SAM Cognito authorization error

My template.yaml:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  sam-myshop
  
  Sample SAM Template for sam-myshop

Globals:
  Function:
    Timeout: 5
    MemorySize: 128

Parameters:
  CognitoDomain:
    Type: String
    MinLength: "3"
    MaxLength: "63"
    AllowedPattern: ^[a-z0-9](?:[a-z0-9\-]{0,61}[a-z0-9])?$
    Description: Enter a string. Must be alpha numeric 3-63 in length.

Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      AliasAttributes:
        - email
      AutoVerifiedAttributes:
        - email
      EmailConfiguration:
        EmailSendingAccount: COGNITO_DEFAULT
        SourceArn: <ARN of SES>
      UserPoolName: !Sub ${CognitoDomain}-user-pool
      Schema:
        - Name: email
          AttributeDataType: String
          Mutable: false
          Required: true
        - Name: name
          AttributeDataType: String
          Mutable: true
          Required: true
  
  UserPoolClient:
    DependsOn: MyShopApi
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref UserPool
      AllowedOAuthFlowsUserPoolClient: true
      CallbackURLs:
        - !Sub "https://${MyShopApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/locations"
      AllowedOAuthFlows:
        - code
        - implicit
      AllowedOAuthScopes:
        - phone
        - email
        - openid
        - profile
        - aws.cognito.signin.user.admin
      SupportedIdentityProviders:
        - COGNITO
  UserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: !Ref CognitoDomain
      UserPoolId: !Ref UserPool
  
  MyShopApi:
    DependsOn: UserPool
    Type: AWS::Serverless::Api
    Properties:
      Name: MyShopApi
      StageName: Prod
      Cors:
        AllowMethods: "'*'"
        AllowHeaders: "'*'"
        AllowOrigin: "'*'"
      Auth:
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !GetAtt UserPool.Arn
  FunctionLocations:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/locations
      Handler: locations
      Runtime: go1.x
      Architectures:
        - x86_64
      Events:
        CatchAll:
          Type: Api
          Properties:
            RestApiId: !Ref MyShopApi
            Path: /locations
            Method: GET
            Auth:
              Authorizer: CognitoAuthorizer
      Environment:
        Variables:
          PARAM1: VALUE


  FunctionUsers:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/users
      Handler: locations
      Runtime: go1.x
      Architectures:
        - x86_64
      Events:
        CatchAll:
          Type: Api
          Properties:
            RestApiId: !Ref MyShopApi
            Path: /users
            Method: GET
      Environment:
        Variables:
          PARAM1: VALUE

Outputs:
  UserPoolId:
    Description: "Id for MyShop user pool"
    Value: !Ref UserPool
  ApiEndpoint:
    Description: "URL of API"
    Value:  !Sub "https://${MyShopApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/locations"
  HostedUIURL:
    Value: !Sub https://${CognitoDomain}.auth.${AWS::Region}.amazoncognito.com/login?client_id=${UserPoolClient}&response_type=token&scope=email+openid+phone+profile&redirect_uri=https://${MyShopApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/locations
    Description: The hosted UI URL

After signin, I'm getting error {"message":"Unauthorized"}

please help. thanks