title: Cognito AUTHORIZATION endpoint responsds with invalid client
body: <p>I have set up a Cognito authorizer with an App client  that is connected to Google Identity Provider. </p>
  
  <p>"Callback URL" is <code>http://localhost</code> and "Sign out URL" is <code>http://localhost/logout</code>.  I have enabled the "Authorization code grant" and the "Implicit grant" flows and the I want to implement the following flow :</p>
  
  <ol>
  <li>User sends a GET request to the LOGIN endpoint (/login) which is the following:</li>
  </ol>
  
  <p><code>https://mycognAuthorizer.auth.eu-west-1.amazoncognito.com/login?client_id=MYCLIENTID&amp;redirect_uri=http://localhost&amp;response_type=code</code></p>
  
  <ol start="2">
  <li>User sends a POST request to the TOKEN endpoint (/oauth2/token) with the following parameters</li>
  </ol>
  
  <pre><code>POST https://hocublen.auth.eu-west-1.amazoncognito.com/oauth2/token
  Content-Type='application/x-www-form-urlencoded'
  
  grant_type:authorization_code&amp;
  client_id:&lt;MYCLIENTID&gt;&amp;
  redirect_uri:http://localhost&amp;
  code:&lt;CODE_FROM_LOGIN&gt;
  </code></pre>
  
  <p>Where <code>&lt;CODE_FROM_LOGIN&gt;</code> is the code returned by <code>/login</code> endpoint on the first step. </p>
  
  <p>My problem is that the first endpoint (/login) works fine and I get the code, but the second endpoint always returns a Bad Request response with an "invalid client"  message. </p>
  
  <p>Is there something that can be missing from the configuration?</p>
  
  <p>Also, if I choose to ask for a token from the login endpoint instead of a code, is this token equivalent with that of the TOKEN endpoint?</p>