# Cannot use 2FA to reset password

**URL:** https://meta.discourse.org/t/cannot-use-2fa-to-reset-password/130875
**Category:** Support
**Created:** [October 13, 2019, 12:09am UTC](https://meta.discourse.org/t/cannot-use-2fa-to-reset-password/130875 "2019-10-13T00:09:07Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![koltl](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/koltl/32/152166_2.png) [@koltl](https://meta.discourse.org/u/koltl)
#### Post date: [October 13, 2019, 12:09am UTC](https://meta.discourse.org/t/cannot-use-2fa-to-reset-password/130875/1 "2019-10-13T00:09:07Z")

</div>

I just installed Discourse on a VPS and recovered from a backup. I have 2FA on my account and when I sign on using the email (and link it sends me) w/o using password, it will ask for 2FA code which does work. But when I want request to reset to password, I open the link and it asks for 2FA which I put in, and it gives me,

Invalid authentication code. Each code can only be used once.

Any solution?

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 13, 2019, 12:16am UTC](https://meta.discourse.org/t/cannot-use-2fa-to-reset-password/130875/2 "2019-10-13T00:16:44Z")

</div>

Yes I ran into this bug too @featheredtoast @sam it is quite bad

---

<div class="post-metadata">

### Author: ![koltl](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/koltl/32/152166_2.png) [@koltl](https://meta.discourse.org/u/koltl)
#### Post date: [October 13, 2019, 12:22am UTC](https://meta.discourse.org/t/cannot-use-2fa-to-reset-password/130875/3 "2019-10-13T00:22:01Z")

</div>

Alright, I guess signing in through 2FA will work until it’s fixed.

I tried [this](https://meta.discourse.org/t/admin-locked-out-of-2fa/92156/2) but it gave me a syntax error,

![image](https://global.discourse-cdn.com/meta/original/3X/0/e/0e15fe93e8c64802c17d371130cf0ea133847763.png)

---

<div class="post-metadata">

### Author: ![featheredtoast](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/featheredtoast/32/116994_2.png) [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [October 13, 2019, 7:59am UTC](https://meta.discourse.org/t/cannot-use-2fa-to-reset-password/130875/4 "2019-10-13T07:59:16Z")

</div>

Oh dear that was rather bad. Looks like we were using an incorrect alias here where we shouldn’t be. This should fix it. 🐒

[https://github.com/discourse/discourse/commit/2b74dc5885df9b2a6fce07a643ad4e817125bb6c](https://github.com/discourse/discourse/commit/2b74dc5885df9b2a6fce07a643ad4e817125bb6c)

---

<div class="post-metadata">

### Author: ![koltl](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/koltl/32/152166_2.png) [@koltl](https://meta.discourse.org/u/koltl)
#### Post date: [October 13, 2019, 12:55pm UTC](https://meta.discourse.org/t/cannot-use-2fa-to-reset-password/130875/5 "2019-10-13T12:55:47Z")

</div>

Stupid question; how do I implement this fix? Thank you

---

<div class="post-metadata">

### Author: ![featheredtoast](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/featheredtoast/32/116994_2.png) [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [October 13, 2019, 4:31pm UTC](https://meta.discourse.org/t/cannot-use-2fa-to-reset-password/130875/6 "2019-10-13T16:31:52Z")

</div>

Visit your site’s upgrade page: `/admin/upgrade`

---

<div class="post-metadata">

### Author: ![featheredtoast](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/featheredtoast/32/116994_2.png) [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [October 15, 2019, 1:00am UTC](https://meta.discourse.org/t/cannot-use-2fa-to-reset-password/130875/7 "2019-10-15T01:00:03Z")

</div>

This topic was automatically closed after 32 hours. New replies are no longer allowed.