Cognito Authorizer Token not working - returning Unauthorized

Question

I have set up a cognito authorizer for my API Gateway. What I am doing in my app is calling

```
const authToken = await fetchAuthSession().tokens.idToken.toString();

```
I am then passing that "authToken" value into my post request to my apiGateway which should authorize and enter the lambda my gateway is triggering

```
let restCall = post({
        apiName: "MY_API", // The name of my API Gateway
        path: "MY_PATH", // The name of my resource in the API Gateway
        options: {body:parameters},
        headers: {'Authorization': authToken, 'Content-Type': 'application/json'}
    });

const { body } = await restCall.response;
    const response = await body.json();
```

What I am getting back is an "unauthorized error". If I test the authorizer with that exact same authToken value I get a successful Response
Likewise in postman, by adding the "Authorization" header manually with the value being the idToken I have from the first line of code above

But no joy in my code. Does anyone have any idea what might be happening? Is there anything else that needs to get added to the post call in the code? I have also tried adding it using Bearer syntax i.e. "Authorization: Bearer MY_ID_TOKEN" Frustratingly all other topics I've found on this where were people were using the "access_token" instead of the "id_token", but I'm already using the id_token!

Note I have also already gone through the steps in [this troubleshooting post](https://repost.aws/knowledge-center/api-gateway-cognito-401-unauthorized)

DinoM · Accepted Answer

As WangQinYang has said, the headers are in the wrong place. Should be in the options object, as per documentation:

```
async function updateItem() {
  await del({
    apiName: 'myRestApi',
    path: 'items/1',
    options: {
      headers: {
        Authorization: authToken
      }
    }
  }).response;
}
```

https://docs.amplify.aws/gen1/javascript/build-a-backend/restapi/customize-authz/

qinyang.wang · Answer

Hi,

> What I am getting back is an "unauthorized error". If I test the authorizer with that exact same authToken value I get a successful Response Likewise in postman, by adding the "Authorizer" header manually with the value being the idToken I have from the first line of code above

You mentioned here that you added the "**Authorizer**" header when using Postman, but your code uses the ”**Authorization**“ header.

```
headers: {'Authorization': authToken, 'Content-Type': 'application/json'}
```

You say you can get a normal response with Postman, I think the id_token should be in effect, and would suggest checking what the difference is between the Postman configuration and the code.

Cognito Authorizer Token not working - returning Unauthorized

Add your answer

Relevant content