> ## Documentation Index
> Fetch the complete documentation index at: https://hoopdev-docs-improve-idp-sso-pages.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Cognito

## Requirements

* An account in AWS
* `API_URL` is the public DNS name of the hoop gateway instance

Contact the administrator of the hoop gateway instance to retrieve the `API_URL` address.

<Steps titleSize="h3">
  <Step title="Create a User Pool">
    Go to AWS Management Panel > AWS Cognito > User Pools > Create User Pool

    * Select the checkbox User Name and Email and click Next
    * In Multi Factor Authentication, change it No MFA and click Next
    * In Requirement Attributes select: `name` and click Next
    * On Message Delivery configure it and click Next
  </Step>

  <Step title="Integrate Your App Section">
    * Select a name for the user pool. e.g.: hoopgateway
    * Select the checkbox Use the Cognito Hosted UI
    * Configure the Cognito domain

    <img src="https://mintcdn.com/hoopdev-docs-improve-idp-sso-pages/quDT6RZSG6Ua5zfL/images/idp/aws-cognito-1.png?fit=max&auto=format&n=quDT6RZSG6Ua5zfL&q=85&s=b9ab18a22055e9f6aaa819ed7aa9f22d" width="2000" height="381" data-path="images/idp/aws-cognito-1.png" />

    * In Initial App Client, select Public Client and add an App client name
    * Select the option Generate Client Secret
    * Add the URL of the callback to `{API_URL}/api/callback`

    <img src="https://mintcdn.com/hoopdev-docs-improve-idp-sso-pages/quDT6RZSG6Ua5zfL/images/idp/aws-cognito-2.png?fit=max&auto=format&n=quDT6RZSG6Ua5zfL&q=85&s=010cb887bdabec2c835515fee8dd32fb" width="2000" height="2153" data-path="images/idp/aws-cognito-2.png" />

    * In Advanced app client settings, select the checkbox ALLOW\_USER\_PASSWORD\_AUTH
    * Configure the scopes Email, OpenID and Profile

    <img src="https://mintcdn.com/hoopdev-docs-improve-idp-sso-pages/quDT6RZSG6Ua5zfL/images/idp/aws-cognito-3.png?fit=max&auto=format&n=quDT6RZSG6Ua5zfL&q=85&s=e196401c4a259c3db5b07cdee8f4c1db" width="2000" height="430" data-path="images/idp/aws-cognito-3.png" />

    * Leave all the rest of options as default, click in Next and create the user pool
  </Step>

  <Step title="Collect the Credentials">
    * Go to the created user pool
    * Select the tab App Integration > Click on `hoopauth`
    * Copy the Client ID and Client Secret

    <img src="https://mintcdn.com/hoopdev-docs-improve-idp-sso-pages/quDT6RZSG6Ua5zfL/images/idp/aws-cognito-4.png?fit=max&auto=format&n=quDT6RZSG6Ua5zfL&q=85&s=875d227818699cc338c4a855b39dab35" width="672" height="446" data-path="images/idp/aws-cognito-4.png" />
  </Step>

  <Step title="Collect Issuer Information">
    The Issuer URL is composed from the user pool region and ID: `https://cognito-idp.{aws-region}.amazonaws.com/{user-pool-id}`
  </Step>
</Steps>

## Configure Hoop Gateway

<Tabs>
  <Tab title="Web App">
    Go to **Integrations** > **Authentication** and fill in:

    * **Auth Method**: OIDC
    * **Issuer URL**: `https://cognito-idp.{aws-region}.amazonaws.com/{user-pool-id}`
    * **Client ID**: the Client ID from above
    * **Client Secret**: the Client Secret from above
  </Tab>

  <Tab title="API">
    ```sh theme={null}
    curl -X PUT {API_URL}/api/serverconfig/auth \
      -H "Api-Key: {API_KEY}" \
      -H "Content-Type: application/json" \
      -d '{
        "auth_method": "oidc",
        "provider_name": "aws-cognito",
        "oidc_config": {
          "issuer_url": "https://cognito-idp.{AWS_REGION}.amazonaws.com/{USER_POOL_ID}",
          "client_id": "{CLIENT_ID}",
          "client_secret": "{CLIENT_SECRET}",
          "groups_claim": "groups"
        },
        "webapp_users_management_status": "active"
      }'
    ```
  </Tab>
</Tabs>