VerifySoftwareToken returns a SUCCESS response.Īmazon Cognito associates the TOTP factor with the user. TOTP and compares it with the one that your user provided. Password to Amazon Cognito in a VerifySoftwareToken API request.Īmazon Cognito has retained the secret key associated with the user, and generates a Your user enters their temporary password. The authenticatorĪpp bases the password on the secret key you gave to the user. The user's authenticator app displays a temporary password. Your app prompts your user for a code to demonstrate that they have set up their Your app or the hosted UI presents the TOTP to Amazon Cognito in MFA challenge responses. Your userĬonfigures their authenticator app and provides a TOTP for subsequent sign-in attempts. TOTP private key and present it to your user in text or QR code format. When a user first signs in, your app uses their one-time access token to generate the Codes generated with SHA-256 hashing return a Code mismatchĬonfiguring MFA for a user in the Amazon Cognito user pools If your users have set up TOTP, they can use it for MFA, even if you deactivate TOTPĪmazon Cognito only accepts TOTPs from authenticator apps that generate codes with the SHA-1 Response value from an MFA_SETUP challenge to InitiateAuth or AdminInitiateAuth in an AssociateSoftwareToken request. Instead of the access token, you can use the session

Token but hasn't set up TOTP MFA, the user can't sign in with the hosted UI until they If a user in a user pool that requires MFA has already received a one-time access Password for the user, Amazon Cognito immediately challenges the user to set up MFA. Succeeds in the challenge to set their initial password, or if you set a permanent In with the InitiateAuth or AdminInitiateAuth API operations. The user, Amazon Cognito issues one-time tokens when the user first signs in.Īmazon Cognito doesn't issue one-time tokens to an administrator-created user who signs One-time tokens from the hosted UI to the user. Or through the hosted UI receives one-time tokens when the user completesĪfter you create a user, and the user sets their initial password, Amazon Cognito issues UI sign-up experience, see How to sign up for a new account in theĪ user who signs up in your user pool with the SignUp API operation In user pools where you have allowed users to choose between SMS and TOTP MFA,Īmazon Cognito also presents your user with a choice of method. MFA method, displays a QR code to set up their authenticator app, and verifies their MFA Amazon Cognito prompts your user to choose an When you configure your user pool to require TOTP MFA and your users sign up for yourĪpp in the hosted UI, Amazon Cognito automates the user process. Your user or set TOTP as the preferred MFA method for your user. TOTP token can continue to use it for MFA.Ĭonfiguring TOTP for your user is a multi-step process where your user receives a secretĬode that they validate by entering a one-time password. Software token MFA for the user pool later, users who previously associated and verified a Software Token MFA has not been enabled by the userPool. SoftwareTokenMFANotFoundException exception with the description If you haven't activated TOTP software token MFA for the user pool, Amazon Cognito can't use

Totp authenticator browser