After a user successfully authenticates, the RSA Authentication Manager authentication activity log shows "Passcode Reuse" or "Bad Tokencode" errors for the same user within seconds — even though the user only authenticated once. The user is ultimately denied access.

 

 

When the authentication agent sends credentials to Authentication Manager, the server processes the request and returns an Authentication Success response. However, if the network does not deliver that response to the agent before the agent's retry timeout (default: 5 seconds), the agent retransmits the request. Authentication Manager treats this retransmission as a new authentication attempt using an already-used passcode — and denies it. This commonly happens when there is network latency or packet loss between the agent and the server, or when the Client Response Delay setting has been increased beyond the recommended value of 2 seconds, causing the agent to time out and retry while the server is still processing.

Step 1: Check the Client Response Delay setting in the Security Console.

Navigate to Setup > System Settings > Agents and locate the Client Response Delay field. Confirm the value is set to 2 (the default and recommended value).

 

ℹ️ NOTE: If this value has been increased above 6, the agent may time out and retransmit authentication requests before Authentication Manager has finished processing — producing the errors described in this article.

 

Step 2: If the Client Response Delay value is above 2, reset it to 2 and save the change.

 

Step 3: Take a packet capture on the authentication agent and on the RSA Authentication Manager server to confirm packets are being correctly sent and received.

 

⚠️ CAUTION: Coordinate with your network team before running packet captures in a production environment, as this may require elevated access or maintenance windows.

 

Step 4: Review the packet capture to identify dropped or delayed packets between the agent and Authentication Manager.

 

Step 5 — Verification: After correcting the Client Response Delay and resolving any identified network issues, ask the affected user to authenticate again. Confirm in Security Console > Reporting > Authentication Activity that only a single Authentication Method Success entry appears — with no subsequent Passcode Reuse or Bad Tokencode entries for the same session.