(i started going that route, but ended up creating a user in a cognito pool to request a token, then used that token on the api gw)