Stuck at 2FA page on self-hosted Dokploy instance

[ZaLiTHkA]

I have a Hostinger VPS running Dokploy on Ubuntu Server 24.04.

when I try and sign in, I get to the 2FA page and I enter my current 2FA code, and then it just sits there with a "busy" spinner forever.. if I open the "Network" panel in my devtools before submitting the form, I can see that the HTTP request to the /api/auth/two-factor/verify-totp endpoint never settles... it just sits there as "pending" forever.

I have had a similar issue in the past, but in those cases I would hit F5 to refresh the page and then I would be signed in. so it was almost like the form submitted properly, but the callback to redirect my browser didn't fire.

this time, however, refreshing the page takes me back to the login prompt.. and then to the 2FA prompt.. and then I sit with the verify-totp request stuck in a pending state.

I've tried searching both the issues and discussions here on GitHub, and I've chatted extensively with Claude AI, but I still cannot work out what is causing this.. can someone please help me work out what's gonewrong and how to fix this?

[dosubot[bot]]

Hi @ZaLiTHkA! I'm Dosu and I’m helping the dokploy team.

Hey @ZaLiTHkA, this is a commonly reported issue caused by a mismatch in the BETTER_AUTH_SECRET environment variable. When this secret changes (often during upgrades), it breaks 2FA verification because the encrypted TOTP data can no longer be decrypted, causing the /api/auth/two-factor/verify-totp request to hang indefinitely [1].

Fix Option 1 — Restore the original auth secret (try first):

Set the environment variable on your Dokploy container:

BETTER_AUTH_SECRET=better-auth-secret-123456789

Then restart Dokploy. If you never changed this from the default, this should allow your existing 2FA to work again [2].

Fix Option 2 — Reset 2FA directly in the database:

If the above doesn't work, you can disable 2FA via PostgreSQL:

-- Find your user
SELECT id, email FROM "user";

-- Remove 2FA records
DELETE FROM two_factor WHERE "userId" = '<your_user_id>';

-- Disable the 2FA flag
UPDATE "user" SET two_factor_enabled = false WHERE id = '<your_user_id>';

After this you can log in without 2FA and re-enable it [1].

Checking logs for more info:

docker service logs dokploy

This may reveal the underlying error (timeout, decryption failure, etc.).

Going forward, make sure you have a stable BETTER_AUTH_SECRET set that persists across restarts and upgrades so this doesn't recur [3].

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[ZaLiTHkA]

@dosu, I did see discussion #4068, but that specifically mentions getting error 504, which is not the same as what I'm seeing.

regardless, I thought it was worth trying to remove the 2FA requirement from my user's login (FYI: the column in the user table is user_id, not userId).. but now I can't even get past the login screen, as that now hangs with a never ending "pending" request to the /api/auth/sign-in/email endpoint. I did also try restarting my Dokploy container after making the DB edits, just in case.

please can a real person help me here? I'm sure it's something simple that I'm missing, I just don't know what that is. this VPS is just a personal playground, nothing too important, so I'm happy to wait a while for a response.

[dosubot[bot]]

@ZaLiTHkA, I hear you — apologies that my initial suggestion wasn't on target. The fact that both /api/auth/two-factor/verify-totp and /api/auth/sign-in/email now hang indefinitely (rather than returning an error code) points to a different root cause than discussion #4068.

There are two likely culprits for requests that stay "pending" forever:

---

1. Missing BETTER_AUTH_TRUSTED_ORIGINS (most likely if you access Dokploy via a domain/proxy)

If you access your Dokploy instance through any domain name, Cloudflare tunnel, or reverse proxy, the auth library's CSRF origin check silently blocks the request. You need to explicitly tell Dokploy which origins are trusted [1]:

docker service update \
  --env-add "BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000,http://<your-vps-ip>:3000,https://your-domain.com" \
  dokploy

Include every URL you use to access the panel (with protocol and port).

2. Database connection pool timeout (common in v0.28.6+)

A regression in recent versions causes Drizzle ORM's connection pool to silently fail to connect to PostgreSQL, even though the database itself is running fine. This makes all auth endpoints hang [2].

Check the logs for CONNECT_TIMEOUT errors:

docker service logs dokploy --tail 100

If you see timeout errors, a restart sometimes resolves it:

docker service scale dokploy=0
docker service scale dokploy=1

If restarts don't help and you're on v0.28.6+, downgrading to v0.27.2 is a reliable workaround until the pool issue is fully resolved [2]:

docker service update --image dokploy/dokploy:v0.27.2 dokploy

---

To narrow it down further: could you share what version you're running, whether you access the panel via IP or domain, and what docker service logs dokploy --tail 50 shows?

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[luixo]

A real person to the rescue.

1. Connect to your server via ssh
2. Find out your postgres container id: docker ps -qf "name=^dokploy-postgres"
3. Connect to it interactively: docker exec -it <id> /bin/bash
4. Inside of the container, connect to database: psql -U dokploy
5. Verify 2fa is enabled: select id, two_factor_enabled from "user";, witness something like this:

    id     | two_factor_enabled
-----------+--------------------
 <user_id> | t
(1 row)

"t" means "true" here
6. Update the table to turn 2fa off for this user: UPDATE "user" SET two_factor_enabled = false where id = '<user_id>'
7. Remove the dangling 2fa: DELETE FROM two_factor WHERE user_id = '<user_id>'

Should work now!

[ZaLiTHkA]

thank you @luixo, you're an absolute legend..

I had already updated the user table to set two_factor_enabled to false, but apparently I missed the step for removing the entry from the two_factor table. not sure how though, because I'm pretty sure I did do that, it's listed both in Dosu's response and in the guide I found before even opening this query.

anyway, after removing that, I restarted my VPS just in case, and I've just managed to sign in to the Dokploy web UI again.