NotAuthorizedException Authentication Origin: Application & API Last updated 14 Oct 2026

AWS Cognito: NotAuthorizedException: Incorrect username or password

Cognito rejected the sign-in — wrong credentials, a disabled user, an auth flow not enabled on the app client, or an expired refresh token.

Exact message you may see Incorrect username or passwordUser is disabledRefresh Token has expiredAccess Token has been revoked
Seen on: REST API

Meaning

Cognito returns NotAuthorizedException for several cases; the message differs: “Incorrect username or password”, “User is disabled”, “Refresh Token has expired”, or “Unable to verify secret hash for client” (secret hash issue).

Common causes

  • Wrong username/password
  • User disabled
  • ALLOW_USER_PASSWORD_AUTH / USER_SRP_AUTH not enabled on the app client
  • Refresh token expired/revoked

⚡ Quick fix

  1. Read the exact message
  2. Enable the needed auth flows on the app client
  3. Re-authenticate when refresh tokens expire

Detailed fix by platform

AWS CLI

  1. aws cognito-idp describe-user-pool-client --user-pool-id eu-west-1_abc --client-id $CLIENT --query 'UserPoolClient.ExplicitAuthFlows'

How to diagnose

  1. Message — Which variant?
  2. User — Enabled/confirmed?
  3. Client — Auth flows

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

401 — HTTP 401 Unauthorized (HTTP)401AADSTS50076 — Azure AD (Entra ID): AADSTS50076 / AADSTS50079 — multi-factor authentication required (Azure)AADSTS50076AADSTS50126 — AADSTS50126: Error validating credentials due to invalid username or password (Azure)AADSTS50126AADSTS700016 — Azure AD (Entra ID): AADSTS700016 Application not found in the directory (Azure)AADSTS700016auth/invalid-credential — Firebase Auth: auth/invalid-credential (auth/wrong-password, auth/user-not-found, auth/invalid-login-credentials) (Authentication)auth/invalid-credenti…Authentication failed — fatal: Authentication failed for 'https://github.com/x/y.git/' (Git)Authentication failedAuthentication token manipulation error — passwd: Authentication token manipulation error (Linux)Authentication token …AuthenticationFailed — Azure Storage: Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature (AuthenticationFailed) (Azure)AuthenticationFailedNotAuthor…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.