TOTP is the only gate this process can see. A public hostname reached from a loopback proxy is not 403’d, because PHP cannot see the client. Use php-fpm (real client address) or set an IP allowlist / mTLS (docs/hosting.md).
This request is served by php -S (four workers). Prefer php-fpm for a TLS hostname (docs/hosting.md).
Log in
Enter the code from your authenticator app.
Phone gone? Use a one-time recovery code from setup.
