Migrate from AWS Cognito

Introduction

Migrate from AWS Cognito is part of the Paycux platform. This page explains what it does, when to reach for it, and the smallest working setup you can ship.

Everything below applies to both environments. Build and test in staging, then promote the same configuration to production without changing your code — only the API key and client ID differ.

Exporting Cognito user data

A user record holds the identity Paycux resolved for the person: email, name, verification state, and the identities they have linked. It is the object your application should key on.

Users are unique by email within a project. When the same person arrives through a second provider, Paycux links the identity to the existing user rather than creating a duplicate.

Importing users into Paycux

Migrations run alongside your current system rather than replacing it in one step. Import the accounts you already have, run both paths in parallel, then cut over once the numbers agree.

1. 1Export your existing users with their stable identifiers and email addresses.
2. 2Import them into Paycux; imported users keep their original ID under external_id so your foreign keys stay valid.
3. 3Send new sign-ins through Paycux while old sessions continue to work.
4. 4Retire the old path once sign-in volume through Paycux matches your baseline.

Using the Paycux migrations CLI

Using the Paycux migrations CLI applies specifically to Migrate from AWS Cognito. It behaves the same in both environments, and the values it depends on are visible in the dashboard for the environment you have selected.

If the behaviour you see does not match this description, check which environment your API key belongs to before anything else — a staging key against production data is the most common cause.

Triggering password resets

Triggering password resets is handled by Migrate from AWS Cognito rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Other authentication methods

Every API request is authenticated with a bearer token in the Authorization header. Keys are scoped to a single environment and are shown once at creation — store them in a secret manager, not in source control.

1curl -X GET 'https://api.paycux.com/v1/organizations' \
2  -H 'Authorization: Bearer $PAYCUX_API_KEY'