∧pex

Connect Cognito

Push your Amazon Cognito users to Apex with two Lambda triggers. The Cognito sub becomes your internal_user_id — the stable, unique key Apex uses for deterministic reconciliation.

PostConfirmation — new signups

Fires once when a user confirms their account.

// cognito-post-confirmation.js
export const handler = async (event) => {
  const { sub, email, name, picture } = event.request.userAttributes;
  await fetch("https://app.apex.inc/api/v1/events", {
    method: "POST",
    headers: {
      "content-type": "application/json",
      "x-api-key": process.env.APEX_API_KEY, // apex_sk_...
    },
    body: JSON.stringify({
      events: [
        {
          type: "user_signed_up",
          email,
          // `picture` is the standard OIDC profile-photo claim — Google,
          // Apple, and most social providers populate it. Mapping it to
          // `avatar_url` (a canonical Apex Spec attribute) gives you
          // end-user photos across Apex with zero extra work.
          data: { userId: sub, name, avatar_url: picture },
        },
      ],
    }),
  });
  return event; // never block the Cognito flow on Apex
};

PostAuthentication — existing users on next login

Fires on every sign-in. This is also how your existing user base reconciles automatically (see backfill — "passive" mode): the next time a pre-Apex user logs in, the trigger carries their verified sub and Apex stitches their history.

// cognito-post-authentication.js
export const handler = async (event) => {
  const { sub, email } = event.request.userAttributes;
  await fetch("https://app.apex.inc/api/v1/events", {
    method: "POST",
    headers: {
      "content-type": "application/json",
      "x-api-key": process.env.APEX_API_KEY,
    },
    body: JSON.stringify({
      events: [{ type: "user_identified", email, data: { userId: sub } }],
    }),
  });
  return event;
};

Warning

Always return event and never throw — an Apex hiccup must never block a user's sign-up or sign-in. The calls above are fire-and-forget by design.

Info

Apex dogfoods this exact pattern: our own Cognito org members are synced into the apex-internal workspace keyed by their sub, which is what powers our price-change notices. Your setup is identical.

Wire it up

  1. Create a workspace API key (apex_sk_…) in Settings → API keys and store it as the Lambda's APEX_API_KEY env var.
  2. Attach the two functions to your User Pool under User pool properties → Lambda triggers (Post confirmation + Post authentication).
  3. Confirm a test user — they should appear in Customers within seconds, identified.
PreviousOverviewNextAuth0