# AllowedFirstAuthFactors

The types of authentication that you want to allow for users' first authentication prompt.

- Source: [`aws-cognito/lib/user-pool.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts#L509)
- Type last changed: v2.179.0 · 18 Feb 2025

## Example

```ts
new cognito.UserPool(this, 'myuserpool', {
  signInPolicy: {
    allowedFirstAuthFactors: { password: true, passkey: true },
  },
  passkeyRelyingPartyId: 'auth.example.com',
  passkeyUserVerification: cognito.PasskeyUserVerification.REQUIRED,
});
```

## Properties

- `emailOtp`: boolean = false — Whether the email message one-time password is allowed.

- `passkey`: boolean = false — Whether the Passkey (WebAuthn) is allowed.

- `password`: boolean (required) — Whether the password authentication is allowed.

  This must be true.

- `smsOtp`: boolean = false — Whether the SMS message one-time password is allowed.