title: Amplify Auth and Android: temporary credentials - accessKey, secretKey invalid in postman
body: <p>i have set up an android app to use amplify auth.</p>
  <p>i have allowed it to accept unauthorized (guest) users and google federated sign in.</p>
  <p>it all seems to work as expected. i can log in using google sign in and cognito.</p>
  <p>i am experiencing a problem with using the temporary credentials generated for the google sign in and the guest user.</p>
  <p>i have set up an api in apigateway (the pet example imported into my apigateway). i can access the endpoint using a user with policy allowing invoke api. i test in postman using the users accessKey and secretKey and it works.</p>
  <p>it also works when i use the cognito logged in users' idToken.</p>
  <p>(i have added allow invoke api to the auth and unauth roles' policies for the identity pool used)</p>
  <p>if i use the accessKey and secretKey generated for the guest using this code:</p>
  <pre><code> public void getGuestCredentials(View view) {
      Log.i(TAG, &quot;inside getGuestCredentials()...&quot;);
      Amplify.Auth.fetchAuthSession(
              result -&gt; {
                  AWSCognitoAuthSession cognitoAuthSession = (AWSCognitoAuthSession) result;
                  Log.i(TAG, &quot;Is user signed in: &quot;+cognitoAuthSession.isSignedIn());
  
                  switch(cognitoAuthSession.getIdentityId().getType()) {
                      case SUCCESS:
                          Log.i(TAG, &quot;success IdentityId: &quot; + cognitoAuthSession.getIdentityId().getValue());
                          Log.i(TAG, &quot;success access key: &quot; + cognitoAuthSession.getAWSCredentials().getValue().getAWSAccessKeyId());
                          Log.i(TAG, &quot;success secret key: &quot; + cognitoAuthSession.getAWSCredentials().getValue().getAWSSecretKey());
                          break;
                      case FAILURE:
                          Log.i(TAG, &quot;failure IdentityId not present because: &quot; + cognitoAuthSession.getIdentityId().getError().toString());
                          break;
                      default:
                          Log.i(TAG, &quot;default IdentityId: &quot; + cognitoAuthSession.getIdentityId().getValue());
                          Log.i(TAG, &quot;default access key: &quot; + cognitoAuthSession.getAWSCredentials().getValue().getAWSAccessKeyId());
                          Log.i(TAG, &quot;default secret key: &quot; + cognitoAuthSession.getAWSCredentials().getValue().getAWSSecretKey());
                          break;
  
                  }
              },
              error -&gt; Log.i(&quot;AuthQuickStart&quot;, error.toString())
      );
  </code></pre>
  <p>I get:</p>
  <p>&quot;message&quot;: &quot;The security token included in the request is invalid.&quot;</p>
  <p>in postman.</p>
  <p>the same with the keys generated for the google signin using this code:</p>
  <pre><code>//            sign in as federated user using google token (using escape hatch)
          AWSMobileClient mobileClient = (AWSMobileClient) Amplify.Auth.getPlugin(&quot;awsCognitoAuthPlugin&quot;).getEscapeHatch();
  </code></pre>
  <p>//            mobileClient.federatedSignIn(IdentityProvider.GOOGLE.toString(), account.getIdToken(), new Callback() {
  mobileClient.federatedSignIn(&quot;accounts.google.com&quot;, account.getIdToken(), new Callback() {</p>
  <pre><code>            @Override
              public void onResult(final UserStateDetails userStateDetails) {
                  //Handle the result
                  Log.i(TAG, &quot;mobileClient login result: &quot; + userStateDetails.getUserState().toString());
                  Log.i(TAG, &quot;success google federation, going to authenticated user page.... &quot;);
  </code></pre>
  <p>//                    ************************************************</p>
  <pre><code>                AWSCredentials credentials = mobileClient.getCredentials();
                  Log.i(TAG, &quot;***** secret key: &quot;+credentials.getAWSSecretKey());
                  Log.i(TAG, &quot;***** access key: &quot;+credentials.getAWSAccessKeyId());
  </code></pre>
  <p>....</p>
  <p>appreciate any help to solve this. thanks</p>