Integrate passkeys and MFA with Amazon Cognito.

1. Deploy passkeys and MFA in days instead of months.
2. Enjoy flexible integration options, including pre-built UX/UI or headless setups.
3. Leverage a visual no-code rules engine to create custom rules and policies effortlessly.
4. Access real-time developer support, comprehensive documentation, and integration guides.

Getting started is straightforward:

1. Sign up for an Authsignal account.
2. Configure Authsignal’s API keys in your AWS Cognito instance.
3. Use our step-by-step documentation to enable passkey authentication and MFA flows. For a full walkthrough, check out our AWS Cognito integration guides.

Authsignal offers SDKs for popular languages, including Java, JavaScript, Python, and more, ensuring smooth compatibility with AWS Cognito’s architecture. Read the docs here.

Integrating with Authsignal is completely free. You can create an account here. Authsignal also offers paid plans with additional features—learn more about our plans and pricing here.

In addition to passkeys, Authsignal supports a range of authentication factors, including Multi-Factor Authentication (MFA) methods such as SMS, email, TOTP, and push notifications. This ensures flexibility and security for various use cases and user preferences.

Yes, you can enable passkey authentication in your existing Cognito user pool by upgrading to the Essentials or Plus tier. This allows you to leverage passwordless authentication methods, including passkeys, without migrating users or altering your current user pool structure.

However, the out-of-the-box implementation has some limitations:

• Limited Customization: Cognito abstracts away the WebAuthn configuration options, restricting your ability to customize parameters like authenticatorSelection or attestation
• Hosted UI Dependency: The native passkey support is primarily designed for use with Cognito’s Hosted UI. Integrating passkeys into custom UIs (e.g. a native mobile app) requires a lot of additional development effort

Authsignal addresses these limitations by providing a flexible integration layer that enables passkey authentication across both Hosted and custom UIs, offering greater control over the authentication flow.

Amazon Cognito now supports passkey-based authentication (via FIDO2/WebAuthn), enabling users to sign in without a password. However, passwords are still required in certain flows, such as:

• Account recovery processes
• Administrative actions
• For users who have enabled MFA (passkeys cannot be used with required MFA)
• When passkeys aren't available to the user

Authsignal makes true passwordless authentication possible. By layering Authsignal on top of Cognito, you can remove passwords entirely from your user journey by providing passwordless recovery options, like WhatsApp OTP, Authenticator Apps etc.. Authsignal supports multiple fallback methods to ensure users aren’t locked out if they lose access to their passkey.

Yes, Cognito’s Hosted UI, now referred to as Managed Login, supports passkey authentication as part of the Essentials and Plus tiers. This allows users to sign in using passkeys through the Hosted UI without additional configuration.

However, if you require a customized user interface for a native mobile application or if you need to integrate passkeys into existing applications that do not use Managed Login, Authsignal provides the necessary SDKs to make supporting passkeys easy.