Auth
Auth gives users of your product an identity. Create a user pool, add an app client, sign those people in with an email code, and protect a Gateway route with the pool. They sign in to your application, not to Skippr Cloud.
People who operate this Skippr Cloud account use Cloud User Directory instead.
Status: Preview. See API actions for the full command list.
What you can do
- Create a user pool for the people who use your SaaS app, mobile app, or portal.
- Add an app client for the application that will sign those users in.
- Sign a pool user in with an email code and receive a token for your app.
- Attach the pool to a Gateway authorizer so only those users can call a route.
If your product has more than one customer, keep that tenancy in your app — for example an org id on the pool user — and enforce it in your functions. App user pools do not create extra Skippr Cloud accounts.
Before you start
Sign in to this Cloud account with skippr login. See Cloud User Directory.
Create a pool and an app client
skippr auth create-user-pool --name customers
skippr auth list-user-poolsSave the returned poolId. Then add an app client for the application that will sign users in:
skippr auth create-app-client --input - <<JSON
{
"poolId": "<poolId>",
"name": "web",
"callbackUrls": ["https://app.example.com/callback"]
}
JSONSign pool users in
Users of that pool sign in with an email code:
skippr auth pool-sign-in --pool-id '<poolId>' --email user@example.com
skippr auth pool-confirm --pool-id '<poolId>' --email user@example.com --code '<code>' --app-client-id '<clientId>'pool-confirm returns tokens for that user in that pool. Refresh and sign out with skippr auth pool-refresh and skippr auth pool-logout.
Protect a Gateway route
skippr gateway create-authorizer --api-id '<apiId>' --authorizer-type USER_POOL --user-pool-id '<poolId>' --app-client-id '<clientId>'Only tokens from that pool (and client, when you set app-client-id) can call the route. See Gateway.
Manage pools
| Task | Command |
|---|---|
| List pools | skippr auth list-user-pools |
| Describe a pool | skippr auth describe-user-pool --pool-id '<poolId>' |
| Delete a pool | skippr auth delete-user-pool --pool-id '<poolId>' |
| List app clients | skippr auth list-app-clients --pool-id '<poolId>' |
| Describe an app client | skippr auth describe-app-client --pool-id '<poolId>' --client-id '<clientId>' |
| Delete an app client | skippr auth delete-app-client --pool-id '<poolId>' --client-id '<clientId>' |
Auth identifiers
| Identifier | What it identifies |
|---|---|
poolId | An app user pool |
clientId | An application in a pool |
| Pool user email | A person who signs in to your product |
Limits and errors
| Limit | Value |
|---|---|
| User pools per account | 25 |
| App clients per pool | 25 |
| Pool name | 128 characters; letters, numbers, spaces, _, and - |
| Callback URLs per client | 10 |
| OTP attempts per code | 5 |
| Access token lifetime | 15 minutes |
| Refresh token lifetime | 365 days |
- 400: the email, code, identifier, or request is invalid.
- 401: the pool session expired. Sign the pool user in again.
- 403: the signed-in Cloud account is not allowed to manage this pool.
- 404: the pool or client does not exist.
- 429: wait, then retry.
Email invites and signing pool users in with a company identity provider are coming soon.