Angular app login to cognito using PKCE then call my API

user_1024941 0
Viewed 677

I have an existing angular app that uses angular-oauth2-oidc to connect to a locally hosted identity server. I have stripped out the angular-oauth2-oidc components and implemented a connection to AWS Cognito (using Amplify) to let users login. The app client settings in the AWS Userpool have been set to authorization code grant.

I can login to my application, but my api isn't authorised to run. It's taken me a month to get this far and I'm still not sure what I'm doing.

What I want to do is login to Cognito using PKCE and be able to call my api endpoints.

I can't find any examples to do what I want to do. Surely this is a common scenario. Can anyone provide me with some guidance on how to do this? An example?

aws-amplify amazon-cognito angular
1 Answers

You'll need the Authorization Code grant type and a hosted UI for signing in with your OIDC provider. Although it's not clearly stated in the docs, Amplify will automatically use PKCE if the Cognito User Pool client does not contain a secret (as is the case with SPA apps).

If you inspect your network requests, you should see a grant_type=authorization_code along with code=AUTHORIZATION_CODE and code_verifier=CODE_VERIFIER uri params when hitting the token endpoint

user_9924530
Related