Amazon Cognito

Enable the Amazon Cognito connector in your fastn dashboard, then let each customer authenticate their own Amazon Cognito account. fastn handles the OAuth flow, token storage and refresh per tenant, so there is no Amazon Cognito client code in your app and no per-customer branch in your codebase. Setup is 4 steps.

Yes. Every connection is scoped to the individual customer, so each authorises their own Amazon Cognito account and only ever sees their own users, groups and roles. That per-tenant isolation is the point of an embedded integration: you support the long tail of customer setups without maintaining an integration per customer.

Yes. The same connection is exposed to your agents through the fastn MCP gateway, with permissions scoped per tenant and every call audited. An agent checks a user's status and groups before answering an access question.

fastn does. When Amazon Cognito changes an endpoint, deprecates a field or alters its auth, the fix lands in the connector rather than in your backlog, and your customers' connections keep working.

Only the scopes required for the actions you enable. Each customer grants access to their own Amazon Cognito tenant, permissions are scoped per tenant, and every call is recorded so an access change can be traced to its source.

Yes. Provisioning and deprovisioning can be driven from your product or an agent within governed permissions, with every action audited, which is what makes automated access changes reviewable after the fact.

A common starting point: read users and group membership from their own user pool. Teams also use it for the other use cases listed above, and expose it to agents for governed reads and writes.

It is included. Pricing is based on connected accounts, not on how many connectors you enable, so adding Amazon Cognito does not change your per-connector cost. You can start free with 3 connected accounts.