Cognito

Cognito identity verification provides instant Know Your Client (KYC) and Anti Money Laundering (AML) compliance, watchlist screening, and more, globally, with just a few lines of code.

In order to integrate Cognito with Relyance AI you will need your Cognito Subdomin, Key, and Secret.

In Cognito:

1. Login to your Cognito account.

2. Click on Settings in the bottom right-hand Account menu.

3. Select API Keys in the pop-up window's navigation.

4. Click the Provision New API Key button.

5. Add a meaningful name and click Provision API Key.

6. Copy the Key as your Cognito Key.
7. Click Reveal API Secret and copy this to be used as the Secret.
8. If you are using a trial account, your Subdomain will be ' sandbox ', otherwise it will be ' api '.

In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the Settings Menu in the bottom left-hand side.
3. Select Integrations.
4. Click on the Vendor Integration tab.
5. Find the Cognito integration card and click it to open its connections.
6. Under Authentication Method, choose Custom.
7. Paste the Subdomin, Key, and Secret into their respective fields.

The Authentication step asks for:

• Subdomain: required.
• Key: required; held as a secret.
• secret: required; held as a secret.

9. Click Authenticate.
10. At this point, you should see the following result on the Vendor Integrations page:

11. Congratulations, you are now connected to Cognito.

If the connection reports Connected but returns nothing

These are the ways this integration comes back empty without reporting an error. Generated from the integration catalog, so it tracks what the connection actually asks for.

1. A credential rotated at the vendor is not picked up here. Key and secret are stored when you save the connection, so regenerating the value at the vendor breaks the next scan until it is re-pasted here. Recording the expiry on the connection means Relyance warns you before it lapses.
2. Check the address fields before suspecting the credentials. Subdomain identifies which tenant, region or host to talk to. A wrong value there fails authentication and looks exactly like a bad secret.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "cognito" {
  vendor = "cognito"
  name   = "<your connection name>"

  auth = {
    method = "api-key"
    params = {
      subdomain = "sandbox"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      api-key = var.cognito_api_key
      api-secret = var.cognito_api_secret
    }
    secrets_wo_version = 1
  }

  scans = { "property-inspection" = { enabled = true } }
}