AWS Cognito: NotAuthorizedException: Incorrect username or password
Cognito rejected the sign-in — wrong credentials, a disabled user, an auth flow not enabled on the app client, or an expired refresh token.
Incorrect username or passwordUser is disabledRefresh Token has expiredAccess Token has been revoked Meaning
Cognito returns NotAuthorizedException for several cases; the message differs: “Incorrect username or password”, “User is disabled”, “Refresh Token has expired”, or “Unable to verify secret hash for client” (secret hash issue).
Common causes
- Wrong username/password
- User disabled
- ALLOW_USER_PASSWORD_AUTH / USER_SRP_AUTH not enabled on the app client
- Refresh token expired/revoked
⚡ Quick fix
- Read the exact message
- Enable the needed auth flows on the app client
- Re-authenticate when refresh tokens expire
Detailed fix by platform
AWS CLI
aws cognito-idp describe-user-pool-client --user-pool-id eu-west-1_abc --client-id $CLIENT --query 'UserPoolClient.ExplicitAuthFlows'
How to diagnose
- Message — Which variant?
- User — Enabled/confirmed?
- Client — Auth flows
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
Most viewed in Authentication
- disallowed_useragent Google OAuth: Error 403: disallowed_useragent (sign-in from an embedded WebView)
- redirect_uri_mismatch OAuth Error: redirect_uri_mismatch
- auth/too-many-requests Firebase Auth: auth/too-many-requests — Access to this account has been temporarily disabled due to many failed login attempts
Other ways to find it
Where this error sits
Origin: Application & API. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Report a correction or suggest an improvement
Last updated 14 Oct 2026