Quite an old question, but I'll try to answer it for others even if OP have already figured it out.
There is no code of requesting the sign-in flow posted, so I'll just assume that OP combined 2 types of request like it is described in Documentation
let requests = [ASAuthorizationAppleIDProvider().createRequest(),
ASAuthorizationPasswordProvider().createRequest()]
Doing this results in no authorizationCode being returned (or actually returned as nil) in ASAuthorizationAppleIDCredential
As for why this happens? Good question I do not know the answer yet.