How do I configure Amazon Cognito SSO?

Last updated: October 13, 2026

At a glance

  • Typical setup time: About 15 minutes

  • Who you need: An AWS administrator who manages your Cognito user pool

  • What Hadrius reads: Each user's name and verified email at sign-in

Before you begin

You need an Amazon Cognito user pool and access to the Amazon Cognito console with permission to manage its domain and app clients. Every user who signs in to Hadrius needs a verified email address in the user pool.

In Amazon Cognito

Give the user pool a domain

In the Amazon Cognito console, open your user pool and go to Domain under Branding in the left navigation. If the pool has no domain yet, add a Cognito domain or a custom domain. Hadrius reads the domain from the user pool, so you don't enter it anywhere.

Create an app client

Go to App clients under Applications and create an app client.

  1. Under Application type, select Traditional web application. This type comes with a client secret, which Hadrius needs.

  2. Give it a recognizable name, such as Hadrius.

  3. Under Return URL, enter https://app.hadrius.com/auth/sso.

Configure the login pages

Open the new app client, go to the Login pages tab, and edit the Managed login pages configuration.

Allowed callback URLs

Make sure https://app.hadrius.com/auth/sso is listed.

OAuth 2.0 grant types

Select Authorization code grant.

OpenID Connect scopes

Select OpenID, Email and Profile.

Hadrius asks for exactly these three scopes. If any of them is missing from the app client, Cognito refuses the sign-in.

Make the email attribute read-only

On the app client's Attribute permissions tab, edit the permissions and clear email under write permissions, leaving it readable. Hadrius signs users in by their email address, so users must not be able to change their own.

Hadrius refuses an unverified email. If Cognito marks a user's email as unverified, that user can't sign in to Hadrius until the address is verified.

In Hadrius

Add the credentials

On the user pool's Overview page, copy the User pool ID (for example, us-east-1_AbC123). On the app client's page, copy the Client ID and Client secret. On the Amazon Cognito SSO integration page in Hadrius, paste them into the User pool ID, Client ID and Client secret fields.

Two fields are optional. Sign in domains takes any additional email domains your team signs in with, separated by commas; your firm's own email domain is always included. Requirement status sets how strictly SSO sign-in is enforced, and defaults to Not required. If you choose Required for all users, every existing Hadrius user's email must be on one of the sign-in domains, since anyone else would be locked out.

The client secret is sensitive. Paste it directly into Hadrius and don't share it by email or chat.

When you save, Hadrius looks up the user pool and its domain. To change other settings later, leave Client secret blank to keep the saved one. You need to enter it again only if you change the client ID or the user pool's domain.

Troubleshooting

Hadrius can't find the user pool

Check that the user pool ID was copied in full, including the region at the start.

The user pool lists no sign-in pages Hadrius can use

The user pool has no domain yet. Add one under Branding > Domain, then save again.

The domain doesn't resolve to a public address

The user pool's custom domain points at a private network address. Hadrius signs users in over the public internet, so point the domain's DNS record at a public address.

A user sees "did not return a verified email address"

That user's email is unverified in the user pool. Verify it in Cognito, then have them sign in again.