Unable to verify secret hash for client 🔐 Authentication

AWS Cognito: NotAuthorizedException: Unable to verify secret hash for client x

The app client has a client secret, so every request needs a SECRET_HASH — and it’s missing or computed wrongly.

Seen on: REST API

Meaning

Browser/mobile apps shouldn’t use clients with secrets. For server-side use, SECRET_HASH = Base64(HMAC_SHA256(client_secret, username + client_id)). Using email vs username (sub) changes the hash.

Common causes

  • Public (browser/mobile) app using a client that has a secret
  • SECRET_HASH not sent
  • Hash computed with the wrong username/alias
  • Wrong client secret

⚡ Quick fix

  1. Create an app client without a secret for public apps
  2. Compute SECRET_HASH server-side with the exact username
  3. Verify client ID/secret pair

Detailed fix by platform

Python

  1. python
    import hmac, hashlib, base64
secret_hash = base64.b64encode(hmac.new(client_secret.encode(), (username + client_id).encode(), hashlib.sha256).digest()).decode()

How to diagnose

  1. Client — Has a secret?
  2. Username — Same value used in hash and request

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.