CUSTOM_WITH_SRP auth flow fails on Vercel deployment with NotAuthorizedException

[mattenarle10]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

Next.js

Amplify APIs

Authentication

Amplify Version

v6

Amplify Categories

auth

Backend

CDK

Environment information

Details

# Put output below this line
 System:
    OS: macOS 26.1
    CPU: (8) arm64 Apple M1
    Memory: 91.63 MB / 8.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 22.22.0 - /Users/matt/.nvm/versions/node/v22.22.0/bin/node
    npm: 10.9.4 - /Users/matt/.nvm/versions/node/v22.22.0/bin/npm
    bun: 1.3.2 - /Users/matt/.bun/bin/bun
  Browsers:
    Safari: 26.1
  npmPackages:
    @aws-amplify/adapter-nextjs: ^1.7.2 => 1.7.2
    @aws-amplify/adapter-nextjs/api:  undefined ()
    @aws-amplify/adapter-nextjs/data:  undefined ()
    @babel/code-frame:  undefined ()
    @babel/core:  undefined ()
    @babel/runtime:  7.27.0
    @biomejs/biome: ^2.3.15 => 2.3.15
    @edge-runtime/cookies:  6.0.0
    @edge-runtime/ponyfill:  4.0.0
    @edge-runtime/primitives:  6.0.0
    @hapi/accept:  undefined ()
    @mswjs/interceptors:  undefined ()
    @napi-rs/triples:  undefined ()
    @next/font:  undefined ()
    @opentelemetry/api:  undefined ()
    @tailwindcss/postcss: ^4 => 4.1.18
    @tanstack/query-codemods:  undefined ()
    @tanstack/react-query: ^5.90.21 => 5.90.21
    @types/node: ^20 => 20.19.33
    @types/react: ^19 => 19.2.14
    @types/react-dom: ^19 => 19.2.3
    @vercel/nft:  undefined ()
    @vercel/og:  0.7.2
    @vercel/routing-utils:  undefined ()
    acorn:  undefined ()
    anser:  undefined ()
    assert:  undefined ()
    async-retry:  undefined ()
    async-sema:  undefined ()
    aws-amplify: ^6.16.2 => 6.16.2
    aws-amplify/adapter-core:  undefined ()
    aws-amplify/adapter-core/internals:  undefined ()
    aws-amplify/analytics:  undefined ()
    aws-amplify/analytics/kinesis:  undefined ()
    aws-amplify/analytics/kinesis-firehose:  undefined ()
    aws-amplify/analytics/personalize:  undefined ()
    aws-amplify/analytics/pinpoint:  undefined ()
    aws-amplify/api:  undefined ()
    aws-amplify/api/internals:  undefined ()
    aws-amplify/api/server:  undefined ()
    aws-amplify/auth:  undefined ()
    aws-amplify/auth/cognito:  undefined ()
    aws-amplify/auth/cognito/server:  undefined ()
    aws-amplify/auth/enable-oauth-listener:  undefined ()
    aws-amplify/auth/server:  undefined ()
    aws-amplify/data:  undefined ()
    aws-amplify/data/server:  undefined ()
    aws-amplify/datastore:  undefined ()
    aws-amplify/in-app-messaging:  undefined ()
    aws-amplify/in-app-messaging/pinpoint:  undefined ()
    aws-amplify/push-notifications:  undefined ()
    aws-amplify/push-notifications/pinpoint:  undefined ()
    aws-amplify/storage:  undefined ()
    aws-amplify/storage/s3:  undefined ()
    aws-amplify/storage/s3/server:  undefined ()
    aws-amplify/storage/server:  undefined ()
    aws-amplify/utils:  undefined ()
    babel-packages:  undefined ()
    babel-plugin-react-compiler: 1.0.0 => 1.0.0
    browserify-zlib:  undefined ()
    browserslist:  undefined ()
    buffer:  undefined ()
    busboy:  undefined ()
    bytes:  undefined ()
    ci-info:  undefined ()
    class-variance-authority: ^0.7.1 => 0.7.1
    cli-select:  undefined ()
    client-only:  0.0.1
    clsx: ^2.1.1 => 2.1.1
    commander:  undefined ()
    comment-json:  undefined ()
    compression:  undefined ()
    conf:  undefined ()
    constants-browserify:  undefined ()
    content-disposition:  undefined ()
    content-type:  undefined ()
    cookie:  undefined ()
    cross-spawn:  undefined ()
    crypto-browserify:  undefined ()
    css.escape:  undefined ()
    data-uri-to-buffer:  undefined ()
    debug:  undefined ()
    devalue:  undefined ()
    domain-browser:  undefined ()
    edge-runtime:  undefined ()
    events:  undefined ()
    find-up:  undefined ()
    fresh:  undefined ()
    glob:  undefined ()
    gzip-size:  undefined ()
    http-proxy:  undefined ()
    http-proxy-agent:  undefined ()
    https-browserify:  undefined ()
    https-proxy-agent:  undefined ()
    icss-utils:  undefined ()
    ignore-loader:  undefined ()
    image-size:  undefined ()
    ipaddr.js:  undefined ()
    is-animated:  undefined ()
    is-docker:  undefined ()
    is-wsl:  undefined ()
    jest-worker:  undefined ()
    json5:  undefined ()
    jsonwebtoken:  undefined ()
    loader-runner:  undefined ()
    loader-utils:  undefined ()
    lodash.curry:  undefined ()
    lru-cache:  undefined ()
    lucide-react: ^0.563.0 => 0.563.0
    mini-css-extract-plugin:  undefined ()
    nanoid:  undefined ()
    native-url:  undefined ()
    neo-async:  undefined ()
    next: 16.1.6 => 16.1.6
    node-html-parser:  undefined ()
    ora:  undefined ()
    os-browserify:  undefined ()
    p-limit:  undefined ()
    p-queue:  undefined ()
    path-browserify:  undefined ()
    path-to-regexp:  undefined ()
    picomatch:  undefined ()
    postcss-flexbugs-fixes:  undefined ()
    postcss-modules-extract-imports:  undefined ()
    postcss-modules-local-by-default:  undefined ()
    postcss-modules-scope:  undefined ()
    postcss-modules-values:  undefined ()
    postcss-preset-env:  undefined ()
    postcss-safe-parser:  undefined ()
    postcss-scss:  undefined ()
    postcss-value-parser:  undefined ()
    process:  undefined ()
    punycode:  undefined ()
    querystring-es3:  undefined ()
    radix-ui: ^1.4.3 => 1.4.3
    raw-body:  undefined ()
    react: 19.2.3 => 19.2.3
    react-builtin:  undefined ()
    react-dom: 19.2.3 => 19.2.3
    react-dom-builtin:  undefined ()
    react-dom-experimental-builtin:  undefined ()
    react-experimental-builtin:  undefined ()
    react-is:  19.3.0-canary-f93b9fd4-20251217
    react-refresh:  0.12.0
    react-server-dom-turbopack-builtin:  undefined ()
    react-server-dom-turbopack-experimental-builtin:  undefined ()
    react-server-dom-webpack-builtin:  undefined ()
    react-server-dom-webpack-experimental-builtin:  undefined ()
    regenerator-runtime:  0.13.4
    safe-stable-stringify:  undefined ()
    sass-loader:  undefined ()
    scheduler-builtin:  undefined ()
    scheduler-experimental-builtin:  undefined ()
    schema-utils:  undefined ()
    semver:  undefined ()
    send:  undefined ()
    serve-handler:  undefined ()
    server-only:  0.0.1
    setimmediate:  undefined ()
    shadcn: ^3.8.4 => 3.8.4
    shell-quote:  undefined ()
    source-map:  undefined ()
    source-map08:  undefined ()
    stacktrace-parser:  undefined ()
    stream-browserify:  undefined ()
    stream-http:  undefined ()
    string-hash:  undefined ()
    string_decoder:  undefined ()
    strip-ansi:  undefined ()
    superstruct:  undefined ()
    tailwind-merge: ^3.4.0 => 3.4.0
    tailwindcss: ^4 => 4.1.18
    tar:  undefined ()
    terser:  undefined ()
    text-table:  undefined ()
    timers-browserify:  undefined ()
    tty-browserify:  undefined ()
    tw-animate-css: ^1.4.0 => 1.4.0
    typescript: ^5 => 5.9.3
    ua-parser-js:  undefined ()
    unistore:  undefined ()
    util:  undefined ()
    vm-browserify:  undefined ()
    watchpack:  undefined ()
    web-vitals:  undefined ()
    webpack:  undefined ()
    webpack-sources:  undefined ()
    ws:  undefined ()
    zod: ^4.3.6 => 4.3.6 (, 3.25.76)
    zod-validation-error:  undefined ()
  npmGlobalPackages:
    @openai/codex: 0.104.0
    aws-cdk: 2.1106.0
    corepack: 0.34.0
    npm: 10.9.4

Describe the bug

CUSTOM_WITH_SRP authentication fails on Vercel deployment with NotAuthorizedException: Incorrect username or password. The same code works perfectly on localhost with OTP being sent correctly.

Expected behavior

Should trigger Lambda custom auth challenge (send OTP via SES) and return CONFIRM_SIGN_IN_WITH_CUSTOM_CHALLENGE. This works on localhost.

Reproduction steps

1. Configure Amplify with SSR support:

import { Amplify } from "aws-amplify";

const config = {
  Auth: {
    Cognito: {
      userPoolId: process.env.NEXT_PUBLIC_COGNITO_USER_POOL_ID,
      userPoolClientId: process.env.NEXT_PUBLIC_COGNITO_CLIENT_ID,
      loginWith: { username: true },
    },
  },
};
Amplify.configure(config, { ssr: true });

2. Call signIn with CUSTOM_WITH_SRP:

import { signIn } from "aws-amplify/auth";

await signIn({
  username: email,
  password,
  options: { authFlowType: "CUSTOM_WITH_SRP" }
});

3. Deploy to Vercel
4. Try to login with valid credentials

Code Snippet

// Put your code below this line.
import { signIn } from "aws-amplify/auth";

await signIn({
  username: email,
  password,
  options: { authFlowType: "CUSTOM_WITH_SRP" }
});

Log output

Details

[LOGIN] Attempting sign in { email: "user@example.com", passwordLength: 16, env: "https://admin.example.com" }
[LOGIN] Sign in error NotAuthorizedException: Incorrect username or password.

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

• Cognito Lambda triggers work correctly (mobile apps with CUSTOM_WITHOUT_SRP work fine)
• User Pool Client has custom: true and ALLOW_CUSTOM_AUTH enabled
• Using @aws-amplify/adapter-nextjs with ssr: true
• This appears to be an SRP crypto issue specific to Vercel's serverless/edge environment
• Current workaround is using USER_PASSWORD_AUTH which bypasses OTP (not acceptable for production)

[soberm]

Hi @mattenarle10,

Thank you for creating this issue. We will look into that and get back to you as soon as we have more information or need additional details.

[soberm]

Hi @mattenarle10,

I attempted to reproduce this issue by deploying a Next.js app with CUSTOM_WITH_SRP auth flow (using Amplify Gen 2 with custom auth Lambda triggers) to Vercel, and the sign-in flow completed successfully without any NotAuthorizedException errors.

Could you provide a minimal reproduction repository so we can investigate further?

[soberm]

Hi @mattenarle10,

We are closing this issue due to inactivity. If you are still experiencing this problem, please provide us with the information previously requested by our team members.

Thank you!