BLUF: I would like to set up software token association in AWS Cognito in a user-facing JavaScript application (using AWS SDK) and am struggling with 'Credential is missing' errors.

I am trying to create an application using AWS Cognito using the Javascript SDK and the CognitoIdentityProviderClient that requires the user to use a software token MFA.

I can sign up and confirm the user using the SignUpCommand and I can generate a successful response for the user with InitiateAuthCommand using username/password login (first time logging in). At that point I then need to process an MFA_SETUP challenge which requires the use of a separate AssociateSoftwareTokenCommand flow to generate the secrets and responses.

I would expect to be able to let the end user, while logging in through their browser, issue the command to associate the software token themselves after successfully entering their username/password for the first time.

The problem I run in to is that I get the following error when issuing the AssociateSoftwareTokenCommand:

Error: Credential is missing
    at SignatureV4.credentialProvider (runtimeConfig.browser.js:16)
    at SignatureV4.<anonymous> (SignatureV4.js:169)
    at step (tslib.es6.js:102)
    at Object.next (tslib.es6.js:83)
    at tslib.es6.js:76
    at new Promise (<anonymous>)
    at __awaiter (tslib.es6.js:72)
    at SignatureV4.signRequest (SignatureV4.js:165)
    at SignatureV4.<anonymous> (SignatureV4.js:85)
    at step (tslib.es6.js:102)

Some vigorous Googling and looking through StackOverflow this method requires a credential object in the Client configuration, however this credential, as far as I can tell from Google/SO/AWS SDK docs, requires me to create an IAM object and generate keys / a secret key.

My application (built with React) is mostly single-app/browser based and I am trying to avoid additional server-side logic to act as a middleman if possible - and obviously don't want to go dropping secret keys into user-facing interfaces.

My questions then are:

• Am I able to do this directly in my React App without action exposing credentials?
• Is a server side middleman/proxy the only way for me to safely associate a software token?
• Or is there perhaps some aspect of these credentials I am overlooking?

The offensive lines of code are simple (I can get the valid session key, no problem):

const client = new CognitoIdentityProviderClient({ region: AWS_REGION });
const command = new AssociateSoftwareTokenCommand({Session: session });
const response = await client.send(command)

Other searches have shown me that the credentials: {} object would then go in the client configuration object, which part I understand, I just don't want to put that on the client side with secret keys, etc.

Thank you for any assistance.