class aws_cdk.aws_cognito.UserPoolClient(scope, id, *, user_pool, access_token_validity=None, auth_flows=None, disable_o_auth=None, generate_secret=None, id_token_validity=None, o_auth=None, prevent_user_existence_errors=None, refresh_token_validity=None, supported_identity_providers=None, user_pool_client_name=None)

Bases: aws_cdk.core.Resource

Define a UserPool App Client.

  • scope (Construct) –

  • id (str) –

  • user_pool (IUserPool) – The UserPool resource this client will have access to.

  • access_token_validity (Optional[Duration]) – Validity of the access token. Values between 5 minutes and 1 day are valid. The duration can not be longer than the refresh token validity. Default: Duration.minutes(60)

  • auth_flows (Optional[AuthFlow]) – The set of OAuth authentication flows to enable on the client. Default: - all auth flows disabled

  • disable_o_auth (Optional[bool]) – Turns off all OAuth interactions for this client. Default: false

  • generate_secret (Optional[bool]) – Whether to generate a client secret. Default: false

  • id_token_validity (Optional[Duration]) – Validity of the ID token. Values between 5 minutes and 1 day are valid. The duration can not be longer than the refresh token validity. Default: Duration.minutes(60)

  • o_auth (Optional[OAuthSettings]) – OAuth settings for this to client to interact with the app. An error is thrown when this is specified and disableOAuth is set. Default: - see defaults in OAuthSettings. meaningless if disableOAuth is set.

  • prevent_user_existence_errors (Optional[bool]) – Whether Cognito returns a UserNotFoundException exception when the user does not exist in the user pool (false), or whether it returns another type of error that doesn’t reveal the user’s absence. Default: true for new stacks

  • refresh_token_validity (Optional[Duration]) – Validity of the refresh token. Values between 60 minutes and 10 years are valid. Default: Duration.days(30)

  • supported_identity_providers (Optional[List[UserPoolClientIdentityProvider]]) – The list of identity providers that users should be able to use to sign in using this client. Default: - supports all identity providers that are registered with the user pool. If the user pool and/or identity providers are imported, either specify this option explicitly or ensure that the identity providers are registered with the user pool using the UserPool.registerIdentityProvider() API.

  • user_pool_client_name (Optional[str]) – Name of the application client. Default: - cloudformation generated name



Returns a string representation of this construct.

Return type




The environment this resource belongs to.

For resources that are created and managed by the CDK (generally, those created by creating new class instances like Role, Bucket, etc.), this is always the same as the environment of the stack they belong to; however, for imported resources (those obtained from static methods like fromRoleArn, fromBucketName, etc.), that might be different than the stack they were imported into.

Return type



The construct tree node associated with this construct.

Return type



The OAuth flows enabled for this client.

Return type



The stack in which this resource is defined.

Return type



Name of the application client.

Return type



The client name that was specified via the userPoolClientName property during initialization, throws an error otherwise.

Return type


Static Methods

classmethod from_user_pool_client_id(scope, id, user_pool_client_id)

Import a user pool client given its id.

  • scope (Construct) –

  • id (str) –

  • user_pool_client_id (str) –

Return type


classmethod is_construct(x)

Return whether the given object is a Construct.


x (Any) –

Return type