AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.
Container for the parameters to the CreateUserPoolClient operation. Creates the user pool client.
When you create a new user pool client, token revocation is automatically activated. For more information about revoking tokens, see RevokeToken.
If you don't provide a value for an attribute, Amazon Cognito sets it to its default value.
Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy.
Learn more
Namespace: Amazon.CognitoIdentityProvider.Model
Assembly: AWSSDK.CognitoIdentityProvider.dll
Version: 3.x.y.z
public class CreateUserPoolClientRequest : AmazonCognitoIdentityProviderRequest IAmazonWebServiceRequest
The CreateUserPoolClientRequest type exposes the following members
Name | Description | |
---|---|---|
CreateUserPoolClientRequest() |
Name | Type | Description | |
---|---|---|---|
AccessTokenValidity | System.Int32 |
Gets and sets the property AccessTokenValidity.
The access token time limit. After this limit expires, your user can't use their access
token. To specify the time unit for
For example, when you set
The default time unit for If you don't specify otherwise in the configuration of your app client, your access tokens are valid for one hour. |
|
AllowedOAuthFlows | System.Collections.Generic.List<System.String> |
Gets and sets the property AllowedOAuthFlows.
The OAuth grant types that you want your app client to generate. To create an app
client that generates client credentials grants, you must add
|
|
AllowedOAuthFlowsUserPoolClient | System.Boolean |
Gets and sets the property AllowedOAuthFlowsUserPoolClient.
Set to
To use OAuth 2.0 features, configure one of these features in the Amazon Cognito console
or set |
|
AllowedOAuthScopes | System.Collections.Generic.List<System.String> |
Gets and sets the property AllowedOAuthScopes.
The allowed OAuth scopes. Possible values provided by OAuth are |
|
AnalyticsConfiguration | Amazon.CognitoIdentityProvider.Model.AnalyticsConfigurationType |
Gets and sets the property AnalyticsConfiguration. The user pool analytics configuration for collecting metrics and sending them to your Amazon Pinpoint campaign. In Amazon Web Services Regions where Amazon Pinpoint isn't available, user pools only support sending events to Amazon Pinpoint projects in Amazon Web Services Region us-east-1. In Regions where Amazon Pinpoint is available, user pools support sending events to Amazon Pinpoint projects within that same Region. |
|
AuthSessionValidity | System.Int32 |
Gets and sets the property AuthSessionValidity.
Amazon Cognito creates a session token for each API request in an authentication flow.
|
|
CallbackURLs | System.Collections.Generic.List<System.String> |
Gets and sets the property CallbackURLs. A list of allowed redirect (callback) URLs for the IdPs. A redirect URI must:
See OAuth 2.0 - Redirection Endpoint. Amazon Cognito requires HTTPS over HTTP except for http://localhost for testing purposes only. App callback URLs such as myapp://example are also supported. |
|
ClientName | System.String |
Gets and sets the property ClientName. The client name for the user pool client you would like to create. |
|
DefaultRedirectURI | System.String |
Gets and sets the property DefaultRedirectURI.
The default redirect URI. In app clients with one assigned IdP, replaces A redirect URI must:
For more information, see Default redirect URI. Amazon Cognito requires HTTPS over HTTP except for http://localhost for testing purposes only. App callback URLs such as myapp://example are also supported. |
|
EnablePropagateAdditionalUserContextData | System.Boolean |
Gets and sets the property EnablePropagateAdditionalUserContextData.
Activates the propagation of additional user context data. For more information about
propagation of user context data, see
Adding advanced security to a user pool. If you don’t include this parameter,
you can't send device fingerprint information, including source IP address, to Amazon
Cognito advanced security. You can only activate |
|
EnableTokenRevocation | System.Boolean |
Gets and sets the property EnableTokenRevocation. Activates or deactivates token revocation. For more information about revoking tokens, see RevokeToken. If you don't include this parameter, token revocation is automatically activated for the new user pool client. |
|
ExplicitAuthFlows | System.Collections.Generic.List<System.String> |
Gets and sets the property ExplicitAuthFlows. The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in your users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and password, or a custom authentication process that you define with Lambda functions.
If you don't specify a value for Valid values include:
In some environments, you will see the values |
|
GenerateSecret | System.Boolean |
Gets and sets the property GenerateSecret. Boolean to specify whether you want to generate a secret for the user pool client being created. |
|
IdTokenValidity | System.Int32 |
Gets and sets the property IdTokenValidity.
The ID token time limit. After this limit expires, your user can't use their ID token.
To specify the time unit for
For example, when you set
The default time unit for If you don't specify otherwise in the configuration of your app client, your ID tokens are valid for one hour. |
|
LogoutURLs | System.Collections.Generic.List<System.String> |
Gets and sets the property LogoutURLs. A list of allowed logout URLs for the IdPs. |
|
PreventUserExistenceErrors | Amazon.CognitoIdentityProvider.PreventUserExistenceErrorTypes |
Gets and sets the property PreventUserExistenceErrors.
Errors and responses that you want Amazon Cognito APIs to return during authentication,
account confirmation, and password recovery when the user doesn't exist in the user
pool. When set to Valid values include:
Defaults to |
|
ReadAttributes | System.Collections.Generic.List<System.String> |
Gets and sets the property ReadAttributes. The list of user attributes that you want your app client to have read access to. After your user authenticates in your app, their access token authorizes them to read their own attribute value for any attribute in this list. An example of this kind of activity is when your user selects a link to view their profile information. Your app makes a GetUser API request to retrieve and display your user's profile data.
When you don't specify the |
|
RefreshTokenValidity | System.Int32 |
Gets and sets the property RefreshTokenValidity.
The refresh token time limit. After this limit expires, your user can't use their
refresh token. To specify the time unit for
For example, when you set
The default time unit for If you don't specify otherwise in the configuration of your app client, your refresh tokens are valid for 30 days. |
|
SupportedIdentityProviders | System.Collections.Generic.List<System.String> |
Gets and sets the property SupportedIdentityProviders.
A list of provider names for the identity providers (IdPs) that are supported on this
client. The following are supported: |
|
TokenValidityUnits | Amazon.CognitoIdentityProvider.Model.TokenValidityUnitsType |
Gets and sets the property TokenValidityUnits. The units in which the validity times are represented. The default unit for RefreshToken is days, and default for ID and access tokens are hours. |
|
UserPoolId | System.String |
Gets and sets the property UserPoolId. The user pool ID for the user pool where you want to create a user pool client. |
|
WriteAttributes | System.Collections.Generic.List<System.String> |
Gets and sets the property WriteAttributes.
The list of user attributes that you want your app client to have write access to.
After your user authenticates in your app, their access token authorizes them to set
or modify their own attribute value for any attribute in this list. An example of
this kind of activity is when you present your user with a form to update their profile
information and they change their last name. Your app then makes an UpdateUserAttributes
API request and sets
When you don't specify the If your app client allows users to sign in through an IdP, this array must include all attributes that you have mapped to IdP attributes. Amazon Cognito updates mapped attributes when users sign in to your application through an IdP. If your app client does not have write access to a mapped attribute, Amazon Cognito throws an error when it tries to update the attribute. For more information, see Specifying IdP Attribute Mappings for Your user pool. |
The following example creates an app client with all configurable properties set to an example value. The resulting user pool client connects to an analytics client, allows sign-in with username and password, and has two external identity providers associated with it.
var client = new AmazonCognitoIdentityProviderClient(); var response = client.CreateUserPoolClient(new CreateUserPoolClientRequest { AccessTokenValidity = 6, AllowedOAuthFlows = new List<string> { "code" }, AllowedOAuthFlowsUserPoolClient = true, AllowedOAuthScopes = new List<string> { "aws.cognito.signin.user.admin", "openid" }, AnalyticsConfiguration = new AnalyticsConfigurationType { ApplicationId = "d70b2ba36a8c4dc5a04a0451a31a1e12", ExternalId = "my-external-id", RoleArn = "arn:aws:iam::123456789012:role/test-cognitouserpool-role", UserDataShared = true }, CallbackURLs = new List<string> { "https://example.com", "http://localhost", "myapp://example" }, ClientName = "my-test-app-client", DefaultRedirectURI = "https://example.com", ExplicitAuthFlows = new List<string> { "ALLOW_ADMIN_USER_PASSWORD_AUTH", "ALLOW_USER_PASSWORD_AUTH", "ALLOW_REFRESH_TOKEN_AUTH" }, GenerateSecret = true, IdTokenValidity = 6, LogoutURLs = new List<string> { "https://example.com/logout" }, PreventUserExistenceErrors = "ENABLED", ReadAttributes = new List<string> { "email", "address", "preferred_username" }, RefreshTokenValidity = 6, SupportedIdentityProviders = new List<string> { "SignInWithApple", "MySSO" }, TokenValidityUnits = new TokenValidityUnitsType { AccessToken = "hours", IdToken = "minutes", RefreshToken = "days" }, UserPoolId = "us-east-1_EXAMPLE", WriteAttributes = new List<string> { "family_name", "email" } }); UserPoolClientType userPoolClient = response.UserPoolClient;
.NET:
Supported in: 8.0 and newer, Core 3.1
.NET Standard:
Supported in: 2.0
.NET Framework:
Supported in: 4.5 and newer, 3.5