aws-auth

Create a Cognito user pool with a public app client (no secret), enable the hosted UI or managed login with the authorization code grant plus PKCE, and wire the Amplify client auth library. The Amplify library handles the code exchange, token storage, and automatic refresh.

A user pool authenticates users and issues JWTs, acting as an OIDC identity provider. An identity pool exchanges a token for temporary AWS credentials via STS, and is only needed when the client must call AWS services like S3 or DynamoDB directly.

For HTTP APIs, add a JWT authorizer with the issuer set to your user pool URL and the audience set to the app client id. For REST APIs, use a Cognito user pools authorizer, which validates the ID token by default.

The callback URL is not registered exactly on the app client; scheme, host, path, trailing slash, and case all must match. Add the exact callback URL to the client's Allowed callback URLs, using HTTP only for localhost loopback addresses.

Avoid localStorage for high-value apps because any injected script can read it via XSS. Prefer cookieStorage with Secure and SameSite=Strict, keep refresh token lifetimes short, and enable refresh token rotation plus token revocation on the app client.

This skill does not cover Amplify Gen2 backend definitions (defineAuth, npx ampx), IAM policy or STS role authoring, or IAM Identity Center. It also excludes API Gateway route and Lambda implementation beyond the Cognito/JWT authorizer configuration.