title: Unauthenticated user to authenticated user on AWS Cognito
body: <p>My code is here: <a href="https://stackoverflow.com/questions/33197019/switch-from-unauth-to-developer-authenticated-cognito-user-aws-ios-sdk">code</a>
  Reposted because I wanted to ask a more direct question. How do I switch between unauthenticated user and authenticated? My unauthenticated seems cached and I've used these methods:  </p>
  
  <pre><code>[credentialsProvider clearCredentials];
  [credentialsProvider clearKeychain];
  </code></pre>
  
  <p>before the rest of my api code and it still doesn't work. Any help is appreciated</p>
  
  <p>Note: I know it's not working because I make a call using lambda right after I switch up my configuration/credentials provider and only authorized users should be able to call this method. </p>
  
  <p>EDIT @behrooziAWS answer: </p>
  
  <p>API CODE:</p>
  
  <pre><code> id&lt;AWSCognitoIdentityProvider&gt; identityProvider = [[DeveloperIdentityProviderClass alloc] initWithRegionType:AWSRegionUSEast1
                                                                                                            identityId:nil
                                                                                  identityPoolId:@"SOMEIDENTITYPOOLID"
                                                                                  logins:@{@"MYIDENTITYPROVIDERNAME": @"MYUSERNAME"}
                                                                                         providerName:@"MYIDENTITYPROVIDERNAME"
                                                                                                      ];
  [credentialsProvider setIdentityProvider:identityProvider];
  [credentialsProvider setLogins:@{@"MYIDENTITYPROVIDERNAME": @"MYUSERNAME"}];
  
  [[credentialsProvider refresh] continueWithBlock:^id(BFTask *task){
      [self testAuth];
      return [BFTask taskWithResult:nil];
  }];
  </code></pre>
  
  <p>Full Error: 
  BusyTime[27043:7097936] AWSiOSSDKv2 [Verbose] AWSURLResponseSerialization.m line:87 | -[AWSJSONResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response body: [{"message":"The security token included in the request is invalid."}]
  2015-10-20 08:51:17.280 BusyTime[27043:7097936] Error: Error Domain=com.amazonaws.AWSLambdaErrorDomain Code=0 "The operation couldn’t be completed. UnrecognizedClientException" UserInfo=0x7ff27ab41150 {NSLocalizedFailureReason=UnrecognizedClientException, responseStatusCode=403, message=The security token included in the request is invalid., responseHeaders={type = immutable dict, count = 6,</p>
  
  <p>IMPORTANT EDIT: I've hardcoded my refresh to use a working token and identityId. so:</p>
  
  <pre><code>self.identityId = @"someID";
  self.token = @"someToken";
  return [super getIdentityId];
  </code></pre>
  
  <p>and then ALL my code is working. But obviously this isn't sustainable, I need to be able to make a call to aws lambda to refresh my credentials. But when I set my identity provider, and set my login, I think it's changing me to my authenticated version, but I need to be in unauthenticated to call aws lambda. <strong>Please refer to my code link above</strong> and take a look at my refresh method to understand what I'm poorly trying to describe. Also please let me know if this should go in a new thread as this is a slightly different question. Not so familiar with stackoverflow's policies on questions. </p>
  
  <p>Another error: [{"Message":"User: arn:aws:sts::445291524102:assumed-role/Cognito_BusyTimeAuth_Role/CognitoIdentityCredentials is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-east-1:445291524102:function:login"}], SO now I'm assuming my auth provider for my refresh which is incorrect login flow. I'm thinking that I switch this up so that I login in my API class. When I return my identity ID and token, I save them to keychain. Finally, I use the above API code to switch my logins and in my refresh method, I simply return what I found in my keychain. The only problem is I'm not sure if this flow is correct because it doesnt actually "refresh" as I'm not calling my backend. I was wondering if I could wrap the refresh by changing back and forth from my unauth role to my auth role but this seems messy. </p>