title: Authorizing AWS API Gateway requests from token in query string
body: <p>I have API Gateway set up with a Cognito authorizer that correctly authorizes any request with the id token in the header. </p>
  
  <p>This is fine when requests are XHR based as I can add the header when preparing the request. However I can't add this when using <code>&lt;audio src="http://api-gateway/..."&gt;</code> which is made directly by the browser.</p>
  
  <p>The best I can do is append the token in the querystring (<code>?token=...</code>) but Cognito only accepts tokens in the headers. </p>
  
  <p>Is there any way to get Cognito to authorize requests when they come from HTML/CSS?</p>