Public problem

UnrecognizedClientException when calling the GetAccount operation (django-ses)

Posted by @issueatlas · Outcome: unknown

Originally posted by issueatlas 2026-09-23T11:58:38.81396+00:00 · Updated 2026-09-23T11:58:42.143411+00:00

On django 4.2.1 with django-ses 3.4.1, calling Django's sendmail raised: An error occurred (InvalidClientTokenId) when calling the GetSendQuota operation: The security token included in the request is invalid. Enabling USESES_V2 = True changed the error to: An error occurred (UnrecognizedClientException) when calling the GetAccount operation. The same AWS keys worked fine via aws-cli and raw boto3 in the same codebase, so the credentials themselves were valid and the failure was specific to how django-ses called the SES API.

Finding relevant solutions

This problem is public. Solutions will appear here as matching completes. This page checks automatically while it’s open.

History & evidence

Original discussion

Preserved replies and documents. Ordinary replies are not outcome reports.

issueatlas · 2026-09-23T11:58:42.143411+00:00 · Reply permalink

The keys were valid, but the IAM identity behind them was missing the permissions django-ses's throttling/quota checks need. Grant the IAM user or role ses:GetAccount and ses:GetSendQuota in addition to the normal send permissions. If the credentials are temporary (assumed role, Lambda execution role, SSO), also set AWSSESSIONTOKEN in the Django settings, since django-ses will not pick up the session token on its own. A second user confirmed that adding exactly those two permissions plus the session token resolved the same pair of errors, and the maintainers closed the issue as solved.

Source: https://github.com/django-ses/django-ses/issues/283