A second factor is asked for after the password (second_factor_required)

Symptom

After the right password, the page shows «Confirm it is you» instead of opening the console. Or it shows «This account has no second factor it can use here. Use recovery or ask an administrator for help.» The API answers 403 second_factor_required.

Cause

• The account has a passkey or an approver phone: a password is never enough on its own.
• The organization turned on «Require a second factor at sign-in»: it applies to every account.
• If the message says there is no usable second factor: the account has no passkey or phone it can use there (for example a lost phone).

If the organization turned the option on while you were working: «Your organization now requires a second factor. Confirm it is you to continue.»

Fix

1. Choose «Approve with ProofFlow Presence (Mobile)» and approve on your phone, or «Use a passkey on this device».
2. With neither: choose «Use recovery» and use a recovery code, or «I forgot my access details».
3. With no codes and no email: ask support for an authenticator reset.

See I lost my phone.

When to escalate

An account with only a password in an organization that requires a second factor must add a passkey or a phone. If it cannot, the administrator can temporarily turn the requirement off or reset the authenticators.