Cognito Invalid Client ID Debugger

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 5–15 mins

TL;DR

• What broke: The client_id in your Cognito auth request does not match any App Client registered under the target User Pool, or it belongs to a different pool/region entirely — Cognito rejects the request with invalid_client.
• How to fix it: Cross-reference the client_id value in your code/env against the exact App Client ID in the AWS Console under Cognito → User Pools → [Your Pool] → App clients. Confirm region and pool ID alignment.
• Shortcut: Use our Client-Side Sandbox above to auto-refactor this — paste your auth config and get corrected initialization code without sending secrets to any server.

POST https://cognito-idp.us-east-1.amazonaws.com/
Response: 400 Bad Request
{
  "__type": "NotAuthorizedException",
  "message": "Invalid client id"
}

HTTP 400
{"error": "invalid_client", "error_description": "Client authentication failed"}

How to Fix It

Step 1: Locate the Correct Client ID

Navigate to: AWS Console → Cognito → User Pools → [your-pool-id] → App clients

Copy the exact Client ID (26-character alphanumeric string). Confirm the User Pool ID and region match your endpoint URL.

Basic Fix — Environment Variable / SDK Init Correction

// AWS Amplify config (amplify-config.js or aws-exports.js)
 const awsConfig = {
   Auth: {
     region: 'us-east-1',
-    userPoolId: 'us-east-1_XXXXXXXXX',
-    userPoolWebClientId: '1abc2defghij3klmnopqrstu45',  // ❌ stale/wrong client ID
+    userPoolId: 'us-east-1_A1B2C3D4E',                  // ✅ verified from Console
+    userPoolWebClientId: '6n7o8pqrstuvwxyz9a0b1c2d3e',  // ✅ current App Client ID
   }
 };

# .env or SSM Parameter
- COGNITO_CLIENT_ID=1abc2defghij3klmnopqrstu45
+ COGNITO_CLIENT_ID=6n7o8pqrstuvwxyz9a0b1c2d3e

Direct Token Endpoint Fix (OAuth2 / curl)

 curl -X POST https://your-domain.auth.us-east-1.amazoncognito.com/oauth2/token \
   -H 'Content-Type: application/x-www-form-urlencoded' \
-  -d 'grant_type=authorization_code&client_id=WRONG_CLIENT_ID&code=AUTH_CODE&redirect_uri=https://app.example.com/callback'
+  -d 'grant_type=authorization_code&client_id=6n7o8pqrstuvwxyz9a0b1c2d3e&code=AUTH_CODE&redirect_uri=https://app.example.com/callback'

Enterprise Best Practice — Client Secret Handling

If your App Client has a client secret (required for server-side/machine-to-machine flows), never use it in browser/mobile clients. Create a separate App Client with no secret for public clients.

# Terraform: aws_cognito_user_pool_client
 resource "aws_cognito_user_pool_client" "web_client" {
   name         = "web-app-client"
   user_pool_id = aws_cognito_user_pool.main.id

-  generate_secret = true   # ❌ NEVER for SPAs or mobile apps
+  generate_secret = false  # ✅ public client — no secret

+  explicit_auth_flows = [
+    "ALLOW_USER_SRP_AUTH",
+    "ALLOW_REFRESH_TOKEN_AUTH"
+  ]

+  allowed_oauth_flows_user_pool_client = true
+  allowed_oauth_flows                  = ["code"]
+  allowed_oauth_scopes                 = ["openid", "email", "profile"]
+  callback_urls                        = ["https://app.example.com/callback"]
 }

For server-side clients (Lambda, backend API), store the client secret in AWS Secrets Manager — not env vars:

- const clientSecret = process.env.COGNITO_CLIENT_SECRET;  // ❌ env var, rotates poorly
+ const secret = await secretsManager.getSecretValue({ SecretId: 'prod/cognito/client-secret' }).promise();
+ const clientSecret = JSON.parse(secret.SecretString).client_secret;  // ✅ rotatable, auditable

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# GitHub Actions / pre-deploy step
aws cognito-idp describe-user-pool-client \
  --user-pool-id $COGNITO_USER_POOL_ID \
  --client-id $COGNITO_CLIENT_ID \
  --region $AWS_REGION \
  || { echo "❌ COGNITO_CLIENT_ID is invalid. Blocking deploy."; exit 1; }

checkov -d ./terraform --check CKV_AWS_131
# CKV_AWS_131: Ensure Cognito UserPool client does not expose secret to public app

resource "aws_ssm_parameter" "cognito_client_id" {
  name  = "/prod/app/cognito_client_id"
  type  = "SecureString"
  value = aws_cognito_user_pool_client.web_client.id

  tags = {
    UserPoolArn = aws_cognito_user_pool.main.arn  # traceability
    Environment = "prod"
  }
}