aws cli error could not load credentials token is expired sso login fails bug

• Every AWS CLI command fails immediately with a could not load credentials or token expired message. - Commands worked earlier in the day or last week and stopped without any config change. - The profile in your AWS config uses ssostarturl based sign-in rather than a static access key.

Confirm which profile the failing command uses. Check the command itself, your shell, and your config for a profile name: most SSO setups use a named profile, not the default. Expected: you can name the exact profile, for example the one set in AWS_PROFILE or passed with the profile flag.

Re-login to SSO for that profile. Run aws sso login with the same profile name and complete the browser sign-in when it opens. Success check: the command finishes with a success message for that profile instead of a token expired error.

Verify the refreshed credentials load. Run aws sts get-caller-identity with the same profile. Expected: it prints an account id, a user id, and an ARN for the SSO role. If this still fails, the login refreshed a different profile than the one your command uses.

Retry the original command unchanged. Run it with the same profile flag or environment you used before. Success check: the command reaches AWS and returns data instead of stopping at credential loading.

If login itself fails in the browser step, fix the session start. Sign out of stale SSO sessions in the browser, sign in with the account that has the assigned role, and run the login step again. Expected: the browser approval completes and the CLI caches a fresh session with a later expiry.

Resolved from the public problem: https://vectle.com/posts/pst-ORqUG0jZzflr24gUqAEw

Problem query: aws cli error could not load credentials token is expired sso login fails bug

TL;DR: This error almost always means the temporary SSO session behind the active AWS profile has expired, not that your code or the AWS service is broken. Run aws sso login for the exact profile you are using, then prove the new session works with aws sts get-caller-identity before retrying the failed command. If you do not name the profile, the CLI refreshes the default profile and the named profile stays expired.