OAuth 2.0 Authorization code grant using AWS Cognito and Postman

The authorization code grant is the preferred method for authorizing end users. Instead of directly providing user pool tokens to an end user upon authentication, an authorization code is provided. This code is then sent to a custom application that can exchange it for the desired tokens. Because the tokens are never exposed directly to an end user, they are less likely to become compromised.

Use Amazon Cognito for user authentication (sign in, sign up, login with identity providers etc) in front of an Amazon API Gateway. Usually the API endpoints control access using Amazon Cognito user pools as authorizer

In these type of APIs, testing the API using Postman is a good practice. Use of Postman helps distributing the API contracts easily while helping you as a developer to run different types of tests without a full-blown client implementation.

[georgesmith]

Thank you - shows exactly what I needed in Postman. One suggestion - re-record the video with the new "Experience" from AWS. Sorry, they changed the UI ... AGAIN :). This will bring more views.

[carloscontreraschavez]

thank you Ravi, very good explanation

[georgesmith]

Great tutorial - gave you thumbs-up. Just one little detail that evaded me. On the diagram you showed the user clicking on a login link (top left), but then we seem to only simulate that click with postman, right? I don't think there was an actual link on a page that this end-user clicked. Thanks in advance for confirming.

[alejopaullier]

Thanks for this video Raavi. I have a question: once you get the access tokens, should they be stored to invoke subsequent API calls? I have been using the implicit grant flow so far, and as far as i understand, after getting access tokens these are stored in the browser's cookies for later calls. It does not come clear to me what to do with these tokens in the authorization code grant flow. Thanks a lot!