Authorization header.
Obtaining a Token
Using the CLI
The simplest way to get a token for development is using the CLI:Programmatic Token Generation (M2M)
For machine-to-machine authentication, use OAuth 2.0 client credentials flow with AWS Cognito:Using Your Token
Include the token in theAuthorization header:
Authentication Errors
401 Unauthorized
Returned when:- No token is provided
- The token is invalid or malformed
- The token has expired
403 Forbidden
Returned when the token is valid but lacks permission for the requested resource:Token Best Practices
- Store securely - Use environment variables or a secrets manager
- Rotate regularly - Tokens expire after 1 hour by default; refresh before expiry
- Never log tokens - Ensure your logging doesn’t capture authentication headers
- Use HTTPS in production - Tokens should never be sent over unencrypted connections