title: Error Amazon Selling Partner API [The security token included in the request is invalid]
body: <p>I have problem while connecting to Amazon SP API. I have follow the guideline on Amazon <a href="https://github.com/amzn/selling-partner-api-docs/blob/main/guides/en-US/developer-guide/SellingPartnerApiDeveloperGuide.md" rel="nofollow noreferrer">https://github.com/amzn/selling-partner-api-docs/blob/main/guides/en-US/developer-guide/SellingPartnerApiDeveloperGuide.md</a></p>
  <p>The C# SDK that I used is <a href="https://github.com/amzn/selling-partner-api-models" rel="nofollow noreferrer">https://github.com/amzn/selling-partner-api-models</a></p>
  <p>I have add below inline policy to my IAM user</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
              &quot;Resource&quot;: &quot;arn:aws:iam::0000000:role/SellingPartnerAPI_Role&quot;
          }
      ]
  }
  </code></pre>
  <p>Below is my c# source code</p>
  <pre><code>var accessKey = &quot;xxx&quot;;
  var secretKey = &quot;xxx&quot;;
  var credentials = new BasicAWSCredentials(accessKey, secretKey);
  var client = new AmazonSecurityTokenServiceClient(credentials);
  var assumeRoleRequest = new AssumeRoleRequest()
  {
      // AWS IAM Role ARN
      DurationSeconds = 3600,
      RoleArn = &quot;arn:aws:iam::0000000000:role/SellingPartnerAPI_Role&quot;,
      RoleSessionName = DateTime.Now.Ticks.ToString()
  };
  AssumeRoleResponse assumeRoleResponse = await client.AssumeRoleAsync(assumeRoleRequest);
  
  RestClient restClient = new RestClient(&quot;https://sellingpartnerapi-fe.amazon.com&quot;);
  IRestRequest restRequest = new RestRequest(&quot;/orders/v0/orders&quot;, Method.GET);
  restRequest.AddQueryParameter(&quot;CreatedAfter&quot;, &quot;2020-12-01T00:00:00Z&quot;);
  restRequest.AddQueryParameter(&quot;marketplaceIds&quot;, &quot;A21BRDQVFO45XV&quot;);
  var lwaAuthCreds = new LWAAuthorizationCredentials
  {
      ClientId = &quot;amzn1.application-oa2-client.xxxxxxxxxx&quot;,
      ClientSecret = &quot;ClientSecretxxxxx&quot;,
      RefreshToken = &quot;RefreshTokenxxxxxx,
      Endpoint = new Uri(&quot;https://api.amazon.com/auth/o2/token&quot;)
  };
  restRequest = new LWAAuthorizationSigner(lwaAuthCreds).Sign(restRequest);
  var awsAuthCreds = new AWSAuthenticationCredentials
  {
      AccessKeyId = assumeRoleResponse.Credentials.AccessKeyId,
      SecretKey = assumeRoleResponse.Credentials.SecretAccessKey,
      Region = &quot;us-west-2&quot;
  };
  
  restRequest.AddHeader(&quot;X-Amz-Security-Token&quot;, assumeRoleResponse.Credentials.SessionToken);
  restRequest = new AWSSigV4Signer(awsAuthCreds)
      .Sign(restRequest, restClient.BaseUrl.Host);
  var resp = restClient.Execute(restRequest);
  Console.WriteLine(resp.StatusCode);
  Console.WriteLine(resp.Content);
  </code></pre>
  <p>The response is</p>
  <pre><code>{
    &quot;errors&quot;: [
      {
        &quot;message&quot;: &quot;The security token included in the request is invalid&quot;,
        &quot;code&quot;: &quot;InvalidInput&quot;
      }
    ]
  }
  </code></pre>