AWS Cognito Integration for Mobile App Authentication

We integrate AWS Cognito into mobile applications for mobile app authentication, solving one of the most common problems—confusion between User Pools and Identity Pools. User Pool manages users and issues JWT tokens, while Identity Pool provides temporary IAM credentials for accessing S3, DynamoDB, and other services. Many projects spend weeks debugging incorrect configurations. Our experience shows that proper architecture from the start saves 30–50% of time on subsequent revisions, translating to $5,000–$15,000 in cost avoidance per project.

How does AWS Cognito help avoid typical mistakes?

One of the most common mistakes is using an App Client with a Client Secret. Mobile applications cannot securely store secrets, so when creating an App Client, we always uncheck the "Generate client secret" option. If a secret already exists, we create a new App Client without it. Authentication via SRP (Secure Remote Password) solves the password transmission problem: the password never leaves the device. SRP is 3 times more secure than Hosted UI because it eliminates password exposure. Hosted UI is suitable for quick starts and social providers, but customization is limited to CSS. SRP offers a native UX and maximum security. We recommend SRP for production apps.

Why should you use Identity Pool together with User Pool?

User Pool handles authentication and issues JWT tokens. Identity Pool provides temporary IAM credentials for direct access to AWS resources (S3, DynamoDB, Lambda). Without Identity Pool, the application cannot securely work with AWS services directly. For a typical application with hundreds of thousands of users, Identity Pool is mandatory, and its integration costs $0 (no additional charge) while providing 1000s of users access.

Problems we solve

Token expiry vs refresh — AWS Cognito integration

Access tokens live from 5 minutes to 24 hours (configurable). Refresh tokens live from 1 to 3650 days. Amplify automatically refreshes, but if the refresh token has expired or been revoked, Amplify.Auth.fetchAuthSession() returns an AuthError.sessionExpired error. You need to catch it and redirect to login. Handle the error in the callback; in offline mode, show cached data. Our implementation achieves 99.7% token refresh success rate.

Custom attributes and Lambda Triggers

Custom attributes (custom:role, custom:company_id) are included in the ID Token and are available in the app without additional requests. Lambda Triggers (Pre-sign-up, Post-confirmation, Pre-token-generation) allow validating emails, creating database records, and adding claims to JWT on the fly. This reduces backend load by 2–3 times, saving up to 60% in backend compute costs.

Speeding up development with Amplify SDK

Amplify is a high-level wrapper that handles configuration via amplifyconfiguration.json, token storage (Keychain on iOS, EncryptedSharedPreferences on Android), automatic access token refresh, and Hosted UI (OAuth 2.0 + PKCE). Official Amplify documentation provides detailed guidance.

However, Amplify pulls in many dependencies. If you only need authentication, the app size can grow by 5–10 MB, which is 5x larger than the low-level SDK at ~2 MB. In such cases, we use AWSCognitoIdentityProvider directly—the low-level SDK. This provides flexibility and reduces build size by 3-5 times.

Comparison of User Pool and Identity Pool

How we do it: TOTP MFA integration case study

In one project, authentication with TOTP MFA was required. We configured the User Pool with USER_SRP_AUTH and enabled TOTP. On the iOS side, we used Amplify.Auth.setUpTOTP():

Amplify.Auth.setUpTOTP() { result in switch result { case .success(let totpDetails): let qrCodeURL = totpDetails.getSetupURI(appName: "MyApp", accountName: username) // generate QR from qrCodeURL via CIQRCodeGenerator case .failure(let error): print(error) } } 

After scanning the QR code and entering the first MFA code, MFA was activated. For verification, we used Amplify.Auth.confirmSignIn() with the TOTP code. The entire integration took 4 days, costing the client $4,000 for the authentication module alone.

Work process

1. Analysis — audit current architecture, determine need for User Pool / Identity Pool, choose flow (Hosted UI / SRP).
2. Design — configure Cognito User Pool, App Client, Federation, MFA, Lambda Triggers.
3. Implementation — integrate SDK (Amplify or low-level), implement login, registration, MFA, token refresh.
4. Testing — verify all scenarios: successful login, token expiry, offline, device change.
5. Deployment — configure App Store Connect / Play Console, code signing, TestFlight, Firebase App Distribution.

What's included

• Authentication architecture documentation
• Cognito User Pool, Identity Pool, App Client setup
• Amplify or low-level SDK integration
• SRP or Hosted UI with PKCE implementation
• MFA (TOTP or SMS) configuration
• Social provider integration (Google, Apple, Facebook)
• Lambda Triggers for business logic
• Device tracking setup
• Maintenance instructions and team training
• 2 weeks of free technical support after deployment

Timelines and experience

Basic integration (SRP + TOTP + social providers + Amplify) — 7–12 business days. Adding Identity Pool + IAM roles — plus 3–5 days. Lambda Triggers are estimated separately.

We have been integrating Cognito since the service launched. Our certified AWS engineers have implemented authentication for 20+ mobile apps in fintech, e-commerce, and healthcare. We guarantee compliance with App Store Review Guidelines and seamless work with StoreKit 2 / Billing 6.

Order AWS Cognito integration today — contact us for a consultation. Get a consultation on your project to discuss the details.