@square-vr-55083 Yes it can query other apis

When the token isn't valid it takes less than 3 seconds

That's weird. I just uploaded a new token that works when I run the code locally, but on the lambda I get this error:

{
  "errorMessage": "{'status_code': 401, 'error_type': 'invalid token', 'error_message': \"Invalid session token: {'status_code': 500, 'error_type': 'invalid public key', 'error_message': 'Unable to validate public key. Public key not found.'}\"}",
  "errorType": "AuthException",
  "stackTrace": [
    "  File \"/var/task/lambda_function.py\", line 14, in lambda_handler\n    jwtdict = client.validate_session(session_token=ds_token)\n",
    "  File \"/var/task/descope/descope_client.py\", line 186, in validate_session\n    return self._auth.validate_session(session_token)\n",
    "  File \"/var/task/descope/auth.py\", line 528, in validate_session\n    401, ERROR_TYPE_INVALID_TOKEN, f\"Invalid session token: {e}\"\n"
  ]
}

Will expire after that

@salmon-night-88354 @dazzling-oyster-96577 if you tried this in lambda, plz share

@steep-keyboard-7095 is your project id ends with

Ohh ok, let me check

Public key , you can use, it will spare you the need to hit our endpoints for session validation

The public key is the key used to validate the jwt signed by the private key that is safely stored with descope. When you first validate a key the SDK fetches the current public key from the descope api, so you don't need to hardcode it. It might also rotate for various reasons so hardcoding it is not recommended and used mostly for debugging and troubleshooting

Regarding your lambda hang, can you determine the exact function call that hangs? You could use printing to see what runs and what doesn't

But when it throws that error, I test out the session token with the same code locally and it works

Same issue

I took out the tokens

I've configured a function URL to my lambda function and it's in a VPC, although I can successfully query a different public API so that's not the issue

I can give you the zip if you like

This error goes away if I use a venv btw

ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
conda-repo-cli 1.0.4 requires pathlib, which is not installed.
anaconda-project 0.10.2 requires ruamel-yaml, which is not installed.
aiohttp 3.8.1 requires charset-normalizer<3.0,>=2.0, but you have charset-normalizer 3.1.0 which is incompatible.

I tried to make it from scratch again, but ran into a different problem. Hopefully all this info I'm giving you can help you reproduce it

I found that the cryptography package issue with the error message as described above is gone when I force install cryptography package 3.4.8

Here's the updated package

I get the same issue that this code in a virtual environment works on my local computer but not in AWS, I keep getting the AuthException error as stated above in the lambda, but a successful authentication locally

This is the last piece of the puzzle for me before I can launch my business, so thank you in advance for helping me solve this

@orange-belgium-27264 @square-vr-55083 Any progress? To reiterate, my issue is that the descopeClient.validate_session function call works locally, but not in my lambda function with the same credentials and code. I tried using a lambda layers and landed a few debug logs. Do they help?

y", line 8, in <module>
import jwt
File "/opt/python/lib/python3.10/site-packages/jwt/__init__.py", line 1, in <module>
from .api_jwk import PyJWK, PyJWKSet
File "/opt/python/lib/python3.10/site-packages/jwt/api_jwk.py", line 6, in <module>
from .algorithms import get_default_algorithms
File "/opt/python/lib/python3.10/site-packages/jwt/algorithms.py", line 6, in <module>
from .utils import (
File "/opt/python/lib/python3.10/site-packages/jwt/utils.py", line 7, in <module>
from <http://cryptography.hazmat.primitives.asymmetric.ec|cryptography.hazmat.primitives.asymmetric.ec> import EllipticCurve
File "/opt/python/lib/python3.10/site-packages/cryptography/hazmat/primitives/asymmetric/ec.py", line 10, in <module>
from cryptography.hazmat._oid import ObjectIdentifier
File "/opt/python/lib/python3.10/site-packages/cryptography/hazmat/_oid.py", line 7, in <module>
from cryptography.hazmat.bindings._rust import (
pyo3_runtime.PanicException: Python API call failed
ModuleNotFoundError: No module named '_cffi_backend'
thread '<unnamed>' panicked at 'Python API call failed', /github/home/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.15.2/src/err/mod.rs:582:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Traceback (most recent call last):
File "/var/runtime/bootstrap.py", line 60, in <module>
main()
File "/var/runtime/bootstrap.py", line 57, in main
awslambdaricmain.main([os.environ["LAMBDA_TASK_ROOT"], os.environ["_HANDLER"]])
File "/var/runtime/awslambdaric/__main__.py", line 21, in main
bootstrap.run(app_root, handler, lambda_runtime_api_addr)
File "/var/runtime/awslambdaric/bootstrap.py", line 389, in run
request_handler = _get_handler(handler)
File "/var/runtime/awslambdaric/bootstrap.py", line 39, in _get_handler
m = importlib.import_module(modname.replace("/", "."))
File "/var/lang/lib/python3.10/importlib/__init__.py", line 126, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "<frozen importlib._bootstrap>", line 1050, in _gcd_import
File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
File "<frozen importlib._bootstrap_external>", line 883, in exec_module
File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
File "/var/task/lambda_function.py", line 2, in <module>
from descope import DescopeClient, AuthException
File "/opt/python/lib/python3.10/site-packages/descope/__init__.py", line 10, in <module>
from descope.descope_client import DescopeClient
File "/opt/python/lib/python3.10/site-packages/descope/descope_client.py", line 5, in <module>
from descope.auth import Auth  # noqa: F401
File "/opt/python/lib/python3.10/site-packages/descope/auth.py", line 8, in <module>
import jwt
File "/opt/python/lib/python3.10/site-packages/jwt/__init__.py", line 1, in <module>
from .api_jwk import PyJWK, PyJWKSet
File "/opt/python/lib/python3.10/site-packages/jwt/api_jwk.py", line 6, in <module>
from .algorithms import get_default_algorithms
File "/opt/python/lib/python3.10/site-packages/jwt/algorithms.py", line 6, in <module>
from .utils import (
File "/opt/python/lib/python3.10/site-packages/jwt/utils.py", line 7, in <module>
from <http://cryptography.hazmat.primitives.asymmetric.ec|cryptography.hazmat.primitives.asymmetric.ec> import EllipticCurve
File "/opt/python/lib/python3.10/site-packages/cryptography/hazmat/primitives/asymmetric/ec.py", line 10, in <module>
from cryptography.hazmat._oid import ObjectIdentifier
File "/opt/python/lib/python3.10/site-packages/cryptography/hazmat/_oid.py", line 7, in <module>
from cryptography.hazmat.bindings._rust import (
pyo3_runtime.PanicException: Python API call failed
START RequestId: 93f1e34f-39da-4833-89a5-fbbedb4ab2a2 Version: $LATEST
RequestId: 93f1e34f-39da-4833-89a5-fbbedb4ab2a2 Error: Runtime exited with error: exit status 1
Runtime.ExitError
END RequestId: 93f1e34f-39da-4833-89a5-fbbedb4ab2a2
REPORT RequestId: 93f1e34f-39da-4833-89a5-fbbedb4ab2a2	Duration: 4389.90 ms	Billed Duration: 4390 ms	Memory Size: 128 MB	Max Memory Used: 18 MB

@orange-belgium-27264 @square-vr-55083 Great news! I solved the issue birthday party parrot and I did it using the version of cryptography used by descope. The problem seems to be that not all of the cryptography package gets properly loaded into the site-packages when you package it up to deploy it to AWS, I'm still a bit fuzzy on what and why. The solution is (please put this in documentation somewhere) to use 2 Lambda Layers. First is one with the properly installed cryptography package. There's one online that you can use here: https://github.com/keithrozario/Klayers/tree/master#using-the-layers Make sure that the same python runtime and the region that your lambda is configured for/in. The second layer is the descope site packages with the cryptography packages removed. The commands would be

pip install --target ./python/lib/python3.9/site-packages/ descope

then navigate down there:

cd python/lib/python3.9/site-packages

and remove the cryptography packages:

rm -r cryptography*

rm -r cffi*

rm -r pycparser*

Of course, replace python3.9 with whatever your operating system version of python is (which must match the lambda function) Finally now that the package is ready, navigate up to the top folder and zip the python folder you created in the first step. Then create a new lambda layer and upload this package to it. Then to make it work for the lambda function, all you have to do is create the function, go to the bottom and add the 2 layers and then it works

And in case you're wondering, this method works with both specifying and not specifying the public key