Send Metadata into "Pre token generation" trigger with REFRESH_TOKEN_AUTH

Question

Hi everyone!

I use AWS Cognito for my apps, and actually have 3 apps working with the same user's Cognito database. This three apps are connected, so the auth is shared. But based on what app you are logging in from, I customize the AccessToken with different params.

When I login, I send a Client Metadata that looks like this:

```
{
  platform: 'ANY_OF_THE_3_PLATFORMS'
}
```

So that when the authentication process gets to the  **Pre token generation** trigger, I check the ClientMetadata and I know where the user is coming from so that I can make changes.

Everything works great until I get to the refresh token process. When the token is refreshed, the ClientMetadata I attach is not received by the **Pre token generation** trigger, so that I don't know where this refresh token request is coming from and therefore I can't customize the AccessToken.

Any solution or workaround?

I have seen in the official docs that **REFRESH_TOKEN_AUTH** should trigger the **Pre authentication trigger**, which includes the Client Metadata, but it actually doesn't. I don't know if this is a AWS error, or I misunderstood something.

Thanks to whoever can save my day!

Answer

The `ClientMetadata` is available in the *Pre token generation* trigger during the initial login process but not during the *refresh token process*. This is why it works for the initial login but not when refreshing the token.

Unfortunately, **Cognito** does not pass `ClientMetadata` to the `Pre token generation` trigger during the *refresh token process*. This is a known limitation and there's no direct way to work around this within Cognito's current functionality.

- [(1) To use the refresh token to get new ID and access tokens with the user pools API, use the `AdminInitiateAuth` or `InitiateAuth` API operations](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.html#amazon-cognito-user-pools-using-the-refresh-token_initiate-token). 
- [(2) But Amazon Cognito doesn't include data from the ClientMetadata parameter in `AdminInitiateAuth` and `InitiateAuth` API operations in the request that it passes to the pre token generation function](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html#cognito-user-pools-lambda-trigger-syntax-pre-token-generation).
![2](/media/postImages/original/IM1cAvUL1LSq2FNMxqiIIwHQ)

Send Metadata into "Pre token generation" trigger with REFRESH_TOKEN_AUTH

Docs say that InitiateAuth with REFRESH_TOKEN_AUTH should fire the Pre authentication trigger, which includes the ClientMetadata. If that's the case, this would be a solution for me, but the truth is that REFRESH_TOKEN_AUTH never fires the Pre authentication trigger. Is that a bug or an error?

Relevant content