Amazon Cognito User Pools API

REST discovered

Details

URL: https://cognito-idp.us-east-1.amazonaws.com
Docs: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/Welcome.html

Authentication

AWS IAM credentials for Signature Version 4 signing aws_sigv4 discovered Get keys ↗

Authorization: AWS4-HMAC-SHA256 <credential>

Create or use an AWS IAM principal in the AWS IAM console and obtain access key credentials, or use temporary credentials from STS. Grant the principal Cognito user-pool permissions as needed. Requests are signed with AWS Signature Version 4 as described in Signing AWS API requests. For CLI use, configure them with aws configure or another supported AWS credential source.

Cognito user pool app client credentials compound discovered Get key ↗

In the Amazon Cognito console, open a user pool and create or select an app client under application settings. This yields a client_id; confidential clients can also have a client_secret. Use the app client in public API flows like InitiateAuth, and on the user-pool domain /oauth2/token endpoint with client_secret_basic or client_secret_post when a secret exists.

Cognito user access token bearer discovered Get token ↗

Create a user pool app client in the Amazon Cognito console, then authenticate a user through Cognito sign-in flows such as InitiateAuth or the user-pool domain OAuth 2.0 endpoints. Use the resulting access token for token-authorized self-service API operations; it must include any required scopes such as aws.cognito.signin.user.admin for GetUser.