Could not start authenticator setup — sign in again
After password login when 2FA is mandatory, POST /api/auth/mandatory-2fa/setup returned not OK. UI falls back to this message and returns to the password step.
Why this happens
Setup is only available with a valid mandatory-setup cookie, CSRF, and site mode allowing + requiring TOTP. API errors include setup not available, already enabled, already configured, user missing, or invalid CSRF. Distinct from the catch-only Could not load authenticator setup — try again.
Diagnose and fix
1. Sign in again from scratch so the mandatory-setup cookie is set.
2. Confirm Two-factor authentication mode is mandatory.
3. If the user already has a secret, complete login with the authenticator code, or reset 2FA as staff.
4. Check CSRF load on the login page first.