AWS Coginto: where is the metadata URL of Cognito User Pool?

byMR

December 15, 2021

I’m trying to use AWS Cognito as an authorizer for my REST API in AWS API Gateway.

It asks me to fill in the Issuer URL:

I digged through the AWS Cognito User Pool page, there is no such thing.

I found a related answer here: AWS: Cognito integration with a beta HTTP API in API Gateway?
and I quote:

Issuer URL: Check the metadata URL of your Cognito User Pool 
(construct the URL in this format :: https://cognito-idp.
[region].amazonaws.com/[userPoolId]/.well-known/openid-configuration 
:: look for a claim named "issuer". Copy its Value and paste it here.

I can of course build the url as said above.

But still, where is the metadata URL of my Cognito User Pool????

Am I missing something really basic and being absolutely silly by asking this question?

Where is it??

This is driving me crazy.

>Solution :

The issuer URL of a Cognito User Pool has the following format:

https://cognito-idp.[region].amazonaws.com/[userPoolId]

As you stated correctly, you can get it from Cognito’s well-known metadata endpoint, which is available at

https://cognito-idp.[region].amazonaws.com/[userPoolId]/.well-known/openid-configuration

This file is JSON-formatted and contains an issuer field, which contains the URL mentioned above. The whole file looks like this:

{
   "authorization_endpoint":"https://cognito-idp.[region].amazonaws.com/[userPoolId]/authorize",
   "id_token_signing_alg_values_supported":[
      "RS256"
   ],
   "issuer":"https://cognito-idp.[region].amazonaws.com/[userPoolId]",
   "jwks_uri":"https://cognito-idp.[region].amazonaws.com/[userPoolId]/.well-known/jwks.json",
   "response_types_supported":[
      "code",
      "token"
   ],
   "scopes_supported":[
      "openid",
      "email",
      "phone",
      "profile"
   ],
   "subject_types_supported":[
      "public"
   ],
   "token_endpoint":"https://cognito-idp.[region].amazonaws.com/[userPoolId]/token",
   "token_endpoint_auth_methods_supported":[
      "client_secret_basic",
      "client_secret_post"
   ],
   "userinfo_endpoint":"https://cognito-idp.[region].amazonaws.com/[userPoolId]/userInfo"
}