Auth
Auth gives users of your product an identity. Create a user pool, add an app client, sign those people in with an email code, and protect a Gateway route with the pool. They sign in to your application, not to Skippr Cloud.
People who operate this Skippr Cloud account use Cloud User Directory instead.
Status: Preview. See API actions for the full command list.
What you can do
- Create a user pool for the people who use your SaaS app, mobile app, or portal.
- Add an app client for the application that will sign those users in.
- Sign a pool user in with an email code and receive a token for your app.
- Attach the pool to a Gateway authorizer so only those users can call a route.
If your product has more than one customer, keep that tenancy in your app — for example an org id on the pool user — and enforce it in your functions. App user pools do not create extra Skippr Cloud accounts.
Before you start
Sign in to this Cloud account with skippr-cloud login. See Cloud User Directory.
Create a pool and an app client
skippr-cloud auth create-user-pool --name customers
skippr-cloud auth list-user-poolsSave the returned poolId. Then add an app client for the application that will sign users in:
skippr-cloud auth create-app-client --input - <<JSON
{
"poolId": "<poolId>",
"name": "web",
"callbackUrls": ["https://app.example.com/callback"]
}
JSONSign pool users in
Users of that pool sign in with an email code:
skippr-cloud auth pool-sign-in --pool-id '<poolId>' --email user@example.com
skippr-cloud auth pool-confirm --pool-id '<poolId>' --email user@example.com --code '<code>' --app-client-id '<clientId>'pool-confirm returns tokens for that user in that pool. Refresh and sign out with skippr-cloud auth pool-refresh and skippr-cloud auth pool-logout.
Protect a Gateway route
skippr-cloud gateway create-authorizer --api-id '<apiId>' --authorizer-type USER_POOL --user-pool-id '<poolId>' --app-client-id '<clientId>'Only tokens from that pool (and client, when you set app-client-id) can call the route. See Gateway.
Manage pools
| Task | Command |
|---|---|
| List pools | skippr-cloud auth list-user-pools |
| Describe a pool | skippr-cloud auth describe-user-pool --pool-id '<poolId>' |
| Delete a pool | skippr-cloud auth delete-user-pool --pool-id '<poolId>' |
| List app clients | skippr-cloud auth list-app-clients --pool-id '<poolId>' |
| Describe an app client | skippr-cloud auth describe-app-client --pool-id '<poolId>' --client-id '<clientId>' |
| Delete an app client | skippr-cloud auth delete-app-client --pool-id '<poolId>' --client-id '<clientId>' |
Auth identifiers
| Identifier | What it identifies |
|---|---|
poolId | An app user pool |
clientId | An application in a pool |
| Pool user email | A person who signs in to your product |
Limits and errors
| Limit | Value |
|---|---|
| User pools per account | 25 |
| App clients per pool | 25 |
| Pool name | 128 characters; letters, numbers, spaces, _, and - |
| Callback URLs per client | 10 |
| OTP attempts per code | 5 |
| Access token lifetime | 15 minutes |
| Refresh token lifetime | 365 days |
- 400: the email, code, identifier, or request is invalid.
- 401: the pool session expired. Sign the pool user in again.
- 403: the signed-in Cloud account is not allowed to manage this pool.
- 404: the pool or client does not exist.
- 429: wait, then retry.
Email invites and signing pool users in with a company identity provider are coming soon.