Why sign in again
Reasons you are asked to sign in again or to verify once more, and what to do when verification fails.
Why am I always asked to sign in again
Sessions have a lifetime; once it ends, signing in again is required. That is by design: a long-lived session keeps the attack window open forever once leaked.
Beyond natural expiry, three things end a session early:
| Cause | How to tell |
|---|---|
| The session was revoked | You revoked it in account settings, or tapped "revoke all other sessions" elsewhere |
| The password was reset | Resetting a password usually ends existing sessions |
| Security policy ended it | Can be triggered by anomalous sign-ins (unusual location or device) |
The session does not carry over to a new device
Sessions are per device and are not shared. Signing in on device A does not sign in device B — deliberately: a leaked credential on one device must not affect the others.
Why am I asked to verify once more
For actions such as changing security settings, deleting data or revoking grants, the server requires confirmation that it is really you right now. On the protocol this is controlled by authentication strength (acr) and maximum authentication age (max_age): the session is valid, but the last strong verification is too old, so a step-up challenge is inserted.
You will be asked to confirm with a passkey or authenticator. This is protection, not an error: without it, anyone holding your unlocked device could change your security settings.
Details are in Authentication strength.
What to do when verification fails
| Symptom | Cause | Fix |
|---|---|---|
| The passkey does not match | It is not the key registered on this device | Go back to the device it was registered on, or use another method |
| The authenticator code is always wrong | Phone clock is off | Enable automatic time sync and retry |
| No verification method available | All methods lost | Use a recovery code; without one, the account recovery flow |
| Asked to verify over and over | The current session's authentication age is too old, or max_age is very short | Normal behaviour; complete one strong verification to continue |
Related
- Sessions and devices: Sessions and devices
- Recovery codes: Verification methods
Sign-in and verification
Questions about the sign-in step itself — why you are asked to sign in again, why you are asked to verify once more, and what to do when verification fails.
Authorization and permissions
Authorization questions between you and an application — what the consent page asks, what happens if you allow only part of it, what revoking does, and why a token cannot read some resource.