Best way to verify signature of ID Token from Cognito


I have a lambda that gets username from the ID token passed to it. But I want to know the best practice safety mechanism to put in place security concerns are addressed. So how can I verify the Id_token is from the same user the ID Token is supposed to be coming from. I know calling the getuser api with acesstoken is not a good method. What should be the best way here to verify the id?

1 Answer
Accepted Answer


the best way to verify the id token is to use an OIDC, OAuth2, or JWT library.

those library will get the public key from the JWKS endpoint associated with the issuer of the token and validate the signature. Then it will validates that the token is in its valid time boundaries (not before, not after). You can generally add additional checks on claims values, scopes, and client id value.

We provide the following library to help you with that:


answered 10 months ago
profile picture
reviewed 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions