«Complete the recovery: add a passkey…» (recovery_session_restricted)

Symptom

After signing in with a recovery code (or a support enrolment code), any action other than creating a passkey is refused with «Complete the recovery: add a passkey or a Presence authenticator and sign in again with it.» On an approval request: «A recovery session cannot decide requests. Register a passkey and sign in again.» The API answers 403 recovery_session_restricted.

Cause

A recovery session lasts 15 minutes and only serves to create one replacement authenticator. It cannot administer, approve requests, generate codes, remove the last authenticator or link a phone.

Fix

1. Choose «Complete recovery: create passkey» and confirm on the device.
2. When «New passkey created. The recovery session has ended; sign in now with ProofFlow.» appears, sign in again with the new passkey.
3. Now you can: remove lost devices, link the new phone and generate new recovery codes.

When to escalate

If you cannot create a passkey (an unsupported device), the recovery cannot be finished in the console: contact your organization's support.