How to authentic/authorize a backend API for non browser clients in AWS Cognito service?

user_5798431 0
Viewed 159

I am working on a NodeJS application which exposes some APIs. This APIs can be accessed by different vendors (Without any browser). Now I want to know what is the best way to Authentic/Authorize these vendors using AWS Cognito service?

  1. Should I give a client ID (Username) and API_KEY (Password) to my vendors and Validate it through cognito for every subsequent requests. (As of now it is already implemented from the Database) [OR]
  2. Should I generate a access and Id token for the vendor with MAX validity and give it to the vendor. (I understand this isn't the best practice)

So what should be the best way to achieve this?

amazon-cognito amazon-web-services
1 Answers

Define app clients in your user pool, one for each of the "foreign" servers. When you create them Cognito will generate an app client id and a secret (if you check that box...and you should check it). In "App client settings" (AWS Console for Cognito) you tell it the client will use "Client credentials." Finally, define whatever custom scopes you think you can leverage to provide finer control of access. These can be different for each client.

Now the foreign server can authenticate/get-authorization by passing in the app client id and the secret, etc., etc. Usual Cognito stuff.

user_45889580
Related