Error when Logging Into AWS "AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken"
Nov 13, 2025
Single Sign-On
Integrations
Okta Classic Engine
Okta Identity Engine
All Engines
Overview
When trying to test the initial setup of AWS, SAML authentication may receive the following error:
Response signature invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken; Request ID: <requestID>). Please try again.
Applies To
- Amazon Account Federation (formerly Amazon Web Services)
- AWS IAM Identity Center
- Security Assertion Markup Language (SAML)
Cause
Solution
- From the Okta Admin Console, navigate to the AWS application in question and select the Sign On Tab.
- Right-click on the Identity Provider metadata and save it into the local directory in .xml format (screenshot attached for Amazon Identity Application).
- Log in to the Amazon Web Service Portal.
- In the Configure Provider screen, locate the SAML provider that was previously created.
- Click on the provider and re-upload the metadata from the SAML setup document generated from the AWS application in Okta.
- Validate that users can now access AWS.
