Change the current user's password. Runs on the AUTHENTICATED pipeline and carries the Cognito access token (read from the credential store) in the body — Cognito's ChangePassword requires the access token, not the idToken bearer. Tokens are not rotated, so nothing is persisted here.
Complete a self-service password reset with the emailed code and a new password (auth-less base pipeline). On success the user can log in with the new password; no session is established here.
Respond to a NEW_PASSWORD_REQUIRED challenge with a new password; on
success persists the resulting session to the credential store exactly
like login.
Start a self-service password reset (runs on the auth-less base pipeline — the user is logged out). The backend returns an anti-enumeration success regardless of whether the account exists.
Probe a temporary-password / challenge session WITHOUT authenticating.
Returns { requiresChallenge, session?, … }; persists nothing (there is
no token yet). On requiresChallenge: true, feed session into
forceChangePassword. This is the signup/temp-password entry point —
login cannot be used because the backend errors on a challenge.
Interactive login; persists the session to the credential store.
Ends the backend session and clears stored credentials.
Identity of the current credential.
The
client.authnamespace: session management (login/logout) and identity inspection (me). Login runs on the auth-less base pipeline; the resulting session is persisted to the client's credential store so subsequent requests (and, on Node, the CLI) pick it up.