Too many authenticator attempts — try again later
POST /api/auth/login/2fa returned 429 AUTH_RATE_LIMIT_TOTP after too many code attempts for that user.
Why this happens
Brute-force protection on the authenticator step. Distinct from That code did not work — try again (single wrong code) and from Sign-in session expired — start again (cookie gone).
Diagnose and fix
1. Wait (respect Retry-After / retryAfterSec); then enter a fresh code.
2. Sync phone time; use the correct authenticator account.
3. If the device is lost, staff Reset user 2FA / sessions.
4. Start password login again if the pending 2FA session expired while waiting.