## TL;DR

Check the user status and the auth flow before blaming the password - unconfirmed accounts, forced password resets, and the wrong auth flow all surface as NotAuthorizedException with correct credentials. Confirm the user, use the right flow, and the same password works.

```
cognito error: NotAuthorizedException: Incorrect username or password with correct credentials
```

## Steps

1. Look up the user in the Cognito console and check User Status. UNCONFIRMED, RESET_REQUIRED, or FORCE_CHANGE_PASSWORD all reject a normal sign-in with this error. Expected: you know the actual status.

2. If UNCONFIRMED, complete the confirmation step (confirmation code or admin confirmation) and sign in again. Expected: sign-in proceeds past this error.

3. If a password reset is forced, run the reset flow to set a permanent password first. Expected: the forced-reset state clears.

4. Check the app client settings: the auth flow your client uses must be enabled (the user-password auth flow for direct username/password sign-in). Expected: the flow is enabled for the app client.

5. Verify you are signing in against the right user pool and app client id, and that the username matches Cognito's username attribute configuration (it may be email, not a separate username). Expected: pool, client, and username attribute all line up.

6. Retry sign-in with the same credentials. Expected: authentication succeeds.

## Use this when

- Cognito says the username or password is incorrect but you have verified they are right.
- A generated client was pointed at a user pool where users were imported or created administratively.
- The error appears for every user, suggesting a pool or app-client setting, not one bad password.

## Not for this skill when

- The user genuinely has the wrong password - reset it and move on.
- The user does not exist in the pool - that is a different error path.
- You are not using Cognito; other providers reuse similar exception names.

## Variant phrasings

- Cognito NotAuthorizedException correct password
- Cognito says incorrect username or password but credentials are right
- Cognito sign in fails with correct credentials

## Why it happens

Cognito deliberately returns the same error for "wrong password" and "account not in a sign-in-able state" so attackers cannot enumerate which is which. Agents take the message literally and chase the password, while the real cause is usually an unconfirmed or force-reset account, or an app client with the needed auth flow disabled.

## Edge cases

- Users imported with a temporary password are FORCE_CHANGE_PASSWORD until they set a permanent one.
- The username attribute setting (email vs username vs phone) decides what "username" means at sign-in; mismatches here look like bad credentials.
- Some SDKs default to a Secure Remote Password flow the app client may not allow; the error then blames credentials instead of the flow.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_SYGhSUPlmaafiEEOskg_pA