remotion-dev/remotion · error · Error

UnrecognizedClientException: The AWS credentials provided we

Error message

UnrecognizedClientException: The AWS credentials provided were probably mixed up. Learn how to fix this issue here: https://remotion.dev/docs/lambda/troubleshooting/unrecognizedclientexception

What it means

getCompositionsOnLambda wraps its call; if the resulting error stack contains 'UnrecognizedClientException', it is rethrown with a clear message. AWS throws UnrecognizedClientException most often when the access key id and secret access key do not belong to the same IAM user/account (a copy-paste mix-up) or when a key has been deleted/rotated.

Source

Thrown at packages/lambda-client/src/get-compositions-on-lambda.ts:105

				serveUrl,
				envVariables,
				inputProps: serializedInputProps,
				logLevel: dumpBrowserLogs ? 'verbose' : (logLevel ?? 'info'),
				timeoutInMilliseconds: timeoutInMilliseconds ?? 30000,
				version: VERSION,
				bucketName: bucketName ?? null,
				offthreadVideoCacheSizeInBytes: offthreadVideoCacheSizeInBytes ?? null,
				forcePathStyle: forcePathStyle ?? false,
				mediaCacheSizeInBytes: mediaCacheSizeInBytes ?? null,
			},
			region,
			timeoutInTest: 120000,
			requestHandler,
		});
		return res.compositions;
	} catch (err) {
		if ((err as Error).stack?.includes('UnrecognizedClientException')) {
			throw new Error(
				'UnrecognizedClientException: The AWS credentials provided were probably mixed up. Learn how to fix this issue here: https://remotion.dev/docs/lambda/troubleshooting/unrecognizedclientexception',
			);
		}

		throw err;
	}
};

View on GitHub (pinned to 78fe4bb3fd)

Solutions

1. Regenerate a matching access-key/secret-key pair from the same IAM user and set both env vars
2. Check for trailing whitespace or newlines in the env values (echo with quotes)
3. Confirm both values come from the same IAM user and the key is still Active

Example fix

# before - mixed keys
AWS_ACCESS_KEY_ID=AKIAUSER1...
AWS_SECRET_ACCESS_KEY=<user2-secret>

# after - matching pair
AWS_ACCESS_KEY_ID=AKIAUSER1...
AWS_SECRET_ACCESS_KEY=<user1-secret>

function assertMatchingAwsCreds() {
  const key = process.env.AWS_ACCESS_KEY_ID;
  const secret = process.env.AWS_SECRET_ACCESS_KEY;
  if (key && secret && !key.includes(secret) && !secret.includes(key)) return; // best-effort
  if (!key || !secret) throw new Error('AWS credentials incomplete or possibly mismatched');
}

try {
  await getCompositionsOnLambda({...});
} catch (err) {
  if ((err as Error).message.includes('UnrecognizedClientException')) {
    // regenerate and set a matching key/secret pair
  }
  throw err;
}

When it happens

Trigger: Calling getCompositionsOnLambda (or any routine routed through this wrapper) with mismatched AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY pair.

Common situations: Key rotated but only one of the two values updated; copy-paste collided two different users' keys; trailing whitespace/newline in an env value; key deleted in IAM but still referenced.

Related errors

• No valid AWS Caller Identity detected
• A custom role ARN must either be "undefined" or a string, bu
• You have tried to call a Remotion Lambda function, but have
• You have tried to call a Remotion Lambda function, but have
• UnrecognizedClientException: The AWS credentials provided we

AI-assisted analysis of remotion-dev/remotion@78fe4bb3fd (2026-08-12). Data as JSON: /api/errors/b58b2605ccacb4e8. Report an issue: GitHub.