# UserPoolClientOptions

Options to create a UserPoolClient.

- Source: [`aws-cognito/lib/user-pool-client.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-cognito/lib/user-pool-client.ts#L243)
- Type last changed: v2.214.0 · 2 Sep 2025

## Example

```ts
const pool = new cognito.UserPool(this, 'Pool');
pool.addClient('app-client', {
  oAuth: {
    flows: {
      authorizationCodeGrant: true,
    },
    scopes: [ cognito.OAuthScope.OPENID ],
    callbackUrls: [ 'https://my-app-domain.com/welcome' ],
    logoutUrls: [ 'https://my-app-domain.com/signin' ],
  },
});
```

## Properties

- `accessTokenValidity`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.minutes(60) — Validity of the access token.

  Values between 5 minutes and 1 day are valid. The duration cannot be longer than the refresh token validity.

- `analytics`: [AnalyticsConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.AnalyticsConfiguration.html) — The analytics configuration for this client.

  **Default:** no analytics configuration

- `authFlows`: [AuthFlow](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.AuthFlow.html) — The set of OAuth authentication flows to enable on the client.

  **Default:** If you don't specify a value, your user client supports ALLOW_REFRESH_TOKEN_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_CUSTOM_AUTH.

- `authSessionValidity`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.minutes(3) — Cognito creates a session token for each API request in an authentication flow.

  AuthSessionValidity is the duration, in minutes, of that session token.
  see defaults in `AuthSessionValidity`. Valid duration is from 3 to 15 minutes.

- `disableOAuth`: boolean = false — Turns off all OAuth interactions for this client.

- `enablePropagateAdditionalUserContextData`: boolean — Enable the propagation of additional user context data.

  **Default:** false for new user pool clients

  You can only activate enablePropagateAdditionalUserContextData in an app client that has a client secret.

- `enableTokenRevocation`: boolean — Enable token revocation for this client.

  **Default:** true for new user pool clients

- `generateSecret`: boolean = false — Whether to generate a client secret.

- `idTokenValidity`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.minutes(60) — Validity of the ID token.

  Values between 5 minutes and 1 day are valid. The duration cannot be longer than the refresh token validity.

- `oAuth`: [OAuthSettings](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.OAuthSettings.html) — OAuth settings for this client to interact with the app.

  **Default:** see defaults in `OAuthSettings`. meaningless if `disableOAuth` is set.

  An error is thrown when this is specified and `disableOAuth` is set.

- `preventUserExistenceErrors`: boolean = false — Whether Cognito returns a UserNotFoundException exception when the user does not exist in the user pool (false), or whether it returns another type of error that doesn't reveal the user's absence.

- `readAttributes`: [ClientAttributes](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.ClientAttributes.html) — The set of attributes this client will be able to read.

  **Default:** all standard and custom attributes

- `refreshTokenRotationGracePeriod`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) — Enables refresh token rotation when set.

  **Default:** undefined (refresh token rotation is disabled)

  Defines the grace period for the original refresh token (0-60 seconds).

- `refreshTokenValidity`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.days(30) — Validity of the refresh token.

  Values between 60 minutes and 10 years are valid.

- `supportedIdentityProviders`: [UserPoolClientIdentityProvider](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.UserPoolClientIdentityProvider.html)[] — The list of identity providers that users should be able to use to sign in using this client.

  **Default:** supports all identity providers that are registered with the user pool. If the user pool and/or identity providers are imported, either specify this option explicitly or ensure that the identity providers are registered with the user pool using the `UserPool.registerIdentityProvider()` API.

- `userPoolClientName`: string — Name of the application client.

  **Default:** cloudformation generated name

- `writeAttributes`: [ClientAttributes](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.ClientAttributes.html) — The set of attributes this client will be able to write.

  **Default:** all standard and custom attributes