Single use access token after a step-up authentication

You may interest on below and please note Cognito doesn't natively support one-time-use tokens out of the box yet:

1. Custom Claim Injection After the user completes the step-up challenge, use the DefineAuthChallenge and CreateAuthChallenge Lambda triggers to inject a custom claim like "step_up": true into the token via the PreTokenGeneration trigger.
2. Token Binding to Transaction Include a unique transaction ID in the token (e.g., "txn_id": "abc123"). This ID should be generated server-side and stored in a secure, short-lived store like DynamoDB with a TTL.
3. Token Validation on API Call When the token is used to perform the sensitive transaction: o Validate the step_up claim. o Check the txn_id against your store to ensure it hasn’t been used. o If valid, mark it as used (e.g., delete or flag it). o If already used, reject the request.
4. Short TTL for Token Expiry Set a very short expiration time (e.g., 5 minutes) for the token to reduce the window of misuse.

https://aws.amazon.com/blogs/security/implement-step-up-authentication-with-amazon-cognito-part-1-solution-overview/

The token content, claim values can't be changed once the token is issued. There is a jti value inside each access token and it's unique identity of the token. https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.html

To indicate a token has been used, your lambda can store the used tokens' jti value within a DB. Always check token jti value against that DB while validating the tokens to avoid tokenreplay. It's a good tip to set TTL to the DB items which can be the same as the token's expiration time.