title: Adding a User Sign-in for Mobile App on a serverless backend on AWS
body: <p>i am creating a mobile app for multiple platforms (iOS, Android, PWA (Web)) and have my backend build with the serverless framework on AWS Lambda, using API Gateway and DynamoDb.</p>
  
  <p>My most recent goal is to add a user login using AWS Cognito, enabling my users to either login using their email and password, or a facebook login. I read multiple threads, tutorials and the official AWS Documentation but am super confused because of the mass of different information.</p>
  
  <p>I want to integrate authorized API Endpoints which can only be called when the user is logged in. </p>
  
  <p>Therefore my first question is:</p>
  
  <p><strong>1) Should i rather use AWS Cognito User Pools or AWS Cognito Identity Pools?</strong> </p>
  
  <p>I also read that for user pools you can solely use the hosted UI for login, which is not a possibility for my app. I want to style my own login page.</p>
  
  <p>As i could not find any sample code for the client side integration, i went with identity Pools for now, and created an endpoint in my serverless.yml which is specified the following:</p>
  
  <pre><code>functions:
    xxx-auth:
      handler: endpoints/xxx-auth.execute
      events:
        - http: 
            path: xxx-auth
            method: put
            cors: true
            integration: lambda
            authorizer: aws_iam
  </code></pre>
  
  <p>So my second question is:</p>
  
  <p><strong>2) How do i properly integrate the authorization for my Cognito Identity Pool or User Pool?</strong></p>
  
  <p>From another Thread i read that there is the possibility to generate an SDK for the API one created on API Gateway, which handles the signature procedures of the request for you. As i tried to do so in my iOS application, i first log the user in using the following code:</p>
  
  <pre><code>let credentialsProvider = AWSCognitoCredentialsProvider(regionType: .EUCentral1 ,
                                                              identityPoolId:"eu-central-1:XXXXXXXX" ,
                                                              identityProviderManager: CustomIdentityProvider(tokens: ["graph.facebook.com": FBSDKAccessToken.current().tokenString]))
      let configuration = AWSServiceConfiguration(region: .EUCentral1, credentialsProvider: credentialsProvider)
      AWSServiceManager.default().defaultServiceConfiguration = configuration
  </code></pre>
  
  <p>and then use the following created code to submit the PUT request:</p>
  
  <pre><code>public func XXXPut() -&gt; AWSTask&lt;AnyObject&gt; {
      let headerParameters = [
                 "Content-Type": "application/json",
                 "Accept": "application/json",
  
              ]
  
      let queryParameters:[String:Any] = [:]
  
      let pathParameters:[String:Any] = [:]
  
      return self.invokeHTTPRequest("PUT", urlString: "/XXX", pathParameters: pathParameters, queryParameters: queryParameters, headerParameters: headerParameters, body: nil, responseClass: nil)
  }
  </code></pre>
  
  <p>But i cannot see any code that signs the HTTP request. Therefore the third question is:</p>
  
  <p><strong>3) How do i create the SDK that properly sends the signed HTTP request to my API Gateway backend?</strong></p>
  
  <p>I also tried the same for Cognito User Pools, using a simple "Authorization" header, but could not figure out a way to obtain the respective Authorization token on the iOS application without using any kind of hosted UI.</p>
  
  <p>It would be very kind if someone could explain this jungle to me.</p>