I build a lot of small internal apps, and for those Cognito is friendly: hosted login, reset-password emails, Google or Microsoft sign-in, MFA, all configured rather than built, and free at their size. It's not worse than Better Auth; it's a different job.
Workers can verify Cognito JWTs at the edge, which makes it a fine identity source for the edge patterns on this page too.
Use it when
- Internal apps and admin panels for corporate clients: they stay under the free 10,000 users, and you get the hosted login page, password reset emails and social sign-in with nothing to build.
- The app needs AWS-native identity (identity pools, IAM-secured access to AWS services, Amplify, ALB authentication).
- Enterprise SSO for lots of users on a tight budget: billed per federated user, not per connection (about $14 a month for 20 connections of 50 users).
Don't use it when
- A serious, growing app on Postgres: users end up in two stores, Cognito and your database, kept in sync with triggers. Better Auth keeps them in one.
- You need organisations, magic links, SCIM or self-serve SSO: Cognito has none of them.
Pricing
Lite and Essentials: 10,000 monthly active users free per account, then $0.015 per user on Essentials (Lite from $0.0055, without passkeys or email codes). Enterprise SSO users: 50 free, then $0.015 each.
In my words: what hurts
- Limited features and identity providers.
- Users live in Cognito and in my Postgres: two systems, duplicated users.
Gotchas, with fixes
Gotcha: Cognito gives trigger Lambdas about 5 seconds. Cold container-image Lambdas blow through it and sign-in fails.
Fix: Keep triggers small and zip-packaged.
Gotcha: Cognito's built-in email sender is capped at 50 emails a day per AWS account.
Fix: Point the user pool at SES before going live.
Gotcha: Passkeys need the username first, and can only be registered after a first sign-in.
Fix: Offer passkeys as an upgrade after sign-in, not as the first-time path.
Provisioning
Official Pulumi package · Official Terraform provider
Instead, consider
- Better Auth A serious app on Postgres: users in one place, more features, no per-user fee.
Worked examples
Where it fits
- Sign-in and identity: Pick 02.
The easy pick for small internal apps and admin panels: hosted login, reset emails and social sign-in out of the box, free under 10,000 users.
Sources
Last reviewed by Nicolas Dao