The AWS connector signs users in against an Amazon Cognito user pool. It is the bridge you want when an existing product already stores its users in Cognito and you are moving the front door to Authdog without migrating the directory on day one.

## Copy the redirect URI

In the [Authdog console](https://console.authdog.com), select the project and environment, open **Authentication > Providers**, find **AWS**, and click **Enable**. Copy the redirect URI shown in the form:

```url
https://identity.authdog.com/api/v1/callback/<connectionId>
```

## Create the app client

1. Open the [Amazon Cognito console](https://console.aws.amazon.com/cognito/) and select the user pool.
2. Under **App integration**, note the **Cognito domain** — that is the Domain URI Authdog needs.
3. Create an **App client** of type *confidential client*, so it is issued a client secret.
4. Under **Hosted UI settings**, add Authdog's redirect URI as an **Allowed callback URL**.
5. Enable the **Authorization code grant** flow.
6. Select the OpenID Connect scopes `openid`, `email`, `phone`, and `profile`.
7. Save, then copy the **Client ID** and **Client secret**.

## Configure Authdog

| Field | Value |
| --- | --- |
| **Client ID** | The client identifier from the provider |
| **Client Secret** | The client secret from the provider |
| **Domain URI** | Your user pool domain, e.g. `https://acme.auth.us-east-2.amazoncognito.com` |

Save, then toggle the connection **active**.

## What AWS Cognito returns

Authdog requests the `openid email phone aws.cognito.signin.user.admin profile` scopes and reads the profile from the ID token the provider issues.

Profile claims come from the ID token Cognito issues — `sub`, email and its verified flag, and any custom attributes you mapped into the token.

The `aws.cognito.signin.user.admin` scope is part of the request, so the pool must allow it on the app client. If your pool does not expose it, sign-in fails at the authorize step rather than the exchange.

## Test it

1. Open your environment's hosted sign-in page, or link to `https://identity.authdog.com/api/v1/signin/<connectionId>`.
2. Select the AWS Cognito button and complete the flow.
3. Confirm the user appears under **Users** in the console with a AWS Cognito identity linked.

## Troubleshooting

| Symptom | Cause |
| --- | --- |
| `invalid_client` | The app client was created as a public client with no secret |
| `invalid_scope` | The app client does not have all the requested scopes enabled |
| Domain not found | The Cognito domain is missing, or the region in the host is wrong |
| Redirect or callback URL error | The URI registered with the provider does not match Authdog's exactly |
| Works in one environment only | Each environment has its own `connectionId`, and so its own redirect URI to register |

## Related

| Read | To learn how to |
| --- | --- |
| [Connectors](/docs/connectors) | Set up any other social provider |
| [Enterprise SSO](/docs/sso) | Connect a workforce IdP instead of a user pool |