Broken 2-Factor Authentication Login

[jmrose]

I've been signing in to Bitbucket with 2-factor authentication for years (standard time-based OTP from an app). Today I was asked if I wanted to register a security key.

I accepted and registered 3 Yubikeys. I then tried to sign in again, but none of them worked. I get the message:  "The operation either timed out or was not allowed. Refresh and then try again".

Chrome says "Try a different security key. You're using a security key that's not registered with this website". I also tried with another browser.

Luckily I was able to use the old OTP option to sign in and disable 2-factor authentication. Then I tried to set up 2FA again (app OTP option).

It's a complete mess. I'm still asked to insert a security key when I try to sign in, although I've reset 2FA. I can still sign in with the NEW (Atlassian) OTP configuration, but I'm also asked for another OTP from the old Bitbucket 2FA setup...

I don't seem to be able to submit a Support ticket with my account.

[Theodora Boudale]

Hi @jmrose and welcome to the community.

Bitbucket uses Atlassian accounts (the ones for https://id.atlassian.com/) for authentication.

At the moment, it is possible to set up 2FA both for a Bitbucket account (via https://bitbucket.org/account/settings/two-step-verification/) and also for an Atlassian account (via https://id.atlassian.com/manage-profile/security/two-step-verification).

I see in our system that this is the case for your account. I cannot see what security keys you have registered and where, but I do see that 2FA is enabled both for your Bitbucket and your Atlassian account.

If the Atlassian account 2FA works ok for you now and it's the Bitbucket one that doesn't work, you can disable the Bitbucket 2FA. On the screen you shared, select the option "Don't have a key?" and on the next page select the option "Send recovery email". Please keep in mind that the recovery email will be sent 24 hours after you request it.

Kind regards,
Theodora