Set up Google Authenticator first
Turn on authenticator failed because the account has no stored twoFactorSecret yet (POST /api/account/2fa/enable).
Why this happens
Enable toggles an already-configured secret. Without completing Set up Google Authenticator (QR + confirm), there is nothing to turn on. Distinct from Could not turn on authenticator (other enable failures) and from “already set up” messages.
Diagnose and fix
1. Click Set up Google Authenticator; scan QR; enter the 6-digit code to confirm.
2. Then use Turn on if the UI shows Off after setup.
3. If setup fails, see Could not start 2FA setup.
4. Site must allow TOTP (Two-factor authentication mode).