createUserPoolClient does NOT persist AllowedOAuthScopes unless followed by updateUserPoolClient #3228
Description
Describe the bug
When creating a Cognito User Pool App Client using the PHP SDK (CognitoIdentityProviderClient::createUserPoolClient), the AllowedOAuthScopes field is silently ignored.
The call does not fail.
The client is created successfully.
But the OAuth scopes are not stored in the app client.
However, if I immediately call:
updateUserPoolClient([... 'AllowedOAuthScopes' => [...] ])
—then the scopes do get persisted correctly.
The behavior is consistent and reproducible.
This suggests either:
- A bug in the AWS SDK for PHP,
- Or a mismatch between SDK expectations and Cognito’s backend API behavior.
Regression Issue
- Select this option if this issue appears to be a regression.
Expected Behavior
When calling:
$client->createUserPoolClient([ 'UserPoolId' => 'us-east-1_XXXX', 'ClientName' => 'TestClient', 'AllowedOAuthFlowsUserPoolClient' => true, 'AllowedOAuthFlows' => ['client_credentials'], 'AllowedOAuthScopes' => ['my-api/write'], ])
The created app client should contain:
"AllowedOAuthScopes": ["my-api/write"]
Current Behavior
The app client is created, but:
AllowedOAuthScopes is missing.
No exception is thrown.
describeUserPoolClient confirms the scopes were never stored.
Only after explicitly calling:
updateUserPoolClient(['AllowedOAuthScopes' => ['my-api/write']])
does Cognito persist the scope.
This means the only reliable way to set scopes is:
createUserPoolClient → updateUserPoolClient
Which should not be necessary.
Reproduction Steps
`$client = new CognitoIdentityProviderClient([
'region' => 'eu-west-3',
'version' => 'latest',
'credentials' => [
'key' => 'XXX',
'secret' => 'XXX',
],
]);
$result = $client->createUserPoolClient([
'UserPoolId' => $userPoolId,
'ClientName' => 'ExampleClient',
'GenerateSecret' => true,
'AllowedOAuthFlowsUserPoolClient' => true,
'AllowedOAuthFlows' => ['client_credentials'],
'AllowedOAuthScopes' => ['civ-regulation-api/write'],
]);
$desc = $client->describeUserPoolClient([
'UserPoolId' => $userPoolId,
'ClientId' => $result['UserPoolClient']['ClientId'],
]);
var_dump($desc['UserPoolClient']['AllowedOAuthScopes']);
`
Possible Solution
No response
Additional Information/Context
No response
SDK version used
3 (latest)
Environment details (Version of PHP (php -v)? OS name and version, etc.)
php 8.4 on macbook M1 with macOS version 15.6.1