Trouble get access to API GAteway with Cognito UserPool

Question

Currently Iam confused about access the API Gateway with Cignito UserPool.
In my mind I have to get an access token from Cognito to get access to the API Gateway. For this I use:

```
curl -X POST -H "content-type: application/x-www-form-urlencoded" --data grant_type=client_credentials --data Authorization="Basic mybase64" --data client_id= --data scope=openid https://auth.eu-central-1.amazoncognito.com/oauth2/token
```
Also tried

```
curl -X POST -H "content-type: application/x-www-form-urlencoded" -H "Authorization=Basic mybase64" --data grant_type=client_credentials  --data client_id= --data scope=openid https://.auth.eu-central-1.amazoncognito.com/oauth2/token
```
But whatever I tried I get an` {"error":"invalid_client"}` back. What is the well working curl method to get the Bearer Token for API Access?

Answer

You can use the following curl command to exchange an authorization code for tokens:

```bash
curl -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Authorization: Basic " \
  --data "grant_type=client_credentials&client_id=&scope=openid" \
  "https://.auth.eu-central-1.amazoncognito.com/oauth2/token"
```
Replace the placeholders with your actual values. For more details, you can refer to the [Cognito Token Endpoint](https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html#post-token).

#### Expected result:
```bash
HTTP/1.1 200 OK
                            Content-Type: application/json
                            
                            {
                            "access_token":"eyJra1example", 
                            "token_type":"Bearer", 
                            "expires_in":3600
                            }
```

Answer

For me I still get the error {"error":"invalid_client"}
I rechecked all the data again. Like base64 string, This is the user inside the user pool, login and password, this is confirmed. The cognito URL is good and the cognito client_id is the one I can find on App client page und Client ID (Above Clients Secret)

After some reading I tried to use for Authorization: Basic  the  "clientid:clientsecret" from the cognito client (bas64)  now I get an {"error":"invalid_grant"}.

Sorry, but I read that an "Expert" has approved the above answer but nothing works in my try outs. Isn't there a clear, undestandable and working sample somewhere in the AWS word?

Trouble get access to API GAteway with Cognito UserPool

Expected result:

Relevant content