title: Signing with temporary credentials for API gateway request problems
body: <p>I'm trying to invoke my API Gateway with authenticated users with the REST API. For this I'm using: <a href="https://forums.aws.amazon.com/thread.jspa?threadID=230452" rel="nofollow noreferrer">Cognito UserPool + Cognito Identity Pool + API Gateway + AWS_IAM Authorization + Cognito Credentials</a>. From what I've gathered I need to sign my request with (temporary credentials). Based on <a href="https://stackoverflow.com/questions/28479138/how-can-one-make-authenticated-requests-with-aws-cognito-from-mobile-to-aws-serv">this thread</a> I want to sign my request with the following keys: </p>
  
  <pre><code>{
   SecretKey: '', 
   AccesKeyId: '',
   SessionKey: ''
  }
  </code></pre>
  
  <p>If I use an associated user from my IAM console and use the corresponding SecretKey + AccesKeyID everything works fine. However, I want to use the <strong>Unauthenticated and Authenticated roles from my Identity Pools</strong> to apply IAM policies based on authenticated or unauthenticated users. 
  FYI: I can call the authenticated functions from <a href="http://docs.aws.amazon.com/cognito/latest/developerguide/using-amazon-cognito-user-identity-pools-ios-sdk.html" rel="nofollow noreferrer">this part of the documentation.</a></p>
  
  <p>I'm building a React-Native app, and because of that I want to keep the native SDK to a minimum and I'm only using <code>AWSCognitoIdentityProvider</code> part. For the user handling. </p>
  
  <p>I trying to receive the correct keys using this Objective-C code:</p>
  
  <pre><code> [[self.credentialsProvider credentials] continueWithBlock:^id(AWSTask *task) {
      if (task.error) {
        NSLog(@"Error: %@", task.error);
      }
      else {
        AWSCredentials *response = task.result;
  
        NSString *accessKey = response.accessKey;
        NSString *secretKey = response.secretKey;
        NSString *sessionKey = response.sessionKey;
        NSDictionary *responseData = @{
                                       @"AccessKey" : accessKey,
                                       @"SecretKey" : secretKey,
                                       @"SessionKey": sessionKey
                                       };
          }
  
      return nil;
    }];
  </code></pre>
  
  <p>The rest I've setup using the <a href="http://docs.aws.amazon.com/cognito/latest/developerguide/using-amazon-cognito-user-identity-pools-ios-sdk.html" rel="nofollow noreferrer">relevant docs.</a> </p>
  
  <p>I (wrongly?) tried to sign my requests with the<br>
  <em>AccessKey</em>, <em>SecretKey</em>, <em>SessionKey</em> retrieved from the <em>CredentialsProvider</em> above. </p>
  
  <pre><code>  {
       SecretKey: credentials.SecretKey, 
       AccesKeyId: credentials.AccessKey,
       SessionKey: credentials.SessionKey
     }
  </code></pre>
  
  <p>The signing fails with the following error: </p>
  
  <pre><code>{ message: 'The security token included in the request is invalid.' }
  </code></pre>
  
  <p>So the question I have is: which keys should I use to sign my requests for authenticated users so that I can apply the attached IAM policies from my Cognito Setup?</p>
  
  <p>Thanks for any help :)</p>