Skip to main content

Troubleshooting

This page contains the problems frequently encountered while using SecTrail Authenticator and their solutions.

Quick Diagnosis Table​

SymptomPossible CauseSection
The OTP code is not acceptedThe device clock is wrongCode Problems
No notification arrivesPermission or network problemNotification Problems
The notification arrives but the approval is not processedThe device has no access to the serverApproval Not Processed
The QR code cannot be scannedCamera permission or image qualityQR Problems
The application does not open / shuts downJailbreak/root detectionApplication Does Not Open
QR login uses the wrong accountAccount orderAccount Order
The passkey option is not visibleOperating system versionPasskey Problems

The OTP Code Is Not Accepted​

Symptoms:

  • The message "OTP code is incorrect" is received
  • Every attempt fails
  • The code is rejected although it is read correctly
The Most Common Cause: The Device Clock

Soft OTP codes are generated according to the device clock. If the device clock drifts from the server clock, all generated codes become invalid. The vast majority of problems come from this.

Solution Steps​

1. Set the device clock to automatic

  • iOS: Settings → General → Date & Time → Set Automatically ✅
  • Android / Huawei: Settings → System → Date & time → Automatic date & time ✅

If the setting is already on, turn it off and on again to let the clock resynchronize.

2. Check the time zone

Even if the time looks correct, the codes become invalid if the time zone is wrong. Make sure the time zone is set automatically as well.

3. Use the current code

Codes refresh every 30 seconds. If the counter is about to end, wait for the new code.

4. Verify that you entered the code of the correct account

If you have more than one account, make sure you are using the code of the account belonging to the organization you are signing in to.

5. Re-register the account

If the above does not solve it, the secret key may have been recorded incorrectly. Re-register the account from the registration panel.

Soft OTP Does Not Require Internet

Soft OTP codes are generated on the device. Code problems are not network related — checking the internet connection does not solve this problem.

The Push Notification Does Not Arrive​

Symptoms:

  • The sign-in is performed but no notification reaches the device
  • The request times out

Solution Steps​

1. Check the notification permission

  • iOS: Settings → SecTrail Authenticator → Notifications → Allow ✅
  • Android / Huawei: Settings → Apps → SecTrail Authenticator → Notifications → Allow ✅

2. Verify the internet connection

Push notification requires an internet connection. Make sure the device is online.

3. Test with mobile data

Diagnosing the Network Problem

Take the device off Wi-Fi and test it with mobile data (4G/5G):

  • If it works on mobile data but not on Wi-Fi → the problem is in the network the device is connected to. Ask your network administrator to open access to cs.sectrail.com:443 and to notification services on the network that user devices connect to.
  • If it does not work on either → the problem is in the permission or the device registration.

4. Turn off battery optimization (Android)

On Android, battery saving can block background notifications:

Settings → Apps → SecTrail Authenticator → Battery → Unrestricted / Don't optimize

5. Renew the device registration

The device registration request may not have reached the server during registration. Re-register the account from the registration panel and keep the application open for at least 30 seconds after registration.

The Notification Arrives but the Approval Is Not Processed​

Symptoms:

  • The notification reaches the device and is displayed
  • The "Approve" button is pressed but the sign-in is not completed
  • The request times out
The Mobile Device Needs Access to the Server

The notification reaching the device and the approval being processed are two separate steps:

  1. The notification arriving → provided over Firebase Cloud Messaging
  2. The approval being processed → provided by the mobile application connecting directly to cs.sectrail.com

If the device cannot reach this address, the notification is displayed, but the "Approve" action does not reach the server and the sign-in is not completed.

The Address the Mobile Device Reaches​

The following access must be open on the network that user devices connect to:

Target:     cs.sectrail.com
Port:       443 (HTTPS)
Direction:  Outbound (from the mobile device)

This access is used for the following operations:

OperationWhen
Device registrationWhen the account is registered for the first time
Approval/rejection resultWhen the user responds to the notification
QR login verificationWhen the QR code is scanned
This Is Different from the Rule on the Server Side

The SecTrail MFA server's access to cs.sectrail.com and the mobile devices' access to this address are separate requirements. Even if the rule is open on the server side, approvals are not processed if this access is closed on the corporate Wi-Fi network the users connect to.

Solution Steps​

  1. Test the device with mobile data (4G/5G) — if it works, the problem is in the Wi-Fi network
  2. Have outbound access to cs.sectrail.com:443 opened on the user Wi-Fi network
  3. Check whether there is content filtering or a proxy on the guest/user Wi-Fi networks

The QR Code Cannot Be Scanned​

Symptoms:

  • The camera opens but the QR code is not read
  • "Invalid QR Code" / "Unknown QR Code" error

Solution Steps​

1. Check the camera permission

  • iOS: Settings → SecTrail Authenticator → Camera ✅
  • Android / Huawei: Settings → Apps → SecTrail Authenticator → Permissions → Camera ✅

2. Improve the image conditions

  • Increase the screen brightness
  • Make sure the whole QR code is within the camera's field of view
  • Do not hold the phone too close or too far
  • Prevent screen reflection

3. Check the validity of the QR code

QR codes have a limited validity period. If the code has been waiting on the screen for a long time, refresh the page to generate a new code.

4. Make sure you are scanning the correct QR code

The registration QR code and the QR login code are different. The application routes automatically based on the content, but it gives an error if an invalid QR is scanned.

5. Use manual registration

If the camera problem persists, you can add the account manually:

⚙️ menu → How to Use It → "Register with Manual Informations" → Add Account

The Secret Key is shown below the QR code on the registration panel.

👉 Manual Registration Details

"Secret Key is invalid" Error​

This error, received during manual registration, indicates that the format of the entered secret key is invalid.

Use Copy-Paste

Instead of typing the secret key by hand, copy and paste it. Misreading characters is the most frequently encountered cause.

The Application Shuts Down as Soon as It Opens​

Symptom: The application is launched but closes immediately.

Jailbreak / Root Detection

SecTrail Authenticator deliberately does not work on jailbroken (iOS) or rooted (Android) devices and shuts itself down.

This is not a bug but a security measure: on a compromised device, the protection of authentication secrets cannot be guaranteed. This check cannot be disabled.

Solution​

  • Remove the jailbreak/root state of the device, or
  • Use a device that has not been compromised for corporate authentication
Customized ROMs

Some customized Android ROMs or developer options may trigger the root detection mechanism. If your device is not rooted but the problem persists, contact your IT team.

QR Login Uses the Wrong Account​

Symptom: More than one account is registered and QR login is performed with another account instead of the intended one.

Expected Behavior

QR login automatically uses the first (topmost) account in the application. This is not a bug but by design.

Solution​

  1. Open the ⚙️ menu → Accounts page
  2. Drag the account you want to sign in with to the top
  3. The change takes effect immediately — QR login now uses this account
Preventive Recommendation

Keep the corporate account you use frequently permanently at the top. Make it a habit to quickly check the account order before signing in with QR.

QR Login Cannot Be Completed​

Symptoms:

  • "Authentication Failed" message
  • "Request Timeout" message
  • The operation takes 30 seconds and fails

Solution Steps​

1. Check the device's access to the server

QR login requires the mobile device to connect directly to cs.sectrail.com. Test the device with mobile data.

👉 The Address the Mobile Device Reaches

2. Make sure the QR code has not expired

Refresh the sign-in screen to generate a new QR code and scan it again.

3. Check the account order

Make sure the correct account is at the top — if the wrong account is used, the server may reject the request.

4. Renew the session

Refresh the browser session and start the sign-in process over.

5. Make sure the application is up to date

Check whether there is an application update in the store.

Biometric Authentication Cannot Be Enabled​

Symptom: The Biometric Authentication switch turns on but immediately returns to the off position.

Possible Causes and Solutions​

CauseSolution
No biometrics registered on the deviceRegister fingerprint / face recognition from the device settings
The hardware does not support itUse the PIN lock
The biometric authentication was cancelledTurn the switch on again and complete the verification
Restart After the Setting

When the biometric setting is saved, the application restarts automatically. This is the expected behavior.

Security Settings Cannot Be Changed​

Symptom: The PIN or biometric switch on the Security page appears greyed out and cannot be changed.

Remote Configuration Is Active

If there is a ☁️ cloud icon and the phrase "Remote Configured" next to the setting, this setting has been enforced centrally by your administrator and cannot be changed from the device.

Contact your IT team for a change.

The Passkey Option Is Not Visible​

Symptom: There is no passkey-related option at all in the application.

Checklist​

1. Check the operating system version

PlatformRequired Minimum Version
iOS17.0 or above
Android14 (API 34) or above

If your device is below this threshold, the feature is not visible at all. This is the expected behavior.

2. Is a screen lock defined?

A screen lock (PIN, pattern or biometric) must be defined on the device in order to use passkeys.

3. Is the autofill provider enabled?

  • iOS: Settings → General → AutoFill & Passwords → SecTrail Authenticator ✅
  • Android: Settings → Passwords & accounts → SecTrail Authenticator ✅

Backup Problems​

Cannot Sign In to the Google Account​

  • Check the internet connection
  • Make sure Google Play Services is up to date (Android)
  • Try with a different Google account

The Backup Cannot Be Restored​

  • Make sure you signed in with the same Google account you created the backup with
  • If the backup file is corrupted, no restore is performed; in that case the accounts must be re-registered
Passkeys Are Not Backed Up

When you restore from a backup, your accounts come back, but passkeys do not. Passkeys are bound to the device and must be re-registered on the new device.

Loss or Theft of the Device​

Emergency Procedure

If the device with the authentication application installed has been lost or stolen, apply the following steps immediately:

  1. Inform your IT team — the user's device registration must be deleted from the management panel
  2. Change your password — the device may still be able to receive notifications
  3. Review the notification history (if possible) — check whether there were unauthorized sign-in attempts

What Needs to Be Done on the Administrator Side​

  • Delete the user's mobile device registration from the management panel
  • Terminate the user's active SSO sessions
  • Check the Monitoring records for suspicious activity

Related pages: Users · Monitoring

If the Problem Is Not Solved​

If the steps above did not solve your problem, contact the support team.

👉 SecTrail Support Portal

Information to Share in a Support Request​

Include the following information to speed up your request:

  • Device model and operating system version
  • SecTrail Authenticator application version
  • The exact symptom of the problem and the error message received
  • When the problem started
  • The solution steps that were tried
Never Share

Never share your Secret Key, your PIN code or your password in a support request. The SecTrail support team does not ask you for this information.