Overview
Amazon Cognito is AWS's managed identity service. User pools store users and handle sign-up, sign-in, MFA, social login, SAML and OIDC federation, passkeys and email or SMS one-time codes; identity pools exchange those logins for temporary AWS credentials. It also issues OAuth 2.0 client-credentials tokens for machine-to-machine calls and acts as an identity provider for Amazon Bedrock AgentCore.
Since November 2024 user pools come in three tiers. Lite covers the basic features that existed before then. Essentials, the default, adds Managed Login (a hosted, brandable UI), passwordless options and access-token customisation. Plus adds threat protection such as adaptive authentication and compromised-credential detection.
The free tier is permanent: 10,000 monthly active users on Lite or Essentials, but only 50 for users federated through SAML or OIDC. Beyond that Essentials costs $0.015 per MAU, so 950,000 users cost about $14,100 a month by AWS's own example. SMS and email are billed separately through SNS and SES. Expect more configuration work than with developer-focused products.
Pricing and plans
checked 28 Sept 2026Free tier · card required
10,000 MAU per month per account on the Lite or Essentials tiers for direct and social sign-ins, plus 50 SAML/OIDC-federated MAU; does not expire after the 12-month AWS free period. No free tier on Plus or for M2M tokens.
| Plan | Price | What you get |
|---|---|---|
| Lite | Usage-based | Basic registration, sign-in, social and SAML/OIDC; 10,000 MAU free |
| Essentials | $0.015/MAU | Default tier; Managed Login, passkeys, email/SMS OTP, token customisation; 10,000 MAU free |
| Plus | Usage-based | Adds adaptive authentication, compromised-credential detection, auth event export; no free tier |
What it does
- User pools
- Managed directory scaling to millions of users with sign-up, sign-in, MFA and account recovery.
- Managed Login
- Hosted sign-in pages you can brand with a UI editor, on Essentials and Plus.
- Passwordless
- WebAuthn passkeys and email or SMS one-time passwords on Essentials.
- Federation
- Social providers plus SAML 2.0 and OIDC enterprise identity providers.
- Identity pools
- Exchange logins for temporary AWS credentials at no charge.
- M2M tokens
- OAuth 2.0 client-credentials flow for services and AI agents, billed per token request.
Strengths and limitations
Strengths
- Permanent 10,000 MAU free tier
- Low per-MAU price at scale
- Deep integration with API Gateway, Lambda, Amplify and IAM
- Runs in AWS regions, including in the EU
Limitations
- Only 50 free MAU for SAML/OIDC-federated users
- Threat protection features require the Plus tier, which has no free tier
- SMS and email are billed separately through SNS and SES
- Less flexible UI customisation than dedicated auth products
- Hosted on AWS only
Who it suits
Good for
- Apps already built on AWS
- Consumer apps with large user counts on a budget
- Serverless back ends using API Gateway and Lambda
Look elsewhere if
- B2B apps with many SSO users on a small budget, given the 50 free federated MAU
- Teams wanting polished drop-in UI components and quick customisation
Pricing history
-
Cognito legacy-price upgrade window to Essentials closes
Existing Cognito customers could move user pools to the new Essentials tier at the old user-pool price only until 30 November 2025 (end date stated on the pricing page); after that Essentials is billed at its list price of $0.015 per MAU above the 10,000 free. Source ↗
Alternatives to Amazon Cognito
| Tool | From | Free option | Stages |
|---|---|---|---|
| Asgardeo Hosted CIAM (with open-source self-hosted option) | $20/mo | Free tier | |
| Authgear Open-source CIAM (cloud, VPC or one-time self-host licence) | $50/mo | Free tier | |
| Firebase Backend platform with document and realtime databases | Usage-based | Free tier | |
| FusionAuth Self-hostable CIAM server | $162/mo | Free tier | |
| Stytch Hosted auth API (B2B and consumer) | $125/mo | Free tier | |
| Supabase Managed Postgres backend platform | $25/mo | Free tier |
Questions
Is Amazon Cognito free?
Up to 10,000 monthly active users on the Lite or Essentials tiers, and the free tier does not expire after 12 months.
How much does Cognito cost per user?
Essentials is $0.015 per MAU above the free 10,000; SAML/OIDC-federated users cost $0.015 per MAU above 50.
What is the difference between Cognito Lite, Essentials and Plus?
Lite is the basic feature set, Essentials adds Managed Login and passwordless login, and Plus adds threat protection such as adaptive authentication.
Does Cognito charge for SMS?
Yes. SMS is sent through Amazon SNS and billed at SNS prices.
Sources read for this page