Skip to main content
This guide walks through configuring Amazon Cognito as an OIDC identity provider for Modelcode SSO. Cognito User Pools natively support OpenID Connect.

​
Prerequisites

  • Admin access to your Modelcode organization, signed in with email and password — the SSO settings page is not available to users who signed in with a social provider (GitHub, GitLab, Microsoft)
  • An AWS account with access to Amazon Cognito
  • Privileges to create and edit app clients and policies in your Cognito User Pool

​
Step 1: Create an App Client in Cognito

  1. In the AWS Console, navigate to Amazon Cognito → User Pools
  2. Select your User Pool (or create a new one)
  3. Go to App integration → App clients and analytics
  4. Click Create app client
  5. Configure the app client:
  1. Under Hosted UI settings, configure:
The Callback URL is displayed on the Modelcode SSO settings page when you select OpenID Connect.
  1. Click Create app client
  2. After creation, note the Client ID and Client Secret from the app client details

​
Step 2: Find Your Cognito Issuer URL

The Cognito Issuer URL follows this format:
To find your values:
  1. In the Cognito console, go to your User Pool
  2. The User Pool ID is displayed on the overview page (e.g., us-east-1_aBcDeFgHi)
  3. The Region is the AWS region where your User Pool is hosted (e.g., us-east-1)
For example, if your User Pool ID is us-east-1_aBcDeFgHi, the Issuer URL is:
You can verify the discovery document is available by visiting:

​
Step 3: Configure OIDC in Modelcode

  1. In Modelcode, navigate to Single Sign-On in the sidebar
  2. Click Setup SSO (or Edit if updating)
  3. Select OpenID Connect as the protocol
  4. Enter the following:
  1. Click Verify & Save
Modelcode validates the configuration by fetching the Cognito OIDC discovery document.

​
Step 4: Update the Callback URL in Cognito

After configuring, verify the Callback URL displayed on the Modelcode SSO settings page matches the Allowed callback URL in your Cognito app client. Update the Cognito app client if needed. Before users can sign in via SSO, they must be invited to Modelcode:
  1. In Modelcode, go to the Members page and invite each user who needs SSO access
  2. Copy the Portal Link from the SSO settings page and share it with your team:
When team members visit this link, they are redirected to the Cognito hosted UI (or your custom UI domain) to sign in, then returned to Modelcode with an active session.

​
Troubleshooting

​
”Verification failed” during setup

  • Confirm the Issuer URL follows the format https://cognito-idp.<region>.amazonaws.com/<user-pool-id>
  • Verify the User Pool ID and region are correct
  • Access the discovery URL in your browser to confirm it returns a JSON document

​
Users see “redirect_mismatch” error

  • The Callback URL in Cognito must exactly match the Callback URL shown in Modelcode — including the protocol, domain, and path
  • Check for trailing slashes or other differences

​
Users authenticate but are not recognized in Modelcode

  • Ensure the user’s email in Cognito matches their Modelcode account email
  • Verify the email attribute is configured and populated for users in the Cognito User Pool
  • Confirm the email scope is included in the app client’s allowed scopes
  • Ensure users are accessing Modelcode through the Portal Link, not the standard login page

​
Users see the Cognito hosted UI instead of a custom login page

  • If you’ve configured a custom domain for your Cognito User Pool, it should work automatically with OIDC
  • The Cognito hosted UI is the default authentication interface when no custom UI is configured