---
title: This guide walks an administrator through connecting Amazon Cognito to WoodsPortal so end users can choose Sign in with AWS Cognito on the login screen.
description:  Before you start AWS account with permission to use Amazon Cognito in your chosen Region (for example eu-central-1). WoodsPortal administrator access (Int
---

[Resources: Guides, Case Studies & Insights](https://digitalwoods.io/resources)

# [This guide walks an administrator through connecting Amazon Cognito to WoodsPortal so end users can choose Sign in with AWS Cognito on the login screen.](https://digitalwoods.io/resources/knowledge-base/woodsportal-aws-cognito-sso-setup)

 Written by [Admin](https://digitalwoods.io/resources/author/admin) | Sep 17, 2026, 5:13:24 AM

   Before you start

- AWS account with permission to use **Amazon Cognito** in your chosen **Region** (for example `eu-central-1`).
- **WoodsPortal** administrator access (Integration Manager).
- A decision on **callback (redirect) URLs**: use the exact HTTPS URLs WoodsPortal expects for OAuth/OIDC (your onboarding doc, support, or the integration **View Details** screen may list them). Add the same URLs in Cognito for the app client.

**Security:** Treat the **client secret** like a password. Do not paste it into chat, tickets, or public repos. Rotate it if it is exposed.

#### 1. Create or open a Cognito user pool

1. In the AWS Management Console, open **Amazon Cognito** → **User pools**.
2. Either create a new pool or open an existing one.

      3.   On the pool **Overview**, copy the **User pool ID** (for example                                                                        `eu-central-1_XwEcf0382`).   The segment before the underscore is your **Region**.

#### 2. Configure a Cognito hosted UI domain

WoodsPortal needs the **hosted UI domain** for your user pool (the URL users see when Cognito handles sign-in).

1. In the left menu, under **Branding**, open **Domain**.
2. Under **Cognito domain**, ensure a domain prefix is set. The full URL looks like`https:// .auth. .amazoncognito.com`.

**WoodsPortal field “Cognito Domain”:** Enter the value your product expects—often the **host only** (no `https://`), for example

`.auth. .amazoncognito.com`. If connection fails, try the **prefix only** form if your admin UI documents that variant.

#### 3. Create an app client (confidential / with secret)

1. In the left menu, open **Applications** → **App clients**.
2. Choose **Create app client**.

       3.   In the wizard:

- - Set **Application type** to **Traditional web application** (or equivalent for a server-side / confidential client that can keep a **client secret**).
    - Set **Return URL** (allowed callback URL) to the **WoodsPortal-provided** redirect URL(s). You can add more callback and sign-out URLs later under the client’s **Login pages** / hosted UI settings if the console moves them there.

       4.   Ensure a **client secret** is generated if WoodsPortal’s form marks **Client Secret** as                         required.   
      5.   Finish creating the client, open it, then copy:

- - **Client ID**
    - **Client secret** (use **Show client secret** only when copying; store it securely)

       6.  ** OAuth scopes:** If sign-in fails with “invalid scope” or similar, edit the app client / **Login                  pages** (or **Hosted UI** settings) so **OpenID Connect scopes** include at least **`openid`**,                  and add **`email`** , **`profile`** if your pool and WoodsPortal expect them.

#### 4. Connect Cognito in WoodsPortal

1. Sign in to WoodsPortal as an admin and open **Integrations** in the sidebar.
2. Under **SSO**, find **AWS Cognito** and click **Connect**.

       3.   In **Connect Integration**, paste the values from Cognito:

| WoodsPortal field | Where to find it in AWS |
| --- | --- |
| **Client ID** | App client → Client ID |
| **Client Secret** | App client → show/copy secret |
| **Region** | Region where the user pool lives (e.g. `eu-central-1`) |
| **User Pool ID** | User pool overview → User pool ID |
| **Cognito Domain** | Branding → Domain → Cognito domain (see section 2) |

       4.   Click **Connect** to save.

#### 5. End-user sign-in

After the integration is saved, the WoodsPortal login page shows **Sign in with AWS Cognito**. Users who should use SSO click that button and complete Cognito sign-in.

#### Troubleshooting

| Symptom | Things to check |
| --- | --- |
| Redirect error / `redirect_mismatch` | Callback URL in Cognito **exactly** matches WoodsPortal (scheme, host, path, no trailing slash mismatch). |
| Invalid client / auth errors | **Client ID** and **secret** copied correctly; client still exists; secret not rotated without updating WoodsPortal. |
| Wrong region errors | **Region** matches the user pool (same as in the User pool ID prefix). |
| Domain errors | **Cognito Domain** format matches what WoodsPortal expects (with or without `https://`, host vs prefix—see section 2). |
| Missing email/name claims | App client **attribute permissions** and **OpenID scopes** (`email`, `profile`) in Cognito.From the **woodsportal** workspace root (parent repo), with a local venv that has Pillow:Otput: `docs/aws-cognito-sso/images/annotated/*.png`.Files in this folderScreenshots in `images/original/` are examples; your pool names, IDs, and URLs will differ. |

[View full post](https://digitalwoods.io/resources/knowledge-base/woodsportal-aws-cognito-sso-setup)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Admin"
  },
  "dateModified" : "2026-09-17T05:13:24.530Z",
  "datePublished" : "2026-09-17T05:13:24Z",
  "headline" : "WoodsPortal: AWS Cognito SSO setup",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1536,
    "url" : "https://8409213.fs1.hubspotusercontent-na1.net/hubfs/8409213/Gemini_Generated_Image_alz28salz28salz2.webp",
    "width" : 2752
  },
  "mainEntityOfPage" : "https://digitalwoods.io/resources/knowledge-base/woodsportal-aws-cognito-sso-setup",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Resources"
  }
}
```