Authentiction with 2FA (TOTP) fails (possibly a stalwart issue?)

unknown commented

2026-08-26 21:14:20 +00:00

When selecting the option to enter the Two-factor code, login fails. The server response is 401 Unauthorized.

The credentials work when logging in directly to stalwart. A login with an app password succeeds.

Browser: Firefox 154 Win 11 / Vivaldi 7.8.3925.66 Win 11

Stalwart version: 0.16.19

Deployment with coolify / github repository /docker-compose.yml

JS Console:
Failed to load resource: the server responded with a status of 401 ()

HTTP Response:
{"error":"invalid_credentials","message":"Invalid credentials"}

_{Rebuilt from: notification email, session transcript.}

When selecting the option to enter the Two-factor code, login fails. The server response is 401 Unauthorized. The credentials work when logging in directly to stalwart. A login with an app password succeeds. Browser: Firefox 154 Win 11 / Vivaldi 7.8.3925.66 Win 11 Stalwart version: 0.16.19 Deployment with coolify / github repository /docker-compose.yml JS Console: Failed to load resource: the server responded with a status of 401 () HTTP Response: {"error":"invalid_credentials","message":"Invalid credentials"} <sub>Rebuilt from: notification email, session transcript.</sub>

mbunkus commented

2026-08-26 21:35:03 +00:00

Adding that both ihasmail & Bulwark Mail fail in the exact same way, and their login mechanism works identically, too (meaning a dialog for login/password, requiring a click on "I have a 2FA code" before the separate 2FA entry is shown).

Looking at the network pane in the browser's developer tools shows that the 2FA code is sent properly as the totp data member to the login endpoint.

Stalwart's own management UI seems to use a different login method (probably OAuth2 with pre-configured OIDC client?); here's an example payload of me logging in to Stalwart successfully with 2FA:

Adding that both ihasmail & Bulwark Mail fail in the exact same way, and their login mechanism works identically, too (meaning a dialog for login/password, requiring a click on "I have a 2FA code" before the separate 2FA entry is shown). Looking at the network pane in the browser's developer tools shows that the 2FA code is sent properly as the `totp` data member to the `login` endpoint. Stalwart's own management UI seems to use a different login method (probably OAuth2 with pre-configured OIDC client?); here's an example payload of me logging in to Stalwart successfully with 2FA: <img width="1571" height="383" alt="Image" src="https://github.com/user-attachments/assets/ee348bd8-ca63-470b-bd72-9a6e560b886b" />

Authentiction with 2FA (TOTP) fails (possibly a stalwart issue?) #75