EC
561
HTTPERRORNotable5xx Server Error (Unofficial)HIGH confidence

Unauthorized

Production Risk

High — if the IdP integration is broken, all authenticated routes behind the ALB are inaccessible.

What this means

561 Unauthorized is used by AWS Application Load Balancer when it receives an invalid or malformed response from a configured IdP (Identity Provider) during the OIDC authentication flow. It is distinct from the standard 401 and indicates an authentication infrastructure problem rather than missing credentials.

Why it happens
  1. 1The ALB is configured with OIDC authentication and the IdP returned an unexpected response.
  2. 2The OIDC token returned by the IdP failed validation.
  3. 3The ALB's OIDC configuration (client ID, client secret, token endpoint) is incorrect.
  4. 4The IdP's well-known configuration endpoint returned an error.
How to reproduce

An ALB with AWS Cognito OIDC authentication configured receives an invalid token from Cognito.

trigger — this will error
trigger — this will error
GET /protected-resource HTTP/1.1
Host: myapp.elb.amazonaws.com
# ALB OIDC flow → IdP returns invalid token

expected output

HTTP/1.1 561 Unauthorized

Fix 1

Verify ALB OIDC configuration

WHEN The OIDC integration is newly configured or recently changed.

Verify ALB OIDC configuration
# AWS Console: EC2 → Load Balancers → Listeners → Authentication
# Verify: client ID, client secret, issuer URL, token/auth/user-info endpoints

Why this works

Corrects misconfigured OIDC parameters so the ALB can complete the auth flow.

Fix 2

Check the ALB access logs for the specific error

WHEN The root cause is unclear.

Check the ALB access logs for the specific error
# Enable ALB access logs in S3
# Look for the error_reason field — it contains the specific OIDC failure

Why this works

The error_reason field in ALB access logs identifies the exact authentication failure.

What not to do

✕ Do not treat 561 as a user authentication problem

561 indicates an infrastructure/configuration issue with the OIDC setup, not wrong user credentials.

Version notes
AWS ALB

Specific to ALB OIDC authentication feature. Not a standard IETF code.

Content generated with AI assistance and reviewed for accuracy. Found an error? hello@errcodes.dev

← All HTTP errors