Use AWS CLI to authenticate a Cognito client and get access_token
Generate the secret hash via https://aws.amazon.com/premiumsupport/knowledge-center/cognito-unable-to-verify-secret-hash/
Then:
aws cognito-idp initiate-auth --region ap-southeast-2 --auth-flow USER_PASSWORD_AUTH --client-id <clientid> --auth-parameters USERNAME=<username>,SECRET_HASH=<generated-secret>,PASSWORD=<password>