AlexxIT/go2rtc · error

invalid 2FA code

Error message

invalid 2FA code

What it means

The Ring OAuth endpoint responded 400 with a 'Verification Code' WWW-Authenticate header, meaning the supplied 2FA code was rejected. The client records Using2FA and sets a retry prompt; the caller must re-authenticate with a fresh code.

Solutions

1. Re-read the code from the authenticator/SMS and resubmit via GetAuth with the new twoFactorAuthCode
2. Check that the system clock is accurate for TOTP codes

When it happens

Trigger: Thrown at pkg/ring/api.go:287 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/5bb35cfade438ce4. Report an issue: GitHub.

Appendix: source

Thrown at pkg/ring/api.go:287

	resp, err := c.httpClient.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()

	// Handle 2FA Responses
	if resp.StatusCode == http.StatusPreconditionFailed ||
		(resp.StatusCode == http.StatusBadRequest && strings.Contains(resp.Header.Get("WWW-Authenticate"), "Verification Code")) {

		var tfaResp Auth2faResponse
		if err := json.NewDecoder(resp.Body).Decode(&tfaResp); err != nil {
			return nil, err
		}

		c.Using2FA = true
		if resp.StatusCode == http.StatusBadRequest {
			c.PromptFor2FA = "Invalid 2fa code entered. Please try again."
			return nil, fmt.Errorf("invalid 2FA code")
		}

		if tfaResp.TSVState != "" {
			prompt := "from your authenticator app"
			if tfaResp.TSVState != "totp" {
				prompt = fmt.Sprintf("sent to %s via %s", tfaResp.Phone, tfaResp.TSVState)
			}
			c.PromptFor2FA = fmt.Sprintf("Please enter the code %s", prompt)
		} else {
			c.PromptFor2FA = "Please enter the code sent to your text/email"
		}

		return nil, fmt.Errorf("2FA required")
	}

	// Handle errors
	if resp.StatusCode != http.StatusOK {
		body, _ := io.ReadAll(resp.Body)

View on GitHub (pinned to c245815e75)