title: Using Cognito for REST API authentication
body: <p>I'm looking to use API Gateway + Lambda + Cognito User Pools to build a simple REST API.</p>
  
  <p>The API will be used in two ways. The first is to support a basic web app (hosted on CloudFront + S3). Authentication for the web application uses the hosted Cognito sign in / sign up flow and is working fine (with API Gateway setup to use the user pool authenticator).</p>
  
  <p>The second method will be for customers to use the REST API to communicate with the system.</p>
  
  <p>As an example, the client might use the web app to configure a workflow and then use an API to invoke that workflow.</p>
  
  <p>What is the recommended method of authenticating the API for use with backend services?</p>
  
  <p>Traditionally, I'd expect to use an API key + secret token for this purpose. I have no issue creating API keys in the API Gateway interface however I can't see anyway to link that to a specific user, nor can I see any method of specifying a secret token alongside the API key.</p>
  
  <p>And assuming the above is possible, how would I set it up in such a way that I could use the JWT-based approach for the web application and the API key + secret token for customers to use.</p>
  
  <p>EDIT: Additionally, I notice that app clients have an ID and a secret. Are they intended to be used for 3rd API-based-authentication (similar to how other systems make you create an app for API access)? I'm a bit skeptical because there's a limit of 25 per user pool, although it is a soft limit...</p>