Auth Option 2: OAuth (AWS Cognito)

Note: OAuth support for payout endpoints is currently a work in progress — not all endpoints are available via this authentication method yet.

This is a newer authentication pathway that allows agencies to call payout APIs using the same OAuth (AWS Cognito) flow originally built for collections. It uses a client credentials flow — no AWS account is required.

Key characteristics:

• Authenticate with a client ID and secret issued by GovWallet
• Obtain short-lived access tokens (expire every hour) via AWS Cognito
• Include the access token in the Authorization header for API calls
• Request bodies are sent in JWE format

For full setup instructions (key generation, token retrieval, and request signing), see the OAuth Onboarding Guide.

Check with the GovWallet team for current payout endpoint coverage and let the team know the required endpoints for prioritisation.