MojoAuth vs AWS Cognito: pricing, developer experience, and migration

import { MojoAuth } from "@mojoauth/server-sdk";

const mojo = new MojoAuth({ apiKey: process.env.MOJOAUTH_API_KEY });

await mojo.email.sendOtp({ email: "user@example.com" });

const { user, accessToken } = await mojo.email.verifyOtp({
  email: "user@example.com",
  otp: req.body.otp,
});

import { CognitoIdentityProviderClient, SignUpCommand,
  ConfirmSignUpCommand } from "@aws-sdk/client-cognito-identity-provider";

const client = new CognitoIdentityProviderClient({ region: "us-east-1" });

await client.send(new SignUpCommand({
  ClientId: process.env.COGNITO_APP_CLIENT_ID,
  Username: "user@example.com",
  Password: tempPassword,
  UserAttributes: [{ Name: "email", Value: "user@example.com" }],
}));

await client.send(new ConfirmSignUpCommand({
  ClientId: process.env.COGNITO_APP_CLIENT_ID,
  Username: "user@example.com",
  ConfirmationCode: req.body.code,
}));

Practical observations:

• The Cognito example assumes you have created a User Pool, created an app client, configured the password policy, and possibly written custom auth Lambda triggers. The setup work happens before this code runs.
• Cognito's SDK calls feel like AWS SDK calls because they are. If your team writes AWS SDK code daily, this is fine. If not, the learning curve is real.
• Error handling is divergent. Cognito returns AWS service exceptions that need parsing for user-facing messages. MojoAuth returns structured errors with codes.

1. Week 1: export and import. Use the Cognito User Pool export feature (or AdminListUsers + custom export) to dump users with their custom attributes. MojoAuth imports the dataset including password hashes; users on subsequent login are transparently upgraded.
2. Week 2: parallel run with feature flag. Update backends to verify MojoAuth JWTs instead of Cognito ID tokens behind a flag. Test in staging, then route a small percentage of production traffic.
3. Week 3: cutover and decommission. Roll traffic to 100% MojoAuth. Replace any Lambda triggers (PreSignUp, PostAuth, etc.) with MojoAuth webhooks. Keep the Cognito User Pool for two weeks as fallback before deletion.

Common pitfalls

• Identity Pool users (the temporary-credentials side of Cognito) do not have a clean MojoAuth analog. If you grant clients direct AWS access via Identity Pools, plan a redesign.
• Cognito custom attributes prefixed with `custom:` need mapping to MojoAuth user metadata. Audit which attributes are read by downstream code before cutover.
• Lambda triggers on PreSignUp, PostAuthentication, and PreTokenGeneration are common. Each needs a webhook equivalent on MojoAuth.