Cognito client crendetials flow

content/en/user-guide/aws/cognito/index.md

@@ -331,6 +331,72 @@ Ensuring this match is crucial for the proper functioning of the authentication
 {"access_token": "eyJ0eXAi…lKaHx44Q", "expires_in": 86400, "token_type": "Bearer", "refresh_token": "e3f08304", "id_token": "eyJ0eXAi…ADTXv5mA"}
 ```
 
+### Client credentials grant
+
+The client credentials grant is designed for machine-to-machine (M2M) communication.
+In contrast, the authorization code and implicit grants provide tokens to authenticated human users.
+The client credentials grant allows for scope-based authorization from a non-interactive system to an API.
+Your app can directly request client credentials from the token endpoint to receive an access token.
+
+To request the token from LocalStack the correct URL is `http://cognito-idp.localhost.localstack.cloud:4566/_aws/cognito-idp/oauth2/token`.
+For additional information on our endpoints you can check our [Internal Endpoints](https://docs.localstack.cloud/references/internal-endpoints/) documentation.
+
+In case that there is more than one user pool, LocalStack detects the right one by inspecting the `clientId` of the requests.
+
+Here is an example on how to set it up:
+
+```sh
+#Create client user pool with a client.
+export client_id=$(awslocal cognito-idp create-user-pool-client --user-pool-id $pool_id --client-name test-client --generate-secret  | jq -rc ".UserPoolClient.ClientId")
+
+#Retrieve secret.
+export client_secret=$(awslocal cognito-idp describe-user-pool-client --user-pool-id $pool_id --client-id $client_id | jq -r '.UserPoolClient.ClientSecret')
+
+#Create resource server
+awslocal cognito-idp create-resource-server \
+  --user-pool-id $pool_id \
+  --identifier "api-client-organizations" \
+  --name "Resource Server Name" \
+  --scopes '[{"ScopeName":"read","ScopeDescription":"Read access to Organizations"}]'
+
+```
+
+Then you can retrieve the token from your application by using the mentioned endpoint: `http://cognito-idp.localhost.localstack.cloud:4566/_aws/cognito-idp/oauth2/token` endpoint.
+
+```javascript
+require('dotenv').config();
+const axios = require('axios');
+
+async function getAccessTokenWithSecret() {
+    const clientId = process.env.client_id;
+    const clientSecret = process.env.client_secret;
+    const scope = 'api-client-organizations/read';
+    const url = 'http://cognito-idp.localhost.localstack.cloud:4566/_aws/cognito-idp/oauth2/token';
+
+    const authHeader = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
+
+    const headers = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Authorization': `Basic ${authHeader}`
+    };
+
+    const payload = new URLSearchParams({
+        grant_type: 'client_credentials',
+        client_id: clientId,
+        scope: scope
+    });
+
+    try {
+        const response = await axios.post(url, payload, { headers });
+        console.log(response.data);
+    } catch (error) {
+        console.error('Error fetching access token:', error.response ? error.response.data : error.message);
+    }
+}
+
+getAccessTokenWithSecret();
+```
+
 ## Serverless and Cognito
 
 Furthermore, you have the option to combine Cognito and LocalStack seamlessly with the [Serverless framework](https://www.serverless.com/).