I'm trying to authorize API Gateway calls using a Cognito User Pool Authorizer. If I get the access token from the Hosted UI offered by AWS and pass it as a header in Postman, everything works fine and I can call my APIs.

So I decided to see if I can get that JWT token programmatically in Node.js, without using Amplify. By using the 'amazon-cognito-identity-js' node module (which is what Amplify actually uses), I can authenticate to a Cognito User Pool successfully (calling the CognitoUser() method, then calling authenticateUser() and finally in its callback I can get the tokens needed with result.getAccessToken().getJwtToken()). This way I can get an access token, an id token and a refresh token. However, that access token doesn't work in Postman and the API returns unathorized.

I tried to analyze the structure of it and it's very similar to the access token returned by the Hosted UI. The only differences are: it doesn't have a version property, the scope is different and it has an extra origin_jti property. The iss, client_id and username are the same.

What am I doing wrong?