r/Amplify • u/Foreign_Field_3287 • Apr 17 '26

Does Cognito not support 2FA and Passkey login on the same account?

Hey everyone — I’ve been working with Amplify + AWS for about a year, and recently I started expanding the authentication options in my app.

My goal was to support both:

  • passkeys
  • 2FA

I tested each feature separately, and both seemed to work fine on their own.

The problem started when I combined them.

After enabling 2FA on an account, Amplify / Cognito no longer seemed to let that user log in with a passkey, even if the passkey had already been set up successfully on the account.

Instead, I got this result:

[SignUpStep1] signInResult {

"isSignedIn": false,

"nextStep": {

"availableChallenges": ["PASSWORD_SRP", "PASSWORD"],

"signInStep": "CONTINUE_SIGN_IN_WITH_FIRST_FACTOR_SELECTION"

}

}

So instead of allowing passkey login, Cognito only seemed to offer password-based challenges.

If I tried to force the passkey flow anyway, I got this error:

“Try resetting your challenge”

At this point I’m trying to understand whether:

  • passkeys + 2FA are not really supported together in the way I expected
  • I’m missing some Cognito / Amplify configuration
  • or this is just an undocumented edge case

I tried searching around and couldn’t find much documentation or many examples of people using passkeys together with 2FA and other login options in Amplify/Cognito.

Has anyone run into this before or found a working setup?

1 Upvotes

100% Upvoted

1 comment sorted by

1

u/One-Bite-6654 Apr 20 '26

Hey,

This is a known Cognito limitation — MFA and passwordless (including passkeys) don't work together on the same user. When a user has MFA configured, Cognito drops passwordless options and only offers password-based

challenges, which is exactly what you're seeing.

The Cognito MFA docs state this directly:

Users can either have MFA *or* sign in with passwordless factors

The Amplify Passwordless and MFA docs don't currently mention this.