Cognito support for verification code configuration

Hi Pandurangaswamy! Why are the lengths of verification code different when doing OTP signUp/signIn? SignUp: 6 digits SignIn: 8 digits This makes the UX experience a mess.

Amazon Cognito does not provide direct configuration options for the following aspects of verification codes:

1. Validity of the Verification Code

• The validity duration of the verification code is fixed and cannot be changed. For SMS verification codes, the default validity is approximately 3 minutes. For email verification codes, the expiration time is also short but is not explicitly documented by AWS.
• Unfortunately, there is no built-in setting to modify the validity period.

AWS Documentation Reference:

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-email-phone-verification.html

2. Length of the Verification Code

• The length of the verification code sent to the user is also fixed:

SMS Verification Codes: Always 6 digits.
Email Verification Codes: These codes follow a standard format and cannot be customized to a specific length.

• Cognito does not provide a configuration to modify the length of these codes.

AWS Documentation Reference:

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-message.html

Workarounds for Custom Configuration

If you need more control over the validity or length of the verification codes, you can implement the following approaches:

A. Use a Custom Message Lambda Trigger

You can use a Custom Message Lambda Trigger to generate and send custom verification codes. This allows you to:

• Define your own verification code format (e.g., length, alphanumeric).
• Set your desired validity period by storing the code and its expiration in a database (e.g., DynamoDB).

Steps:

1. Set up a Custom Message Trigger for your user pool.
2. Generate the verification code in the trigger.
3. Use Amazon SNS (for SMS) or Amazon SES (for email) to send the custom code.
4. Store the code in a database along with an expiration timestamp.
5. Validate the code during user confirmation by cross-checking it with the stored value.

B. Implement a Custom Verification System

If you require complete control over the verification process:

1. Disable Cognito’s built-in email/phone verification during user sign-up by configuring the user pool to not auto-verify these attributes.
2. Implement your own verification logic in your backend:

Generate the verification code.
Send it to the user using your preferred service.
Validate the code when the user submits it.

3. After successful verification, mark the user as verified in Cognito by calling the AdminUpdateUserAttributes API.

AWS Documentation Reference:

https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateUserAttributes.html