# AWS Cognito: NotAuthorizedException: Unable to verify secret hash for client x

**Code:** `Unable to verify secret hash for client` · **Category:** Authentication · **Seen on:** REST API

The app client has a client secret, so every request needs a SECRET_HASH — and it’s missing or computed wrongly.

## Meaning

Browser/mobile apps shouldn’t use clients with secrets. For server-side use, SECRET_HASH = Base64(HMAC_SHA256(client_secret, username + client_id)). Using email vs username (sub) changes the hash.

## Common causes

- Public (browser/mobile) app using a client that has a secret
- SECRET_HASH not sent
- Hash computed with the wrong username/alias
- Wrong client secret

## Quick fix

1. Create an app client without a secret for public apps
2. Compute SECRET_HASH server-side with the exact username
3. Verify client ID/secret pair

## Detailed fix by platform

### Python

1. 

```python
import hmac, hashlib, base64
secret_hash = base64.b64encode(hmac.new(client_secret.encode(), (username + client_id).encode(), hashlib.sha256).digest()).decode()
```


## How to diagnose

1. **Client** — Has a secret?
2. **Username** — Same value used in hash and request

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/auth/cognito-unable-to-verify-secret-hash)