The security token is invalid

[misterakko]

I had not touched my code based on jlevers/selling-partner-api for months, as most of our customers are still using the old MWS codebase — due do Amazon's boneheadedness in handling PIIs — so I was a bit surprised when, on trying it, I noticed that practically every call I make is now answered with { "errors": [ { "message": "The security token included in the request is invalid.", "code": "InvalidInput" } ] } It used to work fine, recently.

I thought that it might depend on the recent switch to v4 of the library, so I upgraded and refreshed my code to use v5.0.1, but I still get the same result.

My authorisations as a developer must be in order, since the MWS calls work as always... I'm really stumped, if anyone has any suggestion I'll be very grateful

Sample code

<?php
        include_once 'sar-el_core.inc.php';
        $db = new DB_Sarel;
        use SellingPartnerApi\Api\SellersV1Api as SellersApi;
        // Load config from DB
        include_once 'SPAPI/amazon.inc.php';
        $a = new SaratAmazon($db);

        $api = new SellersApi($a->myConfig);
        $result = $api->getMarketplaceParticipations()->getPayload();

Code in testing environment: https://dev.accomazzi.net/sarat/akko.php

[jlevers]

What does your config object look like?

[misterakko]

SellingPartnerApi\Configuration Object
(
    [auth:protected] => SellingPartnerApi\Authentication Object
        (
            [lwaClientId:SellingPartnerApi\Authentication:private] => amzn1.application-oa2-client.xxxx...
            [lwaClientSecret:SellingPartnerApi\Authentication:private] => XXXXXXX...
            [lwaRefreshToken:SellingPartnerApi\Authentication:private] => Atzr|IwEBXXXX....
            [lwaAuthUrl:SellingPartnerApi\Authentication:private] => https://api.amazon.com/auth/o2/token
            [endpoint:SellingPartnerApi\Authentication:private] => Array
                (
                    [url] => https://sellingpartnerapi-eu.amazon.com
                    [region] => eu-west-1
                )

            [onUpdateCreds:SellingPartnerApi\Authentication:private] => 
            [roleArn:SellingPartnerApi\Authentication:private] => 
            [requestTime:SellingPartnerApi\Authentication:private] => 
            [signingScope:SellingPartnerApi\Authentication:private] => 
            [client:SellingPartnerApi\Authentication:private] => GuzzleHttp\Client Object
                (
                    [config:GuzzleHttp\Client:private] => Array
                        (
                            [handler] => GuzzleHttp\HandlerStack Object
                                (
                                    [handler:GuzzleHttp\HandlerStack:private] => Closure Object
                                        (
                                            [static] => Array
                                                (
                                                    [default] => Closure Object
                                                        (
                                                            [static] => Array
                                                                (
                                                                    [default] => GuzzleHttp\Handler\CurlMultiHandler Object
                                                                        (
                                                                            [factory:GuzzleHttp\Handler\CurlMultiHandler:private] => GuzzleHttp\Handler\CurlFactory Object
                                                                                (
                                                                                    [handles:GuzzleHttp\Handler\CurlFactory:private] => Array
                                                                                        (
                                                                                        )

                                                                                    [maxHandles:GuzzleHttp\Handler\CurlFactory:private] => 50
                                                                                )

                                                                            [selectTimeout:GuzzleHttp\Handler\CurlMultiHandler:private] => 1
                                                                            [active:GuzzleHttp\Handler\CurlMultiHandler:private] => 0
                                                                            [handles:GuzzleHttp\Handler\CurlMultiHandler:private] => Array
                                                                                (
                                                                                )

                                                                            [delays:GuzzleHttp\Handler\CurlMultiHandler:private] => Array
                                                                                (
                                                                                )

                                                                            [options:GuzzleHttp\Handler\CurlMultiHandler:private] => Array
                                                                                (
                                                                                )

                                                                        )

                                                                    [sync] => GuzzleHttp\Handler\CurlHandler Object
                                                                        (
                                                                            [factory:GuzzleHttp\Handler\CurlHandler:private] => GuzzleHttp\Handler\CurlFactory Object
                                                                                (
                                                                                    [handles:GuzzleHttp\Handler\CurlFactory:private] => Array
                                                                                        (
                                                                                        )

                                                                                    [maxHandles:GuzzleHttp\Handler\CurlFactory:private] => 3
                                                                                )

                                                                        )

                                                                )

                                                            [parameter] => Array
                                                                (
                                                                    [$request] => <required>
                                                                    [$options] => <required>
                                                                )

                                                        )

                                                    [streaming] => GuzzleHttp\Handler\StreamHandler Object
                                                        (
                                                            [lastHeaders:GuzzleHttp\Handler\StreamHandler:private] => Array
                                                                (
                                                                )

                                                        )

                                                )

                                            [parameter] => Array
                                                (
                                                    [$request] => <required>
                                                    [$options] => <required>
                                                )

                                        )

                                    [stack:GuzzleHttp\HandlerStack:private] => Array
                                        (
                                            [0] => Array
                                                (
                                                    [0] => Closure Object
                                                        (
                                                            [static] => Array
                                                                (
                                                                    [bodySummarizer] => 
                                                                )

                                                            [parameter] => Array
                                                                (
                                                                    [$handler] => <required>
                                                                )

                                                        )

                                                    [1] => http_errors
                                                )

                                            [1] => Array
                                                (
                                                    [0] => Closure Object
                                                        (
                                                            [parameter] => Array
                                                                (
                                                                    [$handler] => <required>
                                                                )

                                                        )

                                                    [1] => allow_redirects
                                                )

                                            [2] => Array
                                                (
                                                    [0] => Closure Object
                                                        (
                                                            [parameter] => Array
                                                                (
                                                                    [$handler] => <required>
                                                                )

                                                        )

                                                    [1] => cookies
                                                )

                                            [3] => Array
                                                (
                                                    [0] => Closure Object
                                                        (
                                                            [parameter] => Array
                                                                (
                                                                    [$handler] => <required>
                                                                )

                                                        )

                                                    [1] => prepare_body
                                                )

                                        )

                                    [cached:GuzzleHttp\HandlerStack:private] => 
                                )

                            [allow_redirects] => Array
                                (
                                    [max] => 5
                                    [protocols] => Array
                                        (
                                            [0] => http
                                            [1] => https
                                        )

                                    [strict] => 
                                    [referer] => 
                                    [track_redirects] => 
                                )

                            [http_errors] => 1
                            [decode_content] => 1
                            [verify] => 1
                            [cookies] => 
                            [idn_conversion] => 
                            [headers] => Array
                                (
                                    [User-Agent] => GuzzleHttp/7
                                )

                        )

                )

            [awsCredentials:SellingPartnerApi\Authentication:private] => 
            [grantlessAwsCredentials:SellingPartnerApi\Authentication:private] => 
            [grantlessCredentialsScope:SellingPartnerApi\Authentication:private] => 
            [roleCredentials:SellingPartnerApi\Authentication:private] => 
            [restrictedDataTokens:SellingPartnerApi\Authentication:private] => Array
                (
                )

            [awsAccessKeyId:SellingPartnerApi\Authentication:private] => AKIA6K5VGTH2NWHEAMLN
            [awsSecretAccessKey:SellingPartnerApi\Authentication:private] => Pi+atBcomQ/BNAFWSJjjugjfIRSJAjkPuHyN4BD6
            [tokensApi:SellingPartnerApi\Authentication:private] => 
        )

    [endpoint:protected] => Array
        (
            [url] => https://sellingpartnerapi-eu.amazon.com
            [region] => eu-west-1
        )

    [userAgent:protected] => jlevers/selling-partner-api/5.0.1 (Language=PHP)
    [debug:protected] => 
    [debugFile:protected] => php://output
)

[jlevers]

I updated your comment to redact your actual credentials -- please do not post those publicly, as they make it possible for anyone to make calls to your application.

Are you using a IAM user ARN or an IAM role ARN in your SP API application? Also, have you tried generating a new refresh token?

[misterakko]

User, and, yes, you're right, I had to renew the token. I didn't remember it had an expiration date. Thanks! I swear that if I'll ever be able to put this code into production I'll contribute.

[jlevers]

It shouldn't expire, but if you change ARNs or add/remove roles, you'll have to regenerate a new token for those changes to go into effect.