Find your Salesforce login error
| What you see | Likely cause | Who can fix it | Next step |
|---|---|---|---|
| Salesforce Authenticator approval never arrives | Notifications off, or a slow network | You | Allow notifications; type the app's six-digit code instead. Authenticator guide |
| New phone, old one lost or never backed up | Salesforce still expects the old app | Your admin, then you | Admin disconnects the app and issues a temporary code. Authenticator guide |
| "Invalid or expired verification code" | Broken Authenticator connection, or a phone clock out of sync | Your admin, or you | Admin disconnects so you can reconnect; fix the phone's time. Authenticator guide |
| Create a Passkey, with no other method offered | You have admin-level permissions; phishing-resistant MFA applies | You | Register a passkey or security key. Passkey guide |
| MFA done at your SSO provider, still asked for a passkey | The identity provider sends no MFA signal Salesforce accepts | Your admin and identity team | Send AMR or ACR values Salesforce recognizes. Passkey guide |
| Locked out after wrong passwords | The profile's maximum invalid attempts was reached | The clock, or your admin | Wait out the lockout (15 minutes by default) or ask for Unlock. Lockout guide |
| Locked out again every morning | An app keeps trying an old saved password | Your admin | Find the app in Login History and update or remove it. Lockout guide |
| "Restricted IP" | Your IP is outside the login IP ranges on your profile | Your admin | Admin adds your IP; the only admin opens a Support case. Lockout guide |
| Your user is frozen | The record was frozen to block logins | Your admin | Admin clicks Unfreeze on your user record. Lockout guide |
| You are the only admin and cannot get in | Nobody in the org can edit your user | Salesforce Support | Open a case with org ID and username; email changes need a C-level letter. Lockout guide |
| invalid_grant, redirect_uri_mismatch or "missing required code challenge" | OAuth configuration of an app or integration | Your admin or developer | Match the error string to its fix. OAuth errors guide |
| Verification code email or text never arrives | Spam filtering, a typo in the email, or a badly formatted mobile number | Your admin | Admin checks Identity Verification History and your user record. Salesforce Help |
| Password reset link already expired when you click it | An email link scanner such as Safelinks opened it first | Your admin | Admin can turn on "Don't immediately expire links in forgot password emails". Salesforce Help |
| Right password, sent back to the login page | A bookmark with extra text after the My Domain URL | You | Log in from the plain My Domain URL and update the bookmark. Salesforce Help |
The causes come from Salesforce's own pages, among them (Common MFA Troubleshooting for Sales and Service, Salesforce, published 15 Oct 2026), (Admin Guide: Resolve User Login Problems, Salesforce, published 2 Jul 2026) and (Resolve Passkey Login Issues in Salesforce, Salesforce, published 12 Oct 2026).
Who can fix a Salesforce login problem?
- Read the exact message. Take a screenshot of the login screen, or copy the error from the address bar if an app sent you there. The wording decides the owner.
- If the table says you, fix it on your device. Notifications, the phone's clock, a passkey, a clean bookmark.
- If it says your admin, send them the details below. Most of these fixes live on your user record in Setup.
- If you are the admin, ask a second admin. Temporary codes and disconnects need the Manage Multi-Factor Authentication in User Interface permission (Resolve MFA Access Issues for Your Users, Salesforce, read 16 Oct 2026).
- If there is no other admin, contact Salesforce Support with the org ID and the admin username. The lockout guide lists what Support can do and the letter it asks for.
- Once you are back in, register a second method so the next lost phone is a short call instead of a lockout.
What to send your Salesforce admin
- Your Salesforce username, which is not always your email address.
- The time you tried to log in, so they can find it in Login History.
- The exact message, or a screenshot of it.
- What changed: a new phone, a new laptop, a password change, a new network.
- Whether you log in through your company's SSO page or the Salesforce login page.
Login History keeps up to 20,000 login records from the past six months, with the status of each attempt and the IP it came from (Monitor Login History, Salesforce, read 16 Oct 2026), so those details let an admin find your attempt quickly.
When should you contact Salesforce Support?
When nobody in your org with admin access can act. Salesforce's own pages put the admin first and Support after: the Authenticator troubleshooting page says to contact your administrator and then Salesforce Customer Support (Salesforce Authenticator Troubleshooting, Salesforce, read 16 Oct 2026), and for an IP restriction Support cannot help without an administrator involved (Unable to Log In to Salesforce Due to "Restricted IP" Error, Salesforce, published 11 Oct 2026). Only users with Salesforce licenses can create cases, so a locked-out user can ask a colleague with access to log one (How to Get Support from Salesforce Help, Salesforce, published 4 Sep 2026).
For businesses on Salesforce
No second Salesforce admin? Set one up before the next lockout.
SSO login problems
If you log in through Okta, Microsoft Entra ID or another identity provider, two Salesforce rules explain most surprises. After a sandbox refresh, SAML SSO is turned off in the sandbox until an admin turns it back on, and MFA methods do not carry over (Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins, Salesforce, published 14 Oct 2026). And Salesforce recommends keeping some admins able to log in directly with username, password and MFA, so an outage at the identity provider does not lock everyone out (FAQs for Single Sign-On, Salesforce, read 16 Oct 2026). If your identity provider completes MFA but Salesforce still asks for a passkey, the passkey guide covers the signals it needs.
The guides in this set
- Salesforce Authenticator not working or on a new phone: Moving the app to a new phone, and the admin's temporary code and disconnect steps.
- Salesforce passkey requirement: what admins have to do: Who is covered, the enforcement dates by release group, which methods pass, and the setup steps.
- Locked out of Salesforce? What Salesforce Support can do: Every kind of lockout, who can fix each, the C-level letter, and how to avoid needing it.
- What Salesforce invalid_grant and redirect_uri_mismatch mean: Each OAuth error string with its cause and fix, for admins and developers.
- Codex found a Salesforce 2GP bug and filed the ticket: Our case study of "missing required code challenge" during 2GP namespace linking.
If your company has no second Salesforce admin
We are an independent Salesforce consultancy, separate from Salesforce Support. We cannot unlock a user, reset MFA or change an admin's email from outside your org; only an admin inside it, or Salesforce, can. What we do is the work that keeps a business from depending on one login: a second admin, a break-glass account, passkeys enrolled for everyone who needs them, and SSO and integrations that keep working through the next change. That is the admin work inside our Salesforce managed services.
Frequently asked questions
Why can't I log in to Salesforce?
The message on the login screen tells you which problem you have. The common ones are a lost or replaced MFA phone, the passkey requirement for admins, a password lockout after too many attempts, a login IP restriction, a frozen user, and an expired password reset link. Your Salesforce admin can resolve or walk you through each of them from Setup; Salesforce Support steps in when there is no other admin.
What does "contact your Salesforce administrator" mean?
Your company's Salesforce admin manages your user record: unlocking it, issuing a temporary verification code, disconnecting a lost MFA method or changing your login IP range. Salesforce's own troubleshooting pages send users to their admin first.
Can Salesforce Support unlock my account?
Support acts when nobody in your org can. If you are the only admin, Support can disconnect a lost passkey and take a case for an IP restriction, and it changes a sole admin's email after a signed letter from a C-level executive. For an IP restriction, Support cannot help a user without an administrator involved.
How do I reach Salesforce Support if I can't log in?
Salesforce Help suggests asking your admin or a colleague with access to log a case for you. Chat with Help Agent is listed for Standard, Premier and Signature customers, phone support for Premier and Signature, and for Standard customers on Severity 1 issues.
Do Salesforce admins have to use passkeys now?
Yes, for users with the System Administrator profile or the Modify All Data, View All Data, Customize Application or Author Apex permission. Salesforce began enforcing phishing-resistant MFA in production on 20 July 2026. Salesforce Authenticator no longer counts for those users.