---
title: "Using an API User"
slug: "using-an-api-user"
updated: 2022-01-03T22:01:24Z
published: 2022-01-03T22:01:24Z
canonical: "docs.echo.stream/using-an-api-user"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.echo.stream/llms.txt
> Use this file to discover all available pages before exploring further.

# Using an API User

EchoStream uses AWS Cognito as its Identity Provider (IDP). In order to use your API User, you must obtain it's credentials from EchoStream, log into Cognito to obtain your temporary JSON Web Tokens (JWT), and then use the Access Token JWT to call EchoStream APIs.

## Credentials

To obtain the credentials for your API User, go into your Tenant's settings screen and select the API Users tab. Within that list provided, select the desired user. The following credentials will be provided to you:

| Credential | Description |
| --- | --- |
| clientId | This is the Cognito Application Client ID required to identify the application within the Cognito User Pool |
| password | The password required for Cognito Login |
| userPoolId | The Cognito User Pool to log into |
| username | The username of your API User |

## Logging In

You must log into EchoStream's AWS Cognito User Pool to obtain your JWT, which is then used to access EchoStream's API.

This can be accomplished using either:

- Directly calling the AWS API using RESTful calls (***not*** recommended)
- Your programming language's AWS API SDK (e.g. - [`boto3`](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cognito-idp.html) for Python)
- A higher-level library that abstracts login management (e.g. - [`pycognito`](https://github.com/pvizeli/pycognito) for Python)

> NOTE - In all cases, when you initiate authentication you must use `USER_SRP_AUTH` as the auth flow!

Using the higher-level library is recommended for two reasons:

1. Authenticating to Cognito can be somewhat complex, and the library should abstract that from you.
2. The JWT returned from Cognito is temporary, and contains three tokens; Identity Token, Access Token, and Refresh Token. You will be required to use the Refresh Token to obtain a new Access Token every so often. The library should handle this for you.

## Accessing the API

Once you have logged in, you can call the EchoStream API to get information about your Tenant and, if you have the permissions, make changes to your Tenant.

For every API that you call, you ***must*** pass the Access Token that you obtained during login or refreshed when it expired in the `Authorization` header field.