求LWA与AWS Lambda的端到端解决方案：协议理解后实践存困惑

Got it, let's walk through a complete end-to-end solution for integrating Logon with Amazon (LWA) into your Alexa Skill using AWS Lambda—no more confusion, step by step.

1. Configure LWA in Your Alexa Skill #

• Head to the Alexa Developer Console, open your skill, and navigate to Build > Permissions.
• Toggle on Login with Amazon to enable it, then click Configure Login with Amazon to jump to the Amazon Developer Portal:
  • Create a new security profile (or use an existing one)
  • Set Allowed Origins to https://alexa.amazon.com (for testing purposes)
  • Paste your skill's OAuth redirect URL (found in the Alexa Skill Permissions page, looks like https://pitangui.amazon.com/api/skill/link/XXXXXX) into Allowed Return URLs
• Back in the Alexa Skill Permissions page, select the user data scopes you need (e.g., profile:user_id, profile:name, profile:email)
• Save your changes and jot down your LWA Client ID and Client Secret—you’ll need the client ID for token validation later.

2. Set Up Your AWS Lambda Function #

• Open the AWS Lambda Console, create a new function using Author from scratch.
• Name your function, pick a runtime (we’ll use Node.js 18.x for this example).
• Under Function overview, click Add trigger, select Alexa Skills Kit from the dropdown, and paste your skill’s Skill ID (found in Alexa Developer Console > Skill Settings > Skill ID).
• Save the trigger configuration.

3. Write Lambda Code to Handle LWA Authentication & User Data #

Here’s a full Node.js example that handles an Alexa intent, validates the LWA access token, fetches user profile data, and returns a personalized response:

const axios = require('axios');

exports.handler = async (event) => {
    // Grab the access token from the Alexa request (only present if user authorized)
    const accessToken = event.context.System.user.accessToken;
    
    if (!accessToken) {
        // Prompt user to link their account via the Alexa app
        return {
            version: '1.0',
            response: {
                outputSpeech: {
                    type: 'PlainText',
                    text: 'Please link your Amazon account to use this skill. You can do this in the Alexa app.'
                },
                card: {
                    type: 'LinkAccount'
                },
                shouldEndSession: true
            }
        };
    }
    
    try {
        // Step 1: Validate the access token with LWA's tokeninfo endpoint
        const tokenValidation = await axios.get('https://api.amazon.com/auth/o2/tokeninfo', {
            params: {
                access_token: accessToken
            }
        });
        
        // Ensure the token was issued for our skill's client ID
        if (tokenValidation.data.aud !== 'YOUR_LWA_CLIENT_ID') {
            throw new Error('Token was not issued for this skill');
        }
        
        // Step 2: Fetch the user's profile data
        const userProfile = await axios.get('https://api.amazon.com/user/profile', {
            headers: {
                Authorization: `Bearer ${accessToken}`
            }
        });
        
        const userName = userProfile.data.name;
        const userId = userProfile.data.user_id;
        
        // Step 3: Return a personalized response
        return {
            version: '1.0',
            response: {
                outputSpeech: {
                    type: 'PlainText',
                    text: `Hey ${userName}! Your Amazon user ID is ${userId}.`
                },
                shouldEndSession: false
            }
        };
        
    } catch (error) {
        console.error('LWA processing error:', error);
        return {
            version: '1.0',
            response: {
                outputSpeech: {
                    type: 'PlainText',
                    text: 'Sorry, there was an issue accessing your account. Please try again later.'
                },
                shouldEndSession: true
            }
        };
    }
};

Key Code Notes: #

• Replace YOUR_LWA_CLIENT_ID with your actual LWA Client ID from the Amazon Developer Portal
• Include the axios package: you can add it via a package.json in your deployment zip, or use a Lambda Layer to include dependencies
• The LinkAccount card triggers the Alexa app’s account linking flow for unauthenticated users

4. Test the Full Flow #

• In the Alexa Developer Console’s Test tab, enable testing for your skill
• Invoke the skill by saying "Open [your skill name]"—Alexa will prompt you to link your account
• Open the Alexa app, go to Skills > Your Skills > [your skill] > Account Linking, and follow the prompts to log in with your Amazon account
• Invoke the skill again, and you’ll get a personalized response with your name and user ID

Common Pitfalls to Dodge #

• Missing Scopes: If you can’t fetch user data, double-check that you selected the correct scopes in the Alexa Skill Permissions page
• Lambda Internet Access: Your Lambda needs to reach LWA’s APIs. If it’s in a VPC, ensure you have a NAT gateway set up for outbound internet access
• Token Expiry: Access tokens expire after ~60 minutes, but Alexa automatically refreshes them for subsequent skill requests—no extra work needed from you

内容的提问来源于stack exchange，提问作者John