Question

A developer builds a mobile app that authenticates users with an Amazon Cognito user pool. The app receives ID, access, and refresh tokens after login. Users complain that they are forced to log in again every hour, which harms the user experience. The developer wants users to stay signed in for up to 30 days without re-entering credentials, while keeping short-lived access tokens for API calls. What is the correct approach?

Accepted Answer

Keep the default 1-hour access token expiration and use the refresh token (with its validity set to 30 days) to obtain new access and ID tokens.

Answer

Increase the access token and ID token validity to 30 days in the user pool app client settings.

Answer

Store the user's password in the device keychain and silently re-authenticate with the InitiateAuth USER_PASSWORD_AUTH flow every hour.

Answer

Configure an identity pool to issue temporary AWS credentials that last 30 days so the app never needs new Cognito tokens.