title: Possible reasons for invalid_token from AWS Cognito on https://api.amazon.com/auth/o2/tokeninfo
body: <p>I believe I am missing something with the implicit grant process and access tokens in aws cognito. </p>
  
  <p>To this point:</p>
  
  <ol>
  <li><p>Have a user pool, with a client app configured for implicit flow and scopes openid, profile, aws.cognito.signin.user.admin</p></li>
  <li><p>Used a <a href="https://stackoverflow.com/questions/45926339/cognito-hosted-ui">stack overview</a> and the <a href="https://developer.amazon.com/docs/login-with-amazon/choose-authorization-grant.html" rel="nofollow noreferrer">official documentation</a> and <a href="https://m.media-amazon.com/images/G/01/mobile-apps/dex/login-with-amazon/login-with-amazon._TTH_.pdf" rel="nofollow noreferrer">older white papers</a> to achieve:</p></li>
  <li><p>Login process that redirects to aws cognito UI, and back to my app, with tokens and other information in the fragment portion of the URL. </p></li>
  <li><p>The access_token value parses at jwt.io and signature checks out using the <a href="https://github.com/awslabs/aws-support-tools/tree/master/Cognito/decode-verify-jwt" rel="nofollow noreferrer">aws jwt tool</a></p></li>
  </ol>
  
  <p>Problem: </p>
  
  <p>The <a href="https://developer.amazon.com/docs/login-with-amazon/obtain-customer-profile.html" rel="nofollow noreferrer">recommended step</a> is to "verify that the access token belongs to us" through the tokeninfo api call. 
  When I attempt to call tokeninfo  via javascript code and testing via postman (using: <a href="https://api.amazon.com/auth/o2/tokeninfo?access_token=eyJraWQiOiJoVFBa" rel="nofollow noreferrer">https://api.amazon.com/auth/o2/tokeninfo?access_token=eyJraWQiOiJoVFBa</a>... )</p>
  
  <p>I get the result: </p>
  
  <pre><code>{
  "error_description": "The request has an invalid parameter : access_token",
  "error": "invalid_token"
  }
  </code></pre>
  
  <p>and an http header: </p>
  
  <pre><code>x-amzn-errortype: InvalidTokenException:http://internal.amazon.com/coral/com.amazon.panda/
  </code></pre>
  
  <p>Variants I have tried: </p>
  
  <ul>
  <li><p>I have tried calls directly to the user profile (using Authorization header, and query string and x-amz-access-token header). </p></li>
  <li><p>I have tried adjust parameter names (error becomes "access_token required" or something like that</p></li>
  <li><p>I have tried adjusting scopes in the user pool</p></li>
  <li><p>I have tried adding resource servers (though I am not there yet...) </p></li>
  </ul>
  
  <p>The redirect after login looks like this: </p>
  
  <pre><code>  https://staging.example.com/loginresult.html#id_token=eyJraWQiO&lt;tokenremoved&gt;&amp;access_token=eyJraWQiOiJoVFBa&lt;tokenremoved&gt;&amp;expires_in=3600&amp;token_type=Bearer&amp;state=whateverdevwants
  </code></pre>
  
  <p>The parsed values of the token (through jwt.io) are:</p>
  
  <pre><code>{
  "sub": "5510a27d-ebcb-4883-8680-a66fd0462279",
  "token_use": "access",
  "scope": "aws.cognito.signin.user.admin openid profile",
  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_OF5OOfdx0",
  "exp": 1519352461,
  "iat": 1519348861,
  "version": 2,
  "jti": "31950a91-e2a5-4060-8c31-977f49802d35",
  "client_id": "3iuhnprmod0josge24ogarecfp",
  "username": "5510a27d-ebcb-4883-8680-a66fd0462279"
  }
  </code></pre>
  
  <p><em>Update:</em> As answered below: just don't do this, it is conflating jwt tokens from cognito with whatever "Login With Amazon" was using. </p>