How do I set up LinkedIn as a social identity provider in an Amazon Cognito user pool?

Resolution

LinkedIn lets you authenticate your users through openID connect. Add LinkedIn as the OIDC provider in the Amazon Cognito user pool.

Create an Amazon Cognito user pool with an app client and domain name

To use LinkedIn as a social IdP, you must create a new application in the Amazon Cognito console. You must also configure a user pool app client and domain.

Important: When you create a user pool, you must keep the standard attribute email selected.

Create a LinkedIn app

Do the following:

1. Open the developer suite on LinkedIn, and then choose Create app.
2. On the Create an app page, customize your LinkedIn app, and then choose Create app.
3. Choose the Auth tab. Confirm that the list includes openid, profile and email scope. These permissions provide you access to the required LinkedIn user info. Note: If you don't see openid, profile and email scope listed, then add the product Sign In with LinkedIn using OpenID Connect to your application. You can find this product on the Products tab of the LinkedIn Dev page.
4. On the Auth tab, under Application credentials, copy the Client ID and Client Secret.
5. For OAuth 2.0 settings, choose the pencil icon to edit the settings. Then, choose + Add redirect URL.
6. Under Redirect URLs:, enter the following:https://YourDomainPrefix.auth.region.amazoncognito.com/oauth2/idpresponse.
   Note: Replace YourDomainPrefix and region with the values for your user pool.

Add an OIDC provider to your user pool

Do the following:

1. Open the Amazon Cognito console.
2. Choose your user pool.
3. Under the Sign-in experience tab, choose Add Identity Providers.
4. Choose OpenID Connect.
5. Enter the details of your LinkedIn app for the OIDC provider details: For Provider name, enter a name (for example, LinkedIn). This name appears in the Amazon Cognito hosted web UI.
   Note: You can't change this field after you create the provider. For Client ID, enter the Client ID that you copied earlier from your LinkedIn application. For Client secret, enter the Client Secret that you copied earlier from your LinkedIn application. For Attributes request method, leave the setting as GET. For Authorize scope, enter openid profile email. For Issuer, enter https://www.linkedin.com.To manually enter the endpoint information, see Validating ID Tokens on the Microsoft Build 2026 website for more information.
6. Choose Create provider.

For more information, see Add an OIDC IdP to your user pool.

Map the attributes from OIDC provider to your user pool

Do the following:

1. Open the Amazon Cognito console.
2. Choose your user pool.
3. Under the Sign-in experience tab, select the LinkedIn OIDC provider that you created.
4. Under Attribute mapping, map the userpool email attribute to the OpenID Connect attribute email.
5. Confirm that the OIDC attribute sub maps to the user pool attribute Username.
6. (Optional) Add OIDC attributes that you want to pass along from LinkedIn. For example, you can map given_name and family_name to the corresponding Amazon Cognito user pool attributes.

For more information, see Mapping IdP attributes to profiles and tokens.

Change app client settings for your user pool

Do the following:

1. Open the Amazon Cognito console.
2. Choose your user pool.
3. Under App integration, choose App client.
4. On the App client page, enter the following information:For Callback URL(s), enter a URL where you want to redirect your users after they log in. For testing, enter a valid URL, such as https://example.com/. For Sign out URL(s), enter a URL where you want to redirect your users after they log out. For testing, you can enter any valid URL, such as https://example.com/.Edit the Hosted UI, and add the OIDC provider that you created as your identity provider.Under OAuth 2.0 grant types, select either the Authorization code grant or Implicit grant option.
   Note: The OAuth 2.0 grant types determine which values, code or token, that you can use for the response_type parameter in your endpoint URL.Under OpenID Connect scopes, select the Email, Profile, and Openid options.
5. Choose Save changes.

For more information, see App client terms.

Configure the endpoint URL

To configure your endpoint URL, complete the following tasks.

Construct the endpoint URL

To construct the endpoint URL, use the values from your setup to construct the endpoint URL.

Example:

https://YourDomainPrefix.auth.region.amazoncognito.com/oauth2/authorize?response_type=code&client_id=YourClientId&redirect_uri=redirectUrl

To customize the URL for your setup, make the following changes:

• Replace YourDomainPrefix and region with the values for your user pool. Find them in the Amazon Cognito console on the App integration tab of your user pool.
• If you previously selected only the Implicit grant flow for Allowed OAuth Flows, then change response_type=code to response_type=token.
• Replace YourClientId with your app client's ID, and replace redirectUrl with your app client's callback URL.

For more information, see User pool managed login and The redirect and authorization endpoint.

Test the endpoint URL

To test your endpoint URL, complete the following steps:

1. Enter the constructed endpoint URL in your web browser.
2. Choose the name of your OIDC provider, such as LinkedIn.
3. Choose Log in with LinkedIn. This redirects you to the LinkedIn sign-in page.
   Note: If the URL redirects you to your Amazon Cognito app client's callback URL, then you're already signed in to LinkedIn.
4. On the LinkedIn sign-in page, enter the email address or phone number and password for your LinkedIn account.
5. Choose Sign in.

After you log in successfully, the app redirects you to the app client's callback URL. The authorization code or user pool tokens appear in the URL in your web browser's address bar.

(Optional) Skip the Amazon Cognito hosted UI

For users to skip the Amazon Cognito web UI when they sign in to your app, structure your endpoint URL in the following format:

https://YourDomainPrefix.auth.region.amazoncognito.com/oauth2/authorize?response_type=code&identity_provider=oidcProviderName&client_id=yourClientId&redirect_uri=redirectUrl&scope=allowedOauthScopes

To customize the URL for your setup, make the following changes:

• Replace YourDomainPrefix and region with the values for your user pool. Find them in the Amazon Cognito console on the App integration tab of your user pool.
• If you previously selected only the Implicit grant flow for Allowed OAuth Flows, then change response_type=code to response_type=token.
• Replace oidcProviderName with the name of the OIDC provider in your user pool.
• (Optional) If you added an identifier for your OIDC provider in the Identifiers field, then replace identity_provider=oidcProviderName with **idp_identifier=**idpIdentifier. Replace idpIdentifier with your custom identifier string.
• Replace yourClientId with your app client's ID, and replace redirectUrl with your app client's callback URL.
• Replace allowedOauthScopes with the specific scopes that you want your Amazon Cognito app client to request.