✅ - How to enable a user signUp flow which only requires email in the first step (no password)?

[warm bane]

I imagine something like this:

step 1 - SignUp Page: user email input + sign up button => sign up button sends email
step 2 - Verification Email: click on a button in the email opens verification/password page
step 3 - Password Page: user enters password and hits submit button
step 4 - Entry Page: user is logged in on entry page

[nova bone]

You'd have to create an admin action to enable this sign-up workflow. Are you using gen 1 or gen 2?

[modest lion]

I think you're trying to achieve "magic links" https://aws.amazon.com/fr/blogs/mobile/implementing-passwordless-email-authentication-with-amazon-cognito/

[warm bane]

I am not sure. How do know which gen I use? I am using latest aws-amplify version. Just migrated from v5 to v6 actually. It was a really great upgrade! We only use the auth module of amplify in our Nuxt 3 app.

[warm bane]

Thank you for sharing, I will take a deeper look into this.

[warm bane]

Btw I always read that using admin actions that can be triggered by normal users (sign up button) is considered insecure/bad practise and should be avoided. Do you have a different opinion on that?

And we use aws-cdk-lib for the infrastructure, for example aws-cdk-lib/aws-lambda for lambdas.

[nova bone]

https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#allowing-users-to-sign-up-and-confirm-themselves

I think you're looking for this. In this case, you'd want to create a user dircetly into the "FORCE_CHANGE_PASSWORD" state. You should definitely use Admin actions carefully. As you effectively have to manage the API endpoint and all of its added DevOps overhead (throttling, rate limiting, fraud prevention etc.)

[warm bane]

Thank you, that seems like exactly what I need!

I agree on the admin actions part

[silk loom]

✅ - How to enable a user signUp flow which only requires email in the first step (no password)?