Class CognitoAuthClient

The TOTP secret for an MFA_SETUP challenge, and the session to verify it on.

A new TOTP secret for the signed-in user. The current one keeps working until verifyUserSoftwareToken accepts a code from this one.

The hosted authorize endpoint, sent straight to identityProvider (Google or a tenant IdP).

A wrong previousPassword returns NOT_AUTHORIZED.

credential is WebAuthn RegistrationResponseJSON, as a JSON string.

Confirms the email; the session, when given, signs in without the password.

Redeems an authorization code with the PKCE verifier, authenticating as the client.

Emails a reset code; an unknown address answers the same (preventUserExistenceErrors).

The login's email attribute (AdminGetUser), by username or sub, for a step that holds only a challenge's username. Null for no such user.

Whether the signed-in user has TOTP turned on (GetUser's UserMFASettingList).

Revokes every refresh token the user holds, in every browser (AdminUserGlobalSignOut, which needs IAM). username is cognito:username.

Starts USER_AUTH: a password checked at once, a passkey's request options, or the sign-in ConfirmSignUp handed back as signUpSession.

USER_PASSWORD_AUTH: the password in one call, for a client that allows that flow. A wrong password and an unknown user both return NOT_AUTHORIZED.

Every passkey the signed-in user has, across all pages.

The hosted logout, which ends the pool's own session for a federated login and then sends the browser to logoutUri. That must be one of the app client's logoutUrls exactly: its origins, with no path.

Turns TOTP on as the user's preferred MFA.

New access and ID tokens. username is the token's cognito:username, for the hash.

Revokes the refresh token and every access token issued from it.

Forgot-password for every login, backfilled ones included. A backfilled user is FORCE_CHANGE_PASSWORD with a temporary password nobody was sent, a state ForgotPassword refuses, so it first gets a random permanent one (AdminSetUserPassword, which needs IAM) that the emailed code replaces. A login linked to Google or a tenant IdP never gets a password: it returns as if sent, sending nothing, so its IdP stays the only way in.

Self sign-up; Cognito emails a confirmation code. An address that already has a login returns USERNAME_EXISTS, which callers must not reveal.

WebAuthn PublicKeyCredentialCreationOptionsJSON, as a JSON string.

Checks the first code; answer MFA_SETUP on the session it returns.

Checks a code from the newly associated secret, which then replaces the old one.

Which ways in the address's login has, for the email step to offer. A FORCE_CHANGE_PASSWORD login's temporary password was never sent, so it has none. An unknown address answers as a password login.