Amazon Cognito

A Post-confirmation Lambda trigger forwards each confirmed Cognito sign-up, signed, to Referalli.

Connect

1. Create the connection: {"provider": "cognito", "programId": "prg_…"}. Keep the secret.

2. Create a Lambda function (Node.js 20 or later) from the template in the dashboard (Settings → Auth platforms → Add → Amazon Cognito), with REFERALLI_WEBHOOK_URL and REFERALLI_SECRET.

3. In the user pool open User pool properties → Lambda triggers → Add Lambda trigger → Sign-up → Post confirmation trigger and pick the function.

The user is filed under sub (stable, unlike userName). Only PostConfirmation_ConfirmSignUp counts as a sign-up.

Where the referral goes

Pass window.aff.getReferral() as ClientMetadata on SignUp/ConfirmSignUp, or store it in custom:referalli_anon_id, custom:referalli_click_id and custom:referalli_coupon attributes.

Cognito has no delete or disable trigger. When you call AdminDeleteUser or AdminDisableUser, send {"type": "user.deleted" | "user.banned", "customerRef": "<sub>"} to the same URL with the same signature.

Referral context

On your sign-up page, with the tracking script loaded, window.aff.getReferral() returns the visitor's referral. Put it where this provider carries it (below), under the default keys referalli_anon_id, referalli_click_id and referalli_coupon. The older referally_* spellings are still read. Referalli never links users by email: without these keys a sign-up is not attributed.

For Amazon Cognito the referral is read from: request.clientMetadata.*, request.userAttributes["custom:referalli_*"].

Check it

Each webhook delivery is answered with what Referalli did per user (attributed, partnerId, matchedVia, or the reason it wasn't); signed-protocol calls take "test": true on /signups to see the answer without storing anything. Every connector is held to the same conformance suite.