Codes are typically valid for 3-5min even if the display only shows 1min. This is to avoid issues with time discrepancy on client/server, and doesn't really mak

Codes are typically valid for 3-5min even if the display only shows 1min. This is to avoid issues with time discrepancy on client/server, and doesn't really make a big difference in terms of security, feel free to try it out. So, to fix your issue, just use the current code even if it seems expired. As a side note, it's important to enforce that each code can only be used once. Authy (the server-side service) does that, but many "roll your own" TOTP solutions don't verify this.