OAuthSettings Struct
OAuth settings to configure the interaction between the app and this client.
Example
ts
const pool = new cognito.UserPool(this, 'Pool');
const readOnlyScope = new cognito.ResourceServerScope({ scopeName: 'read', scopeDescription: 'Read-only access' });
const fullAccessScope = new cognito.ResourceServerScope({ scopeName: '*', scopeDescription: 'Full access' });
const userServer = pool.addResourceServer('ResourceServer', {
identifier: 'users',
scopes: [ readOnlyScope, fullAccessScope ],
});
const readOnlyClient = pool.addClient('read-only-client', {
// ...
oAuth: {
// ...
scopes: [ cognito.OAuthScope.resourceServer(userServer, readOnlyScope) ],
},
});
const fullAccessClient = pool.addClient('full-access-client', {
// ...
oAuth: {
// ...
scopes: [ cognito.OAuthScope.resourceServer(userServer, fullAccessScope) ],
},
});
Properties
callbackUrlsoptionalstring[]callback_urlsoptionaltyping.List[str]callbackUrlsoptionalList<String>CallbackUrlsoptionalstring[]CallbackUrlsoptional*[]*string#List of allowed redirect URLs for the identity providers.
Default: ['https://example.com'] if either authorizationCodeGrant or implicitCodeGrant flows are enabled, no callback URLs otherwise.
defaultRedirectUrioptionalstringdefault_redirect_urioptionalstrdefaultRedirectUrioptionalStringDefaultRedirectUrioptionalstringDefaultRedirectUrioptional*string#The default redirect URI. Must be in the `callbackUrls` list.
Default: no default redirect URI
A redirect URI must:
- Be an absolute URI
- Be registered with the authorization server.
- Not include a fragment component.
flowsoptionalOAuthFlowsflowsoptionalOAuthFlowsflowsoptionalOAuthFlowsFlowsoptionalOAuthFlowsFlowsoptionalOAuthFlows#OAuth flows that are allowed with this client.
Default: {authorizationCodeGrant:true,implicitCodeGrant:true}
logoutUrlsoptionalstring[]logout_urlsoptionaltyping.List[str]logoutUrlsoptionalList<String>LogoutUrlsoptionalstring[]LogoutUrlsoptional*[]*string#List of allowed logout URLs for the identity providers.
Default: no logout URLs
scopesoptionalOAuthScope[]scopesoptionaltyping.List[OAuthScope]scopesoptionalList<OAuthScope>ScopesoptionalOAuthScope[]Scopesoptional*[]OAuthScope#OAuth scopes that are allowed with this client.
Default: [OAuthScope.PHONE,OAuthScope.EMAIL,OAuthScope.OPENID,OAuthScope.PROFILE,OAuthScope.COGNITO_ADMIN]