title: TOKEN endpoint returns invalid_client without client secret
body: <p>I am having difficulty with the authorization code flow in Amazon Cognito. The workflow that I am trying to build is the following:</p>
  
  <ol>
  <li>A user authenticates with the built-in Cognito UI.</li>
  <li>Cognito redirects back with the authorization code.</li>
  <li>I send the code to server where it's exchanged for tokens using /oauth2/token endpoint.</li>
  </ol>
  
  <p>I have created a client without client secret. I authenticate using the Cognito UI, get back the code, then send the following with Postman:</p>
  
  <pre><code>URL: https://MY-DOMAIN/oauth2/token
  Method: POST
  Headers: 
  Content-Type: application/x-www-form-urlencoded
  Body:
    grant_type=authorization_code&amp;
    client_id=&lt;my-client-id&gt;&amp;
    code=&lt;code-from-cognito-ui&gt;&amp;
    redirect_uri=&lt;my-redirect-url&gt;
  </code></pre>
  
  <p>I do not use Authorization since there's no client secret.</p>
  
  <p>In return I receive: </p>
  
  <pre><code>Code: 400
  Body: { "error": "invalid_client" }
  </code></pre>
  
  <p>The app client is allowed authorization code grant in the AWS Cognito console.</p>