whichdevtool?
Menu
StacksDirectory Pricing changes Glossary
VPS and cloud servers App hosting and PaaS Managed databases Transactional email APIs Email marketing and newsletters Domain registrars CDN, DNS and edge security Monitoring, uptime and error tracking Auth and identity Frontend and full-stack frameworks Backend frameworks UI component libraries AI model APIs File and object storage Payments and billing Background jobs, queues and workflows ORMs and database toolkits

Cloud user directory and auth service · by Amazon Web Services

Amazon Cognito

AWS's managed user pools and identity service with a permanent 10,000 MAU free tier, low per-MAU prices and tight integration with other AWS services.

Visit aws.amazon.com ↗ Alternatives Free tier EU region
Amazon Cognito homepage
§1

Overview

Amazon Cognito is AWS's managed identity service. User pools store users and handle sign-up, sign-in, MFA, social login, SAML and OIDC federation, passkeys and email or SMS one-time codes; identity pools exchange those logins for temporary AWS credentials. It also issues OAuth 2.0 client-credentials tokens for machine-to-machine calls and acts as an identity provider for Amazon Bedrock AgentCore.

Since November 2024 user pools come in three tiers. Lite covers the basic features that existed before then. Essentials, the default, adds Managed Login (a hosted, brandable UI), passwordless options and access-token customisation. Plus adds threat protection such as adaptive authentication and compromised-credential detection.

The free tier is permanent: 10,000 monthly active users on Lite or Essentials, but only 50 for users federated through SAML or OIDC. Beyond that Essentials costs $0.015 per MAU, so 950,000 users cost about $14,100 a month by AWS's own example. SMS and email are billed separately through SNS and SES. Expect more configuration work than with developer-focused products.

§2

Pricing and plans

Free tier · card required

10,000 MAU per month per account on the Lite or Essentials tiers for direct and social sign-ins, plus 50 SAML/OIDC-federated MAU; does not expire after the 12-month AWS free period. No free tier on Plus or for M2M tokens.

At the limit Bills overage Users past 10,000 MAU are billed per MAU to your AWS account; SMS and email are billed separately.

Plan Price What you get
Lite Usage-based Basic registration, sign-in, social and SAML/OIDC; 10,000 MAU free
Essentials $0.015/MAU Default tier; Managed Login, passkeys, email/SMS OTP, token customisation; 10,000 MAU free
Plus Usage-based Adds adaptive authentication, compromised-credential detection, auth event export; no free tier

Per-MAU prices for Lite and Plus did not appear in the part of the pricing page read, so only Essentials ($0.015 per MAU above 10,000) is listed. Federated SAML/OIDC users cost $0.015 per MAU above 50 on any tier. M2M token requests have no free tier. SMS goes through Amazon SNS and email through Amazon SES at their own prices. An AWS account (which needs a payment method) is required. Existing customers could keep the old price on Essentials until 30 November 2025.

Source: aws.amazon.com/cognito/pricing/ · prices as published, excluding tax.

§3

What it does

User pools
Managed directory scaling to millions of users with sign-up, sign-in, MFA and account recovery.
Managed Login
Hosted sign-in pages you can brand with a UI editor, on Essentials and Plus.
Passwordless
WebAuthn passkeys and email or SMS one-time passwords on Essentials.
Federation
Social providers plus SAML 2.0 and OIDC enterprise identity providers.
Identity pools
Exchange logins for temporary AWS credentials at no charge.
M2M tokens
OAuth 2.0 client-credentials flow for services and AI agents, billed per token request.
§4

Strengths and limitations

Strengths

  • Permanent 10,000 MAU free tier
  • Low per-MAU price at scale
  • Deep integration with API Gateway, Lambda, Amplify and IAM
  • Runs in AWS regions, including in the EU

Limitations

  • Only 50 free MAU for SAML/OIDC-federated users
  • Threat protection features require the Plus tier, which has no free tier
  • SMS and email are billed separately through SNS and SES
  • Less flexible UI customisation than dedicated auth products
  • Hosted on AWS only
§5

Who it suits

Good for

  • Apps already built on AWS
  • Consumer apps with large user counts on a budget
  • Serverless back ends using API Gateway and Lambda

Look elsewhere if

  • B2B apps with many SSO users on a small budget, given the 50 free federated MAU
  • Teams wanting polished drop-in UI components and quick customisation
§6

Pricing history

  • Cognito legacy-price upgrade window to Essentials closes

    Existing Cognito customers could move user pools to the new Essentials tier at the old user-pool price only until 30 November 2025 (end date stated on the pricing page); after that Essentials is billed at its list price of $0.015 per MAU above the 10,000 free. Source ↗

§7

Alternatives to Amazon Cognito

Tool From Free option Stages
Supabase Managed Postgres backend platform
$25/mo Free tier
Firebase Backend platform with document and realtime databases
Usage-based Free tier
Stytch Hosted auth API (B2B and consumer)
$125/mo Free tier
Authgear Open-source CIAM (cloud, VPC or one-time self-host licence)
$50/mo Free tier
WorkOS AuthKit Hosted auth with enterprise SSO
$125/mo Free tier
Asgardeo Hosted CIAM (with open-source self-hosted option)
$20/mo Free tier

All auth and identity →

§8

Questions

Is Amazon Cognito free?

Up to 10,000 monthly active users on the Lite or Essentials tiers, and the free tier does not expire after 12 months.

How much does Cognito cost per user?

Essentials is $0.015 per MAU above the free 10,000; SAML/OIDC-federated users cost $0.015 per MAU above 50.

What is the difference between Cognito Lite, Essentials and Plus?

Lite is the basic feature set, Essentials adds Managed Login and passwordless login, and Plus adds threat protection such as adaptive authentication.

Does Cognito charge for SMS?

Yes. SMS is sent through Amazon SNS and billed at SNS prices.

Sources read for this page