«Phone approvals are paused for this account…» (device_approvals_suspended)

Symptom

Sign-in or approval shows «Phone approvals are paused for this account for a few minutes after repeated refusals. Try again later or use a passkey.» The API answers 429 device_approvals_suspended with Retry-After: 900.

Cause

Three refusals reported as "it wasn't me" arrived within 15 minutes for this account. The pause stops "notification fatigue" attacks, where someone sends repeated requests hoping for an approval by mistake. Passkeys keep working.

Fix

1. If you refused by mistake, wait about 15 minutes and try again, or sign in now with your passkey.
2. If you received requests you did not make, approve none of them. Someone may know your password.
3. Sign in with your passkey and change your password; see Change your password.
4. Tell your organization's helpdesk or security team.

Administrator: the audit log shows the refused requests as suspicious, with the originating browser and network. End the person's sessions if in doubt and review the events.

When to escalate

Requests the person did not make are a possible account takeover attempt: treat them as a security incident and escalate to the human team.