---
title: OAuth2 Token Introspection vs JWT Validation on Cognito and API Gateway
description: Local JWT validation is fast until revocation lags bite you. When to introspect at Cognito, use API Gateway JWT authorizers, and add Verified Permissions for fine-grained authz.
url: https://www.joinhorizon.co/blog/oauth2-introspection-vs-jwt-validation-cognito-api-gateway/
datePublished: 2026-06-12T00:00:00.000Z
dateModified: 2026-10-28T00:00:00.000Z
author: palaniappan-p
category: Cloud Architecture
tags: engineering-guide, security, api-gateway, cognito, aws
---

# OAuth2 Token Introspection vs JWT Validation on Cognito and API Gateway

> Local JWT validation is fast until revocation lags bite you. When to introspect at Cognito, use API Gateway JWT authorizers, and add Verified Permissions for fine-grained authz.

**Amazon Cognito (June 2026)** issues **JWT access tokens**. Validate them locally with JWKS (`/.well-known/jwks.json`) for latency. **Introspection** (RFC 7662) hits the authorization server on each request. It is slower but gives immediate revocation awareness if the AS supports it.

## Symptom → mechanism → AWS control

| Production symptom            | Mechanism                               | AWS control                                               |
| ----------------------------- | --------------------------------------- | --------------------------------------------------------- |
| Auth latency dominates p99    | Per-request introspection round-trip    | API Gateway JWT authorizer with JWKS cache                |
| Stale revoked tokens accepted | JWT validation without revocation check | Short TTL (5–15 min) + app-side deny-list for revoked sessions |
| JWKS fetch failures           | Authorizer can't verify signature       | API Gateway built-in JWKS cache, multi-AZ Cognito pool    |

**Opinionated take:** Default to API Gateway JWT authorizers with 5-minute access tokens, and reserve Cognito introspection for opaque tokens or immediate revocation requirements.

> **Benchmark pattern (hypothetical workload):** API Gateway HTTP API with JWT authorizer (local validation), 8K auth checks/sec at 0.3ms overhead; an introspection call to the authorization server adds 12ms p99 per request at 2K RPS before caching layer.

## Decision matrix

| Approach                   | Latency         | Revocation                                |
| -------------------------- | --------------- | ----------------------------------------- |
| JWT local validate         | Low             | Until expiry (unless short TTL + refresh) |
| Introspection              | Higher          | Real-time if AS honors `active: false`    |
| API Gateway JWT authorizer | Regional validation in API Gateway | Cognito token lifetime                    |

**Opinionated take:** **Short-lived access tokens (5 to 15 min)** plus local JWKS validation for APIs; introspection for high-risk admin actions only.

## AWS wiring

- **HTTP API JWT authorizer:** `issuer`, `audience` from Cognito pool
- **Lambda authorizer:** custom claims, Cedar via **Verified Permissions**
- **mTLS:** separate track for B2B

## AWS services map

| Need                         | Service                            | Skip when                                  |
| ---------------------------- | ---------------------------------- | ------------------------------------------ |
| Local JWT validation         | API Gateway JWT authorizer         | Opaque tokens with no public JWKS          |
| User pool + federation       | Cognito User Pools                 | Internal service-to-service IAM SigV4 only |
| Token introspection (opaque) | Cognito / custom Lambda authorizer | Standard OIDC JWT with short TTL           |

## What to do this week

1. Enable Cognito token revocation API where required.
2. Cache JWKS with kid rotation handling.
3. Map scopes to IAM-style policies in Verified Permissions for new services.

## More in This Track

Part of the **Engineering Guides** library (June 2026).

- Next: [Part 2](https://www.joinhorizon.co/blog/rate-limiting-token-bucket-leaky-bucket-aws-waf-apigw/)
- Browse tracks: [Engineering Guides hub](https://www.joinhorizon.co/resources/engineering-guides/)

## What this guide doesn't cover

Rate limiting is covered in part 2 of the API track.

## FAQ

### When should I introspect every request instead of validating a JWT locally?
Reserve Cognito or RFC 7662 introspection for opaque tokens or high-risk admin actions that need immediate revocation. Default APIs should use the API Gateway JWT authorizer with JWKS cache and 5 to 15 minute access tokens.

### What could go wrong if access tokens live for hours?
Revoked sessions stay valid until expiry. Short TTL plus refresh is the JWT trade-off. Local validation cannot see Cognito revocation in real time. Cognito user pools publish no revocation list or RFC 7662 introspection endpoint, so the options are short access-token TTLs or your own deny-list, which reintroduces a lookup.

### Does a JWT authorizer replace Verified Permissions?
No. The authorizer proves identity and standard claims. Fine-grained authz (Cedar) belongs in Verified Permissions or a Lambda authorizer on custom claims. mTLS is a separate B2B track.

### Why did p99 jump when we switched to introspection?
Each request added an authorization-server round trip. The hypothetical HTTP API JWT authorizer pattern in this guide stayed near 0.3ms overhead; uncached introspection added about 12ms p99 at 2K RPS.

---

*Source: https://www.joinhorizon.co/blog/oauth2-introspection-vs-jwt-validation-cognito-api-gateway/*