AWS Cognito Custom Auth Flow Returning “Incorrect username or password” for Passwordless Login

I’m implementing a custom passwordless authentication flow using AWS Cognito for my application. The idea is to allow users to log in with a phone number and an OTP sent via WhatsApp using Meta’s API.

I have implemented the following Lambda triggers for the custom authentication flow:

1. DefineAuthChallenge: Determines the next challenge and sets it as CUSTOM_CHALLENGE.
2. CreateAuthChallenge: Generates the OTP, stores it temporarily, and sends it to the user via WhatsApp.
3. VerifyAuthChallengeResponse: Validates the OTP provided by the user.

The flow works as expected until the VerifyAuthChallengeResponse step. After verification, Cognito throws the following error:

NotAuthorizedException: Incorrect username or password.

What I’ve Checked:

• The VerifyAuthChallengeResponse Lambda successfully validates the OTP and returns true for event.response.answerCorrect.
• The phone number (username) is correctly formatted in E.164 format.
• The Cognito user has the CONFIRMED status and required attributes (phone_number, phone_number_verified).
• No typos in the event response properties.

What I Need Help With:

1. Why is Cognito throwing the “Incorrect username or password” error even after the challenge is successfully verified?
2. Are there specific fields I need to set in the Lambda trigger responses to ensure Cognito recognizes the authentication as successful?
3. Is it possible that this issue arises because I’m testing with an existing user who was created before implementing the custom authentication flow?

Here’s an outline of my VerifyAuthChallengeResponse Lambda:

exports.handler = async (event) => {
    const userAnswer = event.request.challengeAnswer;
    const correctAnswer = event.request.privateChallengeParameters.otp;

    if (userAnswer === correctAnswer) {
        event.response.answerCorrect = true;
    } else {
        event.response.answerCorrect = false;
    }

    return event;
};

the nestJs code:

async initiateAuth(phoneNumber: string): Promise<any> {
    const command = new InitiateAuthCommand({
      ClientId: this.clientId,
      AuthFlow: "CUSTOM_AUTH",
      AuthParameters: {
        USERNAME: phoneNumber,
        password: "test@1234"
      },
    });

    try {
      const response = await this.client.send(command);
      return response;
    } catch (error: any) {
      this.logger.debug(
        `Error authenticating user, error: ${JSON.stringify(error)}`,
      );
      throw error;
    }
  }

  async respondToAuthChallenge(
    username: string,
    phoneNumber: string,
    otp: string,
    session: string,
  ): Promise<any> {
    const command = new RespondToAuthChallengeCommand({
      ClientId: this.clientId,
      ChallengeName: "CUSTOM_CHALLENGE",
      Session: session,
      ChallengeResponses: {
        USERNAME: username,
        ANSWER: otp,
      },
    });

    try {
      const response = await this.client.send(command);
      return response;
    } catch (error: any) {
      this.logger.debug(
        `Error responding to challenge: ${JSON.stringify(error)}`,
      );
      throw error;
    }
  }

Any insights or troubleshooting tips would be highly appreciated! Let me know if more details or logs are needed.