«The authorization was already used, expired, or was denied by the active policy.» (authorization_rejected)

Symptom

An approval, an application sign-in or a policy change ends with «The authorization was already used, expired, or was denied by the active policy.», or, in privileged access, «The passkey confirmation was not accepted for this request. Confirm again.» The API answers 403 authorization_rejected, 401 proof_rejected or 403 policy_authorization_required.

Cause

Each approval is single-use, short-lived (about two minutes) and bound to the exact operation. It is refused when:

• it was already used (for example a double click or a reloaded page);
• it expired before use;
• the operation changed between the confirmation and the submission;
• the access policy does not allow it when it is issued or consumed;
• for a policy change, the approval of that exact change is missing.

Fix

1. Repeat the operation from the start, to get a new approval.
2. Confirm and submit without delay.
3. If the refusal repeats, ask your administrator to review the policy with «Test decision» for your context.

When to escalate

If the policy allows the operation and the refusal persists, check the device's clock (see Clock out of sync) and contact support with the time and the operation.