REST API WriteOfflineTokens: cannot proceed because of bad server response: 403

Question

With FortiAuthenticator we have correctly installed everything for MFA with Windows. Login works properly, but the offline token is not working.

We have enabled everything according to the guide, and everything appears to be configured correctly, but in the log there is a 403 Forbidden error on the REST API call

I am attaching the log.

Could that be the reason why the offline token is not available? What could the issue be?

Thanks to anyone who can help me.

2026-02-11 10:47:05,149 [8900| 28|DEBUG] RestAPI: GetOfflineTokens queued asynchronously

2026-02-11 10:47:05,165 [6592|14024|INFO ] : Credential::FetchEmergencyToken: Sending EmergencyTokenRequest to service

2026-02-11 10:47:05,165 [8900| 17|DEBUG] FAC_Agent.Service.Impl: Processing EmergencyTokenRequest for domain: xx, username: xx, UPN: xx

2026-02-11 10:47:05,180 [8900| 36|ERROR] TwoFactorAuthenticator: WriteOfflineTokens: cannot proceed because of bad server response: 403

...

2026-02-11 10:47:05,227 [8900| 36|DEBUG] RestAPI: Calling (SERVER_CONFIG)
2026-02-11 10:47:05,227 [8900| 36|ERROR] RestAPI: Failed to get configuration from server: 403 Forbidden
2026-02-11 10:47:05,243 [8900| 35|ERROR] RestAPI: An exception occurred during ReadHTTPResponseAsync: System.IO.IOException: ---> System.Net.Sockets.SocketException:
in System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)
in System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)
in System.Net.FixedSizeReader.ReadPacket(Byte[] buffer, Int32 offset, Int32 count)
in System.Net.Security._SslStream.StartFrameHeader(Byte[] buffer, Int32 offset, Int32 count, AsyncProtocolRequest asyncRequest)
in System.Net.Security._SslStream.StartReading(Byte[] buffer, Int32 offset, Int32 count, AsyncProtocolRequest asyncRequest)
in System.Net.Security._SslStream.ProcessRead(Byte[] buffer, Int32 offset, Int32 count, AsyncProtocolRequest asyncRequest)
in System.Net.Security.SslStream.Read(Byte[] buffer, Int32 offset, Int32 count)
in FAC_Agent.RestAPI.RestAPIBase.ReadHTTPResponse(SslStream stream, DateTime sentUTC, UserObj user, Int32 count_in, Byte[] bytes_in)
in FAC_Agent.RestAPI.RestAPIBase.ReadHTTPResponseAsync(SslHelper sslHelper, DateTime sentUTC, UserObj user)

tbarua · Answer

Hi lozivi,

It is difficult to point out due to the missing logs. However, you can test the following;
-Delete all the offline token files on the installation folder
-or Open the FAC agent, select the simulation tab, down at the bottom select 'All' in the 'Delete Offline Token', then click the green go button.
To re-download, select the domain, enter the Username\password\OTP, then click the green go button.

- Additionally, if you have restriced host , then test with allowing all host under FAC > System > Administration > System Access > Allow all hosts/domain

Sign up

Login with SSO

Login to the community

Login with SSO