60318: Factor is unverified

Twilio returns this error with HTTP 403 when your request uses a Verify Factor whose status is unverified. Verify Factors must be verified before you use them in authentication flows. Unverified Factors can also be deleted and become unverifiable 1 to 24 hours after creation.

• You created a new TOTP Factor, but you did not complete the first-time verification step by sending a valid authPayload, so the Factor remained unverified.
• You created a Push Factor, but the device enrollment flow did not complete the factor verification step in the Verify Push SDK flow.
• You attempted to create or use a Challenge with a factorSid that points to a Factor that has not been verified yet.
• The Factor stayed unverified long enough to age out, which can leave it deleted or no longer verifiable.

• Fetch the Factor and confirm its status is verified before you use it for authentication.
• For TOTP, update the Factor with the latest authPayload from the authenticator app. If the code is correct, the Factor status changes to verified.
• For Push, complete the Verify Push factor verification step in your device enrollment flow before you create a Challenge.
• If the Factor is still unverified or has already aged out, create a new Factor and complete verification as soon as you create it.
• If you manage multiple Factors for the same user, make sure your request uses the correct factorSid for the verified Factor you intend to challenge.

• Factor Resource
• Verify TOTP Quickstart
• Verify Push & Silent Device Approval Overview