Getting credentials

You can use Amazon Cognito to deliver temporary, limited-privilege credentials to your application, so that your users can access Amazon resources. Amazon Cognito supports both authenticated and unauthenticated identities. To provide Amazon credentials to your app, follow these steps.

To use a Amazon Cognito identity pool in an Android app, set up Amazon Amplify. For more information, see Authentication in the Amplify Dev Center.

Retrieving an Amazon Cognito identity

If you're allowing unauthenticated users, you can retrieve a unique Amazon Cognito identifier (identity ID) for your end user immediately. If you're authenticating users, you can retrieve the identity ID after you've set the login tokens in the credentials provider:

String identityId = credentialsProvider.getIdentityId();
Log.d("LogTag", "my ID is " + identityId);

You can use Amazon Cognito to deliver temporary, limited-privilege credentials to your application, so that your users can access Amazon resources. Amazon Cognito identity pools support both authenticated and unauthenticated identities. To provide Amazon credentials to your app, complete the following steps.

To use a Amazon Cognito identity pool in an iOS app, set up Amazon Amplify. For more information, see Swift Authentication and Flutter Authentication in the Amplify Dev Center.

Retrieving an Amazon Cognito identity

You can retrieve a unique Amazon Cognito identifier (identity ID) for your end user immediately if you're allowing unauthenticated users or after you've set the login tokens in the credentials provider if you're authenticating users:

// Retrieve your Amazon Cognito ID
[[credentialsProvider getIdentityId] continueWithBlock:^id(AWSTask *task) {
    if (task.error) {
        NSLog(@"Error: %@", task.error);
    }
    else {
        // the task result will contain the identity id
        NSString *cognitoId = task.result;
    }
    return nil;
}];

You can use Amazon Cognito to deliver temporary, limited-privilege credentials to your application so that your users can access Amazon resources. Amazon Cognito supports both authenticated and unauthenticated identities. To provide Amazon credentials to your app, follow these steps.

To use a Amazon Cognito identity pool in an iOS app, set up Amazon Amplify. For more information, see Swift Authentication in the Amplify Dev Center.

Retrieving an Amazon Cognito identity

You can retrieve a unique Amazon Cognito identifier (identity ID) for your end user immediately if you're allowing unauthenticated users or after you've set the login tokens in the credentials provider if you're authenticating users:

// Retrieve your Amazon Cognito ID
credentialsProvider.getIdentityId().continueWith(block: { (task) -> AnyObject? in
    if (task.error != nil) {
        print("Error: " + task.error!.localizedDescription)
    }
    else {
        // the task result will contain the identity id
        let cognitoId = task.result!
        print("Cognito id: \(cognitoId)")
    }
    return task;
})

If you have not yet created one, create an identity pool in the Amazon Cognito console before using fromCognitoIdentityPool.

After you configure an identity pool with your identity providers, you can use the fromCognitoIdentityPool function from the @aws-sdk/credential-providers package to authenticate users. Rather than setting a global AWS.config.credentials, attach the credentials provider directly to each service client through its credentials property. The v3 SDK resolves the provider lazily the first time the client makes a request, so there is no separate call to obtain credentials. The following example attaches the provider to an S3Client:

import { S3Client } from "@aws-sdk/client-s3";
import { fromCognitoIdentityPool } from "@aws-sdk/credential-providers";

// Set the region where your identity pool exists (for example, us-east-1 or eu-west-1)
const region = "REGION";

// Attach the credentials provider to your service client
const client = new S3Client({
  region,
  credentials: fromCognitoIdentityPool({
    identityPoolId: "IDENTITY_POOL_ID",
    logins: { // optional tokens, used for authenticated login
      "graph.facebook.com": "FBTOKEN",
      "www.amazon.com": "AMAZONTOKEN",
      "accounts.google.com": "GOOGLETOKEN",
      "appleid.apple.com": "APPLETOKEN"
    },
    clientConfig: { region },
  }),
});

// Credentials are resolved lazily when the client first makes a request.
// To inspect them directly, call the provider and await the result
// (from inside an async function):
const credentials = await client.config.credentials();
const { accessKeyId, secretAccessKey, sessionToken } = credentials;

The optional logins property is a map of identity provider names to the identity tokens for those providers. How you get the token from your identity provider depends on the provider you use. For example, if Facebook is one of your identity providers, you might use the FB.login function from the Facebook SDK to get an identity provider token:

FB.login(function (response) {
    if (response.authResponse) { // logged in
        const region = "us-east-1";
        const client = new S3Client({
          region,
          credentials: fromCognitoIdentityPool({
            identityPoolId: "us-east-1:1699ebc0-7900-4099-b910-2df94f52a030",
            logins: {
              "graph.facebook.com": response.authResponse.accessToken
            },
            clientConfig: { region },
          }),
        });

        console.log('You are now logged in.');
    } else {
        console.log('There was a problem logging you in.');
    }
});

Retrieving an Amazon Cognito identity

You can retrieve a unique Amazon Cognito identifier (identity ID) for your end user. If you allow unauthenticated users, you can retrieve it immediately. If you authenticate users, retrieve it after you set the login tokens. The fromCognitoIdentityPool provider exposes the identityId on the credentials that it resolves, so you can read it from the resolved credentials of a client that uses the provider:

// Inside an async function:
const { identityId } = await client.config.credentials();

You can use Amazon Cognito to deliver temporary, limited-privilege credentials to your application, so that your users can access Amazon resources. Amazon Cognito supports both authenticated and unauthenticated identities. To provide Amazon credentials to your app, follow these steps.

The Amazon SDK for Unity is now part of the Amazon SDK for .NET. To get started with Amazon Cognito in the Amazon SDK for .NET, see Amazon Cognito credentials provider in the Amazon SDK for .NET Developer Guide. Or see Amplify Dev Center for options for building an app with Amazon Amplify.

Retrieving an Amazon Cognito identity

You can retrieve a unique Amazon Cognito identifier (identity ID) for your end user immediately if you're allowing unauthenticated users or after you've set the login tokens in the credentials provider if you're authenticating users:

string identityId = await credentials.GetIdentityIdAsync();