As a follow up to this if any one is interested:
We essentially had to setup an intermediate oauth server to handle the tokens inspired by this post:
https://medium.com/@scott_84836/adding-aws-cognito-authentication-to-discourse-using-oauth2-basic-f20209ba6162
We have a flask/python backend so ended up using: python-oauth2 · PyPI
TLDR: can’t do a passwordless setup using cognito using any default means, had to setup lightweight oauth ourselves.