title: Trouble getting cognito JWT token back when using Google sign in
body: <p>Having trouble getting API Gateway JWT Token using Google Sign In.</p>
  
  <p>Use Case:
  We have a cognito user pool set up to use Google as an Identity provider. We also have a set of API endpoints in API Gateway, some of which require an <strong>Authorization</strong> header to access the endpoint. We have a <strong>cognito_user_pool</strong> authorizer attached to some of the routes. When loging in with a <em>cognito user</em> (user signed up to the pool directly and went through account/email verification) I get a JWT token back. I am then able to make API Gateway requests and all is right with the world.</p>
  
  <p>It was my understanding (based on assumption of course...) that when using a 3rd party provider, I would login into the provider (google) get a token back that I would then exchange for a <strong>cognito JWT token</strong> I could then make API requests with. After much digging, it turns out that behavior is <strong>NOT</strong> supported. From what I can tell from a myriad of blog posts and stack overflow, is that you <em>can</em> get credentials to then use other AWS resources but only through the AWS-SDK or a generated API Gateway SDK, which makes no sense in the context of an API... </p>
  
  <p>I am wondering if anyone else has this use case, and how they worked around it while continuing to use cognito as the user management sysytem, or if there are any plans on the part of AWS to enable some form of this behavior? Somewhat related t: <a href="https://forums.aws.amazon.com/thread.jspa?threadID=231850" rel="nofollow noreferrer">https://forums.aws.amazon.com/thread.jspa?threadID=231850</a></p>