Automating DLT Trigger via API Gateway from GitHub Actions workflow fails with Authentication error

Question

Getting below error while trying to trigger DLT via API Endpoint 
I am trying to Configure AWS Creds, Upload JMX file to S3 bucket and Authenticating with Cognito to pass token in Header while Triggering DLT via API End point
{"message":"Invalid key=value pair (missing equal-sign) in Authorization header (hashed with SHA-256 and encoded with Base64): 'NKHXFUD5soOLtD/bYCimX1GTJHyvDTaLGI2WzBEzPyQ='."}

Below is part of my Workflow yml file

- name: Authenticate with Cognito and get token
       id: auth
       run: |
         TOKEN=$(aws cognito-idp initiate-auth \
           --auth-flow USER_PASSWORD_AUTH \
           --client-id ${{ secrets.DLT_COGNITO_CLIENT_ID }} \
           --auth-parameters USERNAME=${{ secrets.DLT_USERNAME }},PASSWORD=${{ secrets.DLT_PASSWORD }} \
           --region ${{ vars.AWS_REGION }} \
           --query 'AuthenticationResult.AccessToken' \
           --output text)
         TOKEN=$(echo "$TOKEN" | tr -d '
' | tr -d '' | xargs)
         if [ -z "$TOKEN" ] || [ "$TOKEN" = "None" ]; then
           echo "Failed to get Cognito token"
           exit 1
         fi
         echo "Token length: ${#TOKEN}"
         echo "Bearer token (first 50 chars): ${TOKEN:0:20}..."
         echo "token=$TOKEN" >> $GITHUB_OUTPUT
         echo "Successfully retrieved Cognito JWT"

- name: Trigger Load Test via DLT API
       id: trigger
       run: |
         TEST_ID="github-${{ github.run_id }}"
         TOKEN=${{ steps.auth.outputs.token }}
         PAYLOAD=$(jq -n \
           --arg id "$TEST_ID" \
           --arg file "test/loadTest/pharmconnect_api_perf.jmx" \
           --arg bucket "${{ steps.get-bucket.outputs.bucket }}" \
           --arg client_id "${{ secrets.CLIENT_ID }}" \
           --arg client_secret "${{ secrets.CLIENT_SECRET }}" \
           '{testId:$id, testPlan:$file, bucket:$bucket, taskCount:1, taskConcurrency:1, testDuration:2, jmeterProperties: { "client.id": $client_id, "client.secret": $client_secret }}')
         echo "Triggering load test $TEST_ID..."
         RESPONSE=$(curl -s -X POST "${{ steps.get-endpoint.outputs.endpoint }}" \
         -H "Authorization: Bearer ${TOKEN}" \
         -H "Content-Type: application/json" \
         -d "$PAYLOAD")
         echo "Response: $RESPONSE" 
         echo "test_id=$TEST_ID" >> $GITHUB_OUTPUT

re:Post Agent · Answer

The "Invalid key=value pair (missing equal-sign) in Authorization header" error you're encountering is related to how the Authorization header is being formatted when making the API Gateway request. This is a common issue when working with API Gateway authentication.

Based on your workflow, there are a few potential issues:

1. **Authorization Header Format**: The error suggests there's an issue with the format of your Authorization header. When using a Bearer token, the format should be exactly `Authorization: Bearer xxxxx` with a space between "Bearer" and the token. Check if there might be any extra spaces, line breaks, or special characters in your token.

2. **Token Processing**: Your workflow is attempting to clean the token by removing newlines and carriage returns, but there might still be some invisible characters or formatting issues. The error message indicates that the SHA-256 hash of your Authorization header doesn't match what's expected.

3. **API Gateway Configuration**: The API Gateway might be expecting a different authentication method. If it's configured to use AWS Signature Version 4 (SigV4) authentication rather than a simple Bearer token, you'll need to sign your request properly.

Here are some suggestions to fix the issue:

1. **Verify Token Format**: Double-check that your token doesn't contain any unexpected characters. You might want to add additional cleaning:
```
TOKEN=$(echo "$TOKEN" | tr -d '
' | tr -d '' | xargs)
```

2. **Modify the curl command**: Try explicitly setting the Authorization header with quotes:
```
curl -s -X POST "${{ steps.get-endpoint.outputs.endpoint }}" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d "$PAYLOAD"
```

3. **Check API Gateway Requirements**: If your API Gateway is configured to use AWS SigV4 authentication, you'll need to sign your request using the AWS credentials rather than just passing a Bearer token. In this case, you might need to use the AWS CLI or SDK to make the request instead of curl.

4. **Debug the Token**: Add a step to print out the exact Authorization header being sent (with sensitive parts redacted) to verify its format.

If you're certain that the API Gateway expects a Cognito JWT token as a Bearer token, then the issue is likely with how the token is being processed or formatted in your curl command. Make sure there are no extra characters or encoding issues with the token.  
**Sources**  
[API Gateway - Missing Authentication Token | AWS re:Post](https://repost.aws/questions/QU1J33gja1TJukhbKkjrgJ2Q/api-gateway-missing-authentication-token)  
[Troubleshoot Signature Version 4 signing for AWS API requests - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-troubleshooting.html)  
[Use InitiateAuth with an AWS SDK or CLI - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity-provider_example_cognito-identity-provider_InitiateAuth_section.html)

Automating DLT Trigger via API Gateway from GitHub Actions workflow fails with Authentication error

Add your answer

Relevant content