The AWS object from the aws-amplify package allows a frontend application to start a cognito authentication flow by calling the signIn method.
This dispatches some traffic to the cognito servers, and ultimately if successful, returns
an AuthenticationResult object, whose values are set in the browser's local storage (or cookies, if configured to do so).
How can the local session be set using an AuthenticationResult object which was acquired elsewhere? (eg through the use of the AdminInitiateAuth method on the backend)
If the backend shares origin with the frontend you can have a simple document that places the values in localstorage before redirecting back to your SPA.
Otherwise you are out of luck. OAuth is all about this exact issue: how to grant access to clients in a secure manner. Your SPA is one client, your backend is another.