The console asks you to confirm your identity again (recent confirmation expired)

Symptom

When saving a change (creating people, changing a setting, removing a phone, issuing a token), one of these appears:

• «Confirm your authenticator again with local verification to complete this change.»
• «This needs a recent confirmation. Confirm with your passkey or another phone, then try again.»
• The «Confirm this change» dialog, with «Choose how to confirm that it is you.»

The API answers 403 fresh_passkey_required.

Cause

Sensitive changes require a passkey, phone or Presence confirmation less than five minutes old, by the server's clock. Your last confirmation is older.

Fix

1. In the dialog, choose your passkey or «Approve on my phone» and confirm.
2. Repeat the change.

Nothing changes without this confirmation: the session is replaced by a recent one and only then is the change sent.

What if «You need to confirm your identity again.» appears?

In Edge appliances (save, confirm or configure) and RADIUS clients (save or remove), the console offers the confirmation right where the message is: «You need to confirm your identity again.» with the «Confirm identity» button.

1. Choose «Confirm identity».
2. Confirm with your passkey or on your phone.
3. The console repeats the same change by itself; you do not need to redo it.

In other views, when the server says the confirmation expired, one of the symptom messages appears instead of the generic «The operation was not allowed by the active policy or by your permissions.». If you see the generic message, see Operation not allowed.

When to escalate

If the confirmation is accepted but the change is still refused, see Operation not allowed. If your computer's clock is far off, fix it (see Clock out of sync).