# Auth with AWS Cognito

> Accept the tokens of an AWS Cognito user pool in API Maker - an AWS auth provider with the pool id, the region and the token use, the person found in your table, and the token sent in x-aws-authorization.

Source: https://docs.apimaker.dev/v1/docs/authorization/AWS.html

Your app signs people in with Cognito and sends the token it gets to API Maker. An auth provider of type **AWS** checks the token with the keys of the user pool, finds the person in a table of yours, and runs the call with the groups of that person.

| | |
|---|---|
| Page | `API Security → Auth Providers` → type AWS. |
| Header | `x-aws-authorization: <Cognito token>` |
| In code | `g.req.auth.authAWS` : the opened token, and the columns selected from your table. |

**The provider**

```typescript
import * as T from 'types';

let awsTokenGenerator: T.IAuthTokenAWS & { name: string; testObj?: any; } = {
    name: 'aws_token_generator',
    cognitoUserPoolId: 'us-east-1_xxxxxx',
    region: 'us-east-1',
    tokenUse: 'access',                 // 'access' | 'id' : which Cognito token the app sends
    tokenExpiration: 3600000,           // milliseconds, at most 3600000
    sourceFieldOfUniqueId: 'sub',       // the claim which identifies the person
    groupsDataSource: { instance: 'mongodb', database: 'shop', collection: 'users', targetFieldForUniqueId: 'cognito_sub', groupsColumn: 'groups', select: { name: 1, email: 1 } },
};
module.exports = awsTokenGenerator;
```

## The groups of the person

- `sourceFieldOfUniqueId` is the claim of the token which identifies the person (an email, `sub`, `oid`).
- `groupsDataSource` names the table of yours which holds that person : `targetFieldForUniqueId` is the column with the same value, `groupsColumn` the comma separated [groups](https://docs.apimaker.dev/v1/docs/apis-security/api-group-permission.html) of the person, `select` the columns to put in `g.req.auth`.
- Without `groupsDataSource`, the token is checked but the person gets no group of its own : only the API user decides.

## Require it

- `authProviders: ['aws_token_generator']` in the settings of the APIs, tables or databases, or in `common.authProviders` of the secret.
- The call carries the API user token in `x-am-authorization` and the token of the provider in ``x-aws-authorization``.
- `testObj` in the provider is the person the API testing page pretends to be.

## Related

- [Single sign-on](https://docs.apimaker.dev/v1/docs/features/single-sign-on-authentication.html) · [Auth of a database user](https://docs.apimaker.dev/v1/docs/authorization/AMDB.html) · [API group permissions](https://docs.apimaker.dev/v1/docs/apis-security/api-group-permission.html)