Our production site, as well as our QA servers, are all having an issue with passing the 2-factor authentication in admin panel.

When a newly created admin user scans the QR code after providing their username and password, and enters the 6-digit code shown on the Google Authenticator app, they are consistently given an "Invalid code" error message. However, if an existing admin resets their Google Authenticator 2FA settings under User Accounts, the new user can scan the QR code and enter the 6-digit code with no issue. This is not happening on any old accounts, only new ones.

This issue is not reproducible on local environments.

There was a similar question asked earlier but the OP himself had to reset the 2FA in the accepted solution. This should ideally work without resetting the 2FA.

We are running Magento Commerce/Enterprise version 2.3.5-p1 while the msp/twofactorauth package is at version 3.1.2

  • Not working of the existing users as well. No idea what happened it was working before Commented Jul 15, 2021 at 16:41

1 Answer 1


we had a similar problem where one environment worked fine and the other kept giving "invalid code" or simply redirected to the same screen. We had a look in the logs and found the following error:

Session size of 259423 exceeded allowed session max size of 256000.

After this the solution was simple:

bin/magento config:set system/security/max_session_size_admin 260000

And it worked. So tail the logs and see if it is a session memory limit.

  • Bingo! I had to set my value a touch higher, but this was the solution. Thanks! Commented Nov 11, 2021 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.