Repository navigation
[Bug]: 2.57.0 breaks existing and new sessions — SDK returns "Invalid Refresh Token" error after ID Token expiration #4207
Description
Describe the bug
Describe the bug
After upgrading to 2.57.0, all users (including fresh installs) are getting logged out approximately 10 minutes after a successful login. The SDK returns an "Invalid Refresh Token" error when attempting to refresh the expired ID token.
Suspected Root Cause
PR #4196 changed ConfirmDevice.swift to store device metadata under inputUsername (the phone number the user typed), but the token refresh path in RefreshUserPoolTokens.swift still retrieves device metadata using existingSignedIndata.username (the JWT username claim, which is the Cognito sub UUID).
Since the store key ≠ retrieval key, Cognito cannot find the device during InitiateAuth with REFRESH_TOKEN_AUTH, and rejects the refresh token.
Steps To Reproduce
### Steps to reproduce
1. Fresh install of app using amplify-swift 2.57.0 (no prior keychain data)
2. Log in successfully with email/phone alias (not the Cognito sub UUID)
3. Wait for ID token to expire (~10 minutes or per your Cognito pool config)
4. SDK attempts token refresh → fails with "Invalid Refresh Token"
5. User is forced to re-authenticateExpected behavior
Expected behavior
Device metadata should be stored and retrieved using a consistent keychain key, regardless of whether the user logs in with an alias (email/phone) or username.
Amplify Framework Version
2.57.0
Amplify Categories
Auth
Dependency manager
Swift PM
Swift version
6.0
CLI version
N/A
Xcode version
24.6
Relevant log output
<details>
<summary>Log Messages</summary>
AuthError: Session expired could not fetch cognito tokens
Recovery suggestion: Invoke Auth.signIn to re-authenticate the user
Caused by:
NotAuthorizedException(properties: AWSCognitoIdentityProvider.NotAuthorizedException.Properties(
message: Optional("Invalid Refresh Token.")),
httpResponse: Status Code: HTTP status code: 400
x-amzn-errortype: NotAuthorizedException:,
x-amzn-errormessage: Invalid Refresh Token.
))
</details>Is this a regression?
Yes
Regression additional context
- Works correctly on 2.56.0. Broken on 2.57.0 for ALL users on fresh installs.
- PR fix(auth): Consistent device metadata keychain key across auth flows #4196 (commit b3b8320) —
fix(auth): Consistent device metadata keychain key across auth flows
Platforms
iOS
OS Version
iOS 17+
Device
iPhone
Specific to simulators
No response
Additional context
Environment
- Cognito User Pool with phone number as sign-in alias
- Device tracking: enabled
- Auth flow: USER_SRP_AUTH
Activity
jvh-aws commentedon May 5, 2026
@moia-hari thanks a lot for reporting the issue. I can reproduce the behavior that you described. We're continuing to investigate and working on a fix.
github-actions commentedon May 5, 2026
This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.
jvh-aws commentedon May 5, 2026
@moia-hari we have released a fix #4208 as part of v2.58.0. Could you please try that and verify if it fixes the issue on your end?
EDIT: Please do not use v2.58.0, since v2.58.1 contains another bugfix for failures with
rememberDevicejvh-aws commentedon May 11, 2026
Closing as the fix is released. Please reopen the issue, if it's not working for you or there are further questions. @moia-hari
github-actions commentedon May 11, 2026
This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.