The new GetClientToken operation allows application clients to securely obtain OAuth2 access tokens using client ID and secret credentials directly via AWS SDK, CLI, or API. This streamlines service-to-service authorization for microservices and automated workloads without setting up a user pool domain.
This addition complements the existing domain-based OAuth client credentials flow while integrating with AWS services such as WAF and PrivateLink for network security. It is generally available in all AWS Regions supporting Cognito user pools and facilitates custom scopes on resource servers.
Source & further reading
Amazon Cognito now supports machine-to-machine authorization without a user pool domain ↗Source published 2026-08-31. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.