Clarification on Supporting Passkeys with MFA in AWS Cognito

Question

I currently have an AWS Cognito user pool with MFA set to “Required”. Now, I want to support passwordless sign-in using WebAuthn (Passkeys) while setting MFA as Optional at pool level

I don’t use the managed Cognito Hosted UI — instead, I want to let users choose their sign-in method directly on my website:

Option 1: Sign in with a passkey (passwordless using WebAuthn)

Option 2: Sign in with a password followed by MFA

If a user selects Passkeys, I plan to use the ALLOW_USER_AUTH auth flow for passwordless authentication.
If they choose Password, I’m unsure whether it’s possible to still apply MFA as an additional challenge when MFA is set to Optional at the pool level and enabled per user. Would that configuration work, or do I need to implement a Custom Auth flow instead? 
Additionally, if I opt for the CUSTOM_AUTH flow, can I still enable multiple flows on a single client (i.e., both ALLOW_USER_AUTH and CUSTOM_AUTH)?
My plan would be:

For Option 1 (Passkey) → call InitiateAuth with ALLOW_USER_AUTH

For Option 2 (Password + MFA) → call InitiateAuth with CUSTOM_AUTH to trigger the additional MFA challenge

Would appreciate your input or confirmation on whether this setup is feasible.

re:Post Agent · Answer

Based on the information available, there are some important constraints to consider when implementing both passkey authentication and MFA in Amazon Cognito.

First, it's important to understand that if you require multi-factor authentication (MFA) in your user pool, you cannot use passwordless authentication. This is a fundamental limitation of Cognito's current implementation. When both MFA and choice-based sign-in methods are active, MFA takes priority, requiring users to input their password followed by an MFA verification code.

According to feedback from AWS Business Support, this behavior is working as expected - MFA will override other choice-based sign-in methods (including Passkeys), making them unavailable when MFA is required at the user pool level.

For your specific scenario, you would need to:

1. Set MFA to "Optional" at the user pool level (not "Required")
2. Enable the Essentials or Plus feature plan, as passwordless authentication is only available in these tiers
3. Use the ALLOW_USER_AUTH authentication flow for passwordless authentication

However, even with this setup, there's a challenge: when a user has MFA enabled individually, the passkey authentication won't work for that user. This is because MFA takes precedence over the passwordless authentication methods.

Regarding your question about using multiple authentication flows on a single client - while you can implement different authentication methods, the fundamental limitation remains that passkeys and MFA cannot be used together for the same user. You would need to choose one approach or the other for each user.

If you want to offer both options as you described, you might need to:
1. Use ALLOW_USER_AUTH for users without MFA enabled (passkey users)
2. Use USER_SRP_AUTH or another standard flow for users with MFA enabled (password + MFA users)

A custom authentication flow might give you more flexibility, but it wouldn't overcome the core limitation that passkeys and MFA cannot be used together for the same user according to current Cognito constraints.  
**Sources**  
[Implement passwordless authentication for Cognito users | AWS re:Post](https://repost.aws/knowledge-center/cognito-passwordless-authentication)  
[Cognito Passkey login without email/username and with MFA enabled | AWS re:Post](https://repost.aws/questions/QU-DKBR1VdQQuRn-WZRFCMzg/cognito-passkey-login-without-email-username-and-with-mfa-enabled)  
[Improve your app authentication workflow with new Amazon Cognito features | AWS News Blog](https://aws.amazon.com/blogs/aws/improve-your-app-authentication-workflow-with-new-amazon-cognito-features/)

Clarification on Supporting Passkeys with MFA in AWS Cognito

Add your answer

Relevant content