On this page

Incorrect IAM authentication information: verify aksk signature fail
Incorrect IAM authentication information: AK access failed to reach the limit,forbidden
Incorrect IAM authentication information: decrypt token fail
Incorrect IAM authentication information: Get secretKey failed

Show all

Help Center/ API Gateway/ FAQs/ Calling APIs/ Why Am I Seeing the Error Message "Incorrect IAM authentication information" When I Call an API?

Why Am I Seeing the Error Message "Incorrect IAM authentication information" When I Call an API?

Updated on 2025-01-21 GMT+08:00

View PDF

You may encounter the following errors related to IAM authentication information:

Incorrect IAM authentication information: verify aksk signature fail
Incorrect IAM authentication information: AK access failed to reach the limit,forbidden
Incorrect IAM authentication information: decrypt token fail
Incorrect IAM authentication information: Get secretKey failed

Incorrect IAM authentication information: verify aksk signature fail

{    
  "error_msg": "Incorrect IAM authentication information: verify aksk signature fail, ......   
  "error_code": "APIG.0301", 
  "request_id": "******" 
}

Possible Cause

The signature algorithm is incorrect, and the signature calculated by the client is different from that calculated by APIG.

Solution

Download the JavaScript SDK, view the visualized signing SDK, and obtain the signature.
Decompress the package and open the demo.html file using a browser.
Obtain the value of x-sdk-date, and check whether the difference between this value and the current time is within 15 minutes.
1. Press F12 on the keyboard, and choose Sources > Snippets > New snippet.
2. Copy the following code to the script snippet on the right, right-click the snippet name on the left, and select Run from the shortcut menu. The value displayed on the Console tab is the value of x-sdk-date.
```
function twoChar(s) {
    if (s >= 10) {
        return "" + s
    } else {
        return "0" + s
    }
}

function getTime() {
    var date = new Date();
    return "" + date.getUTCFullYear() + twoChar(date.getUTCMonth() + 1) + twoChar(date.getUTCDate()) + "T" +
        twoChar(date.getUTCHours()) + twoChar(date.getUTCMinutes()) + twoChar(date.getUTCSeconds()) + "Z"
}
getTime()
```
Add x-sdk-date to Headers, set other parameters, and click Debug to obtain the signature.

For all requests except get, delete, and head, add a body in the Body area by using the same format as a real request body.

Copy the curl command in the figure of 4, run it in a command line interface, and then go to the next step.

curl -X GET "http://192.168.0.1:10000/get" -H "X-Sdk-Date: 20221208T015751Z" -H "host: 192.168.0.1:10000" -H "Authorization: SDK-HMAC-SHA256 Access=6cc7***95a8, SignedHeaders=host;x-sdk-date, Signature=4884***108a" -d $''

If a custom authorizer is used, replace Authorization in the curl command with the authorizer name.

Compare the signature in the local code with the visualized signature of JavaScript.

For example, check whether the values of canonicalRequest, stringToSign, and authorizationHeader in the Java signing code are the same as those in the visualized signature of JavaScript.

Incorrect IAM authentication information: AK access failed to reach the limit,forbidden

{    
  "error_msg": "Incorrect IAM authentication information: AK access failed to reach the limit,forbidden." ......   
  "error_code": "APIG.0301", 
  "request_id": "******" 
}

Possible Causes

The AK/SK signature calculation is incorrect.
The AK and SK do not match. Check whether the SK is correct.
AK/SK authentication fails for more than five consecutive times, and the AK/SK pair is locked for five minutes. (Authentication requests are rejected within this period). Try again 5 minutes later.
An expired token is used for token authentication. Obtain a new token.

Solution

Resolve the problem by referring to Incorrect IAM authentication information: verify aksk signature fail.
Check whether the SK is correct.
Try again 5 minutes later.
Obtain a new token.

Incorrect IAM authentication information: decrypt token fail

{
  "error_msg": "Incorrect IAM authentication information: decrypt token fail",
  "error_code": "APIG.0301",
  "request_id": "******"
}

Possible Cause

The token cannot be parsed for IAM authentication of the API.

Solution

Check whether the obtained token is the token of the corresponding IAM account.
Check whether the token is correct.
Check whether the token has been obtained in the environment where the API is called.

Incorrect IAM authentication information: Get secretKey failed

{
"error_msg": "Incorrect IAM authentication information: Get secretKey failed,ak:******,err:ak not exist",
"error_code": "APIG.0301",
"request_id": "******"
}

Possible Cause

The AK used for IAM authentication of the API does not exist.

Solution

Check whether the AK is correct.

Parent topic: Calling APIs

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot