In many AWS architectures, everything begins smoothly: API Gateway connects to Cognito, the built-in REST authorizer handles ID token validation, and user-based authentication works exactly as expected.
But then a new pattern emerges — services start talking to other services. Automation increases. Backend workflows grow. And suddenly, a quiet gap in the architecture becomes impossible to ignore.
Machine-to-machine clients don't use ID tokens. They rely entirely on Access Tokens.
And that's where the friction appears: API Gateway's native authorizer refuses to validate Access Tokens, leaving internal service calls without a clean authentication path. A small mismatch, but one that can block entire integration flows.
The solution
Instead of relying solely on Cognito's built-in authorizer, a custom Lambda Authorizer steps in:
- Validates Cognito-issued Access Tokens
- Checks signature, issuer, audience, expiry, and scopes
- Supports flexible authorization logic
- Unifies token strategy across all consumers