Drıftstack docs
Docs

‘Confirm this action with a fresh authenticator code’ (MFA step-up)

You might be here because: “it wants a code again even though I just signed in” · “MFA step-up required” · “Your MFA proof has expired” · “This action requires a fresh MFA challenge” · “403 requires_mfa_step_up” · “can’t regenerate recovery codes, asks for a code”

Short answer

Some sensitive actions require that you proved two-factor recently — within a 15-minute window by default. If you never entered a code in this session, or it was more than 15 minutes ago, the server answers 403 mfa-step-up-required and the dashboard shows a Confirm with your authenticator box: enter a fresh 6-digit code or an unused recovery code and the action continues.

Check first

  • Two-factor enrolled on this account? The gate only applies when it is.
  • Is the code from your authenticator app for this account, and is your phone’s clock right?
  • Are you in the web dashboard? The step-up prompt is a dashboard feature; the desktop app only shows the sentence.

Likely causes and fixes

  1. “This action requires a fresh MFA challenge. Sign in again with your authenticator code.” — no code was entered in this web session. Fix: enter a code in the prompt shown, or sign out and sign in again with your code.

  2. “Your MFA proof has expired. Re-enter your authenticator code to continue.” — the last code was more than 15 minutes ago. Fix: enter a fresh code in the prompt; then retry the action.

  3. After confirming, the action did not run. Retry it — it may go through without asking again; if asked again, use a new code or an unused recovery code.

  4. API key or desktop app hit this 403. The step-up is satisfied by a web session; a script cannot answer it. Do the action in the dashboard.

  5. Which actions? Disabling two-factor, regenerating recovery codes, and removing a Google or GitHub sign-in linked to your account.

If it still fails

Press Talk to a person in this chat (or open Help) and include: account email, the action, the exact message, and whether the code was accepted. If you cannot produce any code, see Lost my authenticator app or recovery codes — a person handles access recovery.