561 Unauthorized (ALB authentication)

AWS ALB: the identity provider returned an error while the load balancer was authenticating the user.

561 at a glance

Code: 561
Name: Unauthorized (ALB authentication)
Class: 5xx Server error
Status: Non-standard used by AWS Application Load Balancer
Documented by: AWS Application Load Balancer
Cacheable by default: No by default. Caches only store responses with unrecognised status codes if explicit freshness (Cache-Control max-age) is given.

What 561 means

When an ALB listener rule uses an authenticate-oidc or authenticate-cognito action, the load balancer returns 561 if the identity provider returns an error code during authentication.

What typically causes a 561

Wrong client ID, client secret or callback URL configured for the OIDC/Cognito action.
The IdP rejecting the user (disabled account, missing consent).
IdP token endpoint unreachable from the ALB.

Fix it on the server

Check the ALB rule configuration against the IdP app registration and the IdP's logs; ensure the callback https://<alb-dns>/oauth2/idpresponse is allowed.

Fix it as a client or visitor

Retry the login; if it persists, the configuration is at fault, not you.

Example response

HTTP/1.1 561
Server: awselb/2.0
Content-Type: text/html