I have used the AWS Cognito for the Authentication of my Web Application. The Authentication Provider is being the Intuit. The whole Authentication Part works fine and I'm being able to get the Access Token, ID Token & Refresh Token from the AWS Cognito after the Authorization from Intuit is successful. But, when the Access Token Obtained from the AWS Cognito is used as the Authorization Bearer Token with the Intuit API ( https://quickbooks.api.intuit.com/v3/company/**************/query?query=select%20*%20from%20CompanyInfo&minorversion=63 ), the error occurs. Below is the response I get (Screenshot Attached).
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<IntuitResponse time="2022-04-06T05:36:37.063-07:00" xmlns="http://schema.intuit.com/finance/v3">
<Fault type="AUTHENTICATION">
<Error code="3200">
<Message>message=AuthenticationFailed; errorCode=003200; statusCode=401</Message>
</Error>
</Fault>
</IntuitResponse>
I tried using the Intuit's Access Token Directly by getting it from the Intuit Playground and used it with the same API, which gives the successful expected response.
When the JWT Token obtained from the AWS Cognito is decoded with https://jwt.io/ , below is the decoded values of it ...
{
"sub": "<<HIDDEN FOR PRIVACY REASONS>>",
"cognito:groups": [
"Intuit-Users"
],
"token_use": "access",
"scope": "phone openid profile email",
"auth_time": 1649248040,
"iss": "https://cognito-idp.us-east-2.amazonaws.com/us-east-2_jnCqrZ6om",
"exp": 1649334440,
"iat": 1649248040,
"version": 2,
"jti": "<<HIDDEN FOR PRIVACY REASONS>>",
"client_id": "<<HIDDEN FOR PRIVACY REASONS>>",
"username": "<<HIDDEN FOR PRIVACY REASONS>>"
}
https://i.stack.imgur.com/Cgi7I.png
As mentioned in https://developer.intuit.com/app/developer/qbo/docs/learn/scopes there is a scope of "com.intuit.quickbooks.accounting" which grants access to the QuickBooks Online Accounting API, which focuses on accounting data. As I can see in the above decoded Access Token Data, I cannot find the scope "com.intuit.quickbooks.accounting" in the scopes property. Can this be an issue? If so, how to add the scope for this in AWS Cognito? Or else what could be the issue? Can anyone provide a solution?
NOTE : The Ultimate Need is to make the Cognito Returned Access Token Authorized with Intuit to work with QuickBooks API.