title: Amazon Cognito Oauth2 Native App : Best practice
body: <p>I am developing backend API's for a native app. This backend service(developed using java/springboot) is deployed on AWS. For Securing the backend API's I am planning to use Oauth2 (Authorization Code grant Flow with PKCE).</p>
  
  <p>I am trying to achieve this through Amazon API Gateway and Cognito User Pool. This is what I have done so far.</p>
  
  <ol>
  <li>I have created Cognito user pool </li>
  <li>Add an app client(app client id/secret)</li>
  <li>Configured Domain and Resource Server</li>
  <li>Configured App Client Settings with Authorization code grant as the OAuth flow</li>
  <li>Created a user with default password and also changed password.</li>
  <li>I have setup Amazon API(with resource mapping to my backend) with this cognito user pool as Authorizer. </li>
  </ol>
  
  <p>With these setup my workflow is like this</p>
  
  <p>A. Call <code>/oauth2/authorize</code> endpoint of my domain with response_type as code and also pass all necessary information like client id, callbackurl, code_challenge_method, code_challenge etc. This redirects to <code>/login</code> page. I login with the username/password created in step 5 above. This will return me a code.<br>
  B. Call <code>/oauth2/token</code> with the code returned from previous step and all the other necessary details including code_verifier. This will return me access_token(refresh_token, id_token)<br>
  C. Use this token to call the Amazon API Gateway endpoint. </p>
  
  <p>All this is working fine. But I have a couple of questions.</p>
  
  <ol>
  <li>Do I create an app client (step 2 above) Every time a user downloads the app from playstore. Is app client related to per user or per app?</li>
  <li>Do I need to create a new user(step 5 above) everytime a user downloads the app and want to use it? I have my own customer registration/login process in my app/backend implemented. I do not want Amazon to handle this. But I need atleast one user in cognito user pool to get the code(Step A). Not sure how this should be handled.</li>
  <li>Currently I am using dummy callback url. As this is a mandatory field. How can I handle this in my native app?</li>
  </ol>