Need help?

Our experts have had an average response time of 12.14 minutes in September 2021 to fix urgent issues.

We will keep your servers stable, secure, and fast at all times for one fixed price.

How to fix 401 unauthorized error AWS rest API

by | Nov 5, 2021

Wondering how to fix 401 unauthorized error AWS rest API? We can help you.

As part of our Server Management Services, we assist our customers with several AWS queries.

Today, let us see how our Support techs proceed to perform it.

How to fix 401 unauthorized error AWS rest API?

Today, let us see the steps followed by our Support Techs to resolve it.

Check the authorizer’s configuration on the API method

1.Firstly, in the API Gateway console, on the APIs pane, choose the name of your API.

2.In the left navigation pane, choose Authorizers under your API.

3.Then, review the authorizer’s configuration and confirm that the following is true:

  • The user pool ID matches the issuer of the token.
  • And the API is deploy.
  • The authorizer works in test mode.

Please note if you can’t invoke your API after confirming the authorizer’s configuration on the API method, check the validity of the security token.

Check the validity of the security token

When you check the validity of the security token, confirm that the following is true:

  • Firstly, the security token isn’t expire.
  • Secondly, the issuer in the security token matches the Amazon Cognito user pool configure on the API.
  • Then, the ID token and access token string values are valid.

Please note if the string values are valid, you can then decode the tokens.

If the tokens aren’t valid, make sure that no spaces were added in the tokens when they were pass in the request header.

Important: If there are no additional scopes configured on the API Gateway method, make sure that you’re using a valid ID token.

If additional scopes are configured on the API Gateway method, confirm that you’re using a valid access token.

Example security token payload

Id token payload:
{
"sub": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"aud": "xxxxxxxxxxxxexample",
"email_verified": true,
"token_use": "id",
"auth_time": 1500009400,
"iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_example",
"cognito:username": "janedoe",
"exp": 1500013000,
"given_name": "Jane",
"iat": 1500009400,
"email": "[email protected]"
}
Access token payload:
{
"auth_time": 1500009400,
"exp": 1500013000,
"iat": 1500009400,
"iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_example",
"scope": "aws.cognito.signin.user.admin",
"sub": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"token_use": "access",
"username": "[email protected]"
}

Note the following claim names in the example security token payload:

token_use indicates the type of token (ID or access token).
exp indicates the token’s expiration time.
Coordinated Universal Time (UTC).
auth_time indicates when the token was issue.
iss indicates the domain of the user pool that issue the tokens.

Important: Make sure that the token you’re using matches the user pool configure on the API Gateway method.

If you’re still unable to invoke the API, confirm that you’re using the authorization header correctly.

If you’re using Postman to invoke the API

Use Oauth 2.0 authorization mode to use Amazon Cognito tokens directly.

When you set up Oauth 2.0 authorization mode, confirm that the following is true:

  • Firstly, grant type is Authorization code or Authorization implicit, following your configuration on the user pool’s app client.
  • Then, the callback URL matches the redirected URL configured on the user pool’s app client.
  • The Auth URL is in the following format:
https://mydomain.auth.us-east-1.amazoncognito.com/login

Important: Replace mydomain with the domain name that you’re using to configure your user pool.

Make sure that you enter the correct AWS Region your API is host in.

  • Client ID is the user pool’s app client ID.

Please note if a client secret is associate with the user pool’s app client, make sure that you specify the client secret in the Authorization tab in the client secret field.

If no client secret is associate with the user pool’s app client, leave the client secret field blank.

  • Scope is configured as openid.

Please note the openid scope must allow on the user pool’s app client as well.

  • Then, the correct Amazon Cognito user pool token endpoint is entered for authorization code flow.

Example Amazon Cognito user pool token endpoint

https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/token

Note: Postman might not pass the require content type to the token endpoint, which results in a 405 error.

However, you don’t receive the 504 error when you use implicit flow.

[Stuck in between? We’d be glad to assist you]

Conclusion

In short, today we saw steps followed by our Support Techs to fix 401 unauthorized error AWS rest API.

PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

GET STARTED

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Privacy Preference Center

Necessary

Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

PHPSESSID - Preserves user session state across page requests.

gdpr[consent_types] - Used to store user consents.

gdpr[allowed_cookies] - Used to store user allowed cookies.

PHPSESSID, gdpr[consent_types], gdpr[allowed_cookies]
PHPSESSID
WHMCSpKDlPzh2chML

Statistics

Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

_ga - Preserves user session state across page requests.

_gat - Used by Google Analytics to throttle request rate

_gid - Registers a unique ID that is used to generate statistical data on how you use the website.

smartlookCookie - Used to collect user device and location information of the site visitors to improve the websites User Experience.

_ga, _gat, _gid
_ga, _gat, _gid
smartlookCookie

Marketing

Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

IDE - Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.

test_cookie - Used to check if the user's browser supports cookies.

1P_JAR - Google cookie. These cookies are used to collect website statistics and track conversion rates.

NID - Registers a unique ID that identifies a returning user's device. The ID is used for serving ads that are most relevant to the user.

DV - Google ad personalisation

IDE, test_cookie, 1P_JAR, NID, DV, NID
IDE, test_cookie
1P_JAR, NID, DV
NID
hblid

Security

These are essential site cookies, used by the google reCAPTCHA. These cookies use an unique identifier to verify if a visitor is human or a bot.

SID, APISID, HSID, NID, PREF
SID, APISID, HSID, NID, PREF