Generate AWS credentials for the authenticated user
POST/v1/user/credentials
Exchanges the caller's token pair for temporary AWS credentials (access key id, secret access key, session token) with an expiry.
Needs both tokens: Authorization: Bearer <access_token> plus
id_token in the body, from one sign-in — an end-user pair minted by
the ESP User OIDC issuer, or an admin pair from the admin Cognito
pool. Both halves are verified against the issuer the access token
names and must carry the same authentication-event id, or the request
is rejected with 403. The id_token is what the Identity Pool
federates.
For both users and admins.
Request
Responses
- 200
- 400
- 401
- 403
- 500
Successful response with AWS credentials
Bad request
Unauthorized - Invalid or missing authentication
The id_token does not belong to the authenticated caller, or comes from a different sign-in than the access token.
Internal server error