diff --git a/lib/aws4signer.js b/lib/aws4signer.js
index <HASH>..<HASH> 100644
--- a/lib/aws4signer.js
+++ b/lib/aws4signer.js
@@ -60,6 +60,11 @@ const aws4signer = (esRequest, parent) => {
       esRequest.region = parent.options.awsRegion
     }
 
+    // refreshes the token if has expired.
+    credentials.get(err => {
+      if (err) throw err
+    })
+
     esRequest.headers = Object.assign({ host: urlObj.hostname, 'Content-Type': 'application/json' }, esRequest.headers)
     esRequest.path = `${urlObj.pathname}?${urlObj.searchParams.toString()}`
     aws4.sign(esRequest, credentials)
check if credential has expired
and trigger a refresh