When a user logs in via an SSO they are redirected by to my auth page where I'm grabbing the authorization_code and attempting to authorize the user to grant access. let headers = new HttpHeaders(); let auth = btoa(<clientId> + ':<client secret'); headers.set('Content-Type', 'application/x-www-form-urlencoded'); headers.set('Authorization', `Basic ${auth}`); headers.set('Accept', 'application/json'); this.http.post( 'https://<cognito domain>/oauth2/token', null, { headers, params: new HttpParams() .set('grant_type', 'authorization_code') .set('code', <code>) .set('redirect_uri', <redirect url>) .set('client_id', <clientId>) } ) I've also done this as a body rather than params and I get the same error. Is there something I'm missing? Continue reading...