Problem type

Invalid code

invalid-code

What it means

A one-time code or a passkey ceremony did not verify: a wrong, stale or reused TOTP code, a spent recovery code, a WebAuthn ceremony that failed (registration or passkey sign-in), or any code while the account is locked. It never says which.

What to do

Ask for a fresh code. Failures count toward progressive lockout, on sign-in and on enrolment.

All problem types Read the documentation