CognitoAuth

Protect API Gateway routes with Cognito. Pass the user pool and app client IDs; Anvil derives the issuer and wires up the JWT authorizer.

API & Auth · anvil:aws:CognitoAuth

Arguments

Names below are TypeScript (camelCase). In Python use snake_case (e.g. dataClassification → data_classification); in Go use PascalCase on the Args struct (e.g. DataClassification).

userPoolId required

Output<string>

The Cognito user pool ID. Pass pool.userPoolId directly. Anvil derives the issuer URL automatically.

audience required

string[]

The Cognito app client IDs allowed to access this API. API Gateway rejects tokens whose 'aud' claim does not match one of these values.

Attributes

Outputs available once the resource is deployed.

authorizerId

string

A reference to this authorizer's issuer and audience — not an API Gateway ID. Pass it to HttpApi.defaultAuthorizerId; the HttpApi creates the authorizer on its own API.