2026/08/28 - Amazon Cognito Identity Provider - 2 new api methods
Changes Adds two new operations - GetClientToken which allows M2M auth through the SDK, and DescribeTermsByClient to find which Terms are associated with a user-pool client without knowing the Terms resource id.
Issues an access token for machine-to-machine (M2M) authorization. Your app client provides its client ID and secret, and receives an access token that authorizes requests to your resource servers. GetClientToken provides the same functionality as the OAuth2 client-credentials grant; both authorize an application rather than a user.
To use this operation, you must configure the app client with a client secret and enable the ALLOW_CLIENT_TOKEN_AUTH authentication flow. The ALLOW_CLIENT_TOKEN_AUTH flow is mutually exclusive with user authentication flows. It must be the only authentication flow that you configure for the app client. For more information, see Scopes, M2M, and resource servers.
See also: AWS API Documentation
Request Syntax
client.get_client_token(
ClientId='string',
Secret='string',
Scopes=[
'string',
],
ClientMetadata={
'string': 'string'
}
)
string
[REQUIRED]
The ID of the app client that requests the access token. The app client must have a client secret and the ALLOW_CLIENT_TOKEN_AUTH authentication flow.
string
[REQUIRED]
An active secret for the app client.
list
The custom scopes to authorize in the access token, in the format resource-server-identifier/scope-name. Each scope must belong to a resource server in your user pool. If you don't specify any scopes, Amazon Cognito authorizes the scopes that are configured for the app client.
(string) --
dict
A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers. You create custom workflows by assigning Lambda functions to user pool triggers.
When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the function receives as input. This payload contains a clientMetadata attribute that provides the data that you assigned to the ClientMetadata parameter in your request. In your function code, you can process the clientMetadata value to enhance your workflow for your specific needs.
To review the Lambda trigger types that Amazon Cognito invokes at runtime with API requests, see Connecting API actions to Lambda triggers in the Amazon Cognito Developer Guide.
(string) --
(string) --
dict
Response Syntax
{
'ClientAuthenticationResult': {
'AccessToken': 'string',
'ExpiresIn': 123,
'TokenType': 'string'
}
}
Response Structure
(dict) --
ClientAuthenticationResult (dict) --
The access token that Amazon Cognito issues for the app client, and its metadata.
AccessToken (string) --
The access token for the requested app client. Present this token to a resource server to authorize a request, using the scopes granted in the token.
ExpiresIn (integer) --
The number of seconds until the access token expires.
TokenType (string) --
The type of the token. For example, Bearer.
Returns details for the terms documents that are associated with an app client, identified by the app client ID, user pool ID, and terms name. For more information, see Terms documents.
To call DescribeTermsByClient, you must have the cognito-idp:DescribeTermsByClient Identity and Access Management (IAM) permission. This operation additionally validates your permission for cognito-idp:DescribeTerms, the action for . As a result, an IAM policy that denies cognito-idp:DescribeTerms also denies requests to DescribeTermsByClient.
See also: AWS API Documentation
Request Syntax
client.describe_terms_by_client(
ClientId='string',
UserPoolId='string',
TermsName='string'
)
string
[REQUIRED]
The ID of the app client that the terms documents are associated with.
string
[REQUIRED]
The ID of the user pool that contains the terms documents that you want to describe.
string
[REQUIRED]
The name of the terms documents that you want to describe.
dict
Response Syntax
{
'Terms': {
'TermsId': 'string',
'UserPoolId': 'string',
'ClientId': 'string',
'TermsName': 'string',
'TermsSource': 'LINK',
'Enforcement': 'NONE',
'Links': {
'string': 'string'
},
'CreationDate': datetime(2015, 1, 1),
'LastModifiedDate': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
Terms (dict) --
A summary of the requested terms documents. Includes a unique identifier for later changes to the terms documents.
TermsId (string) --
The ID of the terms documents.
UserPoolId (string) --
The ID of the user pool that contains the terms documents.
ClientId (string) --
The ID of the app client that the terms documents are assigned to.
TermsName (string) --
The type and friendly name of the terms documents.
TermsSource (string) --
This parameter is reserved for future use and currently accepts one value.
Enforcement (string) --
This parameter is reserved for future use and currently accepts one value.
Links (dict) --
A map of URLs to languages. For each localized language that will view the requested TermsName, assign a URL. A selection of cognito:default displays for all languages that don't have a language-specific URL.
For example, "cognito:default": "https://terms.example.com", "cognito:spanish": "https://terms.example.com/es".
(string) --
(string) --
CreationDate (datetime) --
The date and time when the item was created. Amazon Cognito returns this timestamp in UNIX epoch time format. Your SDK might render the output in a human-readable format like ISO 8601 or a Java Date object.
LastModifiedDate (datetime) --
The date and time when the item was modified. Amazon Cognito returns this timestamp in UNIX epoch time format. Your SDK might render the output in a human-readable format like ISO 8601 or a Java Date object.