Get started with Users

By the end of this guide, you'll know which Users service your app should call and whether the browser is allowed to connect to it.

You need a deployed Users service. If you don't have one yet, begin with your first setup. These steps connect to a running service; they don't start a local Cognito emulator.

1. Find your Users API URL

Use the Users endpoint reported by your deployment, such as https://users.example.com. The address is a placeholder here; replace it with your own endpoint.

Keep the public pool and client settings with your app's environment configuration. A Cognito client ID is a public identifier, not a privileged API key. Keep administrative credentials on the server or in your CLI session.

2. Read the public sign-in configuration

This read-only endpoint describes the deployment's sign-in setup:

curl https://users.example.com/api/auth/config

A successful response contains a JSON:API data.attributes object with public connection settings, including region, userPoolId and clientId. It also reports configured providers and sign-in capabilities.

If it fails, check the endpoint and the deployment's status before changing your app code. You don't need an admin API key for this public read.

3. Allow your app's origin

Add the exact origin of your app to the deployment's AllowedAppOrigins setting. During local development this might be http://localhost:3000.

The scheme, hostname and port all matter. A request from http://localhost:5173 is a different origin. A callback URL is separate: it includes the route where a redirected sign-in returns, such as https://app.example.com/sign-in.

Make service-setting changes through the supported SaaSLayer deployment flow. For Google sign-in, your return page must also be listed in AllowedCallbackUrls.

4. Add the sign-in screen

Continue with Add sign-in. The guide previews the React component integration and explains what your server must check after a person signs in.

SDK Preview: @saaslayer/react and @saaslayer/js are not published to npm yet. The component example previews the intended public SDK integration. The discovery and CLI steps do not require those packages; the npm integration becomes usable when they are released.

5. Check the whole flow

Use a test account in this deployment. Check that you can sign in, reload the page, sign out and sign in again. If MFA is required, complete that step too. Then make a protected request to your own backend and confirm that it verifies the session before returning data.

Next, manage the accounts in your app.