Use a bearer token authentication with OAuth or SAML to manage and share a central Amazon Cognito user pool across multiple Amazon API Gateway APIs.

Implement AWS IAM Identity Center (AWS Single Sign-On), and use an identity source of choice. Grant access to users and groups from other accounts by using permission sets that are assigned by account.

Create a unique IAM role for each external account. Create a trust policy using AWS Secrets Manager to create a random external key.

Create a unique IAM role for each external account. Create a trust policy that includes a condition that uses the sts:ExternalId condition key.