Wondering how to fix 401 unauthorized error AWS rest API? We can help you.

As part of our Server Management Services, we assist our customers with several AWS queries.

Today, let us see how our Support techs proceed to perform it.

How to fix 401 unauthorized error AWS rest API?

Today, let us see the steps followed by our Support Techs to resolve it.

Check the authorizer’s configuration on the API method

1.Firstly, in the API Gateway console, on the APIs pane, choose the name of your API.

2.In the left navigation pane, choose Authorizers under your API.

3.Then, review the authorizer’s configuration and confirm that the following is true:

• The user pool ID matches the issuer of the token.
• And the API is deploy.
• The authorizer works in test mode.

Please note if you can’t invoke your API after confirming the authorizer’s configuration on the API method, check the validity of the security token.

Check the validity of the security token

When you check the validity of the security token, confirm that the following is true:

• Firstly, the security token isn’t expire.
• Secondly, the issuer in the security token matches the Amazon Cognito user pool configure on the API.
• Then, the ID token and access token string values are valid.

Please note if the string values are valid, you can then decode the tokens.

If the tokens aren’t valid, make sure that no spaces were added in the tokens when they were pass in the request header.

Important: If there are no additional scopes configured on the API Gateway method, make sure that you’re using a valid ID token.

If additional scopes are configured on the API Gateway method, confirm that you’re using a valid access token.

Example security token payload

Id token payload:

{
"sub": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"aud": "xxxxxxxxxxxxexample",
"email_verified": true,
"token_use": "id",
"auth_time": 1500009400,
"iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_example",
"cognito:username": "janedoe",
"exp": 1500013000,
"given_name": "Jane",
"iat": 1500009400,
"email": "janedoe@example.com"
}

Access token payload:

{
"auth_time": 1500009400,
"exp": 1500013000,
"iat": 1500009400,
"iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_example",
"scope": "aws.cognito.signin.user.admin",
"sub": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"token_use": "access",
"username": "janedoe@example.com"
}

Note the following claim names in the example security token payload:

token_use indicates the type of token (ID or access token).
exp indicates the token’s expiration time.
Coordinated Universal Time (UTC).
auth_time indicates when the token was issue.
iss indicates the domain of the user pool that issue the tokens.

Important: Make sure that the token you’re using matches the user pool configure on the API Gateway method.

If you’re still unable to invoke the API, confirm that you’re using the authorization header correctly.

If you’re using Postman to invoke the API

Use Oauth 2.0 authorization mode to use Amazon Cognito tokens directly.

When you set up Oauth 2.0 authorization mode, confirm that the following is true:

• Firstly, grant type is Authorization code or Authorization implicit, following your configuration on the user pool’s app client.
• Then, the callback URL matches the redirected URL configured on the user pool’s app client.
• The Auth URL is in the following format:

https://mydomain.auth.us-east-1.amazoncognito.com/login

Important: Replace mydomain with the domain name that you’re using to configure your user pool.

Make sure that you enter the correct AWS Region your API is host in.

• Client ID is the user pool’s app client ID.

Please note if a client secret is associate with the user pool’s app client, make sure that you specify the client secret in the Authorization tab in the client secret field.

If no client secret is associate with the user pool’s app client, leave the client secret field blank.

• Scope is configured as openid.

Please note the openid scope must allow on the user pool’s app client as well.

• Then, the correct Amazon Cognito user pool token endpoint is entered for authorization code flow.

Example Amazon Cognito user pool token endpoint

https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/token

Note: Postman might not pass the require content type to the token endpoint, which results in a 405 error.

However, you don’t receive the 504 error when you use implicit flow.

[Stuck in between? We’d be glad to assist you]

Conclusion

In short, today we saw steps followed by our Support Techs to fix 401 unauthorized error AWS rest API.