Cognito pool migration legacy/lite to essentials - passkeys not working

Question

I had an old Cognito userpool (Pool A) which I believe was using what was called plan 'lite'. I changed it over to Essentials to get the new managed login UI and passkeys support. I've enabled passkeys (enabled passwordless login, choices password/passkeys) but they are still not offered to users as a login method even if they have passkeys associated with their account.

**What I've tried.**

1. Pool A - manually go to managed login URL '/passkeys/add' , add a passkey, success. Logout. Log back in, passkey not offered as option, only password. [Fail]
2. Pool A - create a new user (via control panel UI) as thought maybe existing users don't support passkeys. Still no passkeys offered even after adding to the user (via '/passkeys/add' ). [Fail]
3. Create a new user pool (Pool B), try the sign-up managed UI (pool A does not allow signup), during signup got asked to add a passkey. Option during user login.  [Success]
4.  Pool B - create a user via the control panel UI, login via managed UI, go to '/passkeys/add' , add passkey. Passkey option during login. [Success]

From what I can work out from this, although I have updated Pool A to essentials, passkeys can be added to an account but are not offered as an option during login via the managed UI.

Is there any way to fix this without creating a new user pool and migrating users?

EDIT:

Both pools have,

"SignInPolicy": {
                "AllowedFirstAuthFactors": [
                    "PASSWORD",
                    "WEB_AUTHN"
                ]
            }

- Have enabled choice-based authentication and passwordless sign-in.

Thanks

Ryu · Accepted Answer

Based on the current AWS Cognito APIs and configuration mechanisms, the settings that determine whether passkeys are offered as a login option are configured at the user pool level. For an existing user pool (Pool A) that was originally created under the "lite" plan, upgrading it to Essentials does not automatically update the underlying configuration that governs the managed UI. This means that even if you add passkeys to individual user accounts, the managed UI will still not offer passkeys during login.

There isn’t any public API or batch processing method available that allows you to update these core user pool configurations programmatically. In other words, you cannot write code to batch process the change for an existing pool to enable passkeys as a login method. The recommended solutions are to either migrate your users to a new user pool that was created with the correct settings (as evidenced by Pool B in your tests) or to contact AWS Support to see if there is an internal workaround.

Cognito pool migration legacy/lite to essentials - passkeys not working

Add your answer

Relevant content