social & oauth

7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Cognito setup requirements

To integrate with Cognito, you must set up a User Pool and an App client in the Amazon Cognito Console. You need to note the Client ID and Client Secret if enabled. Set a Cognito Hosted UI domain (for example, your-app.auth.us-east-1.amazoncognito.com). In App client settings, enable Authorization code grant OAuth flow and openid, profile, email OAuth scopes. Add your callback URL (for example, http://localhost:3000/api/auth/callback/cognito). The User Pool is required for Cognito authentication and the callback URL must match exactly.

Cognito configuration in auth instance

Configure the cognito key in the socialProviders object of your auth instance. The required and optional fields are: clientId (required), clientSecret (required), domain (required, e.g., your-app.auth.us-east-1.amazoncognito.com), region (required, e.g., us-east-1), userPoolId (required), identityProvider (optional, to skip the hosted UI picker).

Cognito sign-in client code

To sign in with Cognito using the client, call authClient.signIn.social({ provider: "cognito" }). To override the preselected identity provider per call, pass the identity_provider key through additionalParams, for example: authClient.signIn.social({ provider: "cognito", additionalParams: { identity_provider: "Okta" } }).

Cognito scope option

The scope option allows you to request additional OAuth2 scopes combined with default permissions. Default scopes are "openid" "profile" "email". Common Cognito scopes are: openid (required for OpenID Connect authentication), profile (access to basic profile info), email (access to user's email), phone (access to user's phone number), aws.cognito.signin.user.admin (grants access to Cognito-specific APIs). Scopes must be configured in the Cognito App Client settings.

Cognito getUserInfo option

The getUserInfo option is a custom function to retrieve user information from the Cognito UserInfo endpoint.

Cognito identityProvider option

The identityProvider option preselects a Cognito-configured identity provider to skip the hosted-UI picker. Valid values are "COGNITO", a SAML/OIDC provider name on the User Pool, or one of "Google", "Facebook", "LoginWithAmazon", "SignInWithApple". Per-call overrides via additionalParams.identity_provider take precedence.

Cognito refreshAccessToken option

The refreshAccessToken option is a custom function to refresh tokens. It receives the stored refresh token.

Give your agent this brain