Define authorization rules

When working with a REST endpoint, you may need to set request headers for authorization purposes. This is done by passing a custom_header function into the configuration:

1Amplify.configure({
2  API: {
3    endpoints: [
4      {
5        name: 'sampleCloudApi',
6        endpoint: 'https://xyz.execute-api.us-east-1.amazonaws.com/Development',
7        custom_header: async () => {
8          return { Authorization: 'token' };
9          // Alternatively, with Cognito User Pools use this:
10          // return { Authorization: `Bearer ${(await Auth.currentSession()).getAccessToken().getJwtToken()}` }
11          // return { Authorization: `Bearer ${(await Auth.currentSession()).getIdToken().getJwtToken()}` }
12        }
13      }
14    ]
15  }
16});

Note related to use Access Token or ID Token

The ID Token contains claims about the identity of the authenticated user such as name, email, and phone_number. It could have custom claims as well, for example using Amplify CLI. On the Amplify Authentication category you can retrieve the Id Token using:

1(await Auth.currentSession()).getIdToken().getJwtToken();

The Access Token contains scopes and groups and is used to grant access to authorized resources. This is a tutorial for enabling custom scopes.. You can retrieve the Access Token using

1(await Auth.currentSession()).getAccessToken().getJwtToken();

Customizing HTTP request headers

To use custom headers on your HTTP request, you need to add these to Amazon API Gateway first. For more info about configuring headers, please visit Amazon API Gateway Developer Guide

If you have used Amplify CLI to create your API, you can enable custom headers by following above steps:

1. Visit Amazon API Gateway console.
2. On Amazon API Gateway console, click on the path you want to configure (e.g. /{proxy+})
3. Then click the Actions dropdown menu and select Enable CORS
4. Add your custom header (e.g. my-custom-header) on the text field Access-Control-Allow-Headers, separated by commas, like: 'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,my-custom-header'.
5. Click on 'Enable CORS and replace existing CORS headers' and confirm.
6. Finally, similar to step 3, click the Actions drop-down menu and then select Deploy API. Select Development on deployment stage and then Deploy. (Deployment could take a couple of minutes).

Unauthenticated Requests

You can use the API category to access API Gateway endpoints that don't require authentication. In this case, you need to allow unauthenticated identities in your Amazon Cognito Identity Pool settings. For more information, please visit Amazon Cognito Developer Documentation.

Cognito User Pools Authorization

You can use the JWT token provided by the Authentication API to authenticate against API Gateway directly when using a custom authorizer.

1async function postData() {
2  const apiName = 'MyApiName';
3  const path = '/path';
4  const myInit = {
5    headers: {
6      Authorization: `Bearer ${(await Auth.currentSession())
7        .getIdToken()
8        .getJwtToken()}`
9    }
10  };
11
12  return await API.post(apiName, path, myInit);
13}
14
15postData();

Note that the header name, in the above example 'Authorization', is dependent on what you choose during your API Gateway configuration.

Token-based Lambda authorization

You need to provide an authorization token to authenticate against API Gateway when using token-based Lambda authorizer

1async function postData() {
2  const apiName = 'MyApiName';
3  const path = '/path';
4  const myInit = {
5    headers: {
6      Authorization: 'Authorization_token'
7    }
8  };
9
10  return await API.post(apiName, path, myInit);
11}
12
13postData();

Note that the header name, in the above example Authorization, is dependent on what you choose during your API Gateway configuration.