i am using aws cognito as a authorization server, and i have a client server, resource server.

when i start the client server and go to localhost:8082/private i am redirects to cognito in order to login and get the token,
the problem i have now is after seccessful login, cognito redriects me to localhost:8080/private,i get 401, here is how the redirect looks like “http://localhost:8080/private?code=4e71e0f8-4b26-458e-aa6xxxxxx=” with status code 401

here is my oauth2 resource server code
`@Configuration
public class SecurityConfig {

@Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}")
String issuerUri;

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http
            .authorizeHttpRequests(auth -> auth
                    .requestMatchers("/public/**").permitAll()
                    .requestMatchers("/private").hasAnyAuthority("SCOPE_profile")
                    .anyRequest().authenticated())
            .oauth2ResourceServer(oauth2 -> oauth2
                    .jwt(jwt -> jwt.decoder(JwtDecoders.fromIssuerLocation(issuerUri))))
            .build();
}

}`

spring.security.oauth2.resourceserver.jwt.issuer-uri=https://cognito-idp.REGION.amazonaws.com/USERPOOLID_e6gusPFWJ
spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://cognito-idp.REGION.amazonaws.com/USERPOOLID/.well-known/jwks.json

and here is my oauth2 client code, and dependecy i am using is oauth2-client,spring-cloud-starter-gateway,spring-cloud-starter-gateway-mvc

   @Bean
    public RouteLocator customRouteLocator(RouteLocatorBuilder builder ) {
        return builder.routes()
                .route("resource-server", r -> r
                        .path("/private")
                        .filters(GatewayFilterSpec::tokenRelay)
                        .uri("http://localhost:8080/private"))
                .route("resource-server", r -> r
                        .path("/hello")
                        .filters(GatewayFilterSpec::tokenRelay)
                        .uri("http://localhost:8080/hello"))

                .build();
    }

client application.properties

spring.security.oauth2.client.registration.cognito.client-id=CLIENTID
spring.security.oauth2.client.registration.cognito.client-secret=CLIENTSECRET
spring.security.oauth2.client.registration.cognito.scope=profile,email,read
spring.security.oauth2.client.registration.cognito.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.cognito.redirect-uri={baseUrl}/login/oauth2/code/cognito

spring.security.oauth2.client.provider.cognito.authorization-uri=https://domain.auth.REGION.amazoncognito.com/oauth2/authorize
spring.security.oauth2.client.provider.cognito.token-uri=https://domain.auth.REGION.amazoncognito.com/oauth2/token

i cant figure out the problem,

i know the problem is not aws cognito because i already tested in insomnia where i requested oauth2.0 and after successful login i got access token, id token and refresh token. i then took the access token and called the resource server endpoint /private and past the token in the header, everything went well, i could see the content in /private.

the current problem is when i try to sett up the client, and make the client request the resource server endpoints. after login in i cant access resource server, 401