Okta YubiKey "Your code doesn't match our records. Please try again" Error During Enrollment or Verification
Last Updated:
Overview
Okta rejects the YubiKey passcode when the credential is configured in Slot 2 and the user performs a short tap that triggers Slot 1. Resolve the issue by using a sustained press for Slot 2 or by swapping the YubiKey slot configuration.
The user receives the following error during Okta enrollment or verification after YubiKey configuration in the Admin Console:
Your code doesn't match our records. Please try again.
Applies To
- Okta Identity Engine
- Okta Classic Engine
- YubiKey hardware tokens
- Multi-Factor Authentication (MFA) enrollment
- Okta YubiKey verification
Cause
The Okta credential is stored in Slot 2 on the YubiKey, but a short tap triggers Slot 1. Okta rejects the resulting passcode because the generated string does not match the configured credential.
Solution
How is the YubiKey "Your code doesn't match our records. Please try again" error resolved?
These steps ensure that the user generates the correct YubiKey credential for Okta during enrollment or verification.
- Confirm whether the Okta credential is configured in Slot 2 on the YubiKey.
- Instruct the user to press and hold the YubiKey sensor for 3 to 5 seconds until the text string populates the field.
- Retry enrollment or verification after the long press completes.
The following behavior determines which YubiKey slot generates the credential:
- Slot 1 triggers on a short tap.
- Slot 2 triggers on a sustained press and hold.
