AWS First Steps
New feature

Amazon Cognito now supports machine-to-machine authorization without a user pool domain

Amazon Cognito adds the GetClientToken API, allowing machine-to-machine authorization without a user pool domain. This API integrates with AWS SDKs and supports AWS WAF and VPC endpoints.

Amazon Cognito now includes the GetClientToken API operation, enabling app clients to obtain access tokens for machine-to-machine authorization directly through AWS SDKs, CLI, or APIs-without configuring a user pool domain. This provides an additional method to authorize service-to-service communication for applications, microservices, and automated workloads. The GetClientToken API allows app clients to authenticate with their client ID and secret to receive access tokens authorized for custom scopes on resource servers. As a native AWS API, it integrates seamlessly with AWS SDKs and supports AWS WAF and VPC interface endpoints. The existing domain-based OAuth 2.0 client-credentials flow remains available. This feature is available in all AWS Regions where Amazon Cognito user pools are offered, with standard Amazon Cognito M2M pricing applying.

Why it matters

This update benefits developers needing automated service-to-service communication and those wanting to avoid complex user pool configurations.

Read the original AWS announcement

Related articles and terms

Implementing User Authentication - Building a Secure Authentication Foundation with CognitoLearn how to design and implement a user authentication foundation using Amazon Cognito, including building authentication flows with user pools, identity pools, and external identity provider federation.Amazon CognitoA service that provides authentication, authorization, and user management for web and mobile applicationsImplementing User Authentication with Amazon Cognito - Designing User Pools and Identity PoolsLearn about user authentication with Cognito User Pools, AWS resource access with Identity Pools, and social login integration.Amazon Verified PermissionsA managed service that externalizes application authorization logic using the Cedar policy language, enabling fine-grained access controlAmazon API Gateway Design Patterns - Choosing Between REST API and HTTP APIClear criteria for choosing between HTTP API and REST API, authentication patterns with Cognito and Lambda authorizers, and practical throttling design techniques.