Skip to content

Conversation

@ahmedhamouda78
Copy link
Member

@ahmedhamouda78 ahmedhamouda78 commented Dec 23, 2025

Description of changes

This PR adds passwordless authentication support to the Authenticator component, enabling users to sign in using SMS OTP, email OTP, and passkeys (WebAuthn).

Key features:

  • New SignInSelectAuthFactor component for selecting authentication methods
  • New PasskeyPrompt component for passkey registration after sign-in/sign-up
  • Support for SMS OTP and email OTP authentication flows
  • Passkey registration and authentication using WebAuthn
  • "Other sign-in options" button to switch between authentication methods
  • Dynamic form fields based on selected authentication method
  • Proper state management for multi-step passwordless flows

Changes include:

  • Added new UI components: PasskeyPrompt, SignInSelectAuthFactor
  • Added new icons: IconPasskey, IconCheckCircleFill
  • Enhanced state machines for sign-in and sign-up flows to handle passwordless authentication
  • Added guards and actions for passkey and OTP flows
  • Added utility functions for passwordless authentication
  • Comprehensive test coverage for new components
  • Example environment for testing passwordless authentication

Issue #, if available

Description of how you validated changes

  • Added unit tests for PasskeyPrompt and SignInSelectAuthFactor components
  • Added unit tests for passwordless utility functions and default services
  • Created example environment (environments/auth/auth-with-passwordless) for manual testing
  • Tested sign-in flows with SMS OTP, email OTP, and passkeys
  • Verified passkey registration prompts appear after sign-in and sign-up
  • Verified "Other sign-in options" button navigation

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@changeset-bot
Copy link

changeset-bot bot commented Dec 23, 2025

🦋 Changeset detected

Latest commit: 645efc9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 13 packages
Name Type
@aws-amplify/ui-react-core Minor
@aws-amplify/ui-react Minor
@aws-amplify/ui Minor
@aws-amplify/ui-react-core-notifications Patch
@aws-amplify/ui-react-geo Patch
@aws-amplify/ui-react-native Patch
@aws-amplify/ui-react-notifications Patch
@aws-amplify/ui-react-storage Patch
@aws-amplify/ui-react-liveness Patch
@aws-amplify/ui-svelte Patch
@aws-amplify/ui-vue Patch
@aws-amplify/ui-angular Patch
@aws-amplify/ui-test-utils Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@ahmedhamouda78 ahmedhamouda78 force-pushed the feat/add-passwordless-auth-support branch from afa5561 to 25cf198 Compare January 9, 2026 16:09
Scenario: Sign in with email shows passwordless UI
When I type my "email" with status "CONFIRMED"
Then I see "Sign in with Email"
Then I see "Other sign-in options"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it feasible to assert the users actually completed their login?

When I type my "email" with status "CONFIRMED"
Then I see "Other sign-in options"

@react
Copy link
Contributor

@osama-rizk osama-rizk Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we assert we are seeing the forget password view upon user clicking the button?

allowedMfaTypes: ['EMAIL', 'TOTP'],
selectAuthMethod: jest.fn(),
availableAuthMethods: undefined,
toShowAuthMethods: jest.fn(),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to assert these functions/fields gets called or initialized

@@ -0,0 +1,33 @@
Feature: Sign In with Passwordless Authentication
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we add a test case for when use enable the passwordless form the props but not in defineAuth?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants