Setup expired — open Set up Google Authenticator again
Confirming the 6-digit code after Account Settings setup failed because the pending setup cookie/secret is gone or expired (POST /api/account/2fa/confirm).
Why this happens
Member waited too long, closed the modal (DELETE clears pending), changed devices, or cookies were cleared. Distinct from mandatory-login Setup expired. Start sign-in again. (later phase) and from wrong-code errors.
Diagnose and fix
1. Open Set up Google Authenticator again; scan the new QR.
2. Enter the code promptly; keep cookies enabled.
3. Do not reuse an old authenticator entry from a previous abandoned QR — delete the stale account in the app if needed.
4. Staff can Reset user 2FA / sessions if the account is stuck.