Amazon Cognito is a managed service billed per monthly active user; Better Auth is an open-source TypeScript library that keeps users in your own database. AI changed the comparison in two ways: coding agents now write most of the integration code, and your users increasingly connect AI agents and MCP clients to your product. Prices, what each supports for agents, and how to choose.
Cognito runs sign-in for you on AWS: user pools, hosted login pages, tokens, threat protection, and a bill per monthly active user. Better Auth is a library you install in a TypeScript backend: sessions, passkeys, two-factor, organizations and single sign-on as plugins, with every user stored in your own database. We use both, Cognito for clients on AWS and Better Auth in a product of our own.
Lite
Essentials (the default)
Plus (threat protection)
Cognito monthly cost for direct sign-in by monthly active users, US East. From the Cognito pricing page: Lite and Essentials include 10,000 users a month; Lite is $0.0055 per user to 100,000 then $0.0046; Essentials $0.015; Plus $0.020 with no free tier.
Better Auth has no per-user price. You pay for the database rows and the compute your API already runs on, plus the time to operate it: patching, rate limits, email delivery and incident response are yours.
With Better Auth, sign-in is code in your repository: an agent can read the whole flow, add a plugin, write the migration and test it locally against your database.
With Cognito, much of the behaviour lives in AWS configuration: user pool settings, app clients, Lambda triggers and managed login. Agents handle infrastructure code well, but the tests need a real user pool, and customizing the login experience means working within what Cognito exposes.
Better Auth publishes llms.txt and a documentation MCP server for coding assistants. Cognito's documentation is extensive and well known to models trained on years of it.
The risk runs the other way too: an agent can quietly weaken auth code you own. Keep the library's flows, review changes to them like payments code, and test sign-in in CI.
When a customer connects Claude, Cursor or ChatGPT to your product through an MCP server, that client needs OAuth: discover your authorization server, sign the user in, and receive a token for your API. The MCP authorization specification now prefers Client ID Metadata Documents, where the client identifies itself by a URL, over dynamic client registration, so clients you have never seen can connect safely.
From the Cognito developer guide and the Better Auth MCP plugin documentation, November 2026.
Machine-to-machine pricing matters more as agents multiply. A hundred agents each fetching a Cognito token every five minutes is about 864,000 tokens a month, or roughly $1,944. Caching each token for its hour of validity brings that to about 72,000 tokens and $162.
We'll design the OAuth setup with you, on Cognito, Better Auth or AgentCore Identity, before the first client connects. 30 minutes, free.
Cognito does not let you export password hashes; since 2026 it can import them. Leaving Cognito usually means migrating users as they sign in, or asking them to set a new password or use a passkey.
Moving into Cognito from Better Auth, check that Cognito's hash import accepts the algorithm your hashes use; if it doesn't, migrate users as they sign in.
Either way, keep user IDs stable across the move so the rest of your data does not need rewriting.
Bring your user count, your stack and how agents will reach your product. We'll tell you which we'd pick and what moving would take. 30 minutes, free.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Amazon Cognito in 2026: Everything That Changed, for Teams Who Wrote It Off
Cognito spent two years fixing the reasons people left it: new Lite, Essentials and Plus tiers with managed login and passkeys, then in 2026 multi-Region replication, password-hash import, client-secret rotation, federation triggers, self-service rate limits and machine-to-machine tokens without a domain. What changed, what it costs, and whether to look again.
Read
Identity for AI Agents in 2026: The Agent Is Not the User
When software acts for people, identity has to answer new questions: whose permissions does the agent carry, who approved this action, and how does your API tell a real agent from an impersonator? The patterns that work (on-behalf-of tokens, asynchronous approval with CIBA, Cross App Access, MCP's OAuth model and signed agent traffic) and what to build first.
Read
As of November 9, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.