# Error: Invalid signature or credentials (Amazon SES)

Source: https://catalystgroup.gg/docs/email-delivery/error-ses-invalid-signature-or-credentials/
Updated: 2026-10-19 · By Duane Garner

AWS could not match the request to your access key. The Access Key ID or Secret Access Key is wrong, inactive, or the server clock is off.

This article is for sites using the **Amazon SES** mailer where a send fails because AWS rejected the access key or the request signature.

 

> **The error as you see it:** `SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided.`
>  
> or `InvalidClientTokenId: The security token included in the request is invalid.`
>  
> Shown by the **Amazon SES** mailer, in the failed-send banner, in **Tools → Debug Events** and in the **Email Log**.

 

## What this error means

 

Every request the plugin sends to SES is signed with your **Secret Access Key** and labelled with your **Access Key ID** (AWS calls this Signature Version 4). AWS repeats the calculation on its side. The two messages above mean:

 
- **InvalidClientTokenId** — AWS does not know the Access Key ID. It is mistyped, deleted, inactive, or from another AWS partition.
- **SignatureDoesNotMatch** — AWS knows the key, but the signature does not match. The secret is wrong, or the request time is off.

 

Neither has anything to do with your domain or recipients.

 

## Common causes

 
- **The Secret Access Key was copied with a missing character or an extra space.**
- **The Access Key ID and secret come from different keys**, for example after creating a second key.
- **The access key was deactivated or deleted** in IAM.
- **The server clock is wrong.** Signed requests include the time, and AWS refuses requests that are too far from its own clock.
- **The key belongs to a different AWS partition**, such as AWS GovCloud or the China regions, while the **Region** is a standard one.

 

## How to fix

 
1. Check the server clock
  In WordPress, **Settings → General** shows "Universal time". If it differs from real UTC time by more than a minute or two, ask your host to turn on clock synchronisation (NTP). If this was the cause, you can stop here and test.
2. Open the IAM user
  Sign in to `https://console.aws.amazon.com/iam/`, go to **Users**, open the user the site uses, and choose the **Security credentials** tab.
3. Check the access key
  Under **Access keys**, find the key whose ID matches the plugin's **Access Key ID**. Its status must be *Active*.
4. Create a new key if unsure
  The secret cannot be shown again after creation. If you do not have it, choose **Create access key**, pick the use case for an application running outside AWS, and copy both the Access key ID and the Secret access key.
5. Check permissions
  Under **Permissions**, the user needs `ses:SendRawEmail` (or the AmazonSESFullAccess policy). A missing permission gives an *access denied* error, but check it while you are here.
6. Update CRM-NG SMTP
  In **CRM-NG SMTP → Settings → General**, with **Amazon SES** selected, paste the **Access Key ID**, use **Remove Secret Key**, paste the new **Secret Access Key**, check **Region**, and press **Save Settings**.
7. Retire the old key
  Back in IAM, deactivate and then delete any key the site no longer uses.
8. Send a test
  Go to **CRM-NG SMTP → Tools → Email Test**, fill in **Send To** and press **Send Email**.

 

## Verify it worked

 

The test page shows "Test email sent successfully! Check your inbox to confirm delivery." In IAM, the key's *Last used* column updates to today.

 

## Notes

 
- Give the site its own IAM user with only the SES send permission. Never use the AWS root account's keys.
- If you set the keys with `CRMNG_SMTP_*` constants in `wp-config.php`, change them there; the settings page cannot override constants.

 

## Related

 
- [Amazon SES](https://catalystgroup.gg/docs/email-delivery/mailer-amazon-ses/)
- [Error: Email address is not verified (Amazon SES)](https://catalystgroup.gg/docs/email-delivery/error-ses-email-address-not-verified/)
- [Sharing credentials with support safely](https://catalystgroup.gg/docs/email-delivery/sharing-credentials-safely/)
- [Troubleshooting email delivery](https://catalystgroup.gg/docs/email-delivery/troubleshooting/)