AWS Cognito

User pools, app clients, hosted UI, and token refresh.

AWS Cognito provides user authentication, token management, and federated identity for all applications.

Configuration

typescript

import { Amplify } from "aws-amplify";
 
Amplify.configure({
  Auth: {
    Cognito: {
      userPoolId: process.env.NEXT_PUBLIC_COGNITO_USER_POOL_ID!,
      userPoolClientId: process.env.NEXT_PUBLIC_COGNITO_CLIENT_ID!,
      loginWith: {
        oauth: {
          domain: process.env.NEXT_PUBLIC_COGNITO_DOMAIN!,
          scopes: ["openid", "email", "profile"],
          redirectSignIn: ["http://localhost:3000/callback"],
          redirectSignOut: ["http://localhost:3000/"],
          responseType: "code",
        },
      },
    },
  },
});

App client settings

Each environment needs a separate Cognito app client with:

Correct redirect URIs (local, staging, production)
Allowed OAuth flows: Authorization code grant
Token expiration: access 1h, refresh 30d
Required scopes: openid, email, profile

User pool attributes

Attribute	Required	Mutable
email	Yes	Yes
name	Yes	Yes
custom:role	No	Yes (admin only)
custom:org_id	No	Yes (admin only)

MFA policy

MFA is required for admin users and optional for standard users. Supported methods: TOTP authenticator app, SMS (fallback only).