Install & Compatibility
Where this runs
No compatibility data collected yet for this library.
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
CognitoAuth
✓ from fastapi_cognito import CognitoAuth
✗ from fastapi_cognito.cognito import CognitoAuth
Direct import from package is canonical and avoids import errors.
CognitoToken
✓ from fastapi_cognito import CognitoToken
Minimal setup: initialize CognitoAuth with userpool_id and app_client_id, then protect routes with Depends.
from fastapi import FastAPI, Depends
from fastapi_cognito import CognitoAuth, CognitoToken
import os
app = FastAPI()
# Configure
userpool_id = os.environ.get("COGNITO_USERPOOL_ID", "")
app_client_id = os.environ.get("COGNITO_APP_CLIENT_ID", "")
cognito_auth = CognitoAuth(
userpool_id=userpool_id,
app_client_id=app_client_id,
client_secret=None, # Optional
)
@app.get("/protected")
async def protected_route(auth: CognitoToken = Depends(cognito_auth.get_current_user)):
return {"message": "Authenticated", "username": auth.username}
Errors
Common errors & fixes
fastapi_cognito.exceptions.CognitoError: Unable to verify ID token
The region in userpool_id does not match the actual AWS region of the user pool.
fixVerify userpool_id format: <region>_<userPoolId>. Example: us-east-1_abc123.
fastapi_cognito.exceptions.CognitoError: Invalid access token
The access token is expired or from a different app client.
fixEnsure the token is fresh and originated from the configured app_client_id.
Upgrade
Version history
2.9.0latest on PyPI · released Apr 6, 2025
Audit
Dependencies
fastapirequiredRequired for FastAPI app integration
python-jose[cryptography]requiredRequired for JWT decoding
httpxrequiredRequired for JWKS fetch