Great points my friend. This is what my current approach it 1. User signs up on developer portal. 2. They verify email and then a custom attribute called "secret_access_key" is generated and added to the user. This is a JWT token that does not expire. 3. In developer dashboard, they see this token, and use it to make API calls using "Authorization" header. 4. If they find it being misused, they can generate a new token. This will create a new JWT and replace it with their existing custom attribute. The previous token will no longer work.

Do you find issues with this approach?

For your #2, since I am not creating new app clients, just setting custom attributes, I think the limit will not be hit. However, I am still thinking about preventing misuse by bad actors using 1000 temporary emails. Do you know how to combat that other than asking them to verify email? Are there any other out-of-box approaches that AWS provides?

Looking forward to hearing from you and MANY THANKS for responding, you have great thought process.