title: What is the point of an AWS session token if you still have to use the access key and secret key along with it?
body: <p>I'm trying to develop an OAuth solution for an AWS API using C# lambda functions.</p>
  <p>I'm able to get a session token using the access key and secret key of a user I set up with invoke permissions for the API Gateway and functions thereon.  I even have an endpoint that takes the client_id and client_secret and grant_type (client_credentials) as is standard for OAuth2.</p>
  <p>I was then going to use the session token ONLY, which expires, to access the API endpoints.</p>
  <p>However, when I try to find a way to validate the session token, all I can seem to find are solutions that use the access key, the secret key AND the temporary session token.  I just want to use the temporary session token as a bearer token in the header under Authorization, as is standard for OAuth2.</p>
  <p>Authorization: Bearer &lt;session_token&gt;</p>
  <p>Is there any way to accomplish this or have I gone so far down a rabbit hole that there's nothing left to do but start over???</p>