cognitojwt

What it is and what it does

cognitojwt is a lightweight library for validating Amazon Cognito ID tokens by decoding and verifying JWT signatures. It wraps python-jose to handle the cryptographic operations and fetches AWS public key sets (JWKS) to validate token signatures. The library supports both synchronous (using requests) and asynchronous (using aiohttp) modes, letting you choose based on your application architecture.

The package is designed for applications that need to verify Cognito tokens locally without making additional AWS API calls. It handles signature validation, token expiration checks (with an optional test mode to disable expiration), and supports single or multiple app client IDs. However, the repository is archived and no longer actively maintained, so it may not track changes to AWS Cognito's token format or security practices.

Use it for:

• Verify Cognito ID tokens in a Flask or FastAPI application protecting API endpoints.
• Validate Cognito tokens asynchronously in event-driven or async Python applications.
• Decode and extract claims from Cognito tokens for authorization decisions in microservices.
• Test Cognito authentication flows locally by disabling token expiration checks.
• Support applications deployed in private VPCs by loading JWKS from a local file instead of fetching from AWS.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Decodes and verifies Amazon Cognito JWT tokens in both synchronous and asynchronous modes, validating signatures against AWS public key sets.

Yes, but with caution. The package is straightforward and has no known vulnerabilities, making it suitable for projects that need basic Cognito token verification. However, it is abandoned (last release June 2021, repository archived), so you should verify that it remains compatible with your Python version and current Cognito token format. For new projects or those requiring active maintenance, consider whether AWS SDK or a maintained alternative better fits your risk tolerance.

Install

cognitojwt on PyPI

pip install cognitojwt

uv add cognitojwt

poetry add cognitojwt

Installing cognitojwt

Before you install

Low install friction with a single runtime dependency (python-jose). However, the repository is archived and marked abandoned as of the fact sheet date, with the latest release from 2021-06-07 and no commits since 2024-04-19. Active maintenance is not expected.

License in practice

MIT license (permissive) means you can use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.

Quickstart

pip install cognitojwt[sync]

import cognitojwt

verified_claims = cognitojwt.decode(
    id_token,
    REGION,
    USERPOOL_ID,
    app_client_id=APP_CLIENT_ID
)

Requires AWS Cognito credentials (region, user pool ID, app client ID). In private VPC without internet gateway, set AWS_COGNITO_JWKS_PATH environment variable to point to a local jwks.json file.

Verify before relying

• Whether the package remains compatible with modern Python versions beyond 3.7 despite classifiers listing only 3.6 and 3.7.
• Whether abandonment affects real-world reliability for Cognito token verification or if the core functionality remains stable.
• Current status of AWS Cognito JWT format compatibility—whether AWS has changed token structure since the last release.

Package facts

Evidence: cognitojwt-1.4.1-py3-none-any.whl

Keywords: Amazon, Cognito, JWT

Tags

More Cryptography packages