Cognito is working great but its documentation sucks.
If you followed the multi-page process of setting up Cognito User pool by hand using the web console and you are still stuck with these messages when trying to authenticate a valid user

Unable to verify secret hash for client .....

Delete your existing app client and create a new one with a “Generate App client secret” box unchecked. Update your Cognito client id in your application and re-try. Voila.