Introduction

If users can sign in with multiple Google accounts, it is often better to force Google's account chooser instead of silently reusing whichever session is already active in the browser. In Amazon Cognito, the practical way to do that is to send prompt=select_account on the authorization request that redirects the user to Google.

The Parameter That Controls Account Selection

Google supports the OpenID Connect prompt parameter, and the value select_account tells Google to show the account picker. Cognito can forward that parameter when the user is being redirected to a third-party identity provider such as Google.

The important detail is where you put it: on the Cognito /oauth2/authorize request, not on some later callback.

At a high level, the URL looks like this:

1https://your-domain.auth.us-east-1.amazoncognito.com/oauth2/authorize
2  ?response_type=code
3  &client_id=YOUR_APP_CLIENT_ID
4  &redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback
5  &scope=openid+email+profile
6  &identity_provider=Google
7  &prompt=select_account

When Cognito redirects to Google, the prompt=select_account value is forwarded so Google shows the chooser instead of silently continuing with the existing account session.

A Browser Redirect Example

If you are building your own sign-in button instead of relying entirely on a framework helper, constructing the authorize URL yourself is often the clearest option.

1const domain = "https://your-domain.auth.us-east-1.amazoncognito.com";
2
3const params = new URLSearchParams({
4  response_type: "code",
5  client_id: "YOUR_APP_CLIENT_ID",
6  redirect_uri: "https://app.example.com/callback",
7  scope: "openid email profile",
8  identity_provider: "Google",
9  prompt: "select_account",
10});
11
12window.location.href = `${domain}/oauth2/authorize?${params.toString()}`;

This is the core behavior. Everything else is normal OAuth and Cognito configuration: your app client, callback URL, scopes, and Google identity provider setup still need to be correct.

Managed Login Versus Classic Hosted UI

One detail that matters in newer Cognito setups is the login experience version. The prompt behavior is documented for managed login. If you are using older classic hosted UI behavior, you should verify whether your current branding and flow support forwarding the parameter as expected.

In practice, if you control the authorize URL and you are sending users through the modern Cognito authorization endpoint with Google as the identity provider, prompt=select_account is the setting to reach for.

Related Parameters and Tradeoffs

Do not confuse prompt=select_account with prompt=login.

• 'select_account asks the provider to show the account chooser.'
• 'login asks for fresh authentication.'

Sometimes you want both behaviors, but they solve different problems. If your issue is "users keep landing in the wrong Google account," select_account is the relevant parameter.

Also avoid passing login_hint if you want a real chooser experience. A login hint nudges the provider toward a specific identity, which can reduce or bypass the account-selection step.

Common Pitfalls

The most common mistake is trying to configure this only inside Google or only inside Cognito console settings. The account chooser is controlled by the request sent during the authorization flow, so the parameter must be present on the authorize request.

Another mistake is assuming a local Cognito sign-in setting can force Google behavior. Account selection happens at the external identity provider, so the request has to reach Google with the right parameter.

Developers also sometimes forget identity_provider=Google. If you want to skip Cognito's provider picker and go directly to Google, include that parameter explicitly.

Finally, if the behavior still looks inconsistent, check whether an old implementation path is being used. A framework helper, older hosted UI configuration, or cached redirect URL may be dropping the prompt parameter before the user reaches Google.

Summary

• Use prompt=select_account on the Cognito /oauth2/authorize request to force Google account selection.
• Include identity_provider=Google when you want to go straight to Google sign-in.
• Put the parameter on the initial authorization redirect, not on the callback.
• Do not confuse select_account with login, and avoid login_hint when you want the chooser.
• If it does not work, verify that your app is using the expected Cognito login flow and is preserving the query parameter.