---
type: resource-type
title: UserPoolClient
description: aws resource type AWS::Cognito::UserPoolClient
name: UserPoolClient
lexicon: aws
resource_type: AWS::Cognito::UserPoolClient
---
`AWS::Cognito::UserPoolClient`, a resource type of the aws lexicon.

## Properties

- `UserPoolId` (`string`, required)
- `AccessTokenValidity` (`number`, optional)
- `AllowedOAuthFlows` (`string[]`, optional)
- `AllowedOAuthFlowsUserPoolClient` (`boolean`, optional)
- `AllowedOAuthScopes` (`string[]`, optional)
- `AnalyticsConfiguration` (`UserPoolClient_AnalyticsConfiguration`, optional)
- `AuthSessionValidity` (`number`, optional)
- `CallbackURLs` (`string[]`, optional)
- `ClientId` (`string`, optional)
- `ClientName` (`string`, optional)
- `ClientSecret` (`string`, optional)
- `DefaultRedirectURI` (`string`, optional)
- `EnablePropagateAdditionalUserContextData` (`boolean`, optional)
- `EnableTokenRevocation` (`boolean`, optional)
- `ExplicitAuthFlows` (`string[]`, optional)
- `GenerateSecret` (`boolean`, optional)
- `IdTokenValidity` (`number`, optional)
- `LogoutURLs` (`string[]`, optional)
- `Name` (`string`, optional)
- `PreventUserExistenceErrors` (`string`, optional)
- `ReadAttributes` (`string[]`, optional)
- `RefreshTokenRotation` (`UserPoolClient_RefreshTokenRotation`, optional)
- `RefreshTokenValidity` (`number`, optional)
- `SupportedIdentityProviders` (`string[]`, optional)
- `TokenValidityUnits` (`UserPoolClient_TokenValidityUnits`, optional)
- `WriteAttributes` (`string[]`, optional)

## Attributes

- `ClientId`
- `ClientSecret`
- `Name`

## Governed by

- [WAW051](/rules/WAW051.md): Cognito UserPoolClient allows the deprecated implicit OAuth grant