ToolJet/ToolJet · error · QueryError

Invalid credentials configuration

Error message

Invalid credentials configuration

What it means

Thrown by validateCredentials() when a session_token is supplied without a matching access_key + secret_access_key pair. AWS session tokens are only valid as part of temporary STS credentials (the triple access key + secret + token), so a lone token cannot authenticate any SDK call.

Source

Thrown at marketplace/plugins/aws-bedrock/lib/index.ts:162

        } else if (error.name === "AccessDeniedException") {
          errorMessage = "Insufficient permissions";
        }
      }

      throw new QueryError(
        errorMessage,
        error.message,
        errorDetails
      );
    }
  }

  private validateCredentials(sourceOptions: SourceOptions): void {
    const hasAccessKey = sourceOptions.access_key && sourceOptions.secret_access_key;
    const hasSessionToken = sourceOptions.session_token;

    if (hasSessionToken && !hasAccessKey) {
      throw new QueryError(
        "Invalid credentials configuration",
        "Session tokens require temporary credentials (access key + secret + token)",
        {
          validation: {
            error: "session_token_requires_access_keys"
          }
        }
      );
    }

    if (!hasAccessKey) {
      throw new QueryError(
        "Invalid credentials configuration",
        "Access key and secret access key are required",
        {
          validation: {
            missing: "access_credentials_required"
          }

View on GitHub (pinned to 20602a8e10)

Solutions

1. Run `aws sts get-session-token` (or `aws sso login` for SSO) and copy all three returned values: AccessKeyId, SecretAccessKey, SessionToken.
2. Paste AccessKeyId -> access_key, SecretAccessKey -> secret_access_key, SessionToken -> session_token.
3. If you only have long-lived keys, clear the session_token field entirely.
4. Re-test the connection after saving.

Example fix

// before
sourceOptions = { session_token: 'FwoGZXI...' } // missing access_key + secret
// after
sourceOptions = {
  access_key: 'AKIA...',
  secret_access_key: 'wJalrXU...',
  session_token: 'FwoGZXI...'
}

function validateCreds(opts: { access_key?: string; secret_access_key?: string; session_token?: string }) {
  if (opts.session_token && !(opts.access_key && opts.secret_access_key)) {
    throw new Error('session_token requires access_key + secret_access_key');
  }
}

function isCompleteStsTriple(opts: any): opts is { access_key: string; secret_access_key: string; session_token: string } {
  return Boolean(opts.access_key && opts.secret_access_key && opts.session_token);
}

When it happens

Trigger: A user pastes only the session_token field (e.g. copied from an SSO browser URL or a partial AWS_SSO cache) and leaves access_key / secret_access_key blank, or swaps the secret into the session_token field by mistake.

Common situations: Confusing the three STS fields when copying from `aws sts get-session-token` output; using an SSO start-url that emits a token but no long-lived keys; form auto-fill putting the wrong value in the session_token box.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Connection test failed
• Connection could not be established
• API key missing: No API key provided in source options.
• Failed to assume role
• Query could not be completed

AI-assisted analysis of ToolJet/ToolJet@20602a8e10 (2026-08-13). Data as JSON: /api/errors/c69bb35e7e10ce6a. Report an issue: GitHub.