> For the complete documentation index, see [llms.txt](https://docs.assemblylift.akkoro.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.assemblylift.akkoro.io/learn-assemblylift/services/authorizers.md).

# Authorizers

Authorizers are defined in the `api.authorizers` table within the service manifest.

{% code title="service.toml" %}

```
[api.authorizers.iam]
auth_type = "iam"
# IAM authorizers take no parameters
```

{% endcode %}

To be of any use, an authorizer must be attached to a function (see `authorizer_id` in [Functions](/learn-assemblylift/services/functions.md)). The type of authorizer must also be supported by the API provider. At this time the default provider (AWS Lambda/APIGW) supports two types of authorization; IAM or JWT.

Authorizers protect only the publicly defined API of a function (such as an HTTP route); a Lambda function can still be invoked by other means (such as the AWS SDK).

{% hint style="warning" %}
Without an attached authorizer, your functions will be **publicly accessible via HTTP** if a route is defined. We recommend always using at least an IAM authorizer during development. Tools such as [Postman](https://www.postman.com/) will help you test protected routes.
{% endhint %}

{% code title="service.toml" %}

```
[api.authorizers.cognito]
auth_type = "JWT"
audience = ["client_id"]
issuer = "issuer_url"
scopes = ["claim1", "claim2", ...] # optional
```

{% endcode %}

The JWT type is used for authorizers such as Cognito or Auth0, which support JWT/OAuth authorization.