Standard Cognito login
Add Cognito sign-in to an Auth.js application using the provider's default configuration and environment variables.
Auth.js · Const
Cognito
Cognito is a built-in Auth.js OpenID Connect provider. Register it directly or configure it with a client ID, client secret, and Cognito issuer.
How it works
Cognito is a built-in OpenID Connect provider. Add it to Auth.js configuration directly, or call it with client credentials and an issuer when explicit configuration is needed; the issuer identifies the Cognito user pool.
Syntax
Cognito(options)Parameters
| Name | Type | Description |
|---|---|---|
options | OAuthUserConfig<P> | Provider options including OAuth client settings; the reference types this as OAuthUserConfig<P>. |
Returns
OAuthConfig<P>
Key points
- Auth.js includes Cognito as a ready-made provider rather than requiring a custom OAuth implementation.
- The provider can obtain its client ID, client secret, and issuer from the documented Cognito environment variables.
- Cognito is handled using OpenID Connect semantics by default.
- The imported provider can be placed directly in the providers list when the defaults and environment-based settings are sufficient.
- Explicit configuration is supported by calling Cognito with an OAuth user configuration object.
Common mistakes
- Use the user-pool issuer URL, not the app client ID, and substitute the correct AWS region and pool ID.
- Incomplete Cognito app-client settings can prevent the OAuth flow from completing.
Example: Enable Cognito with NextAuth
import NextAuth from "next-auth"
import Cognito from "next-auth/providers/cognito"
export const { handlers, auth, signIn, signOut } = NextAuth({
providers: [Cognito],
})Register the built-in Cognito provider with NextAuth; credentials and issuer are read from the documented environment variables.
When to use it
Explicit provider configuration
Supply explicit Cognito credentials and the user-pool issuer when defaults are insufficient.
Hosted UI integration
Connect Auth.js to a Cognito hosted UI through the required OAuth callback route.
Interview questions
QHow do you configure Cognito in Auth.js?
Cognito is registered as a built-in provider in the Auth.js providers array. The shorthand form uses the imported provider directly, while the configured form calls Cognito with clientId, clientSecret, and issuer.
Follow-up: Why is issuer needed? It identifies the Cognito OpenID Connect issuer and lets Auth.js use the provider's discovery configuration.
QWhat callback URL does Cognito use?
The callback URL for a typical Next.js deployment is https://example.com/api/auth/callback/cognito. Cognito must be configured to allow the corresponding callback URL.
Follow-up: What should be checked if sign-in fails after callback configuration? Verify the hosted domain and the Cognito app-client settings.
QHow can Cognito's defaults be customized?
Auth.js treats Cognito as an OpenID Connect provider by default and supplies a default provider configuration. Override it by passing an options object to the provider function.
Follow-up: What is the resulting type of the provider factory? The reference gives OAuthConfig<P>, where P extends CognitoProfile.
Related
CognitoProfileOAuthUserConfigOAuthConfigprovidersissuer