561
Unofficial (AWS)
561 Unauthorized: AWS Authentication Failure
✦ The Golden Answer: The 561 Unauthorized is an AWS‑specific status code. It indicates that the request was rejected due to invalid authentication credentials. This is used by AWS services (such as API Gateway, S3, CloudFront, and other AWS APIs) when the client's credentials are missing, expired, or incorrect. Unlike the standard 401 Unauthorized (which is also used for authentication failures), 561 is a custom code that AWS uses to provide a more specific error signal in certain contexts, particularly when using AWS Signature V4.
Common Causes of 561 Errors
| Cause | Example | How to Fix |
|---|---|---|
| Missing AWS credentials | Request does not include an Authorization header or AWS access key. | Include valid AWS credentials in the request (e.g., via Authorization header). |
| Expired AWS credentials | Access key or temporary session token has expired. | Renew credentials or obtain new temporary tokens (e.g., via STS). |
| Incorrect signature | Signature V4 calculation is incorrect (e.g., wrong region, service, or date). | Verify the signature algorithm, region, service name, and date. |
| Clock skew | Client's clock is out of sync with AWS servers (more than 5 minutes). | Synchronize the client's clock using NTP. |
| Insufficient IAM permissions | The authenticated user/role does not have permission to perform the action. | Review IAM policies and grant the necessary permissions. |
| Invalid API key | For API Gateway, an invalid or missing API key was used. | Check the API key and ensure it is enabled and correct. |
Example: 561 Response (AWS API Gateway)
When an API Gateway request fails due to invalid credentials, the response may look like:
HTTP/1.1 561 Unauthorized
Content-Type: application/json
{
"message": "Invalid credentials. Please check your AWS access key and signature."
}
How to Fix 561 Errors
- Verify AWS credentials: Ensure that your Access Key ID and Secret Access Key are correct and have not been rotated. If using temporary credentials (e.g., from STS), check that they have not expired.
- Check signature calculation: If you are using AWS Signature V4, verify that you are using the correct region, service name (e.g., "execute-api" for API Gateway), and that the date is in the correct format (YYYYMMDD). Use AWS SDKs to handle signing automatically when possible.
- Synchronize clock: Ensure your system's clock is accurate. Use NTP to sync time. A clock skew of more than 5 minutes will cause signature verification to fail.
- Review IAM policies: Check that the IAM user or role has the necessary permissions (e.g.,
execute-api:Invokefor API Gateway, ors3:GetObjectfor S3). - For API Gateway: If you are using API keys, ensure the key is correct, enabled, and associated with the correct usage plan.
- Use AWS SDKs: The AWS SDKs handle credential management and signing automatically, which reduces the risk of manual errors.
561 vs. 401
- 401 Unauthorized – standard HTTP status for authentication failure. Used broadly across many services.
- 561 Unauthorized – AWS‑specific status, often used in API Gateway and other AWS services to indicate invalid AWS credentials specifically.
In practice, some AWS services may return 401 instead of 561, depending on the context. If you see 561, it's a strong indicator of an AWS authentication issue.
Frequently Asked Questions
Is 561 a client error or a server error?
It is a client error (4xx) because the client's credentials are invalid. The server (AWS) is functioning correctly but rejecting the request due to authentication issues.
Can I fix a 561 error from the client side?
Yes, the fix is on the client side. You need to provide valid AWS credentials and ensure your request is correctly signed.
Why does AWS use 561 instead of 401?
AWS sometimes uses 561 to differentiate between general authentication failures and AWS‑specific credential issues. However, the use of 561 is not universal across all AWS services; some may still return 401.