Add Login with Amazon as a social identity provider - Amazon Cognito
Register a Login with Amazon security profileAdd Login with Amazon to your user poolTest Login with Amazon sign-inLogin with Amazon pitfalls
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Add Login with Amazon as a social identity provider

Note

Last verified against the provider console: October 2, 2026. Login with Amazon steps use the Amazon Developer console (not the AWS console).

To let your users sign in with their Amazon account, you register a Login with Amazon security profile, then add Login with Amazon as an identity provider (IdP) in your user pool. You must enable managed login first.

Register a Login with Amazon security profile

To create and configure a security profile

  1. Sign in to the Amazon Developer console, or go to Apps and Services, then Login with Amazon.

  2. Choose Create a New Security Profile. Enter a Name (shown on the consent screen), a Description, and a Consent Privacy Notice URL. Choose Save.

  3. Reveal the Client ID and Client Secret for the security profile. You enter these when you add Login with Amazon to your user pool.

  4. Open Web Settings for the profile and choose Edit. Enter the values below, then Save.

    • Allowed Origins (HTTPS, no path): https://<your-prefix>.auth.<region>.amazoncognito.com or https://auth.example.com.

    • Allowed Return URLs (the /oauth2/idpresponse endpoint): https://<your-prefix>.auth.<region>.amazoncognito.com/oauth2/idpresponse or https://auth.example.com/oauth2/idpresponse. Amazon Cognito uses the redirect flow, so the return URL is the value it depends on.

Add Login with Amazon to your user pool

To add Login with Amazon as an IdP in the AWS Management Console

  1. In the Amazon Cognito console, choose your user pool, then Social and external providers, then Add an identity provider, then Login with Amazon.

  2. Enter the Client ID and Client Secret from the security profile.

  3. For Authorized scopes, enter profile. This returns the user's name, email, and user ID. (Add postal_code only if you need the ZIP or postal code.)

  4. Map email to email, name to name, and user_id to your user name attribute.

  5. Choose Add identity provider, and enable Login with Amazon on your app client.

Test Login with Amazon sign-in

Open your managed login sign-in page and choose Continue with Amazon, then authenticate and accept the consent screen.

Checkpoint

The browser returns through /oauth2/idpresponse to your app with an authorization code, and the user appears in your user pool as a federated user whose user name is prefixed LoginWithAmazon_. The ID token contains the mapped email and name. Note that email_verified reads false unless you set it with a trigger (see pitfalls).

Login with Amazon pitfalls

No email_verified claim

The profile scope returns only email, name, and user_id—there is no email_verified claim to map. Mapped emails are unverified by default, so Login with Amazon users land with email_verified set to false.

Effect on account linking

Because the email is unverified, Amazon Cognito won't automatically merge a Login with Amazon user into an existing email-verified user. To link or mark the email verified, use a pre sign-up Lambda trigger (and AdminLinkProviderForUser), and only when your trust model justifies trusting the Amazon-asserted email.

Mapped attributes must be writable

Any custom attribute you map must be mutable and writable by the app client, or sign-in fails or silently skips the attribute. Standard email and name are fine.