Looking for an AWS Cognito alternative? Logto gives you multi-tenant organizations, enterprise SSO, and a sign-in experience you fully control without Lambda glue code or a new user pool every time requirements change.
Cognito earned its place in the AWS stack: it lives next to your infrastructure, identity pools can hand your apps temporary AWS credentials, and the Lite tier stays cheap at scale. But auth rarely stays a checkbox. When sign-up requirements change, when business customers arrive, or when the bill changes shape again, teams realize they're maintaining a toolkit instead of shipping a product. That's usually when they start comparing.
| Motivation | What it looks like in practice |
|---|---|
| Pricing that keeps moving | In May 2024, AWS introduced billing for machine-to-machine auth that had been free; existing accounts got a 12-month exemption, and those bills arrived in May 2025. In November 2024, new tiers cut the free allowance for new accounts from 50,000 to 10,000 MAU, and new user pools now default to Essentials at $0.015 per MAU, nearly three times the Lite rate. In November 2025, AWS dropped the per-app-client M2M fee but kept charging for every token request. Each change was announced. None of them asked. |
| Settings you can never change | In Cognito, sign-in identifiers, username case sensitivity, and required attributes are locked when a user pool is created, and custom attributes can never be modified or deleted. Get one wrong and the official remedy is blunt: "migrate your users to a new user pool". Auth requirements evolve; your pool configuration can't. |
| One rate-limit pool for your whole account | Cognito request quotas apply per AWS account per region, shared across every user pool you run, so a sign-in spike in one product can throttle all of them. Raising the adjustable categories means buying provisioned capacity on top of MAU pricing. Others are fixed: password recovery is capped at 30 requests per second and machine-to-machine token issuance at 150, no matter what you pay. |
| B2B is a do-it-yourself project | Cognito has no organization model. The official multi-tenancy guidance offers patterns to assemble yourself from user pools, app clients, or groups, and concedes that with pool-per-tenant "the development and operation effort" is high and "each user must sign up individually for each tenant". On top of that, every enterprise user signing in through SAML or OIDC costs $0.015 per month after the first 50, on every tier. |
| The sign-in page isn't really yours | Managed login gives you a visual editor for colors and logos, but AWS is explicit: you can't modify or localize the text, and only 12 built-in languages exist. The Lite tier is limited to the older classic hosted UI, which supports a logo and a fixed set of CSS values, with no localization at all. And a custom domain requires a certificate in US East (N. Virginia), wherever your users live. |
Logto doesn't lock your identity schema at setup. Sign-in identifiers are settings you change in the console, and user profiles carry schemaless custom data. When requirements shift from email-only to phone or passkeys, you flip the configuration; you don't rebuild the tenant and migrate every user.
Logto organizations give each business customer its own members, roles, and enterprise SSO connection, with just-in-time provisioning when their users first sign in. What Cognito's best-practices guide leaves you to assemble from pools, app clients, and groups is a first-class product surface in Logto.
Logto's free plan covers 50K MAU and 50K tokens a month, machine-to-machine included, and Pro is $24 per month with unlimited MAU. Rate limits are per tenant, and raising them for a growing workload is a conversation with support, not a capacity purchase. Logto Cloud is a fully managed service, and it runs the same codebase as Logto's open-source version (13k+ GitHub stars). If the pricing or the roadmap ever stops working for you, you can self-host and keep going.
We believe in honest positioning. Logto isn't the perfect fit for every AWS Cognito customer.
| Logto | AWS Cognito | |
|---|---|---|
| Key differences | ||
| Free tierWhat the free plan includes | Up to 50K MAU and 50K tokens | 10K MAU on Lite and Essentialsno free tier on Plus |
| Machine-to-machine authService-to-service tokens via client credentials | Includedonly access tokens count toward billing | No free allowanceevery token request billed, from $0.00225 |
| B2B / multi-tenancyModel business customers as organizations with roles | Unlimited*organizations with roles and per-org SSO | No built-in organization modelDIY pool or group patterns |
| Enterprise SSO pricingUsers signing in through SAML or OIDC federation | Connectors configured in the consoleMAU-based plans | 50 federated MAU free, then $0.015 per user on every tier |
| Identity schema changesAdjusting sign-in identifiers and attributes later | Reconfigurable anytimeschemaless custom data | Sign-in identifiers, case sensitivity, and custom attributes locked at creation |
| Sign-in UI controlBranding, wording, and languages of the hosted pages | Custom phrases in any languagebring your own UI | Colors and logo onlytext not editable12 languages (Essentials and up) |
| Deployment optionsWhere the auth service can run | Cloud, private cloud, or self-hosted | AWS-hosted only |
Based on publicly available information as of July 2026; Cognito prices are US East (N. Virginia). Please verify with the respective vendor for the latest details.
* "Unlimited" refers to features without a fixed limit, but is subject to system policies to ensure fair usage, security, and optimal performance.
Here's the honest part: Cognito doesn't let you export password hashes, so no vendor can promise a bulk migration where every existing password silently keeps working. Cognito itself doesn't accept imported hashes either: its own bulk import makes users reset their password on first sign-in.
Everything else moves cleanly. Export user profiles through the Cognito APIs and bulk-import them with Logto's Management API. Users who sign in with social providers or passwordless methods won't notice the switch at all.
For password users, plan either a one-time reset or a staged rollout. The right approach depends on your user base, so tell us about your setup and we'll help you plan the cutover.
Read the user migration guide →Every migration is a little different. If the guide doesn't cover your case, talk to us and tell us what you need.
Partly. Accounts created after November 22, 2024 get 10,000 MAU free per month on the Lite or Essentials tier; older accounts keep 50,000 free MAU on Lite. The Plus tier has no free allowance. Machine-to-machine token requests are always billed, users federated through SAML or OIDC are free only up to 50 MAU, and SMS messages are billed separately through Amazon SNS.
Three changes in two years. May 2024: AWS introduced per-token billing for machine-to-machine auth, with a 12-month exemption for existing accounts that ended in May 2025. November 2024: Cognito was restructured into Lite, Essentials, and Plus tiers, the free tier for new accounts dropped from 50,000 to 10,000 MAU, and new user pools default to Essentials at $0.015 per MAU. November 2025: AWS removed the per-app-client M2M fee while keeping per-token charges.
Not as a built-in feature. AWS documents multi-tenancy patterns you implement yourself: a user pool per tenant, an app client per tenant, or groups within one pool. Each has documented trade-offs, from high development and operations effort to users signing up separately for each tenant. Logto models this directly with organizations: each business customer gets its own members, roles, and enterprise SSO connection.
It depends on why you're leaving. If your apps need temporary AWS credentials for services like S3, Cognito identity pools remain the native path. If you want built-in B2B organizations, enterprise SSO without per-user federation fees, and pricing that doesn't change underneath you, Logto is a strong choice. Auth0, Firebase Auth, and Keycloak are also commonly evaluated.
AWS, Amazon Cognito, and Amazon Web Services are trademarks of Amazon.com, Inc. or its affiliates. Feature comparisons are based on publicly available information as of July 2026. Please verify with the respective vendor for the latest details.
