title: AWS Cognito - using scopes in authorizing access to api gateway
body: <p>I have setup a Cognito user pool so that I can use it to authorize access the an api gateway. It uses OAUTH2 and the flow im using is : Authorization Code Grant,
  Scopes : email, openid and profile,
  Allowed Custom Scope : product-api/read_product, product-api/create_product, product-api/delete_product</p>
  
  <p>I use boto3 admin_initiate_auth command to connect to the user pool:-</p>
  
  <pre><code>response = idpclient.admin_initiate_auth(
  UserPoolId=USERPOOLID,
  AuthFlow='ADMIN_NO_SRP_AUTH',
  AuthParameters={
  'USERNAME':USERNAME,
  'PASSWORD':PASSWORD,
  'SECRET_HASH':SECRET_HASH
  },
  ClientId=APPCLIENTID
  )
  </code></pre>
  
  <p>and the response I receive is a json object with several fields, which include access_token, refresh_token etc...</p>
  
  <p>but when I use the access_token to access the api gateway, i get a 401 error. Unauthorised. Looking into the access_token it looks like the custom scopes have not been added.</p>
  
  <p>Could you advise why the custom scope has not been added to the access_token and how do i get the custom scopes added ?</p>
  
  <p>the api gateway has a lambda authorizer added.</p>