate credentials — no credentials found by the SDK at all.
• The security token included in the request is invalid — credentials present but rejected.
• Could not connect to the endpoint URL — a malformed or unreachable endpoint.
• Learn: Connect to DynamoDB Local & LocalStack

Sources

• Troubleshoot Signature Version 4 signing for AWS API requests — IAM User Guide (verified 2026-07-13)
• Error handling with DynamoDB — Amazon DynamoDB Developer Guide (verified 2026-07-13)
• Create a signed AWS API request — IAM User Guide (verified 2026-07-13)
• DynamoDB local usage notes — Amazon DynamoDB Developer Guide (verified 2026-07-13)

Reproduced 2026-07-26 against the live DynamoDB service in us-east-1 — the output above is verbatim.