Registry /
aws / cognito-passport-oauth2
Install & Compatibility
Where this runs
No compatibility data collected yet for this library.
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
CognitoOAuth2Strategy
✓ import { CognitoOAuth2Strategy } from 'cognito-passport-oauth2'
✗ const CognitoOAuth2Strategy = require('cognito-passport-oauth2');
ESM import available; avoid mixing require() in ESM files. The default export is the strategy class.
CognitoOAuth2Strategy
✓ const { CognitoOAuth2Strategy } = require('cognito-passport-oauth2')
✗ const CognitoOAuth2Strategy = require('cognito-passport-oauth2').default
CommonJS destructured import is correct. The library exports the class directly, not as a default export.
Strategy
✓ import { CognitoOAuth2Strategy as Strategy } from 'cognito-passport-oauth2'
✗ import Strategy from 'cognito-passport-oauth2'
No default export; use named import with alias to mimic common pattern.
Shows Express app setup with Passport, Cognito OAuth2 strategy, session handling, and route configuration.
import express from 'express';
import passport from 'passport';
import { CognitoOAuth2Strategy } from 'cognito-passport-oauth2';
import session from 'express-session';
const app = express();
app.use(session({ secret: 'your-secret', resave: false, saveUninitialized: true }));
app.use(passport.initialize());
app.use(passport.session());
passport.serializeUser((user, done) => done(null, user));
passport.deserializeUser((user, done) => done(null, user));
const options = {
callbackURL: 'http://localhost:4001/auth/callback',
clientDomain: 'https://yourdomain.auth.eu-west-1.amazoncognito.com',
clientID: process.env.COGNITO_CLIENT_ID ?? '',
clientSecret: process.env.COGNITO_CLIENT_SECRET ?? '',
region: 'eu-west-1',
passReqToCallback: true
};
async function verify(req, accessToken, refreshToken, profile, done) {
// Custom user logic here
return done(null, { username: profile.username });
}
passport.use('cognito', new CognitoOAuth2Strategy(options, verify));
app.get('/auth/login', passport.authenticate('cognito'));
app.get('/auth/callback', passport.authenticate('cognito', { failureRedirect: '/login', successRedirect: '/' }));
app.listen(3000);
Errors
Common errors & fixes
CognitoOAuth2Strategy is not a constructor
Using CommonJS require without destructuring, e.g., const CognitoOAuth2Strategy = require('cognito-passport-oauth2'); returns the module object, not the class directly.
fixUse const { CognitoOAuth2Strategy } = require('cognito-passport-oauth2'); to destructure the named export. Error: Unsupported grant type: authorization_code
Missing or incorrect client_id or client_secret; or using wrong clientDomain.
fixVerify that clientID, clientSecret, and clientDomain are correct and that the app client has authorization_code grant enabled.
TypeError: Cannot destructure property 'id_token' of 'undefined' or 'null'.
Using the 5-argument verify signature but the strategy expects a 4-argument signature (older version) or the token object is not provided.
fixEnsure you are using version >=1.2 and the verify function signature matches: verify(req, accessToken, refreshToken, { id_token }, profile, done) if you need id_token. Audit
Dependencies
passport-oauth2requiredExtends the OAuth2 strategy; required for token exchange and authorization
passportrequiredPassport authentication framework; must be installed separately