Faable Auth vs AWS Cognito

Short answer: both are managed OAuth 2.0 / OpenID Connect identity providers with hosted login pages. Cognito is the natural choice when your stack already lives in AWS — IAM, API Gateway and ALB authorizers, AppSync — and its free tier covers the first 10,000 monthly active users. Faable Auth is free up to 15,000 MAU with no credit card and never charges per user after that; it is the better fit when you want a bill that doesn’t grow with every user, a login that needs no AWS account, IAM or CloudFront certificate to brand, protocol features Cognito doesn’t ship (device code, token exchange, dynamic client registration), and identities stored by a European company on its own hardware in Europe.

Cognito details checked against AWS’s pricing page and developer guide in September 2026. AWS changes Cognito often — the passwordless and passkey support below is from late 2024, multi-region replication and password-hash import from mid-2026 — so confirm anything decisive on aws.amazon.com/cognito .

At a glance

Pricing, worked through

Cognito charges per monthly active user, and the rate depends on the feature plan. Passkeys, passwordless codes, email MFA and the branded managed login all need Essentials:

Machine-to-machine tokens cost the same per token on both — $0.00225 on Cognito, €0.00225 on Faable (billed in blocks of 1,000) — but Faable includes the first 100 a month on every plan, and Cognito has no free tier for them. A service that caches its token and renews it when it expires needs about 30 a month. Enterprise SSO users on Cognito are $0.015 each after the first 50, and SMS goes through Amazon SNS at SNS prices.

The reading: up to 10,000 monthly active users both are free — Faable up to 15,000, and without a credit card. Past that, Cognito charges every user and Faable stays at 15 €, whatever the count. Machine tokens cost the same per unit; Faable’s first 100 a month are free.

Faable figures are the plan fees from Auth pricing, in euros, VAT excluded; Hobby’s 15 € covers any number of users. Cognito figures are AWS list prices in US dollars for US East, before tax, with no multi-region replication.

Hosted login pages

Both products host the login so your application only redirects to it. The difference is how much of the account lifecycle those pages cover, and what it takes to make them look like yours.

Cognito’s branding editor is more flexible visually and it speaks more languages. Faable’s pages cover more of the lifecycle — the security page and the device flow in particular are things you otherwise build and host yourself.

See Hosted Login UI for every screen.

CLI and automation

Both products can be run from a terminal. They differ in what the commands are designed for.

Cognito exposes its whole API through aws cognito-idp and CloudFormation: user pools, clients, domains, branding and import jobs can all be declared as code, which is its real strength if you already run CDK or CloudFormation. Day-to-day operations are raw API calls (admin-get-user, list-users with a filter on a fixed set of standard attributes, 60 results per page), and there is no command to read a sign-in log unless you are on Plus and have set up log export.

faable auth is built around the operations you do by hand when something happens:

# Who is this user, how did they sign in, from where?
faable auth users get user_abc123
 
# Everyone unverified, as JSON, suspended in one pipe
faable auth users list --query email_verified:false --json \
  | jq -r '.[].id' \
  | faable auth users suspend -y -r "unverified batch"
 
# Ship an Action from a file, switch it off without a deploy
faable auth actions update action_xyz -f ./gate.js
faable auth actions update action_xyz --no-enabled
 
# What failed in the OAuth flow since yesterday?
faable auth logs list --origin oauth --status failed --since 2026-09-23

For configuration as code, Faable has the Management API but no Terraform provider or CloudFormation equivalent. If declaring your identity setup in the same templates as the rest of AWS matters to you, that is a point for Cognito.

Multi-tenancy

AWS documents five ways to model tenants in Cognito — a user pool, an app client, a group, a custom attribute or a custom scope per tenant — and every option shares the account’s regional quotas. A local user’s session signs them into every app client in the same pool, so real isolation usually means a pool per tenant.

In Faable Auth, an auth account is the tenant: its own users, connections, clients, signing keys, login experience and logs. Inside an account, teams and roles group your customers’ users. Several auth accounts on one subscription is a Pro feature.

Where your users’ data lives

Cognito keeps user-pool data in the region you choose, and eight of them are in Europe. Email and SMS go through the SES and SNS regions you configure. Cognito is not on the launch list of the AWS European Sovereign Cloud. Amazon Web Services is a US company, which is the question behind most EU procurement reviews rather than the region.

Faable Auth runs on our own hardware in a European datacenter, operated by a European company, with no non-EU region to fall back to. For SOC 2, ISO 27001 or HIPAA, see our compliance scope or ask sales.

Migrating, in either direction

Leaving Cognito is the hard part of any Cognito decision: AWS does not let you export password hashes. Every migration off Cognito ends with users setting a new password, or with a period where your app checks passwords against Cognito and re-creates them elsewhere.

From Cognito to Faable: create users over the Management API, and let them in with an emailed code (passwordless, Hobby and up) or a password reset — a user created over the API gets a credential without a password, so Forgot password works as “set your password”. Federated users keep their account if you also create their identity (POST /identity with the provider’s user id). Because Cognito does not release the hashes, the reset step is unavoidable when leaving Cognito, whichever tool you move to.

From Faable to Cognito, or anywhere else: faable auth users export --include-hashes exports users, identities and their password hashes (Argon2id), which Cognito’s next-generation pools can import, so leaving Faable does not force a password reset. See Import and export password hashes.

When Faable Auth is the better fit

• You’re past 10,000 MAU, or need Plus features. A fixed 15 € replaces a bill that grows with every user.
• You don’t want AWS in the login path. No IAM, no pool settings you can’t change after creation, no us-east-1 certificate for a custom domain.
• You need grants Cognito doesn’t have — device code for a CLI, token exchange for keyless CI, dynamic client registration for MCP clients.
• You want your users to manage their own security on a hosted page, and to be nudged into passkeys right after they sign in.
• You want identities held by a European company in Europe, and auth and hosting on the same invoice.

When AWS Cognito might fit better

• Your backend is on AWS and you want API Gateway, ALB or AppSync to validate tokens natively, or IAM credentials for users through identity pools.
• You need SAML, Sign in with Apple or SMS login today.
• You want identity declared in CloudFormation or CDK alongside the rest of your infrastructure.
• You need multi-region failover for authentication.

Related

• Faable Auth vs Auth0, Clerk & Keycloak
• Faable Auth vs Supabase Auth · vs Firebase Authentication · vs Authelia
• Faable Auth features · Auth pricing
• What is a multi-tenant identity server?
• Get Started with Faable Auth

Last updated on September 24, 2026