# Udibo vs Amazon Cognito Amazon Cognito is the user directory of AWS: 10,000 monthly active users free on its Lite and Essentials plans, SAML federation on every plan, and native hooks into IAM, API Gateway, and Lambda. Udibo gives you hosted sign-in behind a standard OAuth 2.0 boundary, with organizations, custom roles, and per-resource permissions included as a product rather than a pattern you assemble. The difference that decides most evaluations: Cognito prices the user and leaves the organization model, the authorization model, and the messaging bill to you; Udibo prices growth and includes those. **Checked September 7, 2026** against [Amazon Cognito's pricing page](https://aws.amazon.com/cognito/pricing/) and [Amazon SES pricing](https://aws.amazon.com/ses/pricing/). Udibo's prices are on its [pricing page](https://www.udibo.com/pricing). **Additional details reviewed October 2, 2026:** Udibo usage assumptions and API access, plus Cognito's shared free allowance and documented profile-export limits. Other vendor claims use the check date above. ## The short version | If you need | Start with | | --------------------------------------------------------------------------- | -------------------------------------------------- | | Authorization already expressed in IAM, API Gateway authorizers, and Lambda | Cognito | | SAML federation at launch | Cognito, or another provider that ships it today | | Fewer than about 10,000 users and no organization model | Cognito, whose free allowance covers all of them | | Organizations with invitations, members, and roles as a product | Udibo | | Permissions checked on your server, per organization or per resource | Udibo | | Audit history and hosted-page branding without a plan change | Udibo | | One bill without SES, SNS, or Lambda line items | Udibo | ## Why teams pick Udibo over Amazon Cognito - **Organizations are a product, not a pattern.** AWS documents multi-tenancy as approaches you implement: a user pool, an app client, a group, or a custom attribute per tenant ([multi-tenancy guidance](https://docs.aws.amazon.com/cognito/latest/developerguide/multi-tenant-application-best-practices.html)). Udibo ships organizations with invitations, memberships, and roles on every plan, with no cap on organizations or members, and a person can hold a different role in each. - **Roles and permissions your server can enforce.** A Cognito group carries a name, a precedence, and an optional IAM role; your API reads the `cognito:groups` claim and decides what it means, and anything finer is a pre-token-generation Lambda function or a separate AWS service ([groups](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-user-groups.html)). Udibo lets you register the permissions your application interprets, attach them to roles across a tenant, inside an organization, or on one resource, and read the result from the token or a hosted check. - **A record without a plan change.** Cognito's user activity logs and their export are on Plus, which has no free allowance. Udibo keeps at least 90 days of audit history on every plan, exportable as CSV or NDJSON. - **Your brand at the door on Free.** Cognito's managed login takes CSS on every plan and its visual editor on Essentials and Plus. Udibo puts your name, logo, and colors on the hosted pages with no vendor badge on any plan. - **One bill, three meters.** A Cognito bill for a working product also carries SES for email, SNS for SMS, Lambda for triggers, and $0.00225 per machine-to-machine token, and a user bills as active on any identity operation, including "administrative creation or update" and "an attribute query on a user". Udibo's prices follow retained users, hosted permission checks, and the emails it sends for you; email through your own sender is counted but never billed. - **Growth costs less past the free allowance.** Udibo's rate is $3 per 1,000 retained users above its allowance. Cognito Essentials is $0.015 per user, or $15 per 1,000; Lite is $5.50 per 1,000 and then $4.60, without passwordless codes, passkeys, or the branding editor. At 100,000 users that is about $290 on Udibo, $1,350 on Essentials, and $495 on Lite, before email. ## Why Amazon Cognito may still be the right choice - **You are already on AWS.** API Gateway authorizers, ALB authentication, Lambda triggers, and identity pools that exchange a sign-in for temporary AWS credentials make Cognito the native fit when your authorization is written in IAM. Udibo issues no IAM credentials. - **10,000 users free, indefinitely.** Lite and Essentials include 10,000 monthly active users at no charge, shared per AWS account or organization, rather than per user pool. The free tier does not expire and excludes AWS GovCloud. Udibo's Free plan includes 500 retained users, and its Standard plan does not have a lower user-only cost until somewhere past 10,000 users. - **SAML federation today.** SAML and OIDC federation are on every Cognito plan at $0.015 per federated user after 50 free. Udibo does not offer SAML or SCIM today. Cognito's passkeys are on Essentials and Plus; Udibo's are on every plan. - **MFA is on every Cognito plan too.** Authenticator-app and SMS one-time codes are on Lite, Essentials, and Plus, so MFA alone is not a reason to switch. Udibo's MFA is authenticator apps, passkeys, and recovery codes. ## Pricing side by side Cognito's rates follow the September 7, 2026 check, with the October 2 shared allowance review noted above. Udibo's pricing assumptions were reviewed October 2. Cognito bills a monthly active user, defined on its page as any user with an identity operation in a calendar month, including "administrative creation or update" and "an attribute query on a user". Udibo's prices count a retained user: "A person who returns more than 24 hours after creating their account counts once in that UTC calendar month." The examples below assume the two counts are equal, which favours Cognito. | You need | Udibo | Amazon Cognito | | -------------------------------- | -------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | Free plan | 500 retained users, 25,000 hosted permission checks, 1,000 emails | 10,000 monthly active users on Lite and Essentials, none on Plus; 50 for SAML/OIDC federation; the free tier does not expire | | First paid plan | $5 a month plus usage: 5,000 users, 250,000 checks, 10,000 emails included | No base fee: Lite $0.0055 per user past 10,000 and $0.0046 past 100,000; Essentials $0.015 per user past 10,000; Plus $0.020 from the first | | Multi-factor authentication | Included on Free | Authenticator app and SMS codes on every plan; email codes on Essentials and Plus; SMS billed through Amazon SNS | | Custom roles and permissions | Included on Free | Groups on every plan at no charge; roles and permissions are yours to build from the `cognito:groups` claim, a Lambda trigger, or a separate service | | Organizations and members | No cap | No organization object; documented patterns using a user pool, app client, group, or attribute per tenant | | Hosted page branding | Your name, logo, and colors with no vendor badge, on Free | CSS on every plan; the visual editor on Essentials and Plus | | Custom session lifetime | Included on Free | Token expiry configurable in minutes, hours, or days; the managed login session cookie is fixed at one hour | | Enterprise SSO connections | No per-connection fee for OpenID Connect providers; SAML not yet available | SAML and OIDC federation on every plan; $0.015 per federated user after 50 free | | Audit or application log history | At least 90 days on every plan | User activity logs and their export on Plus | | Sign-in email | Free: 1,000 emails. Standard: 10,000, then $1 per 1,000; your own sender is counted but not billed | Amazon SES at $0.10 per 1,000 messages à la carte | | Users beyond the allowance | $3 per 1,000 retained users | Essentials $15 per 1,000; Lite $5.50 per 1,000, then $4.60 past 100,000; Plus $20 per 1,000 | | Hosted permission checks | $10 per 1,000,000 past the allowance | No equivalent in Cognito; Amazon Verified Permissions is a separate service billed per request | | Machine-to-machine tokens | No per-token charge; technical and abuse limits apply | $0.00225 per successful token response | Three worked examples, with the same assumptions on both sides: | Scenario | Udibo | Amazon Cognito | | ------------------------------------------------------------------------------------ | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | Consumer app: 10,000 retained users, 5,000 sign-in emails, MFA on, your own branding | $20 (Standard base plus 5,000 users above allowance) | $0.50 (10,000 users inside the free allowance on Lite or Essentials; 5,000 emails through SES at $0.10 per 1,000) | | B2B app: 200 users, 5 organizations of 30 members, custom roles, MFA | $0 on Free, or $5 on Standard | $0 for users; the organization and role model is yours to build from groups, attributes, and a pre-token-generation Lambda function, billed as Lambda | | Consumer app at 100,000 retained users | About $290 | Essentials: 90,000 × $0.015 = $1,350; Lite: 90,000 × $0.0055 = $495, without passwordless codes, passkeys, or the branding editor; plus SES email | Sources: [Amazon Cognito pricing](https://aws.amazon.com/cognito/pricing/), [Amazon SES pricing](https://aws.amazon.com/ses/pricing/), [Amazon SNS SMS pricing](https://aws.amazon.com/sns/sms-pricing/) (per-country rates, no single figure), [Amazon Verified Permissions pricing](https://aws.amazon.com/verified-permissions/pricing/), and Udibo's [pricing page](https://www.udibo.com/pricing). Token expiry and the session cookie are from AWS's [token expiration](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-caching-tokens.html) and [multi-tenancy guidance](https://docs.aws.amazon.com/cognito/latest/developerguide/multi-tenant-application-best-practices.html) pages. All of them change; check the vendor's current page before you decide. ## Cost at scale Users only, assuming the same number of Cognito monthly active users and Udibo retained users. The meters differ: Cognito can count administrative identity operations and first-day users that Udibo's retained-user meter excludes. These rows use direct or social sign-in, Udibo Standard's prices, and Cognito's published Lite and Essentials rates; SAML/OIDC federation uses a separate rate. Lite includes authenticator-app MFA but lacks Essentials' branding editor. The examples assume one shared AWS free allowance, direct or social users, and the listed pricing; regional add-ons and federation can change the bill. The free allowance is not multiplied by adding user pools. | Users | Udibo | Cognito Essentials | Cognito Lite | | --------- | ------------- | ------------------ | ------------ | | 1,000 | $5 (Standard) | $0 | $0 | | 10,000 | $20 | $0 | $0 | | 100,000 | About $290 | $1,350 | $495 | | 1,000,000 | About $2,990 | $14,850 | About $4,635 | Email through SES and SMS through SNS are extra on every Cognito row. Both providers can have no user charge within Udibo's 500 retained users and other Free allowances. From 501 to 10,000 users, Cognito Lite and Essentials still have no user charge while Udibo's prices call for Standard. With equal user counts, Udibo Standard's user-only price becomes lower at roughly 12,000 users against Essentials and 18,000 against Lite, within the scenarios above. Email, SMS, hosted permission checks, and other services can change the complete bill. ## What the integration looks like With Udibo, register an application and its callback, send people to the hosted sign-in page, and finish the authorization-code flow on your server. Your backend holds the session and the browser gets a cookie, never a token. The [first-login guide](https://www.udibo.com/docs/identity/get-started) walks each checkpoint, and the [organizations](https://www.udibo.com/docs/identity/organizations) and [permissions](https://www.udibo.com/docs/identity/permissions) guides cover a person with a different role in each of two organizations. With Cognito, create a user pool and an app client, send people to [managed login](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managed-login.html) or call the user pools API from an SDK, and validate the returned tokens in your API, natively through an API Gateway authorizer. Some choices need to be correct before users arrive: AWS documents that you cannot later change the username and alias configuration or the required attributes, or remove or redefine a custom attribute ([user attributes](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html)). Josh Karamuth's July 2026 [account](https://joshkaramuth.com/blog/aws-cognito-authentication-startup-nightmare/) and the linked [HN discussion](https://news.ycombinator.com/item?id=49478091) report setup, SDK-migration, and configuration difficulty alongside people for whom Cognito has worked well; they are reported experiences, not a benchmark of either product. For either provider, rehearse email verification, password recovery, a changed profile field, and logout before choosing. A valid token says who someone is; your backend still decides what they may read. ## Where Udibo needs a closer look Udibo does not currently offer SAML or SCIM. It issues no IAM credentials, so an application whose authorization lives in IAM policies keeps that layer or redesigns it. Udibo's [webhooks](https://www.udibo.com/docs/identity/webhooks) are signed notifications delivered after the fact, with retries and redrive; there is no synchronous hook in the sign-in path, so anything a Lambda trigger changed inline needs a different design. Customers administer tenants through the dashboard today; there is no self-serve management API credential for a script or backend. See the [API guide](https://www.udibo.com/docs/identity/apis#the-management-api). The `@udibo/oauth2` package is a separate operating model, not a self-hosted user pool. Test the whole account journey before committing; a successful login alone does not establish parity. ## Moving an existing Cognito application Both products are OpenID Connect issuers, so the boundary change is an issuer change rather than a rewrite. Inventory user pools, app clients, identity pools, Lambda triggers, custom claims, groups, and every IAM or application rule that depends on them. Preserve your own user IDs and map the old issuer and subject to the new one explicitly; do not use email alone as an account-linking rule. Decide what each group becomes: an [organization](https://www.udibo.com/docs/identity/organizations), a role, or a [permission](https://www.udibo.com/docs/identity/permissions) a role carries. Credential migration deserves a rehearsal. Cognito now supports [password-hash import](https://aws.amazon.com/about-aws/whats-new/2026/07/amazon-cognito-password-hash-import/); importing into Cognito does not establish exportability from it, and AWS's [profile-export guidance](https://docs.aws.amazon.com/solutions/latest/cognito-user-profiles-export-reference-architecture/guidance-components.html) does not replicate passwords or export federated-user profiles, and assigns new subjects on restoration. Check the actual export against Udibo's [supported import formats](https://www.udibo.com/docs/identity/user-import), plan a re-enrollment path for [MFA](https://www.udibo.com/docs/identity/mfa) and sessions, and retest every trigger-dependent behavior. Follow the [migration guide](https://www.udibo.com/docs/identity/migrate) before routing a cohort to the new issuer. **Try next:** complete [one Udibo login](https://www.udibo.com/docs/identity/get-started), then give a person two organizations and a different role in each. Before you have an account, the [agent integration brief](https://www.udibo.com/docs/identity/agents) lets your coding assistant prepare the integration. ## Frequently asked questions **Is Udibo cheaper than Cognito?** For direct or social sign-in, both can have no user charge within Udibo's 500 retained users and other Free allowances. Between 501 and 10,000 users, Cognito Lite and Essentials have no user charge while Udibo's prices call for Standard. At equal user counts, Udibo Standard's user-only price becomes lower at roughly 12,000 against Essentials and 18,000 against Lite. That comparison excludes Cognito's SES email, SNS SMS, and any Lambda work, as well as Udibo email and hosted checks above the allowances. Model those separately before comparing the complete bill. **Does Udibo have organizations like Cognito groups?** Cognito has groups and attributes; the organization model, invitations, and per-organization roles are yours to assemble with Lambda triggers. Udibo ships organizations, invitations, memberships, roles, and per-resource permissions as a product, with a hosted check your backend can call. **Can I move from Cognito to Udibo?** Yes, with an export and account-linking plan. AWS's documented [profile-export workflow](https://docs.aws.amazon.com/solutions/latest/cognito-user-profiles-export-reference-architecture/guidance-components.html) omits passwords and federated-user profiles. Inspect the actual data you can export before planning a password-hash import or social-account mapping. Without supported hashes, users need a new password or a correctly linked provider on first return. See [migration planning](https://www.udibo.com/docs/identity/migrate). **Does Udibo integrate with IAM or API Gateway authorizers?** Not natively. Udibo issues standard OAuth 2.0 tokens; an API Gateway JWT authorizer can validate them like any OpenID Connect issuer, but there is no IAM role mapping. _Last verified 2026-10-02._