Complete Guide to Amazon Cognito for WordPress with Gatey

The model

Separate WordPress content management from customer identity.

01 · Concepts

Which Cognito components matter for a WordPress project?

A User Pool is the account directory and authentication service. It controls sign-up, sign-in, password recovery, MFA, standard and custom attributes, groups, and federation with external identity providers.

An app client defines how the browser application uses the User Pool. For a frontend-only WordPress integration, use an app client that does not generate a client secret. An Identity Pool is optional and becomes relevant when authenticated users need temporary AWS credentials for signed calls to AWS services.

• User Pool: accounts, policies, groups, federation, and JWT tokens.
• App client: allowed browser flows, callbacks, scopes, and token behavior.
• Identity Pool: temporary AWS credentials for IAM-authorized access.

Keeping these roles distinct makes the integration easier to secure and explain.

02 · Setup

How do you connect Gatey to a Cognito User Pool?

Install Gatey, open its settings under the SmartCloud admin menu, and provide the User Pool ID, app client ID, and AWS region. Then create a WordPress page and add the Gatey Authenticator block for sign-in, registration, password recovery, MFA, or account editing.

Choose a clear default screen and language, then verify that callback and sign-out URLs in Cognito match the actual site routes. If hosted federation is used, configure the Cognito domain and enable the required providers on the app client.

• Use a no-secret app client for browser-based flows.
• Match callback and sign-out URLs exactly, including scheme and path.
• Test sign-up, confirmation, sign-in, password recovery, and sign-out separately.

Start with the smallest working flow before adding custom fields, external providers, groups, or API permissions.

03 · Experience

What does Gatey add beyond a basic login form?

Gatey provides a reusable authentication experience for Gutenberg, Elementor, and shortcode-based layouts. It includes sign-in, sign-up, MFA, password reset, profile editing, account attributes, and 22 built-in interface languages with a custom translation option.

The plugin can also expose account information inside page layouts and control frontend behavior based on authenticated state, attributes, or groups. Because the authentication flow runs in the browser, the same approach can continue to work after a static export.

• Use the Authenticator block for account journeys.
• Use Account Attribute blocks for profile-aware page content.
• Use custom translations and direction settings for multilingual sites.

The WordPress page remains editable while Cognito remains the source of truth for identity.

04 · API access

How should authenticated users reach protected APIs?

Cognito issues ID and access tokens that can be validated by a protected API. This is the natural choice when authorization depends on claims, scopes, groups, or the identity of the signed-in user.

For direct AWS calls from the browser, an Identity Pool can exchange the authenticated session for temporary IAM credentials. Those credentials should assume narrowly scoped roles that allow only the required API Gateway methods or AWS resources.

• Use JWT authorization for application APIs that understand Cognito tokens.
• Use temporary IAM credentials only when SigV4 access is required.
• Keep public, authenticated, and administrative routes separate.

Authentication proves who the user is; authorization still needs an explicit rule for what that user may do.