Auth InvalideStateException when calling 'resendSignUpCode' after 'signup' with an email challenge

[niqo01]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.

Language and Async Model

Kotlin - Coroutines

Amplify Categories

Authentication

Gradle script dependencies

amplify = "2.28.0"

Environment information

------------------------------------------------------------
Gradle 8.14.2
------------------------------------------------------------

Build time:    2025-06-05 13:32:01 UTC
Revision:      30db2a3bdfffa9f8b40e798095675f9dab990a9a

Kotlin:        2.0.21
Groovy:        3.0.24
Ant:           Apache Ant(TM) version 1.10.15 compiled on August 25 2024
Launcher JVM:  21.0.7 (Azul Systems, Inc. 21.0.7+6-LTS)
Daemon JVM:    /Library/Java/JavaVirtualMachines/zulu-21.jdk/Contents/Home (no JDK specified, using current Java home)
OS:            Mac OS X 15.5 aarch64

Please include any relevant guides or documentation you're referencing

https://docs.amplify.aws/android/build-a-backend/auth/connect-your-frontend/sign-up/#email-otp

Describe the bug

1. I am calling amplify signUp with email OTP like so:

      val result = auth.signUp(
        email,
        null,
        AuthSignUpOptions.builder()
          .userAttributes(
            listOf(
              AuthUserAttribute(AuthUserAttributeKey.email(), email),
              AuthUserAttribute(AuthUserAttributeKey.givenName(), firstName),
            ),
          )
          .build(),
      )

2. I then receive nextStep.signUpStep == AuthSignUpStep.CONFIRM_SIGN_UP_STEP
3. I display an UI to the user to enter the code from the email and an option to resend the email if, for some reason, they did not receive it.
4. If the user select the option to resend the email I then call: auth.resendSignUpCode(email) which produces the following issue:

Resend Sign up code: InvalidStateException{message=Auth state is an invalid state, cannot process the request., cause=null, recoverySuggestion=Operation performed is not a valid operation for the current auth state.} (Ask Gemini)
                                                                                                    InvalidStateException{message=Auth state is an invalid state, cannot process the request., cause=null, recoverySuggestion=Operation performed is not a valid operation for the current auth state.}
                                                                                                    	at com.amplifyframework.auth.cognito.usecases.ResendSignupCodeUseCaseKt.requireSignedInOrSignedOutState(ResendSignupCodeUseCase.kt:73)
                                                                                                    	at com.amplifyframework.auth.cognito.usecases.ResendSignupCodeUseCaseKt.access$requireSignedInOrSignedOutState(ResendSignupCodeUseCase.kt:1)
                                                                                                    	at com.amplifyframework.auth.cognito.usecases.ResendSignupCodeUseCaseKt$requireSignedInOrSignedOutState$1.invokeSuspend(Unknown Source:13)
                                                                                                    	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)

If I debug the code I can see that the internal amplify state at ResendSignupCodeUseCase.kt#L73
is SigningIn

SigningIn(signInState=ResolvingChallenge(challengeState=WaitingForAnswer(challenge=AuthChallenge(challengeName='EMAIL_OTP', username=xxx@www.com, session=AYAB***, parameters={CODE_DELIVERY_DELIVERY_MEDIUM=EMAIL, CODE_DELIVERY_DESTINATION=n******}, availableChallenges=null), signInMethod=ApiBased(authType=USER_AUTH), hasNewResponse=false)))

Which is neither AuthenticationState.SignedIn nor AuthenticationState.SignedOut and therefore fails.

thanks for your help.

Reproduction steps (if applicable)

No response

Code Snippet

// Put your code below this line.

Log output

// Put your logs below this line

Configuration File

{
  "$schema": "https://raw.githubusercontent.com/aws-amplify/amplify-backend/main/packages/client-config/src/client-config-schema/schema_v1.json",
  "version": "1",
  "auth": {
    "user_pool_id": "{redacted}",
    "aws_region": "us-east-1",
    "user_pool_client_id": "{redacted}",
    "identity_pool_id": null,
    "mfa_methods": [],
    "standard_required_attributes": [
      "email"
    ],
    "username_attributes": [
      "email"
    ],
    "user_verification_types": [
      "email"
    ],
    "mfa_configuration": "NONE",
    "password_policy": {
      "min_length": 8,
      "require_lowercase": true,
      "require_numbers": true,
      "require_symbols": true,
      "require_uppercase": true
    },
    "unauthenticated_identities_enabled": true
  }
}

GraphQL Schema

// Put your schema below this line

Additional information and screenshots

No response

[vincetran]

Thanks for opening this issue. Taking a look at the history of the underlying code, this state check has been there for about 3 years now and at first glance, it does seem odd that you're not able to call it during the SigningIn state. We'll have to do a further investigation to understand this flow a little better.