Okta Verify Fails to Scan QR Code with "Unable to Scan the QR Code" Error

During Okta Verify onboarding on an Apple iOS device, the QR code scan fails because the workstation has iCloud Private Relay enabled, the device clock lacks synchronization, or the QR code expires. Resolve this error by disabling iCloud Private Relay, synchronizing the device clock, or resetting the authenticator. When attempting to scan the QR code with the device camera, Okta Verify displays a red banner with the following error:

Unable to scan the QR Code

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Verify
• Apple iOS

Several factors cause this error:

• iCloud Private Relay is active on the device, interfering with QR code scanning.
• The device clock is unsynchronized, causing a time mismatch during enrollment.
• The QR code has expired before scanning completes.
• A previous application instance is active, requiring a multifactor authentication (MFA) reset in the Admin Console.
• Network connectivity issues prevent registration.

How Is iCloud Private Relay Disabled Before Enrollment?

Deactivate iCloud Private Relay on the workstation before attempting the enrollment process again.

Navigate to Settings > [Name] > iCloud > Private Relay and toggle it off.

Synchronizing the iPhone Clock

Synchronize the iPhone clock by toggling the automatic time configuration in device settings.

1. Navigate to Settings > General > Date & Time on the iPhone.
2. Toggle Set Automatically to the ON position. If it is already enabled, toggle it off, wait five seconds, and toggle it back on to force a synchronization.

How Is a New QR Code Generated?

Refresh the browser page on the computer to generate a new QR code, then scan the new QR code immediately.

1. Refresh the browser page on the computer to generate a new QR code.
2. Scan the new QR code immediately.

Resetting the Authenticator to Clear Previous Enrollments

Navigate to the user profile in the Okta Admin Console and reset the authenticator to clear previous enrollments.

1. Sign in to the Okta Admin Console.
2. Navigate to the user profile.
3. Select Reset Authenticator or Reset Multifactor for Okta Verify.
4. Instruct the end user to attempt the enrollment process again.

How Is Network Connectivity Verified Before Enrollment?

Connect the iPhone to a stable Wi-Fi network or cellular data to ensure an active internet connection.

1. Connect the iPhone to a stable Wi-Fi network or cellular data.
2. If a corporate guest Wi-Fi network blocks specific ports, disconnect from Wi-Fi and use cellular data temporarily.

Using Manual Setup to Bypass the Camera

Select the manual setup link on the computer screen and open the provided link on the iPhone to bypass the camera.

1. Select the Can't scan? or Setup manually without a QR code link located underneath the QR code on the computer screen.
2. Choose the option to send a Short Message Service (SMS) link or an email.
3. Open the link directly on the iPhone to launch the Okta Verify app and complete enrollment.