AWS Cognito; unauthorized_client error when hitting /oauth2/token : <p>Steps taken so far:</p>

<ul>
<li>Set up new user pool in cognito</li>
<li>Generate an app client with <em>no secret</em>; let's call its id <code>user_pool_client_id</code></li>
<li>Under the user pool client settings for <code>user_pool_client_id</code> check the "Cognito User Pool" box, add <code>https://localhost</code> as a callback and sign out url, check "Authorization Code Grant", "Implicit Grant" and everything under "Allowed OAuth Scopes"</li>
<li>Create a domain name; let's call it <code>user_pool_domain</code></li>
</ul>

<p>Create a new user with a username/password</p>

<p>Now, I can successfully go to:</p>

<p><code>https://{{user_pool_domain}}.auth.us-east-2.amazoncognito.com/oauth2/authorize?response_type=code&amp;client_id={{user_pool_client_id}}&amp;redirect_uri=https%3A%2F%2Flocalhost</code></p>

<p>This presents me with a login page and I am able to login as my user which returns me to <code>https://localhost/?code={{code_uuid}}</code></p>

<p>I then try the following:
<code>
curl -X POST https://{{user_pool_domain}}.auth.us-east-2.amazoncognito.com/oauth2/token -H 'Content-Type: application/x-www-form-urlencoded'  -d 'grant_type=authorization_code&amp;redirect_uri=https%3A%2F%2Flocalhost&amp;code={{code_uuid}}&amp;client_id={{user_pool_client_id}}'
</code></p>

<p>However, this just returns back the following:
<code>
{"error":"unauthorized_client"}
</code></p>

<p>The <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html" rel="noreferrer">token endpoint docs</a> say that <code>unauthorized_client</code> is because "Client is not allowed for code grant flow or for refreshing tokens." which is confusing because I checked the boxes allowing the client to use the code grant flow.</p>
