canonical: https://jentic.com/apis/amazonaws.com/aws-cognito-identity

# AWS Amazon Cognito Identity

Amazon Cognito Identity (Federated Identities) issues scoped, temporary AWS credentials to mobile and web clients so applications can call AWS services without embedding long-lived secrets. Identity pools federate users from public providers like Apple, Google, Facebook, SAML, and OpenID Connect, or from unauthenticated guests, and map them to IAM roles for fine-grained access. The service uniquely identifies devices and maintains stable identity IDs across sign-ins for the lifetime of the application.

## For AI agents

Issue scoped temporary AWS credentials to federated users and unauthenticated guests, and manage identity pools, identity-to-role mappings, and developer-authenticated identities.

## Scope

Does not handle user sign-up, password reset, MFA, or user directory storage - use for federated identity and AWS credential vending only; for full user pools use Amazon Cognito User Pools.

## Capabilities

- Create identity pools that federate users from Cognito User Pools, SAML, OpenID Connect, Facebook, Google, and Apple
- Issue temporary, scoped AWS credentials to identities via GetCredentialsForIdentity
- Map federated identities to IAM roles using rule-based or token-based role resolution
- Link multiple external logins to a single Cognito identity for cross-provider account linking
- Manage developer-authenticated identities through GetOpenIdTokenForDeveloperIdentity
- List, describe, and delete identities and pools for housekeeping and compliance

## Use cases

### Federated Mobile App Access to AWS

Mobile and single-page apps need to call AWS services such as S3, DynamoDB, or API Gateway without embedding long-lived AWS keys. Amazon Cognito Identity issues short-lived, scoped credentials after a user signs in with Google, Apple, Facebook, or a SAML provider, and maps them to an IAM role that limits what the app can do.

Example prompt: Create an identity pool that allows Google logins, then call GetId followed by GetCredentialsForIdentity to obtain temporary AWS credentials for a sample Google ID token.

### Guest Access for Public-Facing Apps

Public sites and games need read-only access to AWS resources for unauthenticated visitors. Amazon Cognito Identity supports unauthenticated guest identities that map to a separate IAM role with restricted permissions, so guests can fetch assets or anonymous metrics without registering. The pool can be upgraded to authenticated when the user signs in.

Example prompt: Configure an identity pool with AllowUnauthenticatedIdentities=true and call GetId with no logins to obtain a guest IdentityId.

### Developer-Authenticated Identities

Apps with their own user database can integrate it with AWS by using developer-authenticated identities. The backend authenticates the user, calls GetOpenIdTokenForDeveloperIdentity, and the client exchanges that token for AWS credentials. This keeps the existing login system while gaining IAM-based authorization for AWS calls.

Example prompt: Call GetOpenIdTokenForDeveloperIdentity with a custom user identifier and the developer provider name to mint an OpenID token mapped to an IAM role.

### Agent-Driven Identity Pool Provisioning

An AI agent operating an AWS landing zone can create and configure identity pools on demand. Through Jentic, the agent searches for identity pool operations, loads the input schema, and creates pools wired to the correct IAM roles for new applications. Operations that previously required navigating the AWS console can be issued as structured calls.

Example prompt: Create an identity pool named 'agent-provisioned-pool', set its role mappings via SetIdentityPoolRoles, and verify the configuration via DescribeIdentityPool.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /#X-Amz-Target=AWSCognitoIdentityService.CreateIdentityPool | Create a new identity pool |
| POST | /#X-Amz-Target=AWSCognitoIdentityService.GetId | Generate or fetch an identity ID for a user |
| POST | /#X-Amz-Target=AWSCognitoIdentityService.GetCredentialsForIdentity | Issue temporary AWS credentials for an identity |
| POST | /#X-Amz-Target=AWSCognitoIdentityService.GetOpenIdTokenForDeveloperIdentity | Mint an OpenID token for a developer-authenticated user |
| POST | /#X-Amz-Target=AWSCognitoIdentityService.SetIdentityPoolRoles | Map identities to IAM roles for a pool |
| POST | /#X-Amz-Target=AWSCognitoIdentityService.DescribeIdentityPool | Retrieve identity pool configuration |

## Key resources

- **IdentityPool** — Create, describe, update, list, and delete identity pools that federate external identity providers.
- **Identity** — Look up, describe, list, merge, and delete individual federated identities within a pool.
- **Credentials** — Issue temporary AWS credentials and OpenID tokens via GetCredentialsForIdentity, GetId, and GetOpenIdToken.
- **RoleMapping** — Configure how identities map to IAM roles using GetIdentityPoolRoles and SetIdentityPoolRoles.

## Why Jentic

- **Setup:** Wiring Amazon Cognito Identity by hand means implementing SigV4 request signing, choosing the right regional host, and getting the IAM role mapping right before a single call returns credentials. Through Jentic you install once, import Amazon Cognito Identity from the API Directory, store your AWS access key once, and your agent calls it.
- **Permission scoping:** You choose which of the 23 operations your agent may call. Amazon Cognito Identity carries the identity pool id inside the request body, so a rule bounds the operations rather than pinning the agent to one pool: read and credential-vending calls can be allowed while pool deletion and role remapping stay out of reach.
- **Credential handling:** Your AWS access key ID and secret access key are stored once, encrypted, by your own Jentic One instance, and used to sign each SigV4 request at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic with intents like 'issue temporary AWS credentials for a federated user' and Jentic returns the matching Amazon Cognito Identity operation with its input schema, so the agent can call the correct endpoint without browsing the AWS service reference.

## Related APIs

- **Amazon Cognito Sync** — Cross-device data syncing that uses Cognito Identity IDs as the identity layer.
- **Auth0 Authentication API** — Hosted identity-as-a-service that issues JWTs rather than AWS credentials.
- **Okta API** — Enterprise identity provider for SSO and lifecycle management.

## FAQ

### What authentication does the Amazon Cognito Identity API use?

It uses AWS Signature v4 (HMAC) signing with an AWS access key ID and secret access key. Four operations are marked optional-auth in AWS's own service model and can be called unsigned from an untrusted client: GetId, GetOpenIdToken, GetCredentialsForIdentity, and UnlinkIdentity. Through Jentic, your AWS keys are stored encrypted by your own self-hosted instance and each SigV4 request is signed at call time, so the keys never reach the agent.

### Can I federate Google or Apple sign-in with the Amazon Cognito Identity API?

Yes. Configure the identity pool with the relevant provider in SupportedLoginProviders (for example accounts.google.com or appleid.apple.com), then call GetId with the provider's ID token in the Logins map to map the external user to a Cognito identity.

### What are the rate limits for the Amazon Cognito Identity API?

AWS publishes a default request-rate quota per operation, measured per AWS account and per Region. The documented defaults include GetCredentialsForIdentity and GetOpenIdToken at 200 requests per second, GetOpenIdTokenForDeveloperIdentity at 50, GetId at 25, DeleteIdentities and ListTagsForResource at 10, and ListIdentities, TagResource and UntagResource at 5. All of these are adjustable, and AWS states the default is the minimum for any Region in your account, so your ceiling may be higher. Retry with exponential backoff on TooManyRequestsException.

### How do I issue temporary AWS credentials with Amazon Cognito Identity through Jentic?

Search Jentic for 'issue temporary AWS credentials for a federated user', load the GetCredentialsForIdentity schema, and execute it with the IdentityId and Logins map. Jentic signs the SigV4 request and returns the temporary access key, secret, and session token.

### Is the Amazon Cognito Identity API free?

AWS states that use of Amazon Cognito identity pools for authenticating users and generating unique identifiers is provided at no charge; you pay for the AWS resources your application reaches with the issued credentials. Cognito User Pools, which is a separate service, has its own pricing.

### Is there an Amazon Cognito Identity MCP server?

You don't need an MCP server to give your agent Amazon Cognito Identity. Jentic connects it directly from the API Directory: import it, store your AWS keys once, and your agent can create identity pools, map IAM roles, and vend temporary credentials, with no extra tool definitions loaded into its context.

### Can I limit what my agent is allowed to do with Amazon Cognito Identity?

Yes. This API sends the identity pool id in the request body rather than in the URL path, so your rules bound the operations rather than the individual pool. A workable split allows GetId, GetOpenIdToken and GetCredentialsForIdentity for credential vending, and withholds DeleteIdentityPool, UpdateIdentityPool and SetIdentityPoolRoles.