aws cognito get jwt token in single api call - amazon-cognito

Question

How to get jwt token in single step(api call) from aws cognito oauth2/token endpoint passing username and password
curl --location --request POST 'https://xxx.auth.us-east-2.amazoncognito.com/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic a......k' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=t34...nu'
--Authorization base64ecoded username:password
Response- "error": "invalid_client"
App client settings :
Allowed OAuth Flows : Authorization code grant, Implicit Grant
Allowed OAuth scope : email , openid
App clients : ALLOW_USER_PASSWORD_AUTH
I tried oauth2/authorize too but getting html page in response

Answer 1

There's no need to add the Authorization header. Instead, use the code you see in the URL. This worked for me.
curl --location --request POST 'https://xxx.auth.us-east-2.amazoncognito.com/oauth2/token'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'grant_type=client_credentials'
--data-urlencode 'client_id=t34...nu'
--data-urlencode 'code=afa78ac6-..-b8dd-5b'
--data-urlencode 'redirect_uri=path'

Answer 2

The client credentials flow to the token endpoint is to receive an access token for machine to machine communication. It is not based on a given user so no user name and password is required.
See 'Exchanging Client Credentials for an Access Token'
https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html
To sign in with the oauth endpoints it is intended to do this via the HostedUI or an external IDP. However, you can do it pro-grammatically but will require a call to authorize and login endpoint.. You can see an example in python here:
https://github.com/starkshaw/aws-cognito-user-pool-custom-scope

Answer 3

This is a late answer, but following worked for me nicely with a client_credentials workflow.
curl --request POST \
--url 'https://XYZ.auth.us-west-2.amazoncognito.com/oauth2/token' \
--header 'content-type: application/x-www-form-urlencoded' \
--data grant_type=client_credentials \
--data client_id=7*******e \
--data client_secret=2*****5pjk9valn
Here is the response I got:
{"access_token":"eyJra*****eA","expires_in":3600,"token_type":"Bearer"}