Passwordless

Amplify supports the use of passwordless authentication flows using the following methods:

• SMS-based one-time password (SMS OTP)
• Email-based one-time password (Email OTP)
• WebAuthn passkey

Passwordless authentication removes the security risks and user friction associated with traditional passwords.

Configure passwordless authentication

You can enable passwordless authentication methods directly in your defineAuth configuration. Passwordless methods are used alongside traditional password-based authentication, giving users multiple options to sign in.

import { defineAuth } from '@aws-amplify/backend';

export const auth = defineAuth({
  loginWith: {
    email: {
      otpLogin: true // Enable email OTP
    }
  }
});

You can enable multiple passwordless methods simultaneously:

import { defineAuth } from '@aws-amplify/backend';

export const auth = defineAuth({
  loginWith: {
    email: {
      otpLogin: true // Enable email OTP
    },
    phone: {
      otpLogin: true // Enable SMS OTP
    },
    webAuthn: true // Enable WebAuthn passkeys
  }
});

SMS OTP

SMS-based authentication uses phone numbers as the identifier and text messages as the verification channel. At a high level end users will perform the following steps to authenticate:

1. User enters their phone number to sign up/sign in
2. They receive a text message with a time-limited code
3. After the user enters their code they are authenticated

Configure SMS OTP

Enable SMS OTP by setting otpLogin: true in your phone login configuration:

import { defineAuth } from '@aws-amplify/backend';

export const auth = defineAuth({
  loginWith: {
    phone: {
      otpLogin: true
    }
  }
});

Learn more about using SMS OTP in your application code.

Email OTP

Email-based authentication uses email addresses for identification and verification. At a high level end users will perform the following steps to authenticate:

1. User enters their email address to sign up/sign in
2. They receive an email message with a time-limited code
3. After the users enters their code they are authenticated

Configure Email OTP

Enable Email OTP by setting otpLogin: true in your email login configuration:

import { defineAuth } from '@aws-amplify/backend';

export const auth = defineAuth({
  loginWith: {
    email: {
      otpLogin: true
    }
  }
});

Learn more about using email OTP in your application code.

WebAuthn Passkey

WebAuthn uses biometrics or security keys for authentication, leveraging device-specific security features. At a high level end users will perform the following steps to authenticate:

1. User chooses to register a passkey
2. Their device prompts for biometric/security key verification
3. For future logins, they'll authenticate using the same method

Configure WebAuthn

Enable WebAuthn passkeys in your auth configuration. The simplest configuration uses automatic relying party ID resolution:

import { defineAuth } from '@aws-amplify/backend';

export const auth = defineAuth({
  loginWith: {
    email: true, // Users need a sign-up method
    webAuthn: true // Automatically resolves relying party ID
  }
});

When webAuthn: true is used, the relying party ID is automatically resolved:

• In sandbox environments: resolves to localhost
• In branch deployments: resolves to your Amplify app domain (e.g., [branch].[appId].amplifyapp.com)

For production environments or custom domains, specify the relying party ID explicitly:

import { defineAuth } from '@aws-amplify/backend';

export const auth = defineAuth({
  loginWith: {
    email: true,
    webAuthn: {
      relyingPartyId: 'example.com',
      userVerification: 'required' // or 'preferred' (default)
    }
  }
});

Learn more about using WebAuthn passkeys in your application code.

Managing credentials

Passwordless authentication with WebAuthn requires associating one or more credentials with the user's Amazon Cognito account. Amplify provides APIs that integrate with each platform's local authenticator to easily create, view, and delete these credential associations.

Learn more about managing WebAuthn credentials.

Passwordless authentication

When you enable passwordless authentication methods, traditional password authentication remains available. This gives users flexibility to choose their preferred authentication method:

import { defineAuth } from '@aws-amplify/backend';

export const auth = defineAuth({
  loginWith: {
    email: {
      otpLogin: true // Email OTP enabled alongside password auth
    }
  }
});

In this configuration, users can authenticate using either:

• Email and password (traditional)
• Email OTP (passwordless)

You can enable multiple passwordless methods to give users even more options:

import { defineAuth } from '@aws-amplify/backend';

export const auth = defineAuth({
  loginWith: {
    email: {
      otpLogin: true
    },
    phone: {
      otpLogin: true
    },
    webAuthn: {
      relyingPartyId: 'example.com'
    }
  }
});

In this configuration, users can authenticate using:

• Email and password
• Email OTP
• Phone and password
• SMS OTP
• WebAuthn passkeys

Next steps

• Learn how to implement passwordless sign-in in your application
• Configure email settings for Email OTP
• Configure SMS settings for SMS OTP
• Manage WebAuthn credentials