title: Amazon Cognito Login
body: <p><em>TL;DR</em></p>
  
  <p>Why isn't there <code>authenticate</code> (or <code>login</code>) in the same way there is <code>SignUp</code> or <code>ChangePassword</code> in AWS Cognito/AWS Cognito Identity Provider?</p>
  
  <p>--</p>
  
  <p>I'm struggling to understand how to implement AWS Cognito into an API flow. I've researched this extensively and feel like the functionality is so obvious, that I must be misunderstanding something.</p>
  
  <p>This API will serve Android, iOS and an SPA. I imagine the basic flow to go through my api, with an endpoint something like this:</p>
  
  <pre><code>/v1.0/authenticate/
  </code></pre>
  
  <p>It would accept a user/pwd, then the PHP on the server would do something like this:</p>
  
  <pre><code>require 'vendor/autoload.php';
  
  $sdk = new Aws\Sdk([
      'region'   =&gt; 'us-east-1',
      'version'  =&gt; 'latest'
  ]);
  
  $client = $sdk-&gt;createCognitoIdentity(['profile' =&gt; 'app-test-cognito']);
  
  $result = $client-&gt;login([
      'ClientId' =&gt; '6p16oao60fvakje31lexabcmplgecliecd99ntid', 
      'Username' =&gt; $user, 
      'Password' =&gt; $pwd]);
  </code></pre>
  
  <p>And <code>$result</code> would be a json string something like </p>
  
  <pre><code>{
     "result": "success",
     "token": "&lt;the token&gt;"
  }
  </code></pre>
  
  <p>And the <code>token</code> would be returned to the client, who would store it in localStorage/memory and return it on every other API call until it expired, using <code>Authorization: Bearer &lt;token&gt;</code>.  I think the token would be a JWT that I could test for expiration on each call without having to leave my API, would also include an immutable userId and that could be trusted by decrypting using a API-based secret or signature test.   </p>
  
  <p>But there is little or no indication that there is anything like this in existence except this recent blog post, using Javascript, that indicates there is a JS method called 'authenticateUser':</p>
  
  <p><a href="https://mobile.awsblog.com/post/Tx2O14ZY8A5LFHT/Accessing-Your-User-Pools-using-the-Amazon-Cognito-Identity-SDK-for-JavaScript" rel="nofollow noreferrer">https://mobile.awsblog.com/post/Tx2O14ZY8A5LFHT/Accessing-Your-User-Pools-using-the-Amazon-Cognito-Identity-SDK-for-JavaScript</a>  (I found this link in this SO question: <a href="https://stackoverflow.com/questions/37941780/what-is-the-rest-or-cli-api-for-logging-in-to-amazon-cognito-user-pools">What is the REST (or CLI) API for logging in to Amazon Cognito user pools</a>, which is similar to mine, I will allow, but not a duplicate).</p>
  
  <p>But, I went to their Github repo and <a href="https://github.com/aws/aws-sdk-js/search?utf8=%E2%9C%93&amp;q=authenticateuser" rel="nofollow noreferrer">did a search for 'authenticateUser'</a> and found no such method. I also <a href="https://github.com/aws/aws-sdk-php/search?utf8=%E2%9C%93&amp;q=authenticateUser" rel="nofollow noreferrer">did the same search in the PHP repo.</a> Nope.</p>
  
  <p>BTW, this (below) is a real, working <code>Signup</code> so it seems (to me) that it would follow that such an easy authentication would work, too. What am I missing??</p>
  
  <pre><code>require 'vendor/autoload.php';
  
  $sdk = new Aws\Sdk([
      'region'   =&gt; 'us-east-1',
      'version'  =&gt; 'latest'
  ]);
  
  $client = $sdk-&gt;createCognitoIdentityProvider(['profile' =&gt; 'app-test-cognito']);
  
  $result = $client-&gt;signUp([
      'ClientId' =&gt; '6p16oao60fvakje31lexabcmplgecliecd99ntid', 
      'Username' =&gt; 'fakeexampleusername', 
      'Password' =&gt; 'a#--sldjf383af09aw3jJJJL', 
      'UserAttributes' =&gt; [
          [
           'Name' =&gt; 'email',
           'Value'=&gt; 'me@example.com'
          ],
       ],
  ]); // based on pool settings, even sends out an email automatically.
  </code></pre>
  
  <p>Note: I also checked out Auth0, which seemed great but didn't have and SDK-login, either (you have to forward to their servers and use a form they provide...); Stormpath was out of the price range.</p>
  
  <p>Thanks for your help!</p>