Wrong, expired, and too many attempts
Every state here fails closed and stays on the screen: no navigation and no "verified" state. A rejected code is cleared. A code the server couldn't check because of an outage is kept, because it may be right. Today the server returns 401 NOT_ACTIVE for both wrong and expired codes. That looks the same as an expired session, so the UI can't tell them apart. The manifest asks for distinct codes (Δ): 422 CODE_INVALID {attemptsRemaining}, 422 CODE_EXPIRED, 429 TOO_MANY_ATTEMPTS + Retry-After.
- Account (completed)
- Phone (current step)
- Email (not started)
Enter your code
Enter the 6-digit code we sent to
+44 •••• •• 0123
- Account (completed)
- Phone (current step)
- Email (not started)
Enter your code
Enter the 6-digit code we sent to
+44 •••• •• 0123
error-invalid · wrong code
422 CODE_INVALID. The rejected digits are cleared, the cells keep their red error ring, and cell 1 gets focus. Confirm stays disabled until 6 new digits are entered, so re-submitting the same wrong code can't burn an attempt. The tries-left count comes from the server, not a client counter. The error is announced once via role=alert.
- Account (completed)
- Phone (current step)
- Email (not started)
Enter your code
Enter the 6-digit code we sent to
+44 •••• •• 0123
error-expired · expired code
422 CODE_EXPIRED, or the expiry countdown hit 0:00 on the client, which disables the cells before anything is sent. The only action is to send a new code.
- Account (completed)
- Phone (current step)
- Email (not started)
Enter your code
The code we sent to this number has expired
+44 •••• •• 0123
error-locked · too many attempts / 429
429 TOO_MANY_ATTEMPTS + Retry-After. Live countdown. Never a dead end: Continue for now works under both policies (under required, the user is re-prompted at next sign-in; see 07).
- Account (completed)
- Phone (current step)
- Email (not started)
Too many tries
To keep your account safe, code entry is paused. You can try again in 14:52.
error-confirm-unavailable · verify service down (503 / 502)
503 VERIFY_UNAVAILABLE (or 502) from /confirm (Δ): sms-service /sms/verify timed out or failed. Today this becomes false and then 401, which tells a user with a correct code that it's wrong. Now the digits are kept, no attempt is used, and Try again re-submits the same code. Escape: Skip (optional) or Continue for now (required).
- Account (completed)
- Phone (current step)
- Email (not started)
Enter your code
Enter the 6-digit code we sent to
+44 •••• •• 0123
error-confirm-unavailable · under required
The same state with the required-policy escape.
- Account (completed)
- Phone (current step)
- Email (not started)
Enter your code
Enter the 6-digit code we sent to
+44 •••• •• 0123