Which service should I use to authorize client applications running on desktops?

Question

Hello, I have a client application written in Java that is running as a desktop app. I want it to communicate with my API. The problem is I want to prevent unauthorized clients from to connecting the API. At first, I was considering using some kind of API keys, but then I thought that maybe IoT core will be a better option. I could authorize clients with certificates. 
What do you think, would that be the best choice?

Accepted Answer

Using AWS IoT Core to authenticate desktop apps is definitively an option. You can use X509 certificates which can be stored in the OS keychain, and you can also use the certificate to obtain temporary STS credentials in order to directly access AWS services in case MQTT protocol is not sufficient. With AWS IoT Core you can also leverage additional services like Device Defender, Registry, Fleet Indexing, which are not available when using API Gateway. Another main difference is that with AWS IoT Core you do not need to maintain a PKI infrastructure to manage the certificates.

You would still need to solve how the app obtains its unique certificate, one option being using Fleet provisioning.

You would still need to solve how the app obtains its unique certificate, one option being using [Fleet provisioning](https://docs.aws.amazon.com/iot/latest/developerguide/provision-wo-cert.html).

Answer

What about using Cognito for user authentication management?  
Simple authentication processes can be created with Cognito.  
https://aws.amazon.com/jp/cognito/

Which service should I use to authorize client applications running on desktops?

Relevant content