如何在没有应用程序客户端密钥的情况下使用 Cognito OAuth 2.0 对 API 网关请求进行身份验证？

Question

I'm using aws sdk to manage logins and signups on my app and the sdk requires my app client to have no secret key. This is a problem since I intend to use Cognito to authenticate the API gateway. I tried to enable OAuth 2.0 client credentials flow on app client settings, select a scope and give it to the API method, but when I try to save the app client settings I get:

"We were unable to update your App Configuration: client_credentials flow can not be selected if client does not have a client secret. (Service: AWSCognitoIdentityProviderService; Status Code: 400; Error Code: InvalidOAuthFlowException"

Is there a better way to configure API Gateway with Cognito? Am I doing something wrong?

Answer 1

You need to create a new app client for your API with a secret.

front end client - app client with out secret Backend client / api - app client with secret

Client credentials is a usually a method for service-service authentication. You have to store the secret securely.therefore insecure to use in an unsafe front end app such as an html website.

Hope this helps.

Answer 2

To add to Arun's answer, the API should not need a Cognito OAuth client entry and just needs to validate received Cognito access tokens.

Typically this is done by downloading JWKS keys from Cognito - and API Gateway has a setting that automatically does this.

I can provide further details if you run into problems identifying the user after token validation.