JA EN
shiichan

Amazon Cognito Now Lets You Skip the User Pool Domain for Machine-to-Machine Auth!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi, I'm Shii-chan! I found a small but genuinely useful update today. It's about making service-to-service authentication a bit lighter to set up, so let me walk you through it!

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, Amazon Cognito now supports the new GetClientToken API operation! This lets app clients obtain access tokens for machine-to-machine (M2M) authorization directly, without configuring a user pool domain.

Since you can call it directly through the AWS SDK, CLI, or API, this adds a new path for authorizing service-to-service communication for applications, microservices, and automated workloads.

The story so far

Until now, using the OAuth 2.0 client-credentials flow for M2M authorization in Cognito required setting up a user pool domain. The domain-based flow is still available, but needing a domain just for M2M auth was an extra piece of setup that not every workload really wanted.

What changes

GetClientToken is a native AWS API operation, so it integrates cleanly with AWS SDKs, and it also supports AWS WAF and VPC interface endpoints (AWS PrivateLink). That means you can authorize M2M communication without going through a domain, which is great if you want a tighter security boundary around your token flow.

The mechanism itself is straightforward: your app client authenticates with its client ID and secret, and receives back an access token authorized for custom scopes on your resource servers. If you're running microservices or automated workloads, this could simplify one piece of your auth configuration.

Dive Deep

GetClientToken doesn't replace the existing domain-based OAuth 2.0 client-credentials flow — it's offered as an additional option. Your existing domain-based flow keeps working as-is, so there's no need to migrate right away.

Getting started is simple too: configure an app client, then call GetClientToken from the AWS Management Console, CLI, or SDKs. This feature is available in all AWS Regions where Amazon Cognito user pools are available, and standard Amazon Cognito M2M pricing applies.

Wrap-up

  • Amazon Cognito adds a new GetClientToken API operation
  • You can obtain M2M access tokens using just a client ID and secret, without a user pool domain
  • Access tokens can carry custom scopes for your resource servers
  • Works through the AWS SDK, CLI, and API, with support for AWS WAF and VPC interface endpoints (AWS PrivateLink)
  • The existing domain-based OAuth 2.0 client-credentials flow remains available
  • Available in all Regions with Cognito user pools, at standard M2M pricing

If you're building microservices or service-to-service auth on Cognito, this is an update that could simplify your setup!

Related posts