AWS Amazon Cognito Identity

Name: Amazon Cognito Identity API
Brand: Amazon Cognito Identity
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthenticationAWS Signature v4 (HMAC)23 Endpoints

Install Jentic One Beta

Connect the Amazon Cognito Identity to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Amazon Cognito Identity, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Amazon Cognito Identity API.

Create identity pools that federate users from Cognito User Pools, SAML, OpenID Connect, Facebook, Google, and Apple

Issue temporary, scoped AWS credentials to identities via GetCredentialsForIdentity

Map federated identities to IAM roles using rule-based or token-based role resolution

GET STARTED

Start building with Amazon Cognito Identity API

Explore with Jentic

View OpenAPI Document

For Agents

Issue scoped temporary AWS credentials to federated users and unauthenticated guests, and manage identity pools, identity-to-role mappings, and developer-authenticated identities.

Use for: I need to issue temporary AWS credentials to a mobile app user, I want to federate Google sign-in into AWS access, Set up an identity pool that supports unauthenticated guest access, Get the IAM role mapping for a Cognito identity pool

Not supported: Does not handle user sign-up, password reset, MFA, or user directory storage - use for federated identity and AWS credential vending only; for full user pools use Amazon Cognito User Pools.

Use Cases

Patterns agents use Amazon Cognito Identity API for, with concrete tasks.

★ Federated Mobile App Access to AWS

Mobile and single-page apps need to call AWS services such as S3, DynamoDB, or API Gateway without embedding long-lived AWS keys. Amazon Cognito Identity issues short-lived, scoped credentials after a user signs in with Google, Apple, Facebook, or a SAML provider, and maps them to an IAM role that limits what the app can do.

Create an identity pool that allows Google logins, then call GetId followed by GetCredentialsForIdentity to obtain temporary AWS credentials for a sample Google ID token.

Guest Access for Public-Facing Apps

Public sites and games need read-only access to AWS resources for unauthenticated visitors. Amazon Cognito Identity supports unauthenticated guest identities that map to a separate IAM role with restricted permissions, so guests can fetch assets or anonymous metrics without registering. The pool can be upgraded to authenticated when the user signs in.

Configure an identity pool with AllowUnauthenticatedIdentities=true and call GetId with no logins to obtain a guest IdentityId.

Developer-Authenticated Identities

Apps with their own user database can integrate it with AWS by using developer-authenticated identities. The backend authenticates the user, calls GetOpenIdTokenForDeveloperIdentity, and the client exchanges that token for AWS credentials. This keeps the existing login system while gaining IAM-based authorization for AWS calls.

Call GetOpenIdTokenForDeveloperIdentity with a custom user identifier and the developer provider name to mint an OpenID token mapped to an IAM role.

Agent-Driven Identity Pool Provisioning

An AI agent operating an AWS landing zone can create and configure identity pools on demand. Through Jentic, the agent searches for identity pool operations, loads the input schema, and creates pools wired to the correct IAM roles for new applications. Operations that previously required navigating the AWS console can be issued as structured calls.

Create an identity pool named 'agent-provisioned-pool', set its role mappings via SetIdentityPoolRoles, and verify the configuration via DescribeIdentityPool.

Key Endpoints

23 endpoints — amazon cognito identity (federated identities) issues scoped, temporary aws credentials to mobile and web clients so applications can call aws services without embedding long-lived secrets.

METHOD

PATH

DESCRIPTION

POST

/#X-Amz-Target=AWSCognitoIdentityService.CreateIdentityPool

Create a new identity pool

POST

/#X-Amz-Target=AWSCognitoIdentityService.GetId

Generate or fetch an identity ID for a user

POST

/#X-Amz-Target=AWSCognitoIdentityService.GetCredentialsForIdentity

Issue temporary AWS credentials for an identity

POST

/#X-Amz-Target=AWSCognitoIdentityService.GetOpenIdTokenForDeveloperIdentity

Mint an OpenID token for a developer-authenticated user

POST

/#X-Amz-Target=AWSCognitoIdentityService.SetIdentityPoolRoles

Map identities to IAM roles for a pool

POST

/#X-Amz-Target=AWSCognitoIdentityService.DescribeIdentityPool

Retrieve identity pool configuration

POST

/#X-Amz-Target=AWSCognitoIdentityService.CreateIdentityPool

Create a new identity pool

POST

/#X-Amz-Target=AWSCognitoIdentityService.GetId

Generate or fetch an identity ID for a user

POST

/#X-Amz-Target=AWSCognitoIdentityService.GetCredentialsForIdentity

Issue temporary AWS credentials for an identity

POST

/#X-Amz-Target=AWSCognitoIdentityService.GetOpenIdTokenForDeveloperIdentity

Mint an OpenID token for a developer-authenticated user

POST

/#X-Amz-Target=AWSCognitoIdentityService.SetIdentityPoolRoles

Map identities to IAM roles for a pool

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your AWS access key ID and secret access key are stored once, encrypted, by your own Jentic One instance, and used to sign each SigV4 request at execution time. They never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic with intents like 'issue temporary AWS credentials for a federated user' and Jentic returns the matching Amazon Cognito Identity operation with its input schema, so the agent can call the correct endpoint without browsing the AWS service reference.

Time to first call

FAQs

Specific to using Amazon Cognito Identity API through Jentic.

What authentication does the Amazon Cognito Identity API use?

It uses AWS Signature v4 (HMAC) signing with an AWS access key ID and secret access key. Four operations are marked optional-auth in AWS's own service model and can be called unsigned from an untrusted client: GetId, GetOpenIdToken, GetCredentialsForIdentity, and UnlinkIdentity. Through Jentic, your AWS keys are stored encrypted by your own self-hosted instance and each SigV4 request is signed at call time, so the keys never reach the agent.

Can I federate Google or Apple sign-in with the Amazon Cognito Identity API?

Yes. Configure the identity pool with the relevant provider in SupportedLoginProviders (for example accounts.google.com or appleid.apple.com), then call GetId with the provider's ID token in the Logins map to map the external user to a Cognito identity.

What are the rate limits for the Amazon Cognito Identity API?

AWS publishes a default request-rate quota per operation, measured per AWS account and per Region. The documented defaults include GetCredentialsForIdentity and GetOpenIdToken at 200 requests per second, GetOpenIdTokenForDeveloperIdentity at 50, GetId at 25, DeleteIdentities and ListTagsForResource at 10, and ListIdentities, TagResource and UntagResource at 5. All of these are adjustable, and AWS states the default is the minimum for any Region in your account, so your ceiling may be higher. Retry with exponential backoff on TooManyRequestsException.

How do I issue temporary AWS credentials with Amazon Cognito Identity through Jentic?

Search Jentic for 'issue temporary AWS credentials for a federated user', load the GetCredentialsForIdentity schema, and execute it with the IdentityId and Logins map. Jentic signs the SigV4 request and returns the temporary access key, secret, and session token.

Is the Amazon Cognito Identity API free?

AWS states that use of Amazon Cognito identity pools for authenticating users and generating unique identifiers is provided at no charge; you pay for the AWS resources your application reaches with the issued credentials. Cognito User Pools, which is a separate service, has its own pricing.

Is there an Amazon Cognito Identity MCP server?

You don't need an MCP server to give your agent Amazon Cognito Identity. Jentic connects it directly from the API Directory: import it, store your AWS keys once, and your agent can create identity pools, map IAM roles, and vend temporary credentials, with no extra tool definitions loaded into its context.

Can I limit what my agent is allowed to do with Amazon Cognito Identity?

Yes. This API sends the identity pool id in the request body rather than in the URL path, so your rules bound the operations rather than the individual pool. A workable split allows GetId, GetOpenIdToken and GetCredentialsForIdentity for credential vending, and withholds DeleteIdentityPool, UpdateIdentityPool and SetIdentityPoolRoles.

AWS Amazon Cognito Identity

Connect the Amazon Cognito Identity to your agent

Capabilities

Start building with Amazon Cognito Identity API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs