First, you'll authenticate your users with Cognito:

• either using their hosted UI ( https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-integration.html )
• or with Amplify ( https://aws-amplify.github.io/docs/js/authentication )
• or with the AWS SDK if you want to downgrade ( https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html )

At that point, you'll have a set of JWT tokens (ID token, access token, and depending on the authentication flow you choose, refresh token).

Now you can pass the access token/id to your backend API and verify it:

• using the API Gateway Lambda authorizer, if applicable ( https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html )
• verifying the token and claims manually ( https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html ). You can find implementations of this on Github.
  If you're using Node, one of the options is cognito-jwt-verifier : a small npm package to verify id and access JWT tokens obtained from AWS Cognito in your node/Lambda backend with minimal dependencies (disclaimer: I'm the package author).