Introduction

The Cognito error about a token not being from a supported provider usually means the identity pool does not recognize the issuer behind the token you supplied. In practice, the problem is often a mismatch between the token source and the Logins map key, the wrong user pool or region, or an identity pool that was never configured to trust that provider.

Understand the Two Cognito Systems

AWS Cognito has two different concepts that people often blur together:

• User Pools, which authenticate users and issue tokens
• Identity Pools, which exchange trusted identities for temporary AWS credentials

The error happens at the identity-pool step. Your app has a token, but Cognito Identity says, in effect, "I do not know this provider for this pool."

The Logins Key Must Match the Provider Exactly

When you call Cognito Identity APIs, the Logins map key must match the provider identifier expected by the identity pool.

For a Cognito User Pool token, the key is typically:

cognito-idp.<region>.amazonaws.com/<userPoolId>

Example in JavaScript:

const logins = {
  "cognito-idp.us-east-1.amazonaws.com/us-east-1_ABC123": idToken,
};

If you use the wrong region, the wrong user pool ID, or a provider key such as accounts.google.com for a Cognito token, the identity pool rejects it with this error.

The Identity Pool Must Trust That Provider

Even if the Logins key is correct, the identity pool itself must be configured to accept that provider.

For a Cognito User Pool token, verify that the identity pool is configured with:

• the correct user pool ID
• the correct app client ID
• the correct region

For third-party providers such as Google or Facebook, make sure the provider is explicitly enabled in the identity pool settings.

A Typical Cognito User Pool Example

1import { CognitoIdentityClient, GetIdCommand } from "@aws-sdk/client-cognito-identity";
2
3const client = new CognitoIdentityClient({ region: "us-east-1" });
4
5const command = new GetIdCommand({
6  IdentityPoolId: "us-east-1:11111111-2222-3333-4444-555555555555",
7  Logins: {
8    "cognito-idp.us-east-1.amazonaws.com/us-east-1_ABC123": idToken,
9  },
10});
11
12const response = await client.send(command);
13console.log(response.IdentityId);

If the token came from a different user pool or a different region than the key indicates, GetId fails.

Check the Token Type Too

Make sure you are passing the right token. For Cognito User Pools, this is usually the ID token or sometimes the access token depending on the integration pattern, but the token still has to come from the provider configured in the identity pool.

If the token issuer claim points somewhere unexpected, the identity pool will not treat it as a trusted provider for that pool.

Common Pitfalls

The biggest pitfall is using the wrong Logins key string. The provider identifier must match exactly, including region and user pool ID.

Another issue is mixing up two different user pools or app clients between environments such as dev and prod. The token may be valid, but not for the identity pool you are calling.

Developers also sometimes assume any Cognito token works with any Cognito identity pool. It does not. The trust relationship must be configured explicitly.

Finally, do not debug only on the identity-pool side. Decode the token and confirm its issuer, audience, and region actually match the expected provider.

Summary

• This error means the identity pool does not recognize the provider behind the token you supplied.
• Check that the Logins key exactly matches the configured provider identifier.
• Make sure the identity pool trusts the correct user pool, app client, and region.
• Verify that the token really comes from the provider and environment you think it does.
• Most fixes come from correcting provider mapping, not from regenerating the token blindly.