Akamai EdgeGrid "Invalid timestamp" / signature auth error in CI

By Kaveh Alemi·Latchkey

The EdgeGrid signature did not validate: a 401 with "Invalid timestamp" or a signature mismatch means the client_token, client_secret, access_token, and host in .edgerc are wrong or incomplete, or the runner clock drifted outside the allowed window.

What this error means

Any EdgeGrid call (purge or config) returns HTTP 401 with a problem+json title like "Invalid timestamp" or "The signature does not match". It fails before the request is processed.

{
  "type": "https://problems.luna.akamaiapis.net/-/pep-authn/invalid-timestamp",
  "title": "Invalid timestamp",
  "status": 401
}

Common causes

Incomplete or malformed .edgerc

A missing access_token, a truncated client_secret, or the wrong host section produces a signature the API cannot verify.

Runner clock skew

EdgeGrid signatures include a timestamp; if the runner clock is off beyond the tolerance, the request is rejected as an invalid timestamp.

How to fix it

Write a complete .edgerc from secrets

1. Store host, client_token, client_secret, and access_token as secrets.
2. Write them into a .edgerc section at the start of the job.
3. Point the client at that section.

cat > ./.edgerc <<EOF
[default]
host = ${AKAMAI_HOST}
client_token = ${AKAMAI_CLIENT_TOKEN}
client_secret = ${AKAMAI_CLIENT_SECRET}
access_token = ${AKAMAI_ACCESS_TOKEN}
EOF

Keep the runner clock in sync

A timestamp error usually clears once the runner clock is correct; managed runners sync NTP by default.

date -u

How to prevent it

• Populate all four .edgerc fields from secrets, no partial config.
• Keep the runner clock synced to avoid timestamp errors.
• Never commit .edgerc credentials to the repo.

Frequently asked questions

Related guides

References

• GitHub Actions documentation