Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →webiny/webiny-cognito-federation
Configuring Cognito Federation for Webiny projects — federated sign-in via external identity providers (Google, Facebook, Apple, Amazon, OIDC/Entra ID) while keeping Cognito as the user pool.
Passed 20 of 22 test cases with the skill, and 3 of 22 without it.
and 28 more in the full report
17 fixed3 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 17 test cases the skill fixed. Same model, same prompt, with and without the skill.
I have written a custom identity mapping extension file at ./extensions/cognito/api.ts. How do I register this file with the <Cognito /> component in webiny.config.tsx?
| Checked | Without skill | With skill |
|---|---|---|
| Sets apiConfig prop on Cognito to the extension file path. | Missed | Passed |
The instructions your model reads when the skill loads.
Webiny supports federated sign-in through Cognito — users authenticate via external identity providers (Google, Entra ID, etc.) while Cognito remains the user pool. Configure it by adding a federation prop to <Cognito /> in webiny.config.tsx. This handles both infrastructure (Cognito User Pool Domain, IdP resources, OAuth client) and the admin login screen (provider buttons, OAuth for Amplify). Federated users are auto-detected and synced into Webiny. For advanced use cases, provide apiConfig (custom identity mapping) and/or adminConfig (custom login screen behavior).
Cognito Federation has three layers:
Infrastructure — The federation prop on <Cognito />, under the hood, creates the Cognito User Pool Domain, Identity Provider resources, and configures OAuth on the User Pool Client.
Admin Login Screen — The federation config is passed as an Admin.BuildParam to the admin app. A CognitoSignInConfig abstraction provides the login screen with provider buttons, OAuth settings for Amplify, and credentials visibility. By default, this is auto-generated from the federation prop. For advanced customization (IP whitelists, async logic), provide an adminConfig extension.
API Identity — Federated tokens are auto-detected via the identities JWT claim and marked external: true. The ExternalIdpUserSyncHandler auto-creates/updates users on login. For custom role/team mapping, provide an apiConfig extension implementing CognitoIdpConfig.
signInWithRedirect() redirects to Cognito Hosted UIidToken with an identities claimfetchAuthSession()identities in the token, sets external: trueExternalIdpUserSyncHandler creates/updates the Webiny user with roles/teams<Cognito /> Props| Prop | Type | Description |
|---|---|---|
federation | object | () => Promise<object> | Federation config (see below) — sync or async |
mfa | boolean | Enable TOTP MFA for all users (default: false) |
apiConfig | string | Path to API identity mapping extension |
adminConfig | string | Path to Admin login customization extension |
federation Object| Field | Type | Required | Default | Description |
test cases passed, vs 3 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.