Cognito Token Endpoint - Metadata with Auth Code

Yes, you can pass aws_client_metadata to your Pre token generation Lambda trigger when using the authorization_code grant type with Amazon Cognito's token issuer endpoint, similar to how it's used with the client_credentials grant type.

The aws_client_metadata parameter is an optional parameter that can be included in the request body to the token endpoint. It allows you to pass additional information from the user or application environment to the Pre token generation Lambda trigger.

When using the authorization_code grant type, you can include the aws_client_metadata parameter in the POST body of your token request, just as you would for a client_credentials request. The parameter should be URL-encoded (x-www-form-urlencoded) and contain a JSON object with the metadata you want to pass.

For example, you could include a parameter like this in your token request:

aws_client_metadata=%7B%22environment%22%3A%20%22dev%22,%20%22language%22%3A%20%22en-US%22%7D

This would pass the key-value pairs {"environment": "dev", "language": "en-US"} to your Pre token generation Lambda trigger.

It's important to note that for this to work, your Pre token generation Lambda trigger must be configured to use event version two or later. This allows the trigger to receive and process the client metadata for both authorization_code and client_credentials grant types.

While the documentation examples often focus on the client_credentials flow, the functionality is not limited to that grant type. The aws_client_metadata parameter can be used with various authentication flows, including the authorization_code grant type, to provide additional context to your Lambda trigger.
Sources
The token issuer endpoint - Amazon Cognito
Scopes, M2M, and APIs with resource servers - Amazon Cognito
Pre token generation Lambda trigger - Amazon Cognito
Customizing user pool workflows with Lambda triggers - Amazon Cognito