title: AWS Cognito Authorization code grant flow without using the hosted UI
body: <p>Using AWS's Cognito without the hosted UI, given a username, and password I would like to receive an Authorization code grant without using the hosted ui.</p>
  
  <p>Is this possible? I am writing my own sign up, log in forms but cannot seem to find documentation on this subject.</p>
  
  <p>Currently I can use AWS.CognitoIdentityServiceProvider and the initiateAuth function to exchange username password for tokens, but I do not want to return those tokens in the redirect URL, I would rather return an authorization code grant that can be exchanged for tokens.</p>
  
  <p>So how can I using initiateAuth receive authorization code grant instead of tokens.</p>
  
  <p>UPDATE: Using the correct answer below,  this is how I ended up doing it in node.</p>
  
  <pre><code>const base64url = require('base64url');
  const crypto = require('crypto');
  const request = require('request');
  const querystring = require ('querystring');
  
  function generateCodeVerifierHash(code_verifier) {
    return crypto.createHmac('SHA256', code_verifier)
    .digest('base64');
  }
  
  function generateCodeVerifier() {
    var text = "";
    var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._`-";
  
    for (var i = 0; i &lt; 64; i++)
      text += possible.charAt(Math.floor(Math.random() * possible.length));
  
    return base64url.encode(text);
  }
  
  var CLIENT_ID="Your Client Id";
  var CLIENT_SECRET="Your Client Secret";
  var RESPONSE_TYPE="code";
  var REDIRECT_URI= encodeURIComponent("Your Redirect Url");
  var SCOPE="openid";
  var AUTH_DOMAIN= "Your Cognito Auth Domain";
  var USERNAME="User's Username";
  var PASSWORD="User's Password";
  var CODE_CHALLENGE_METHOD="S256";
  
  // Challenge
  var code_verifier = generateCodeVerifier();
  var code_challenge = generateCodeVerifierHash(code_verifier);
  
  // Get CSRF token from /oauth2/authorize endpoint
  var csrfRequestUrl = `https://${AUTH_DOMAIN}/oauth2/authorize?response_type=${RESPONSE_TYPE}&amp;client_id=${CLIENT_ID}&amp;redirect_uri=${REDIRECT_URI}&amp;scope=${SCOPE}&amp;code_challenge_method=${CODE_CHALLENGE_METHOD}&amp;code_challenge=${code_challenge}`;
  // Post CSRF Token and username/password to /login endpoint
  var codeRequestUrl = `https://${AUTH_DOMAIN}/login?response_type=${RESPONSE_TYPE}&amp;client_id=${CLIENT_ID}&amp;redirect_uri=${REDIRECT_URI}`;
  
  request.get(csrfRequestUrl, (err, res, body) =&gt; {
      var XSRFTOKEN = res.headers['set-cookie'].filter( (header) =&gt; header.substring(0,10) == 'XSRF-TOKEN')[0];
  
      form = {
        '_csrf': `${XSRFTOKEN.split(';')[0].split('=')[1]}`,
        'username': `${USERNAME}`,
        'password': `${PASSWORD}`,
      }
  
      var formData = querystring.stringify(form);
      var contentLength = formData.length;
  
      request({
        headers: {
          'Content-Length': contentLength,
          'Content-Type': 'application/x-www-form-urlencoded',
          'Cookie': `${XSRFTOKEN}`,
        },
        uri: codeRequestUrl,
        body: formData,
        method: 'POST'
      }, function (err, res, body) {
        var authorizationCodeGrant = res.headers.location.split('=')[1];
        console.log(authorizationCodeGrant);
      });
  });
  </code></pre>