Learn how to integrate Authsignal with Amazon Cognito to rapidly implement passwordless authentication.
Amazon Cognito offers two approaches for authentication: a managed login with a hosted UI, or integration via Custom authentication challenge Lambda triggers when you need more control over the authentication UI and user experience.
To integrate Authsignal with Cognito, you’ll use the second approach. Authsignal offers two ways of integrating with Cognito’s custom authentication challenge Lambda triggers:
Passkey authentication in a native mobile app using Authsignal Client SDKs
WhatsApp OTP authentication in a web app using Authsignal's pre-built UI
The first lambda trigger which we will use is Create auth challenge.
We will use the Authsignal Server SDK in this lambda to return a short-lived challenge token.
We’ll also return whether the user is enrolled or not, so we know which Client SDK method to use in a subsequent step.
We will use the Authsignal Server SDK in this lambda to return a short-lived challenge token.
We’ll also return whether the user is enrolled or not, so we know which Client SDK method to use in a subsequent step.
We will use the Authsignal Server SDK in this lambda to return a short-lived pre-built UI URL.
The second lambda trigger which we will use is Verify auth challenge response.
In this lambda we will take the validation token obtained from the Authsignal Client SDK and pass it to the Authsignal Server SDK to verify the challenge.
In this lambda we will take the validation token obtained from the Authsignal Client SDK and pass it to the Authsignal Server SDK to verify the challenge.
In this lambda we will take the validation token obtained when redirecting back from the Authsignal pre-built UI and pass it to the Authsignal Server SDK to verify the challenge.
Once the user has inputted their email address or phone number you can either:
The approach will depend on your user pool configuration. For more detail on Cognito usernames refer to the AWS documentation.
Passkeys represent a new paradigm of device-initiated authentication where a username is not required as the first step. For this reason the integration steps are slightly different - see our guide on implementing passkeys with Cognito.
You can call SignUp either as part of a separate account registration flow, or “just-in-time” before every sign-in attempt (ignoring if the user already exists).
Alternately you can handle the sign-up logic in your backend using Cognito’s AdminCreateUserCommand as in this example.
The next step in authenticating with Cognito from your web or mobile app is to call InitiateAuth. This will invoke the Create auth challenge lambda which we have implemented above to return an Authsignal challenge token.
Here we obtain a challenge token to pass to an Authsignal Client SDK.
Here we obtain a challenge token to pass to an Authsignal Client SDK.
Here we obtain a short-lived URL for the Authsignal pre-built UI.
The next step is to use Authsignal to handle presenting the user with a challenge.
Use an Authsignal Client SDK to present the user with a challenge.
Here we show email OTP but our SDKs support a variety of methods including SMS or WhatsApp OTP, email magic link, authenticator app, and more.
Use an Authsignal Client SDK to present the user with a challenge.
Here we show email OTP but our SDKs support a variety of methods including SMS or WhatsApp OTP, email magic link, authenticator app, and more.
Use the Authsignal pre-built UI to present the user with a challenge.
The Authsignal Web SDK can be used to launch the pre-built UI in redirect or popup mode.
The final step of your app integration is to call RespondToAuthChallenge. This will invoke the Verify auth challenge response lambda which we have implemented above to complete authentication using our Authsignal validation token.
Pass the validation token obtained from the Authsignal Client SDK to Cognito as the challenge answer.
Pass the validation token obtained from the Authsignal Client SDK to Cognito as the challenge answer.
Pass the validation token obtained from the Authsignal pre-built UI to Cognito as the challenge answer.