AWS Cognito, authorization code request issue - php

Question

I'm redirecting my user to Cognito hosted UI, then returning to my PHP application. If the code is found then I use Guzzle to exchange this with the access tokens, however I keep on receiving the following error:
{"error":"unauthorized_client"}
This is my code, I have double checked what i'm passing in with the documentation and it all looks fine to me!
if ($code = request()->input('code')) {
$client = new Client();
$confirmCodeDomain = "https://$domain/oauth2/token";
try {
$result = $client->post($confirmCodeDomain, [
'form_params' => [
'grant_type' => 'authorization_code',
'client_id' => $client_id,
'code' => $code,
'redirect_uri' => 'https://localhost/auth/',
],
'headers' => [
'Content-Type' => 'application/x-www-form-urlencoded',
'Authorization' => 'Basic '.base64_encode("$client_id:$client_secret")
]
]);
} catch (\Exception $e) {
dd($e);
}
dd($result);
}
This is my serverless file which creates the AWS resources required, the error states:
unauthorized_client
Client is not allowed for code grant flow or for refreshing tokens.
However as you can see from my client definition the AllowedOAuthFlows is set to code:
resources:
Resources:
CognitoEmployeePool:
Type: AWS::Cognito::UserPool
Properties:
UserPoolName: employees
MfaConfiguration: OFF
AdminCreateUserConfig:
AllowAdminCreateUserOnly: true
Policies:
PasswordPolicy:
MinimumLength: 7
RequireLowercase: true
RequireUppercase: true
RequireNumbers: false
RequireSymbols: false
EmailConfiguration:
EmailSendingAccount: "COGNITO_DEFAULT"
UsernameAttributes:
- email
AutoVerifiedAttributes:
- email
CognitoEmployeePoolClient:
Type: AWS::Cognito::UserPoolClient
Properties:
ClientName: employees-webplanner
CallbackURLs:
- "https://localhost"
- "https://localhost/auth"
AllowedOAuthFlowsUserPoolClient: true
SupportedIdentityProviders:
- "COGNITO"
AllowedOAuthFlows:
- "code"
AllowedOAuthScopes:
- "openid"
- "email"
UserPoolId:
Ref: CognitoEmployeePool
ExplicitAuthFlows:
- ALLOW_ADMIN_USER_PASSWORD_AUTH
- ALLOW_REFRESH_TOKEN_AUTH
- ALLOW_USER_PASSWORD_AUTH
GenerateSecret: true
CognitoEmployeePoolDomain:
Type: AWS::Cognito::UserPoolDomain
Properties:
UserPoolId: !Ref CognitoEmployeePool
Domain: "marvs-sso"