Amplify Auth is Amazon Cognito with a TypeScript definition and client libraries. Since November 2024 it supports passwordless sign-in with SMS and email codes and passkeys, and Gen 2 supports OIDC and SAML sign-in with Entra ID, Okta and Auth0. The setup, the limits (no MFA and passwordless for the same user) and the costs.
Sign-in with email, phone or username; social providers (Google, Apple, Amazon, Facebook); user groups.
Passwordless: SMS one-time codes, email one-time codes and WebAuthn passkeys, supported in the JavaScript, Swift and Android libraries.
OIDC and SAML providers, first-class in Gen 2, for business customers who sign in with Entra ID, Okta or Auth0.
MFA with SMS or authenticator apps, and the Authenticator UI component for the sign-in screens.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Cognito does not support enabling both MFA and passwordless sign-in for the same user. Decide per user population which you want.
Federated users are priced separately: 50 free a month, then $0.015 per MAU.
Changes to some user pool settings require recreating the pool, which means migrating users. Get attributes and sign-in identifiers right early.
Cognito Essentials is free up to 10,000 monthly active users and $0.015 per MAU after that. Lite is cheaper with fewer features; Plus adds threat protection at $0.020 per MAU with no free tier. For most Amplify apps, Essentials is the right tier.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Using the Amplify Libraries Without an Amplify Backend: Cognito, AppSync and S3 You Already Have
The Amplify client libraries and UI components work against AWS resources created any way you like: CDK, Terraform or the console. How to point them at an existing Cognito user pool, AppSync API or S3 bucket, what you gain (sign-in screens, token refresh, signed uploads) and what you give up.
Read
Amazon Cognito in 2026: Everything That Changed, for Teams Who Wrote It Off
Cognito spent two years fixing the reasons people left it: new Lite, Essentials and Plus tiers with managed login and passkeys, then in 2026 multi-Region replication, password-hash import, client-secret rotation, federation triggers, self-service rate limits and machine-to-machine tokens without a domain. What changed, what it costs, and whether to look again.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.