# Webiny Cognito Federation

Configuring Cognito Federation for Webiny projects, federated sign-in via external...

- Repository: https://github.com/webiny/webiny-js (8051 stars)
- Category: Engineering
- License: see repository
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add webiny/webiny-js --skill webiny-cognito-federation -g -a claude-code -y`
Codex: `npx skills add webiny/webiny-js --skill webiny-cognito-federation -g -a codex -y`
Cursor: `npx skills add webiny/webiny-js --skill webiny-cognito-federation -g -a cursor -y`
Gemini CLI: `npx skills add webiny/webiny-js --skill webiny-cognito-federation -g -a gemini-cli -y`

## Description

Configuring Cognito Federation for Webiny projects, federated sign-in via external identity providers (Google, Facebook, Apple, Amazon, OIDC/Entra ID) while keeping Cognito as the user pool. Use this skill when the developer asks about Cognito federation, SSO with Cognito, adding Google/Microsoft/OIDC login to Cognito, federated identity providers, CognitoSignInConfig, CognitoIdpConfig, external users, signInWithRedirect, OAuth redirect URLs, hiding the password form, allowCredentialsLogin, or customizing the federated login screen.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Cognito Federation

## TL;DR

Webiny supports federated sign-in through Cognito, users authenticate via external identity providers (Google, Entra ID, etc.) while Cognito remains the user pool. Configure it by adding a `federation` prop to `<Cognito />` in `webiny.config.tsx`. This handles both infrastructure (Cognito User Pool Domain, IdP resources, OAuth client) and the admin login screen (provider buttons, OAuth for Amplify). Federated users are auto-detected and synced into Webiny. For advanced use cases, provide `apiConfig` (custom identity mapping) and/or `adminConfig` (custom login screen behavior).

## Pattern / Core Concept

Cognito Federation has three layers:

1. **Infrastructure**, The `federation` prop on `<Cognito />`, under the hood, creates the Cognito User Pool Domain, Identity Provider resources, and configures OAuth on the User Pool Client.

2. **Admin Login Screen**, The federation config is passed as an `Admin.BuildParam` to the admin app. A `CognitoSignInConfig` abstraction provides the login screen with provider buttons, OAuth settings for Amplify, and credentials visibility. By default, this is auto-generated from the `federation` prop. For advanced customization (IP whitelists, async logic), provide an `adminConfig` extension.

3. **API Identity**, Federated tokens are auto-detected via the `identities` JWT claim and marked `external: true`. The `ExternalIdpUserSyncHandler` auto-creates/updates users on login. For custom role/team mapping, provide an `apiConfig` extension implementing `CognitoIdpConfig`.

### How Federated Login Works

The rest: https://github.com/webiny/webiny-js/blob/HEAD/skills/user-skills/cognito-federation/SKILL.md