Bitbucket Cloud Login Fails with "Invalid two step verification code" error

Summary

When attempting to log in, the user enters the 6-digit code from their authenticator app (e.g., Google Authenticator, Duo, Microsoft Authenticator) or a recovery key, but receives the following error message: "Invalid two step verification code"

Diagnosis

Error message: "Invalid two step verification code" is reported when trying to login on Bitbucket using 2 step verification process.

Cause

Bitbucket's two-step verification (2SV) uses TOTP (Time-based One-Time Password) to generate verification code. This protocol generates and validate codes based on the current time. If the time on the user's mobile device differs from the server time by even a small margin (usually more than 30-60 seconds), the generated codes will be considered invalid.

If the clock on the user's device drifts more than 30–60 seconds from the server's time, the code generated by the authenticator app will fall outside the valid window and be rejected as invalid

Solution

To resolve this issue, ensure that the mobile device's time is accurately synchronized, then verify the code works. Follow the steps below for your specific device:

For iPhone (iOS)

1. Open Settings → General → Date & Time

2. Enable "Set Automatically" by Toggle ON

3. If it is already enabled, toggle it OFF, wait a few seconds, then toggle it back ON to force a re-sync.

For Android

1. Open Settings → General Management → Date and Time (Path may vary slightly by manufacturer — e.g., Samsung, Pixel, etc.).

2. Enable "Automatic date and time" (may also appear as "Use network-provided time").

3. If it's already on, toggle it OFF, wait a few seconds, then toggle it back ON to force a refresh.

4. Google Authenticator only: Open the Google Authenticator app, tap the Menu(three dots) -> Settings -> Time correction for codes -> Sync now.

After syncing, wait for the current code to rotate and try logging in with the next freshly generated code.

If the issue still persists after making the clock synchornised, try the following steps to re-link the account on Bitbucket

1. Delete the existing Bitbucket entry from your authenticator app.

2. In Bitbucket, navigate to your Personal settings > Two-step verification.

3. Re-scan the QR code to register the account again.

4. Enter the new 6-digit code immediately when it appears (don't wait for it to be close to expiring)