After completing the actions specified by the sign-on policy, in this case submitting a username and password, the authentication flow completes and the user is redirected to the URL specified in the resumeUrl property in the flow resource.

You can use the GET /{envID}/as/resume?flowId={flowID} endpoint to obtain the code required to exchange for an access token. The Location HTTP header returnd by the resume endpoint contains the code.