AWS Cognito
Configure Cognito User Pools, Identity Pools, and the secure Steam exchange
AWS Cognito
AWSIKCognito registers two separate identity authorities:
- Cognito User Pool owns application-user sessions and exposes managed login, password, SRP, email/SMS OTP, MFA, passkey, and custom-challenge routes.
- Cognito Identity Pool exchanges Google or Apple tokens, or project-verified Steam proof, for temporary AWS credentials. Your product decides whether that ID is also the primary player account.
Configure Project Settings > Betide > Crossplay > AWS Cognito. User Pool routes require UserPoolId and UserPoolClientId; managed login also requires the domain and redirect URI. Identity Pool routes require IdentityPoolId. Never put an app client secret, AWS access key, password, authorization code, proof, or exchange bearer in Unreal config.
Steam exchange
Cognito does not natively verify Steam tickets. Deploy the SAM app in Scripts/awsik/cognito-steam-exchange/:
-
Create a Secrets Manager secret for the Steam publisher Web API key and another containing a random 32-byte exchange bearer.
-
Enable developer-authenticated identities on the target Identity Pool.
-
From
Scripts/awsik/cognito-steam-exchange/, runsam build, then:sam deploy --guided \ --parameter-overrides IdentityPoolId=REGION:UUID SteamAppId=APP_ID SteamTicketAudience=YOUR_IDENTITY SteamPublisherKeySecretArn=ARN ExchangeAuthorizationSecretArn=ARN -
Copy the stack's
ExchangeEndpointoutput into the AWS Cognito settings and set the identicalSteamTicketAudience. -
Put the bearer value in the environment variable named by
ExchangeAuthEnvironmentVariable(defaultAWSIK_COGNITO_EXCHANGE_AUTH) before launching the game. -
Run
python -m unittest discover -s testsin the exchange directory before deployment.
The endpoint requires authenticated HTTPS, verifies the ticket against Steam, maps the verified Steam ID to a developer identity, and calls Cognito only on the trusted backend. It rejects replay, wrong audience, expired proof, malformed tickets, another Steam app, and missing or incorrect endpoint authentication. Tickets and request bodies are never logged.
After setup, select Betide.Cognito.IdentityPool.SteamExchange in the guided Login node or from Get Login Methods. UCIK obtains a Web API ticket for the configured audience, calls the exchange, consumes the returned short-lived OpenID proof, and releases the Steam ticket.