NextAuth.js + AWS Cognito: OAUTH_CALLBACK_ERROR - invalid_client despite correct setup

[Wuzoobia]

Hi everyone,

I've been stuck on this issue for over 2 days and would appreciate any guidance.
I'm trying to integrate Amazon Cognito with NextAuth.js in a Next.js app, using the next-auth Cognito provider. No matter what I do, I keep hitting the following error after a successful redirect from the Cognito [next-auth][error][OAUTH_CALLBACK_ERROR] https://next-auth.js.org/errors#oauth_callback_error invalid_client { error: [Error [OAuthCallbackError]: invalid_client] { code: undefined }, providerId: 'cognito', message: 'invalid_client' }
I’m not using a client secret (the Cognito App Client is set up as a Single Page App without a secret).

My .env has the correct COGNITO_CLIENT_ID, COGNITO_USER_POOL_ID, and issuer.

The issuer is set to the standard format: COGNITO_ISSUER=https://cognito-idp.us-east-1.amazonaws.com/us-east-1_XXXXXXX
Callback URLs in Cognito match: http://localhost:3000/api/auth/callback/cognito

The Hosted UI flow starts correctly, and I can log in, but the error occurs at the callback step.
CognitoProvider({ clientId: process.env.COGNITO_CLIENT_ID || '', clientSecret: '', // No secret used issuer: process.env.COGNITO_ISSUER || '', wellKnown: ${process.env.COGNITO_ISSUER}/.well-known/openid-configuration, }),
Attempts so far:
Regenerated and deleted App Clients multiple times

Tried setting secret to undefined, null, empty string

Set and verified correct callback/logout URLs in Cognito console

Read all related NextAuth + Cognito GitHub issues and discussions most seem unresolved or apply to apps using secrets

Any insights would be greatly appreciated 🙏. If anyone has a working no-secret Cognito + NextAuth.js config, I'd love to see it! Learnign curve! 🙏

Thanks in advance.

[cmma0003]

Hi @Wuzoobia , did you find the solution to this issue? I am facing the same one

[Wuzoobia]

I didn't! I used a different alternative. Gmail Oauth and Clerk. But if you must use cognito, I believe they have a login oauth template in the cognito setup page I think. BTW, I no longer use AWS, too expensive.