Passwordless login for more than 10 app clients with AWS Cognito

Question

I use Cognito passwordless login for my users. Also, I need to open my product APIs to external clients. Consider me as a Meta with its users, and my clients are external developers who (similarly to Meta for Developers) should be able to create an app and set up an OAuth client. For each client, I then make an API Gateway key and rate-limit their requests. 
Since I need a passwordless login, I decided to use managed login first. So far, the process is as follows (and I'm unsure whether it is the only possible way): create an app client, create a managed login style, and assign the style to the app client. It is not possible to assign the same style to more than one client. However, there is a limit of 10 managed login styles that I can create only (error message: The number of ManagedLoginBrandings in User Pool has reached the maximum quota of 10). I don't see this value in the service quota, so I'm unsure if it is possible to increase it via a support case.
Do you have any suggestions on what can be done before I consider migration to another provider?
To summarize:
- I need multiple app clients 
- I don't need custom branding for each client, but I do need passwordless login

re:Post Agent · Answer

To implement passwordless authentication for multiple app clients in Amazon Cognito while working within the limitation of 10 managed login styles, you have a few options:

1. **Share app clients**: Instead of creating a separate app client for each external developer, you could consider using a smaller number of shared app clients with appropriate scopes and permissions. This approach would require you to implement additional logic in your application to manage client-specific rate limiting and API keys.

2. **Request a quota increase**: Although the 10 managed login styles limit isn't explicitly listed in the service quotas, you can still submit a support case to AWS requesting an increase. AWS often provides quota increases based on legitimate business needs.

3. **Use API-based passwordless authentication**: Instead of relying on managed login UI, you could implement passwordless authentication directly using the Cognito APIs. This approach would allow you to create your own authentication UI and workflow while still leveraging Cognito's passwordless capabilities. You would need to implement the challenge-response flow for one-time passwords (OTP) via SMS or email.

4. **Use a single managed login style with dynamic configuration**: Create one managed login style but dynamically configure the behavior based on the client ID or other parameters. This would require custom implementation on your side but could work within the 10-style limit.

Remember that passwordless authentication in Cognito requires the Essentials or Plus feature plan and is only available in the choice-based authentication AuthFlow of ALLOW_USER_AUTH. Also note that if you require multi-factor authentication (MFA), you cannot use passwordless authentication.

Before considering migration to another provider, I'd recommend first trying to request a quota increase from AWS support, as this would be the simplest solution if approved.  
**Sources**  
[Implement passwordless authentication for Cognito users | AWS re:Post](https://repost.aws/knowledge-center/cognito-passwordless-authentication)  
[Amazon Cognito now supports passwordless authentication for low-friction and secure logins - AWS](https://aws.amazon.com/about-aws/whats-new/2024/11/amazon-cognito-passwordless-authentication-low-friction-secure-logins/)  
[Essentials plan features - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html)

Passwordless login for more than 10 app clients with AWS Cognito

Add your answer

Relevant content