Who this comparison is for
AccessGuard highlights
- Bridge installs on any web host; no CORS preflight
- Rich Profiles (contacts, payments, consents, risk flags)
AWS Cognito highlights
- AWS-native integration, Lambda triggers, low-level control
- Attractive per-MAU pricing for serverless workloads
Capability matrix
| Capability | AccessGuard | AWS Cognito | Notes |
|---|---|---|---|
| Hosted login across multiple domains | native (bridge/web component) | full (Hosted UI) | — |
| Custom flows without CORS pain | native (HMAC proxy) | partial (requires CORS + Lambda triggers) | — |
| SSO (SAML/OIDC) | Full | Full | — |
| MFA (TOTP) with staged enforcement | Full | Full | — |
| RBAC & route-level guards | native (RouteGuard caps) | partial (DIY with groups/claims) | — |
| Profiles (consents/KYC/risk) | Full | partial (DIY in app or via services) | — |
| Prometheus metrics | Native | none (CloudWatch by default) | Export to Prometheus via bridges |
| SCIM provisioning | Full | partial (SCIM via AWS SSO/Identity Center) | — |
| Self-host/on-prem flexibility | self_hosted | none (AWS managed) | — |
- Cognito feature depth varies between User Pools vs Identity Pools; verify chosen path.
Total cost of ownership
For AWS-only teams, Cognito minimizes infra cost. For estates spanning multiple hosts and needing richer identity records, AccessGuard lowers engineering effort with built-in modules and standard observability.
Assumptions
- 3–8 sites, hybrid hosting
- Compliance exports required quarterly
Migration plan
From AWS Cognito · User import → parallel SSO → token rotation cutover
-
1
Export users and claims; import to AccessGuard with staged verification
-
2
Run gateway introspection against AccessGuard while Cognito issues tokens
-
3
Rotate refresh tokens, enforce MFA, and retire triggers progressively
Security
- Encrypted tokens and MFA seeds
- Session revocation and audit exports
Evidence & sources
| Claim | Value | Source |
|---|---|---|
| Bridge replay protection | 60-second window with HMAC | product_docs |
About AccessGuard
AccessGuard secures apps and external sites with hosted authentication and short-lived JWTs. Enable MFA, define RBAC permissions, and connect enterprise identity via SAML or OIDC. A lightweight HMAC bridge lets you embed login, registration, and token refresh flows on any domain without CORS pain.
Admins manage users, sessions, connections, and policies from one console. Profiles consolidate verified emails/phones, consents, KYC docs, and risk flags. Events and metrics provide visibility for security and ops.
Designed for velocity and safety: opinionated defaults, least-privilege keys, Prometheus counters, and exportable audit logs.