<p>I'm providing an external-facing REST GET API service in a kubernetes pod on AWS EKS. I had configured an ALB Ingress for this service which enforces Cognito user pool authentication. Cognito is configured with <code>Authorization code grant</code> with the <code>openid</code> OAuth scope enabled.</p>
<p>If I invoke my REST API from the browser, I get redirected to the Cognito login page. After a sucessful authentication on the form here, I can access my REST GET API just fine. This works, but this is not what I'd like to achieve.</p>
<p>Instead of this, I would need to use a <code>Bearer</code> token, after getting successfully authenticated. So first I invoke <a href="https://cognito-idp.ap-southeast-1.amazonaws.com" rel="noreferrer">https://cognito-idp.ap-southeast-1.amazonaws.com</a> using Postman with the request:</p>
<pre><code>    &quot;AuthParameters&quot; : {
        &quot;USERNAME&quot; : &quot;&lt;email&gt;&quot;,
        &quot;PASSWORD&quot; : &quot;&lt;mypass&gt;&quot;,
        &quot;SECRET_HASH&quot; : &quot;&lt;correctly calculated hash&gt;&quot;
    },
    &quot;AuthFlow&quot; : &quot;USER_PASSWORD_AUTH&quot;,
    &quot;ClientId&quot; : &quot;&lt;cognito user pool id&gt;&quot;
}
</code></pre>
<p>and I get a successful response like:</p>
<pre><code>  &quot;AuthenticationResult&quot;: {
    &quot;AccessToken&quot;: &quot;...&quot;,
    &quot;ExpiresIn&quot;: 3600,
    &quot;IdToken&quot;: &quot;...&quot;,
    &quot;RefreshToken&quot;: &quot;...&quot;,
    &quot;TokenType&quot;: &quot;Bearer&quot;
  },
  &quot;ChallengeParameters&quot;: {}
}
</code></pre>
<p>In the last step I'm trying to invoke my REST API service passing the <code>Authorization</code> HTTP header with the value <code>Bearer &lt;AccessToken&gt;</code> but I still get a HTML response with the login page.</p>
<p>How can I configure Cognito to accept my Bearer token for this call as an authenticated identity?</p>

<p>Quoting AWS support on this topic: &quot;the Bearer token can not be used instead of the session cookie because in a flow involving bearer token would lead to generating the session cookie&quot;.</p>
<p>So unfortunately this usecase is not possible to implemented as of today.</p>
