title: AWS cognito: What's the difference between Access and Identity tokens?
body: <p>Just reading the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html#amazon-cognito-identity-user-pools-using-id-and-access-tokens-in-web-api" rel="noreferrer">docs</a>, they seem very similar to me so I can't really discern why to use one over the other. Although identity token seems better since it has custom attributes on it from the user pool (eg: <code>custom:blah</code> and the default ones like <code>name</code> and <code>email</code>).</p>
  
  <p>Right now, I am working with an app that passes the access token back down to the browser so it can use it for making ajax REST calls (there is an auth filter that expects this access token and validates it). Could I just switch out the access token with the id token? The current validation logic is to just get the <code>sub</code> field (the uuid) from the access token, but this <code>sub</code> field is also present in the identity token (as well as practically every other attribute except the <code>aud</code> which I don't need). I just want to make sure I am understanding this right as it is confusing to me why both tokens exist and seem so similar.</p>