# MfaSecondFactor

The different ways in which a user pool can obtain their MFA token for sign in.

- Source: [`aws-cognito/lib/user-pool.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts#L413)
- Type last changed: v2.164.0 · 24 Oct 2024

## Example

```ts
new cognito.UserPool(this, 'myuserpool', {
  // ...
  mfa: cognito.Mfa.REQUIRED,
  mfaSecondFactor: {
    sms: true,
    otp: true,
    email: false, // email-based MFA
  },
});
```

## Properties

- `email`: boolean = false — The MFA token is sent to the user via EMAIL.

  To enable email-based MFA, set `email` property to the Amazon SES email-sending configuration
  and set `feturePlan` to `FeaturePlan.ESSENTIALS` or `FeaturePlan.PLUS`

- `otp`: boolean (required) = false — The MFA token is a time-based one time password that is generated by a hardware or software token.

- `sms`: boolean (required) = true — The MFA token is sent to the user via SMS to their verified phone numbers.