websocket – Cannot connect to IoT Core MQTT broker from Flutter

I’m trying to connect to the AWS IoT Core broker through a flutter app. I could successfully use Amplify to get credentials from Cognito, and now I’m trying to setup the MQTT over WebSockets using these creds.

The problem is that I’m encountering a flutter error about a FormatException, I think something is not properly encoded in my request but I cannot find what.

I used the aws_iot_cognito_amplify example from github.com/shamblett/mqtt_client

Here the code to generate the websocket URL:

String getWebSocketURL(
    {required String accessKey,
    required String secretKey,
    required String sessionToken,
    required String region,
    required String scheme,
    required String endpoint,
    required String urlPath}) {
  final creds = AWSCredentials(accessKey, secretKey, sessionToken);

  final signer = AWSSigV4Signer(
    credentialsProvider: AWSCredentialsProvider(creds),
  );

  final scope = AWSCredentialScope(
      region: region, service: AWSService('iotdevicegateway'));

  final request = AWSHttpRequest(
    method: AWSHttpMethod.get,
    uri: Uri.https(endpoint, urlPath),
  );

  ServiceConfiguration serviceConfiguration =
      const BaseServiceConfiguration(omitSessionToken: true);

  var signed = signer.presignSync(request,
      credentialScope: scope,
      expiresIn: Duration(hours: 1),
      serviceConfiguration: serviceConfiguration);
  var finalParams = signed.query;
  return '$scheme$endpoint$urlPath?$finalParams';
}

And the code crashes at connect operation:

// Create the client with the signed url
  MqttServerClient client = MqttServerClient.withPort(
      signedUrl, identityId, port,
      maxConnectionAttempts: 2);

  // Set the protocol to V3.1.1 for AWS IoT Core, if you fail to do this you will not receive a connect ack with the response code
  client.setProtocolV311();
  // logging if you wish
  client.logging(on: false);
  client.useWebSocket = true;
  client.secure = true;
  client.autoReconnect = true;
  client.disconnectOnNoResponsePeriod = 90;
  client.keepAlivePeriod = 30;

  final MqttConnectMessage connMess =
      MqttConnectMessage().withClientIdentifier(identityId);

  client.connectionMessage = connMess;

  // Connect the client
  try {
    print('MQTT client connecting to AWS IoT using cognito....');
    await client.connect();

It crashes with a FormatException:

FormatException: wss://aw1...y95p-ats.iot.eu-central-1.amazonaws.com/mqtt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA...7RNO6%2F20240711%2Feu-central-1%2Fiotdevicegateway%2Faws4_request&X-Amz-Date=20240711T080057Z&X-Amz-SignedHeaders=host&X-Amz-Signature=7faa4659d57ae9176cf507fb764735c00985e915be577f96bc6e40ae7b1f5d36&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEJD%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDGV1LWNlbnRyYWwtMSJGMEQCIAXJml2dJ48TuDEwTy%2FRvZQgz8mgNjGO6vtoF3PlNshLAiAzhVWAIScvn4B5GCqoWrMrFxCEDOeu6ZCyrvhV9LHdJyrWBAhZEAAaDDg1MTcyNTY1OTczNyIMhc8SLgJtxVE31PQFKrMEOSwxNr%2FT9oEwU2Kakwmi1AFgCLbzL44LRNWCM4pTczH00sFDs4lm1uyMHn4zr2pVMpS3qOdJK4QPlfUecXtDI0Kbj3e6PSItj2mz2g0q39Ksu23UF%2B%2BfJaWzIenJBwVmvqi18d2l%2FhvUf3CoabG42e8HDL7S23t%2BH8KzohHjDb%2BzqbGkLRphJW3zZVTIY39aL%2FJjvXGiMvuu58dyKK16Z%2BmTojjXrmFk0QLF05w6Kn6%2BCNK16teDr7FeXF1bESSYyDUJlBYYu7OMRQfqDUYW6RvD%2FzwUfPnnMHvLmTOXDleBIOd5b12E%2BJAcp0oSf6mLsamFXl51dKoeSAjot57xQ8tJpnVriF9r6%2FeDHuMSZQXGalufsrRhM1F5eeibOrVg927X%2B1tWVAXmN14sFNY49EnLGeIGqTOQHKKR2d5cs51jtECdZF0WR80I3Lu41Ky85CBqmjNlgjkLoW1r%2BBlYePjJfq%2FZqmEbrRU8n1bvihUHk7j98nrA%2Bi4GXtVaSlotBc76aWNXgutcJgLWttMg8jsnelapkm0cFWyktMn2WP7mCKpGNN9%2FRVnsnSArc%2Br%2BamX4q9cHB3T1vCIy6UlOHc0i8RxQ8%2FVViRs%2B1TSy5DhJdErAJFIw9zp5Wsb1QCXnFbf7pBDx2Lxya9hhYte9L1pI3%2FO0%2F05P1zN%2BtINSCb9l5Ot5fD1D368UIJrbO7I00yXp9SBB7qG4AN4nXxtb4v%2BTtxtjAFnmawj5m84OanIDUzEwuaK%2BtAY6hgKN3lNXLmLRHKqOFzL4X9hXaLgOC75z2H8MV5glIF09aGi6F8mugqWKliYsHf0ZQNs7GhNu7cdBW%2FPkKOyp4pQhX9A6T9f84aCUIUZaZGG6uUWF7BdOWggaNi%2B2iz%2Be...j4yUoNAAwdOktK3LYx0Kc6zV1Jd%2F63dBzHvIEVBIUCApJs7RYTJXEjJpjwg105S0pwApida9VD%2Bm5803vOCvGoxNpukhacdyj7qHelUMGmxzKCbB7BEWVCREZwN2lOb%2FaS%2BNI3I8hFbXUxP1lPXKDNndwIzDPN8acoTPIjTFpux8RZJQujzDCF is not a valid link-local address but contains %. Scope id should be used as part of link-local address. (at character 131)

Do you guys have any idea what I’m doing wrong? Thanks