Sign in

v1

latestOpenAPI 3.0.0Apache 2.0 License2026-07-14101465558.4 KB

Use this API to register a user's entered time-based one-time password (TOTP) code and mark the user's software token MFA status as "verified" if successful. The request takes an access token or a session string, but not both.

post/#X-Amz-Target=AWSCognitoIdentityProviderService.VerifySoftwareToken

Headers

X-Amz-Target'AWSCognitoIdentityProviderService.VerifySoftwareToken' required

Request body

AccessTokenstring password

A valid access token that Amazon Cognito issued to the user whose software token you want to verify.

Sessionstring

The session that should be passed both ways in challenge-response calls to the service.

UserCodestring required

The one- time password computed using the secret code returned by <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AssociateSoftwareToken.html">AssociateSoftwareToken</a>.

FriendlyDeviceNamestring

The friendly device name.

Response

Success

Status'SUCCESS' | 'ERROR'

The status of the verify software token.

Sessionstring

The session that should be passed both ways in challenge-response calls to the service.