Sign-in
Amplify provides a client library that enables you to interact with backend resources such as Amplify Auth.
Using the signIn API
Amplify.Auth.signIn( "username", "password", result -> Log.i("AuthQuickstart", result.isSignedIn() ? "Sign in succeeded" : "Sign in not complete"), error -> Log.e("AuthQuickstart", error.toString()));
Amplify.Auth.signIn("username", "password", { result -> if (result.isSignedIn) { Log.i("AuthQuickstart", "Sign in succeeded") } else { Log.i("AuthQuickstart", "Sign in not complete") } }, { Log.e("AuthQuickstart", "Failed to sign in", it) })
try { val result = Amplify.Auth.signIn("username", "password") if (result.isSignedIn) { Log.i("AuthQuickstart", "Sign in succeeded") } else { Log.e("AuthQuickstart", "Sign in not complete") }} catch (error: AuthException) { Log.e("AuthQuickstart", "Sign in failed", error)}
RxAmplify.Auth.signIn("username", "password") .subscribe( result -> Log.i("AuthQuickstart", result.isSignedIn() ? "Sign in succeeded" : "Sign in not complete"), error -> Log.e("AuthQuickstart", error.toString()) );
The signIn
API response will include a nextStep
property, which can be used to determine if further action is required. It may return the following next steps:
Next Step | Description |
---|---|
CONFIRM_SIGN_IN_WITH_NEW_PASSWORD | The user was created with a temporary password and must set a new one. Complete the process with confirmSignIn . |
CONFIRM_SIGN_IN_WITH_CUSTOM_CHALLENGE | The sign-in must be confirmed with a custom challenge response. Complete the process with confirmSignIn . |
CONFIRM_SIGN_IN_WITH_TOTP_CODE | The sign-in must be confirmed with a TOTP code from the user. Complete the process with confirmSignIn . |
CONFIRM_SIGN_IN_WITH_SMS_MFA_CODE | The sign-in must be confirmed with a SMS code from the user. Complete the process with confirmSignIn . |
CONFIRM_SIGN_IN_WITH_OTP | The sign-in must be confirmed with a code from the user (sent via SMS or Email). Complete the process with confirmSignIn . |
CONFIRM_SIGN_IN_WITH_PASSWORD | The sign-in must be confirmed with the password from the user. Complete the process with confirmSignIn . |
CONTINUE_SIGN_IN_WITH_MFA_SETUP_SELECTION | The user must select their mode of MFA verification to setup. Complete the process by passing either MFAType.EMAIL.challengeResponse or MFAType.TOTP.challengeResponse to confirmSignIn . |
CONTINUE_SIGN_IN_WITH_MFA_SELECTION | The user must select their mode of MFA verification before signing in. Complete the process with confirmSignIn . |
CONTINUE_SIGN_IN_WITH_TOTP_SETUP | The TOTP setup process must be continued. Complete the process with confirmSignIn . |
CONTINUE_SIGN_IN_WITH_EMAIL_MFA_SETUP | The EMAIL setup process must be continued. Complete the process by passing a valid email address to confirmSignIn . |
CONTINUE_SIGN_IN_WITH_FIRST_FACTOR_SELECTION | The user must select their mode of first factor authentication. Complete the process by passing the desired mode to the challengeResponse field of confirmSignIn . |
RESET_PASSWORD | The user must reset their password via resetPassword . |
CONFIRM_SIGN_UP | The user hasn't completed the sign-up flow fully and must be confirmed via confirmSignUp . |
DONE | The sign in process has been completed. |
For more information on handling the MFA steps that may be returned, see multi-factor authentication.
With multi-factor auth enabled
When you have Email or SMS MFA enabled, Cognito will send messages to your users on your behalf. Email and SMS messages require that your users have email address and phone number attributes respectively. It is recommended to set these attributes as required in your user pool if you wish to use either Email MFA or SMS MFA. When these attributes are required, a user must provide these details before they can complete the sign up process.
If you have set MFA to be required and you have activated more than one authentication factor, Cognito will prompt new users to select an MFA factor they want to use. Users must have a phone number to select SMS and an email address to select email MFA.
If a user doesn't have the necessary attributes defined for any available message based MFA, Cognito will prompt them to set up TOTP.
Visit the multi-factor authentication documentation to learn more about enabling MFA on your backend auth resource.
ArrayList<AuthUserAttribute> attributes = new ArrayList<>();attributes.add(new AuthUserAttribute(AuthUserAttributeKey.email(), "my@email.com"));attributes.add(new AuthUserAttribute(AuthUserAttributeKey.phoneNumber(), "+15551234567"));
Amplify.Auth.signUp( "username", "Password123", AuthSignUpOptions.builder().userAttributes(attributes).build(), result -> Log.i("AuthQuickstart", result.toString()), error -> Log.e("AuthQuickstart", error.toString()));
val attrs = mapOf( AuthUserAttributeKey.email() to "my@email.com", AuthUserAttributeKey.phoneNumber() to "+15551234567")val options = AuthSignUpOptions.builder() .userAttributes(attrs.map { AuthUserAttribute(it.key, it.value) }) .build()Amplify.Auth.signUp("username", "Password123", options, { Log.i("AuthQuickstart", "Sign up result = $it") }, { Log.e("AuthQuickstart", "Sign up failed", it) })
val attrs = mapOf( AuthUserAttributeKey.email() to "my@email.com", AuthUserAttributeKey.phoneNumber() to "+15551234567")val options = AuthSignUpOptions.builder() .userAttributes(attrs.map { AuthUserAttribute(it.key, it.value) }) .build()try { val result = Amplify.Auth.signUp("username", "Password123", options) Log.i("AuthQuickstart", "Sign up OK: $result")} catch (error: AuthException) { Log.e("AuthQuickstart", "Sign up failed", error)}
ArrayList<AuthUserAttribute> attributes = new ArrayList<>();attributes.add(new AuthUserAttribute(AuthUserAttributeKey.email(), "my@email.com"));attributes.add(new AuthUserAttribute(AuthUserAttributeKey.phoneNumber(), "+15551234567"));
RxAmplify.Auth.signUp( "username", "Password123", AuthSignUpOptions.builder().userAttributes(attributes).build()) .subscribe( result -> Log.i("AuthQuickstart", result.toString()), error -> Log.e("AuthQuickstart", error.toString()) );
Confirm sign-in
Following sign in, you will receive a nextStep
in the sign-in result of one of the following types. Collect the user response and then pass to the confirmSignIn
API to complete the sign in flow.
Next Step | Description |
---|---|
CONFIRM_SIGN_IN_WITH_TOTP_CODE | The sign-in must be confirmed with a TOTP code from the user. Complete the process with confirmSignIn . |
CONFIRM_SIGN_IN_WITH_SMS_MFA_CODE | The sign-in must be confirmed with a SMS code from the user. Complete the process with confirmSignIn . |
CONFIRM_SIGN_IN_WITH_OTP | The sign-in must be confirmed with a code from the user (sent via SMS or Email). Complete the process with confirmSignIn . |
CONFIRM_SIGN_IN_WITH_PASSWORD | The sign-in must be confirmed with the password from the user. Complete the process with confirmSignIn . |
CONTINUE_SIGN_IN_WITH_FIRST_FACTOR_SELECTION | The user must select their mode of first factor authentication. Complete the process by passing the desired mode to the challengeResponse field of confirmSignIn . |
CONTINUE_SIGN_IN_WITH_MFA_SELECTION | The user must select their mode of MFA verification before signing in. Complete the process with confirmSignIn . |
CONTINUE_SIGN_IN_WITH_MFA_SETUP_SELECTION | The user must select their mode of MFA verification to setup. Complete the process by passing either MFAType.EMAIL.challengeResponse or MFAType.TOTP.challengeResponse to confirmSignIn . |
CONTINUE_SIGN_IN_WITH_TOTP_SETUP | The TOTP setup process must be continued. Complete the process with confirmSignIn . |
CONTINUE_SIGN_IN_WITH_EMAIL_MFA_SETUP | The EMAIL setup process must be continued. Complete the process by passing a valid email address to confirmSignIn . |
Amplify.Auth.confirmSignIn( "confirmation code received via SMS", result -> Log.i("AuthQuickstart", result.toString()), error -> Log.e("AuthQuickstart", error.toString()));
Amplify.Auth.confirmSignIn("code received via SMS", { Log.i("AuthQuickstart", "Confirmed signin: $it") }, { Log.e("AuthQuickstart", "Failed to confirm signin", it) })
try { val result = Amplify.Auth.confirmSignIn("code received via SMS") Log.i("AuthQuickstart", "Confirmed signin: $result")} catch (error: AuthException) { Log.e("AuthQuickstart", "Failed to confirm signin", error)}
RxAmplify.Auth.confirmSignIn("confirmation code received via SMS") .subscribe( result -> Log.i("AuthQuickstart", result.toString()), error -> Log.e("AuthQuickstart", error.toString()) );
Sign in with an external identity provider
To sign in using an external identity provider such as Google, use the signInWithSocialWebUI
function.
Update AndroidManifest.xml
Add the following activity and queries tag to your app's AndroidManifest.xml
file, replacing myapp
with
your redirect URI prefix if necessary:
<application ...> ... <activity android:name="com.amplifyframework.auth.cognito.activities.HostedUIRedirectActivity" android:exported="true"> <intent-filter> <action android:name="android.intent.action.VIEW" /> <category android:name="android.intent.category.DEFAULT" /> <category android:name="android.intent.category.BROWSABLE" /> <data android:scheme="myapp" /> </intent-filter> </activity> ...</application>
Launch Social Web UI Sign In
Sweet! You're now ready to launch sign in with your social provider's web UI.
For now, just add this method to the onCreate
method of MainActivity with whatever provider you're using (shown with Facebook below):
// Replace facebook with your chosen auth provider such as google, amazon, or appleAmplify.Auth.signInWithSocialWebUI( AuthProvider.facebook(), this, result -> Log.i("AuthQuickstart", result.toString()), error -> Log.e("AuthQuickstart", error.toString()));
// Replace facebook with your chosen auth provider such as google, amazon, or appleAmplify.Auth.signInWithSocialWebUI( AuthProvider.facebook(), this, { Log.i("AuthQuickstart", "Sign in OK: $it") }, { Log.e("AuthQuickstart", "Sign in failed", it) })
try { // Replace facebook with your chosen auth provider such as google, amazon, or apple val result = Amplify.Auth.signInWithSocialWebUI(AuthProvider.facebook(), this) Log.i("AuthQuickstart", "Sign in OK: $result")} catch (error: AuthException) { Log.e("AuthQuickstart", "Sign in failed", error)}
// Replace facebook with your chosen auth provider such as google, amazon, or appleRxAmplify.Auth.signInWithSocialWebUI(AuthProvider.facebook(), this) .subscribe( result -> Log.i("AuthQuickstart", result.toString()), error -> Log.e("AuthQuickstart", error.toString()) );
Sign in with passwordless methods
Your application's users can also sign in using passwordless methods. To learn more, visit the concepts page for passwordless.
SMS OTP
To request an OTP code via SMS for authentication, you pass the challengeResponse
for AuthFactorType.SMS_OTP
to the confirmSignIn
API.
Amplify will respond appropriately to Cognito and return the challenge as the sign in next step: CONFIRM_SIGN_IN_WITH_OTP_CODE
. You will call confirmSignIn
again, this time with the OTP that your user provides.
// First confirm the challenge typeAmplify.Auth.confirmSignIn( AuthFactorType.SMS_OTP.getChallengeResponse(), result -> { if (result.getNextStep().getSignInStep() == AuthSignInStep.CONFIRM_SIGN_IN_WITH_OTP) { // Show UI to collect OTP } }, error -> Log.e("AuthQuickstart", error.toString()));
// Then pass that OTP into the confirmSignIn APIAmplify.Auth.confirmSignIn( "123456", result -> { // result.getNextStep().getSignInStep() should be "DONE" now }, error -> Log.e("AuthQuickstart", error.toString()));
// First confirm the challenge typeAmplify.Auth.confirmSignIn( AuthFactorType.SMS_OTP.challengeResponse, { result -> if (result.nextStep.signInStep == AuthSignInStep.CONFIRM_SIGN_IN_WITH_OTP) { // Show UI to collect OTP } }, { error -> Log.e("AuthQuickstart", "Failed to sign in", error) })
// Then pass that OTP into the confirmSignIn APIAmplify.Auth.confirmSignIn( "123456", { result -> // result.nextStep.signInStep should be "DONE" now }, { error -> Log.e("AuthQuickstart", "Failed to sign in", error) })
// First confirm the challenge typevar result = Amplify.Auth.confirmSignIn(AuthFactorType.SMS_OTP.challengeResponse)if (result.nextStep.signInStep == AuthSignInStep.CONFIRM_SIGN_IN_WITH_OTP) { // Show UI to collect OTP}
// Then pass that OTP into the confirmSignIn APIresult = Amplify.Auth.confirmSignIn("123456")
// result.nextStep.signInStep should be "DONE" now
// First confirm the challenge typeRxAmplify.Auth.confirmSignIn(AuthFactorType.SMS_OTP.getChallengeResponse()) .subscribe( result -> { if (result.getNextStep().getSignInStep() == AuthSignInStep.CONFIRM_SIGN_IN_WITH_OTP) { // Show UI to collect OTP } }, error -> Log.e("AuthQuickstart", error.toString()) );
// Then pass that OTP into the confirmSignIn APIRxAmplify.Auth.confirmSignIn("123456") .subscribe( result -> { // result.getNextStep().getSignInStep() should be "DONE" now }, error -> Log.e("AuthQuickstart", error.toString()) );
Email OTP
To request an OTP code via email for authentication, you pass the challengeResponse
for AuthFactorType.EMAIL_OTP
to the confirmSignIn
API.
Amplify will respond appropriately to Cognito and return the challenge as the sign in next step: CONFIRM_SIGN_IN_WITH_OTP_CODE
. You will call confirmSignIn
again, this time with the OTP that your user provides.
// First confirm the challenge typeAmplify.Auth.confirmSignIn( AuthFactorType.EMAIL_OTP.getChallengeResponse(), result -> { if (result.getNextStep().getSignInStep() == AuthSignInStep.CONFIRM_SIGN_IN_WITH_OTP) { // Show UI to collect OTP } }, error -> Log.e("AuthQuickstart", error.toString()));
// Then pass that OTP into the confirmSignIn APIAmplify.Auth.confirmSignIn( "123456", result -> { // result.getNextStep().getSignInStep() should be "DONE" now }, error -> Log.e("AuthQuickstart", error.toString()));
// First confirm the challenge typeAmplify.Auth.confirmSignIn( AuthFactorType.EMAIL_OTP.challengeResponse, { result -> if (result.nextStep.signInStep == AuthSignInStep.CONFIRM_SIGN_IN_WITH_OTP) { // Show UI to collect OTP } }, { error -> Log.e("AuthQuickstart", "Failed to sign in", error) })
// Then pass that OTP into the confirmSignIn APIAmplify.Auth.confirmSignIn( "123456", { result -> // result.nextStep.signInStep should be "DONE" now }, { error -> Log.e("AuthQuickstart", "Failed to sign in", error) })
// First confirm the challenge typevar result = Amplify.Auth.confirmSignIn(AuthFactorType.EMAIL_OTP.challengeResponse)if (result.nextStep.signInStep == AuthSignInStep.CONFIRM_SIGN_IN_WITH_OTP) { // Show UI to collect OTP}
// Then pass that OTP into the confirmSignIn APIresult = Amplify.Auth.confirmSignIn("123456")
// result.nextStep.signInStep should be "DONE" now
// First confirm the challenge typeRxAmplify.Auth.confirmSignIn(AuthFactorType.EMAIL_OTP.getChallengeResponse()) .subscribe( result -> { if (result.getNextStep().getSignInStep() == AuthSignInStep.CONFIRM_SIGN_IN_WITH_OTP) { // Show UI to collect OTP } }, error -> Log.e("AuthQuickstart", error.toString()) );
// Then pass that OTP into the confirmSignIn APIRxAmplify.Auth.confirmSignIn("123456") .subscribe( result -> { // result.getNextStep().getSignInStep() should be "DONE" now }, error -> Log.e("AuthQuickstart", error.toString()) );
WebAuthn Passkeys
To sign in with WebAuthn, you pass the challengeResponse
for AuthFactorType.WEB_AUTHN
to the confirmSignIn
API. Amplify will invoke Android's Credential Manager to retrieve a PassKey, and the user will be shown a system UI to authorize the PassKey access. This flow
completes without any additional interaction from your application, so there is only one confirmSignIn
call needed for WebAuthn.
// Pass the calling activityAuthSignInOptions options = AWSCognitoAuthConfirmSignInOptions.builder() .callingActivity(activity) .build();
// Confirm WebAuthn as the challenge typeAmplify.Auth.confirmSignIn( AuthFactorType.WEB_AUTHN.getChallengeResponse(), options, result -> Log.i("AuthQuickStart", "Next sign in step: " + result.getNextStep()), error -> Log.e("AuthQuickstart", "Failed to sign in", error));
// Pass the calling activityval options = AWSCognitoAuthConfirmSignInOptions.builder() .callingActivity(activity) .build()
// Confirm WebAuthn as the challenge typeAmplify.Auth.confirmSignIn( AuthFactorType.WEB_AUTHN.name, options, { result -> Log.i("AuthQuickStart", "Next sign in step: ${result.nextStep}") }, { error -> Log.e("AuthQuickstart", "Failed to sign in", error) })
// Pass the calling activityval options = AWSCognitoAuthConfirmSignInOptions.builder() .callingActivity(activity) .build()
try { // Confirm WebAuthn as the challenge type var result = Amplify.Auth.confirmSignIn( challengeResponse = AuthFactorType.WEB_AUTHN.challengeResponse, options = options ) Log.i("AuthQuickStart", "Next sign in step: ${result.nextStep}")} catch (error: AuthException) { Log.e("AuthQuickstart", "Failed to sign in", error)}
// Pass the calling activityAuthSignInOptions options = AWSCognitoAuthConfirmSignInOptions.builder() .callingActivity(activity) .build();
// Confirm WebAuthn as the challenge typeRxAmplify.Auth.confirmSignIn(AuthFactorType.WEB_AUTHN.getChallengeResponse(), options) .subscribe( result -> Log.i("AuthQuickStart", "Next sign in step: " + result.getNextStep()), error -> Log.e("AuthQuickstart", "Failed to sign in", error) );
Using WebAuthn sign in may result in a number of possible exception types.
UserCancelledException
- If the user declines to authorize access to the PassKey in the system UI. You can retry the WebAuthn flow by invokingconfirmSignIn
again, or restart thesignIn
process to select a differentAuthFactorType
.WebAuthnNotEnabledException
- This indicates WebAuthn is not enabled in your user pool.WebAuthnNotSupportedException
- This indicates WebAuthn is not supported on the user's device.WebAuthnRpMismatchException
- This indicates there is a problem with theassetlinks.json
file deployed to your relying party.WebAuthnFailedException
- This exception is used for other errors that may occur with WebAuthn. Inspect thecause
to determine the best course of action.
Password
Pass either PASSWORD
or PASSWORD_SRP
as the preferredChallenge
in order to initiate a traditional password based authentication flow.
// First confirm the challenge typeAmplify.Auth.confirmSignIn( AuthFactorType.PASSWORD.getChallengeResponse(), // or PASSWORD_SRP result -> { if (result.getNextStep().getSignInStep() == AuthSignInStep.CONFIRM_SIGN_IN_WITH_PASSWORD) { // Show UI to collect password } }, error -> Log.e("AuthQuickstart", error.toString()));
// Then pass that password into the confirmSignIn APIAmplify.Auth.confirmSignIn( "password", result -> { // result.getNextStep().getSignInStep() should be "DONE" now }, error -> Log.e("AuthQuickstart", error.toString()));
// First confirm the challenge typeAmplify.Auth.confirmSignIn( AuthFactorType.PASSWORD.challengeResponse, // or PASSWORD_SRP { result -> if (result.nextStep.signInStep == AuthSignInStep.CONFIRM_SIGN_IN_WITH_PASSWORD) { // Show UI to collect password } }, { error -> Log.e("AuthQuickstart", "Failed to sign in", error) })
// Then pass that password into the confirmSignIn APIAmplify.Auth.confirmSignIn( "password", { result -> // result.nextStep.signInStep should be "DONE" now }, { error -> Log.e("AuthQuickstart", "Failed to sign in", error) })
// First confirm the challenge typevar result = Amplify.Auth.confirmSignIn(AuthFactorType.PASSWORD.challengeResponse) // or PASSWORD_SRPif (result.nextStep.signInStep == AuthSignInStep.CONFIRM_SIGN_IN_WITH_PASSWORD) { // Show UI to collect password}
// Then pass that password into the confirmSignIn APIresult = Amplify.Auth.confirmSignIn("password")
// result.nextStep.signInStep should be "DONE" now
// First confirm the challenge typeRxAmplify.Auth.confirmSignIn(AuthFactorType.PASSWORD.getChallengeResponse()) // or PASSWORD_SRP .subscribe( result -> { if (result.getNextStep().getSignInStep() == AuthSignInStep.CONFIRM_SIGN_IN_WITH_PASSWORD) { // Show UI to collect password } }, error -> Log.e("AuthQuickstart", error.toString()) );
// Then pass that password into the confirmSignIn APIRxAmplify.Auth.confirmSignIn("password") .subscribe( result -> { // result.getNextStep().getSignInStep() should be "DONE" now }, error -> Log.e("AuthQuickstart", error.toString()) );
First Factor Selection
Omit the preferredChallenge
parameter to discover what first factors are available for a given user.
The confirmSignIn
API can then be used to select a challenge and initiate the associated authentication flow.
// Retrieve the authentication factors by calling .availableFactorsAWSCognitoAuthSignInOptions options = AWSCognitoAuthSignInOptions .builder() .authFlowType(AuthFlowType.USER_AUTH) .callingActivity(callingActivity) .build();Amplify.Auth.signIn( "hello@example.com", null, options, result -> { if (result.getNextStep().getSignInStep() == AuthSignInStep.CONTINUE_SIGN_IN_WITH_FIRST_FACTOR_SELECTION) { Log.i( "AuthQuickstart", "Available authentication factors for this user: " + result.getNextStep().getAvailableFactors() ); } }, error -> Log.e("AuthQuickstart", error.toString()));
// Retrieve the authentication factors by calling .availableFactorsval options = AWSCognitoAuthSignInOptions.builder() .authFlowType(AuthFlowType.USER_AUTH) .callingActivity(callingActivity) .build()Amplify.Auth.signIn( "hello@example.com", null, options, { result -> if (result.nextStep.signInStep == AuthSignInStep.CONTINUE_SIGN_IN_WITH_FIRST_FACTOR_SELECTION) { Log.i( "AuthQuickstart", "Available factors for this user: ${result.nextStep.availableFactors}" ) } }, { error -> Log.e("AuthQuickstart", "Failed to sign in", error) })
try { // Retrieve the authentication factors by calling .availableFactors val options = AWSCognitoAuthSignInOptions.builder() .authFlowType(AuthFlowType.USER_AUTH) .callingActivity(callingActivity) .build() val result = Amplify.Auth.signIn( username = "hello@example.com", password = null, options = options ) if (result.nextStep.signInStep == AuthSignInStep.CONTINUE_SIGN_IN_WITH_FIRST_FACTOR_SELECTION) { Log.i( "AuthQuickstart", "Available factors for this user: ${result.nextStep.availableFactors}" ) }} catch (error: AuthException) { Log.e("AuthQuickstart", "Sign in failed", error)}
// Retrieve the authentication factors by calling .availableFactorsAWSCognitoAuthSignInOptions options = AWSCognitoAuthSignInOptions .builder() .authFlowType(AuthFlowType.USER_AUTH) .callingActivity(callingActivity) .build();RxAmplify.Auth.signIn("hello@example.com", null, options) .subscribe( result -> { if (result.getNextStep().getSignInStep() == AuthSignInStep.CONTINUE_SIGN_IN_WITH_FIRST_FACTOR_SELECTION) { Log.i( "AuthQuickstart", "Available authentication factors for this user: " + result.getNextStep().getAvailableFactors() ); } }, error -> Log.e("AuthQuickstart", error.toString()) );