AWS Cognito web interface is a dumpster fire if you expose it to people outside a small team. A little buggy, but terrible if your brand is associated with their out-of-the-box web flow. Password resets, username collision issues due to capitalization, login flow state can throw error messages that users can’t comprehend or fix, etc will all bleed customer support time.

The APIs seem fine, but you still need to build a GUI to replace all of the flows.

Okta is a far more mature solution for something directly customer facing and supports better 2FA options.

I want to use cognito but the documentation is not good. For example, how do I use cognito to authorize against an api I wrote? It's not clear from the documentation.

You'd probably use a custom workflow backed by lambda functions that interact with your api: https://docs.aws.amazon.com/cognito/latest/developerguide/co...

As a rule I think if you feel you're outside the sweet spot of an AWS service before you start using it, I'd take that as a steer that it's probably not the right route to go.

It feels like someone's hackathon project that was accidentally deployed to production, and has been running ever since.