External App authentication with AWS Cognito

💬 External Apps
1

I am trying to replace an in-house React app with a Retool app. Our app backend uses AWS Cognito and AppSync GraphQl.

Desired outcome:

  1. My existing customers arrive at a Retool landing page.
  2. They are prompted to authenticate.
  3. Retool redirects the user to my hosted Cognito login.
  4. Auth tokens received, everyone high-fives and gets to work.

I cannot for the life of me get this working. I have a GraphQL resource using OAuth 2.0 Authentication:

  • I can hit 'Connect with OAuth' and I am directed to oauth.retool.com/oauth/authorize and an 'authenticate' prompt is shown.
    image
  • Clicking 'authenticate' redirects to Cognito, and I authenticate with username/password.
  • I am redirected back to the resource, and my authentication status is shown as 'Connected'
  • I can check my authentication status using the test endpoint and get confirmation.
    image
    image1400×579 39.4 KB

I set 'Branding' to use a simple app to test authentication. It has:

  1. An authLogin button configured to call my GraphQL/OAuth2 resource.
  2. A query that tries a simple GraphQL query and detects authentication status on the basis of an HTTP 200 (or not) response code.

2025-02-22_13h34_24
2025-02-22_13h34_24725×432 20.8 KB

So far so good. This simple authenticate/am-i-authenticated flow works fine if I am trying it from Editor mode when logged-in to Retool.

PROBLEM: When I try this with one of my test user accounts direct from my public URL, the authLogin button redirects to oauth.retool.com/oauth/authorize and I get the message:
Here is the error: JsonWebTokenError: jwt malformed
image

What is causing this issue?

2

OK - I think I'm figuring this out.

The JWT issue is because the user doesn't have a Retool account. If I want my Cognito users to have access to Retool I'm probably going to need to move to the Enterprise plan and look at SSO?

3

Hi @Tony_Bryan!

Apologies for this confusion with setting up Auth :sweat_smile:

Your desired outcome is what everyone on Retool should be able to achieve. Let me double check on the JWT situation, if you have an External app set up for External users, that should be something that can be done on the Business Plan per our docs. Will get back to you with more info!

Enterprise would include SSO and make things much easier to set up and an easy click to auth in and be done flow working for app editors and app users.