Talk to our team

Documentation

✉️ Email Delivery

Documentation, reference material and tutorials for CRM-NG SMTP Email: setup guides for every mail service, troubleshooting, and one article per error message.

Error: Invalid signature or credentials (Amazon SES)

Updated

By Duane GarnerChief Executive Officer (CEO)
Summarize: Claude ChatGPT View Markdown
On this page

AWS could not match the request to your access key. The Access Key ID or Secret Access Key is wrong, inactive, or the server clock is off.

This article is for sites using the Amazon SES mailer where a send fails because AWS rejected the access key or the request signature.

The error as you see it

SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided.

or InvalidClientTokenId: The security token included in the request is invalid.

Shown by the Amazon SES mailer, in the failed-send banner, in Tools → Debug Events and in the Email Log.

What this error means

Every request the plugin sends to SES is signed with your Secret Access Key and labelled with your Access Key ID (AWS calls this Signature Version 4). AWS repeats the calculation on its side. The two messages above mean:

  • InvalidClientTokenId — AWS does not know the Access Key ID. It is mistyped, deleted, inactive, or from another AWS partition.
  • SignatureDoesNotMatch — AWS knows the key, but the signature does not match. The secret is wrong, or the request time is off.

Neither has anything to do with your domain or recipients.

Common causes

  • The Secret Access Key was copied with a missing character or an extra space.
  • The Access Key ID and secret come from different keys, for example after creating a second key.
  • The access key was deactivated or deleted in IAM.
  • The server clock is wrong. Signed requests include the time, and AWS refuses requests that are too far from its own clock.
  • The key belongs to a different AWS partition, such as AWS GovCloud or the China regions, while the Region is a standard one.

How to fix

  1. Check the server clock

    In WordPress, Settings → General shows "Universal time". If it differs from real UTC time by more than a minute or two, ask your host to turn on clock synchronisation (NTP). If this was the cause, you can stop here and test.

  2. Open the IAM user

    Sign in to https://console.aws.amazon.com/iam/, go to Users, open the user the site uses, and choose the Security credentials tab.

  3. Check the access key

    Under Access keys, find the key whose ID matches the plugin's Access Key ID. Its status must be Active.

  4. Create a new key if unsure

    The secret cannot be shown again after creation. If you do not have it, choose Create access key, pick the use case for an application running outside AWS, and copy both the Access key ID and the Secret access key.

  5. Check permissions

    Under Permissions, the user needs ses:SendRawEmail (or the AmazonSESFullAccess policy). A missing permission gives an access denied error, but check it while you are here.

  6. Update CRM-NG SMTP

    In CRM-NG SMTP → Settings → General, with Amazon SES selected, paste the Access Key ID, use Remove Secret Key, paste the new Secret Access Key, check Region, and press Save Settings.

  7. Retire the old key

    Back in IAM, deactivate and then delete any key the site no longer uses.

  8. Send a test

    Go to CRM-NG SMTP → Tools → Email Test, fill in Send To and press Send Email.

Verify it worked

The test page shows "Test email sent successfully! Check your inbox to confirm delivery." In IAM, the key's Last used column updates to today.

Notes

  • Give the site its own IAM user with only the SES send permission. Never use the AWS root account's keys.
  • If you set the keys with CRMNG_SMTP_* constants in wp-config.php, change them there; the settings page cannot override constants.
Go to Top