Solved - we were using a custom domain in AWS cognito, and had the wrong value in the Service Identifier