{"record":{"id":"e5e08e62f3309178","repo":"atuinsh/atuin","slug":"unexpected-two-factor-requirement-during-registrat","errorCode":null,"errorMessage":"unexpected two-factor requirement during registration","messagePattern":"unexpected two-factor requirement during registration","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/atuin/src/command/client/account/register.rs","lineNumber":93,"sourceCode":"                        let is_hub_token =\n                            auth_type.as_deref() == Some(\"hub\") || session.starts_with(\"atapi_\");\n\n                        if is_hub_token {\n                            meta.save_hub_session(&session).await?;\n                        } else {\n                            meta.save_session(&session).await?;\n                            println!(\n                                \"\\nNote: Your account has not been fully migrated to Atuin Hub.\"\n                            );\n                            println!(\n                                \"Sync will continue to work, but you can visit hub.atuin.sh to \\\n                                 create a new Hub account and link it to your existing CLI \\\n                                 account.\"\n                            );\n                        }\n                    }\n                    AuthResponse::TwoFactorRequired => {\n                        bail!(\"unexpected two-factor requirement during registration\");\n                    }\n                }\n\n                let _key = paseto_v4::Key::try_load_or_generate(&settings.key_path)?;\n\n                println!(\n                    \"Registration successful! Please make a note of your key (run 'atuin key') \\\n                     and keep it safe.\"\n                );\n                println!(\n                    \"You will need it to log in on other devices, and we cannot help recover it \\\n                     if you lose it.\"\n                );\n            } else {\n                // Interactive registration: delegate to the browser OAuth flow.\n                // Registration on Hub happens on the website; the CLI just needs\n                // to authenticate afterwards.\n                super::login::Cmd {","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/atuinsh/atuin/blob/900007c48045867e7f44b0f9bc55ad9dbe99ee0d/crates/atuin/src/command/client/account/register.rs#L75-L111","documentation":"This error is thrown by `atuin register` when the registration API call to the sync server unexpectedly responds with a two-factor-authentication requirement. Registration of a brand-new account should never require 2FA (no 2FA has been configured yet), so the CLI treats this response as unexpected and aborts instead of continuing the key-generation/linking flow.","triggerScenarios":"Running `atuin register` against a server whose `register` endpoint returns `AuthResponse::TwoFactorRequired` — e.g. registering on a hub/server that enforces 2FA at account-creation time, or hitting a different (2FA-enabled) endpoint than intended via a custom `sync_address`.","commonSituations":"Pointing `sync_address` at a non-standard server (e.g. an Atuin Hub instance with mandatory 2FA) while trying to register a new account; using `atuin register` where `atuin login --2fa` or the server's web UI is the expected path.","solutions":["Check `sync_address` in your config; make sure you are registering against the server you intend (standard atuin servers do not require 2FA on register).","If you already have an account, use `atuin login` instead of `atuin register`.","If the target server enforces 2FA at registration, complete registration/2FA through the server's web UI, then link with `atuin account link` / `atuin login`.","Inspect the server deployment for an unexpected 2FA-on-register policy if this is your own instance."],"exampleFix":"// before\natuin register -u me -e me@example.com\n// (fails: unexpected two-factor requirement)\n// after\n# register on the correct server / use the web UI for 2FA servers\natuin register -u me -e me@example.com  # with sync_address unset or pointing at a non-2FA server","handlingStrategy":"try-catch","validationCode":"# verify sync_address before registering\ngrep -E 'sync_address|two_factor' ~/.config/atuin/config.toml; echo \"registering against: ${ATUIN_SYNC_ADDRESS:-default}\"","typeGuard":null,"tryCatchPattern":"match atuin::register(&username, &email, &password) {\n    Err(e) if e.to_string().contains(\"two-factor requirement\") => {\n        eprintln!(\"This server requires 2FA at registration; use the web UI or `atuin login`.\");\n    }\n    Err(e) => return Err(e),\n    Ok(session) => { /* proceed */ }\n}","preventionTips":["Confirm sync_address points at the intended server before registering.","Use `atuin login` for accounts that already exist or have 2FA.","Complete 2FA enrollment via the server's web UI, then link the CLI.","Document non-standard sync_address values in team setup guides."],"tags":["auth","registration","two-factor","cli"],"backgroundTag":"unexpected-api-response-shape","analyzedSha":"900007c48045867e7f44b0f9bc55ad9dbe99ee0d","analyzedAt":"2026-09-19T12:52:51.491Z","contentChangedAt":"2026-09-19T12:52:51.491Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}