Clock out of sync (device_clock_skew, one-time codes refused)

Symptom

• The phone or the browser shows «This device's clock differs from the server time.» (API 401 device_clock_skew).
• Six-digit codes from an authenticator app are always refused, even when typed correctly.
• Windows offline codes are refused.
• An Edge appliance shows a high value under «Clock offset».

Cause

Approvals and codes depend on the time:

• The phone may differ from the server by up to 60 seconds.
• One-time codes change every 30 seconds; the previous and next codes are accepted.
• TLS certificates and short-lived authorizations also fail with the wrong time.

Changing the time zone is not the problem; the right time in the right zone is what counts.

Fix

1. Phone: under Settings › System › Date and time, turn on automatic date and time.
2. Windows computer: under Settings › Time and language, turn on "Set time automatically" and sync. On a domain, the domain controller must be right.
3. Edge appliance: check that NTP is on and the appliance reaches a time server.
4. Ask for a new code or approval after fixing the time.

When to escalate

If the time is right and the refusal persists, contact support with the exact time shown on the device.