two_factor_required

HTTP status: 403 Forbidden

The organization requires two-factor authentication for every member, and the person this token belongs to hasn’t turned it on. Their grace period, if the organization gave one, has run out.

This is separate from forbidden, which means the token’s role can’t perform the action, and from sso_required, which is about how the token’s session signed in.

Common causes

• An Owner turned on Require two-factor authentication after the personal access token was created, and the token’s owner never set it up.
• The token’s owner turned 2FA off before joining the organization.

How to fix

• Sign in to Featureflip as the token’s owner. The dashboard walks you through setting up two-factor authentication. The same token works again as soon as you finish, so there’s no need to create a new one.
• For automation that shouldn’t depend on one person’s account, use a service token instead. Service tokens belong to the organization and aren’t affected by this requirement.

Example

{
  "error": "two_factor_required",
  "message": "This organization requires two-factor authentication. Turn it on for your account in the dashboard, then retry.",
  "docs_url": "https://featureflip.io/docs/management-api/errors/two_factor_required"
}