title: AWS Cognito - AdminInitiateAuth vs InitiateAuth
body: <p>We're looking to leverage AWS Cognito for authentication with an architecture that looks like:
  <code>client (browser) -&gt; our server -&gt; AWS Cognito</code></p>
  
  <p>With various configurations set, <code>initiateAuth</code> seems no different to <code>AdminInitiateAuth</code> and so I'd like to understand when under these configurations if it matters whether one is chosen over the other.</p>
  
  <p>It seems that when I create an app with a <code>client secret</code> and use <code>initiateAuth</code>, it seems to be almost the same integration experience as <code>adminInitiateAuth</code> that uses the <code>ADMIN_NO_SRP_AUTH</code> auth flow. The latter does not even require AWS credentials as stated in the AWS documentation. My integration with Cognito is as below:</p>
  
  <p><strong>initiateAuth</strong>:</p>
  
  <pre><code>  const payload = {
      AuthFlow: "USER_PASSWORD_AUTH",
      ClientId: cognitoClientId,
      AuthParameters: {
        USERNAME: username,
        PASSWORD: password,
        SECRET_HASH: generateSignature(username)
      }
    }
    const response = await cognitoClient.initiateAuth(payload).promise();
  </code></pre>
  
  <p><strong>adminInitiateAuth</strong>:</p>
  
  <pre><code>  const payload = { 
      UserPoolId: userPoolId,
      AuthFlow: "ADMIN_NO_SRP_AUTH",
      ClientId: cognitoClientId,
      AuthParameters: {
        USERNAME: username,
        PASSWORD: password,
        SECRET_HASH: generateSignature(username)
      }
    }
    const response = await cognitoClient.adminInitiateAuth(payload).promise();
  </code></pre>
  
  <p>You can see the difference is the different <code>AuthFlow</code> values, calling different methods and <code>ADMIN_NO_SRP_AUTH</code> requiring the <code>UserPoolId</code> parameter which seems superficial to me.</p>
  
  <p>We are also generating the signature based on the client secret which is something that we would handle securely.</p>