Two-factor authentication is already enabled — sign in again
During mandatory 2FA setup (POST /api/auth/mandatory-2fa/setup), the account already has 2FA enabled. Product: sign in again (use the authenticator code path).
Why this happens
Member hit the mandatory QR flow while twoFactorEnabled is already true. Setup cookie is cleared; they should complete normal password + TOTP login. Sibling of Google Authenticator already set up — sign in with code (configured but setup blocked).
Diagnose and fix
1. Return to login; enter password; then the 6-digit code.
2. Do not stay on the mandatory setup step.
3. If codes fail, see That code did not work — try again / staff reset.
4. Distinct from Account Settings already enabled (no “sign in again”).