Error with Cognito Access Tokens after authorization

Question

After I sign in in the user pool and get assign the access and refresh tokens. If I use the access tokens on any cognito related task it returns Invalid access token or Access token revoked. Just realize about this a couple ours ago. I looked at  Aws Health but not issue was notified about Cognito. Does anyone else had this problem?? If so, have you find a way to fix it?

yunganw · Accepted Answer

It should not revoke the tokens after the revoke operation.
You may test with AWS CLI to see whether that's the case. 
If this revoke is reproducible via CLI, I assume the flow would be 
- sign-in
- revoke/logout
- sign-in 
- new assigned access token also revoked.

Then Provide the timestamp and CLI log to the AWS support team for troubleshooting the root cause.

If you find CLI is hard to reproduce, can record a HAR file of the browser http requests. Meanwhile, it would worth to cross check AWS CloudTrail to ensure there is no other operations like logout/revoke in the middle of the test which affects the new gained tokens.

yunganw · Answer

If the error is 'revoked', check somewhere in your application or settings where could be possibly called revoke token or globalSignOut api. Amplify SDK signOut api may cause this triggered in some conditions as well.
- https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html

For 'invalid', you may use some tool, eg. jwt.io, to decode the token content and check the claim values - including expiration time, aud, issuer, to ensure they are valid.

re:Post Agent · Answer

If you're experiencing "Invalid access token" or "Access token revoked" errors with your Cognito access tokens, there are several possible causes:

1. The token may have been explicitly revoked. If you or someone else called the GlobalSignOut or AdminUserGlobalSignOut operations for the user, all tokens (identity, access, and refresh) would be invalidated. These operations are typically called when a user signs out of your application.

2. The token may have been revoked through the /oauth2/revoke endpoint. This endpoint revokes not only the access token but also the refresh token and all subsequent tokens derived from it.

3. The token may have expired. Access tokens have a limited lifespan, and you would need to use the refresh token to obtain new valid tokens.

4. You might be using the token for operations that require specific scopes. For example, some operations require the access token to contain the scope "aws.cognito.signin.user.admin".

To resolve this issue:

- Check if the token has expired and use the refresh token to obtain new tokens if needed
- Verify that you haven't inadvertently triggered a sign-out operation
- Ensure you're using the correct token type for your operations
- Confirm that your token has the necessary scopes for the operations you're attempting

If the issue persists and you've verified these aspects, it might be worth contacting AWS Support as there could be an underlying service issue not yet reported in the AWS Health Dashboard.  
**Sources**  
[AdminUserGlobalSignOut - Amazon Cognito User Pools](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.html)  
[GlobalSignOut - Amazon Cognito User Pools](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html)  
[The token revocation endpoint - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/revocation-endpoint.html)

Error with Cognito Access Tokens after authorization

Add your answer

Relevant content