COGNITO: ClientMetadata is not passed to PreTokenGeneration Lambda trigger on REFRESH_TOKEN_AUTH

Question

I am facing a limitation in Amazon Cognito where the `ClientMetadata` parameter is not consistently forwarded to Lambda triggers on refresh token operation.

In my specific use case:
* I am using the `AdminInitiateAuthCommand` with `AuthFlow: REFRESH_TOKEN_AUTH`.
* I pass custom key-value pairs via the `ClientMetadata` parameter when initiating the request.
* However, Cognito does not forward this `ClientMetadata` to any of the triggers involved in the refresh token flow, such as the `PreTokenGeneration`.

This creates a gap where contextual client information (which is available at initial authentication flows) becomes unavailable during token refresh operations. In many scenarios, it is important to pass metadata at refresh time (e.g. for multi-tenant with multi session setups, client instance identifiers, A/B testing, audit reasons, or custom claim logic).

This inconsistency forces developers to implement complex workarounds, such as:
* External session stores.
* Client-side state persistence.
* Unnecessary calls to custom APIs to propagate metadata manually.

Feature request:
Please consider extending Cognito to allow `ClientMetadata` to be passed through during refresh token operations, and be made available to Lambda triggers involved in these flows — in the same way as initial authentication flows.

Manvitha Potluri · Answer

You're absolutely right, we ran into the exact same issue. ClientMetadata not being passed to Lambda triggers like PreTokenGeneration during REFRESH_TOKEN_AUTH is definitely a limitation, especially for multi-tenant or context-aware setups.

Since Cognito doesn’t support this natively (yet), here’s what we’re doing as a workaround:

**Try with the below workaround:**
At initial login (when ClientMetadata is available), we store the key context (like tenant ID, feature flags, etc.) in a DynamoDB table keyed by user sub or a session ID.

Then in the PreTokenGeneration Lambda (during refresh), we look up the relevant context using the user’s sub and apply our custom logic for claims, roles, etc.

It’s not ideal, adds a little complexity, but works reliably until AWS (hopefully) supports this natively for token refresh flows.

Would definitely +1 this as a feature request. Having ClientMetadata consistently available across all auth flows would make things much cleaner.

COGNITO: ClientMetadata is not passed to PreTokenGeneration Lambda trigger on REFRESH_TOKEN_AUTH

Aggiungi la tua risposta

Contenuto pertinente