Sign in

v1

latestOpenAPI 3.0.0Apache 2.0 License2026-07-142311090.8 KB

Returns credentials for the provided identity ID. Any provided logins will be validated against supported login providers. If the token is for cognito-identity.amazonaws.com, it will be passed through to AWS Security Token Service with the appropriate role for the token.

This is a public API. You do not need any credentials to call this API.

post/#X-Amz-Target=AWSCognitoIdentityService.GetCredentialsForIdentity

Headers

X-Amz-Target'AWSCognitoIdentityService.GetCredentialsForIdentity' required

Request body

IdentityIdstring required

A unique identifier in the format REGION:GUID.

Loginsobject
<p>A set of optional name-value pairs that map provider names to provider tokens. The name-value pair will follow the syntax "provider_name": "provider_user_identifier".</p> <p>Logins should not be specified when trying to get credentials for an unauthenticated identity.</p> <p>The Logins parameter is required when using identities associated with external identity providers such as Facebook. For examples of <code>Logins</code> maps, see the code examples in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/external-identity-providers.html">External Identity Providers</a> section of the Amazon Cognito Developer Guide.</p>
CustomRoleArnstring

The Amazon Resource Name (ARN) of the role to be assumed when multiple roles were received in the token from the identity provider. For example, a SAML-based identity provider. This parameter is optional for identity providers that do not support role customization.

Response

Success

IdentityIdstring

A unique identifier in the format REGION:GUID.