Problem type
Re-authentication required
reauth-required
What it means
A sensitive self-service action (changing a second factor, passkey, password, linked identity or email address, regenerating recovery codes, requesting account deletion, or approving a device sign-in) on a session that has not re-authenticated in the last five minutes. A fresh sign-in does not count.
What to do
Re-authenticate, then retry. On the account API, GET /account/v1/reauth says how this person can.