Why doesn't Amazon Cognito send the verification code email or SMS text message with the ForgotPassword API?

Resolution

Check the spam and junk folders

Make sure that the verification email doesn't go to the user's spam or junk folders.

Confirm that the user exists in the user pool

Confirm that the user exists in the Cognito user pool. To use the Cognito console to search for users in the user pool, see Managing and searching for user accounts. You can also use the AdminGetUser API.

Check the user status

Until users that administrators create sign in with the provided password, the user status is FORCE_CHANGE_PASSWORD by default. 

If the user status is FORCE_CHANGE_PASSWORD, then users can't use the ForgotPassword API and they don't receive the verification code. Instead, Cognito prompts users to change their password.

Check how the user can recover the account

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To recover the account, you must verify the user account configuration. Check whether the recovery message delivery method is email, phone, email only, phone only, phone if available, or none.

Complete the following steps:

1. Open the Cognito console.
2. Select the user pool.
3. Under Authentication, choose Sign-in.
4. In the User account recovery section, check the options under Recovery message delivery method. Then, confirm that the delivery method is a verified attribute for the user.

Users in the CONFIRMED status might not have a verified email or phone number for password recovery. When you select the verification check box to create accounts, you must verify the email and phone number of user accounts that an administrator created. Administrators can use the AdminUpdateUserAttributes API call to mark the email and phone number as verified.

To set a user's email address as verified, run the following admin-update-user-attributes AWS CLI command and specify email_verified:

aws cognito-idp admin-update-user-attributes --user-pool-id example-userpool-id --username example-username --user-attributes 
Name=email_verified,Value=true --region example-region

Note: Replace example-userpool-id, example-username, and example-region with your values.

To set a user's phone number as verified, run the following admin-update-user-attributes command and specify phone_number_verified:

aws cognito-idp admin-update-user-attributes --user-pool-id example-userpool-id --username example-username --user-attributes 
Name=phone_number_verified,Value=true --region example-region 

Note: Replace example-userpool-id, example-username, and example-region with your values.

Check the Amazon SNS quota

Cognito uses Amazon Simple Notification Service (Amazon SNS) to deliver SMS text messages. The default Amazon SNS spend quota for accounts is $1.00 (USD) per month. To check or change the account spend quota, see Setting SMS messaging preferences using the AWS Management Console.

Important: If the account spend quota that you set exceeds your service quota, then SNS doesn't publish SMS messages.

For quota increases, see Requesting increases to your monthly Amazon SNS SMS spending quota.

Check the Amazon SES quota

Cognito uses Amazon Simple Email Service (Amazon SES) to deliver emails. By default, Cognito allows a limited number of daily emails for your user pool. For more information, see Quotas on resource number and size.

To set a higher email delivery, you can configure your user pool to use your Amazon SES email configuration. For instructions, see Email settings for Amazon Cognito user pools.

Reset the user password using the AdminSetUserPassword API

Administrators can use the AdminSetUserPassword API to set a user's password in a Cognito user pool as temporary or permanent. Users with temporary passwords must sign in and change the temporary password before it expires. After a user resets the temporary password, or the password is permanent, the status changes to CONFIRMED.

Related information

SMS delivery failure reasons

admin-get-user

AdminResetUserPassword