Unable to verify secret hash for client Authentication Origin: Application & API Last updated 13 Oct 2026

AWS Cognito: NotAuthorizedException: Unable to verify secret hash for client x

The app client has a client secret, so every request needs a SECRET_HASH — and it’s missing or computed wrongly.

Exact message you may see Unable to verify secret hash for clientClient is configured for secret but secret was not received
Explore the map of this error Full error map →
Seen on: REST API

Meaning

Browser/mobile apps shouldn’t use clients with secrets. For server-side use, SECRET_HASH = Base64(HMAC_SHA256(client_secret, username + client_id)). Using email vs username (sub) changes the hash.

Common causes

  • Public (browser/mobile) app using a client that has a secret
  • SECRET_HASH not sent
  • Hash computed with the wrong username/alias
  • Wrong client secret

⚡ Quick fix

  1. Create an app client without a secret for public apps
  2. Compute SECRET_HASH server-side with the exact username
  3. Verify client ID/secret pair

Detailed fix by platform

Python

  1. python
    import hmac, hashlib, base64
secret_hash = base64.b64encode(hmac.new(client_secret.encode(), (username + client_id).encode(), hashlib.sha256).digest()).decode()

How to diagnose

  1. Client — Has a secret?
  2. Username — Same value used in hash and request

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

auth/invalid-credential — Firebase Auth: auth/invalid-credential (auth/wrong-password, auth/user-not-found, auth/invalid-login-credentials) (Authentication)auth/invalid-credenti…auth/network-request-failed — Firebase Auth: auth/network-request-failed — A network AuthError (such as timeout, interrupted connection or unreachable host) has occurred (Authentication)auth/network-request-…Clock skew too great — Kerberos: Clock skew too great (KRB_AP_ERR_SKEW) (Authentication)Clock skew too greatEmail not confirmed — Supabase Auth: AuthApiError: Email not confirmed (Authentication)Email not confirmedIllegal arguments: undefined, string — bcrypt error: Illegal arguments: undefined, string / data and salt arguments required / data and hash arguments required (Authentication)Illegal arguments: un…invalid two-factor code — Two-factor (TOTP) code invalid / Invalid verification code (authenticator app time drift) (Authentication)invalid two-factor co…invalid_client — OAuth 2.0 Error: invalid_client (Authentication)invalid_clientLDAP error code 49 — LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e (Authentication)LDAP error code 49Unable to…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.