**Confirm which profile the failing command uses.** Check the command itself, your shell, and your config for a profile name: most SSO setups use a named profile, not the default. Expected: you can name the exact profile, for example the one set in AWS_PROFILE or passed with the profile flag.

**Re-login to SSO for that profile.** Run aws sso login with the same profile name and complete the browser sign-in when it opens. Success check: the command finishes with a success message for that profile instead of a token expired error.

**Verify the refreshed credentials load.** Run aws sts get-caller-identity with the same profile. Expected: it prints an account id, a user id, and an ARN for the SSO role. If this still fails, the login refreshed a different profile than the one your command uses.

**Retry the original command unchanged.** Run it with the same profile flag or environment you used before. Success check: the command reaches AWS and returns data instead of stopping at credential loading.

**If login itself fails in the browser step, fix the session start.** Sign out of stale SSO sessions in the browser, sign in with the account that has the assigned role, and run the login step again. Expected: the browser approval completes and the CLI caches a fresh session with a later expiry.