AWS Cognito

Managed customer identity and access management service for adding user sign-up, sign-in, and access control to web and mobile apps. Provides scalable user directories, social and enterprise federation, passwordless options including WebAuthn passkeys and email or SMS one-time codes, plus branded login flows with minimal custom code.

Part of the AWS ecosystem and processes high-volume authentication traffic across millions of users. Amazon Cognito differentiates by unifying human and machine identity in one service: user pools for end-user auth and identity pools for federating into AWS with temporary credentials. Integrates directly with Amplify, API Gateway, Lambda, S3, and DynamoDB for end-to-end serverless auth flows.

Key capabilities:

• User pools with self-service registration, MFA, and configurable password policies
• Social IdP login (Apple, Google, Facebook, Amazon) and enterprise federation via SAML and OIDC
• Passwordless authentication with WebAuthn passkeys, magic links, and SMS or email OTP
• No-code hosted UI editor for customizing sign-up, sign-in, and MFA screens to match your brand
• Lambda triggers for custom logic during sign-up, sign-in, and token generation
• Risk-based adaptive authentication, compromised credential monitoring, and IP geo-velocity checks
• Multi-tenancy and B2B identity support with tenant isolation
• OAuth 2.0 client-credentials flow for machine-to-machine and microservice auth

Common setups include serverless web and mobile apps using Amplify or direct SDK integration, API protection with API Gateway and JWT validation, and role-based access to S3 or DynamoDB via identity pools. Works across React, Next.js, Angular, Vue, Flutter, iOS, Android, and backend runtimes including Node, Python, and .NET.