## AWS API Gateway Backend Protection

Use AWS API Gateway to control access to your backend. When API calls are made to your routes, API Gateway verifies the caller's identity using a **JWT authorizer** and grants access only if the caller is authorized. This guide covers setup for **HTTP APIs** in API Gateway.

### Step-by-step guide

Follow the steps below to protect your AWS resources using the AWS API Gateway JWT authorizer:

### Step 1: Select a route to protect

1. Sign in to the [AWS Management Console](https://aws.amazon.com/console/), search for **API Gateway** in the top search bar, and open it.
2. Select your **HTTP API** from the list.
3. In the left sidebar, choose **Authorization**.
4. On the **Attach authorizers to routes** tab, select the route you want to protect from the left panel (for example, `GET /data`).
5. Click **Create and attach an authorizer**.


![aws-gateway-1](/assets/aws-gateway-1.042c7b6c4b3b2bf129b26f1c6311affccace6912ed750d77601227537f22e0af.97d793c5.png)

### Step 2: Configure the JWT authorizer

On the **Create authorizer** form, select **JWT** as the authorizer type, then fill in the following:

| Parameter | Value |
|  --- | --- |
| **Name** | A logical name to identify this authorizer (for example, `frontegg-jwt`). |
| **Identity source** | `$request.header.Authorization` — already pre-filled; passes the Bearer token from the `Authorization` header. |
| **Issuer URL** | In the Frontegg portal, go to your environment **→ Keys & domains**. Copy the **Frontegg domain** and use: `https://[your-frontegg-domain].frontegg.com` |
| **Audience** | Click **Add audience**. In the Frontegg portal, go to your environment **→ Keys & domains**, copy your **Client ID**, and paste it here. |


![aws-gateway-2](/assets/aws-gateway-2.7a38f1e26b5eaee9352e673026e3d51b7a10a5f567ff6f3555bef5067f94e6be.97d793c5.png)

Click **Create and attach** to save. AWS API Gateway will now validate Frontegg-issued JWTs on every request to the protected route.