Based on the information in your question and the provided knowledge sources, there are a few key points to consider: 1. Invalid OTP Code: The error message "The provided authentication code is invalid, please try again." is a standard Ory Kratos error when the OTP (TOTP) code entered does not match what Kratos expects. This can be caused by several factors, such as time drift between the server and the authenticator app, or an incorrect secret being used to generate the code. Make sure your server and client device clocks are synchronized, and that the TOTP secret is correctly set up in both places. This error is documented in the Ory Kratos UI messages reference ["The provided authentication code is invalid, please try again. (4000008)"](https://www.ory.sh/docs/kratos/concepts/ui-messages#the-provided-authentication-code-is-invalid-please-try-again-4000008). 2. OAuth 2.0 Login Challenge Error: The error message "Unable to get OAuth 2.0 Login Challenge" and the 404 status code suggest that Kratos is unable to retrieve the login challenge from Hydra. This can happen if: - The

login_challenge

parameter is missing or invalid in the request. - There is a misconfiguration in the integration between Kratos and Hydra, such as incorrect URLs or network connectivity issues. - The Hydra database is in an inconsistent state, possibly due to incomplete or failed login/consent flows. In some cases, users have reported that deleting problematic sessions from the Hydra database resolves the issue, but this is more of a workaround than a solution [Kratos return null for login_challenge when previous OIDC for the same client not complete](https://github.com/ory/kratos/issues/4024). 3. Configuration Mismatch: One user reported that having a mismatch between the Kratos binary version and the configuration file version (e.g., using a config for v1.0.0 with a v1.2.0 binary) caused similar issues. Updating the configuration file to match the running Kratos version resolved the problem [Kratos return null for login_challenge when previous OIDC for the same client not complete](https://github.com/ory/kratos/issues/4024). Recommendations: - Double-check that the TOTP secret is correctly set and that both server and client clocks are in sync. - Ensure that the

login_challenge

parameter is present and valid in your login/registration flows. - Verify that your Kratos and Hydra configuration files match the versions of the binaries you are running. - Check network connectivity between Kratos and Hydra, and ensure the

oauth2_provider.url

in Kratos points to the correct Hydra admin endpoint. - If you have previously interrupted OIDC flows, consider cleaning up old sessions in the Hydra database, but be cautious with this in production environments. If after these checks the issue persists, please provide more details about your flow and configuration for further troubleshooting.

New message text here

New message text here

New message text here

The error message you are seeing:

TypeError: fetch failed [cause]: [AggregateError: ] { code: 'ECONNREFUSED' }

indicates that your application is unable to connect to the HYDRA_ADMIN_URL endpoint when trying to accept the consent request. The

ECONNREFUSED

error means that the network connection to the specified address and port was refused—most likely because the service is not running, is not reachable, or the URL/port is incorrect. Based on the knowledge sources, here are the most likely causes and solutions: 1. Hydra Admin Endpoint Not Running or Not Reachable Make sure that the Ory Hydra admin API is running and accessible at the URL specified in

process.env.HYDRA_ADMIN_URL

. By default, the admin API runs on port 4445. If you are running in Docker, ensure that the network configuration allows your app to reach the Hydra container on this port [Deploy Login & Consent App](https://www.ory.sh/docs/hydra/self-hosted/configure-deploy#deploy-login--consent-app). 2. Incorrect HYDRA_ADMIN_URL Double-check the value of

HYDRA_ADMIN_URL

. It should point to the admin endpoint, e.g.,

<http://hydra:4445>

if using Docker Compose with a service named

hydra

, or

<http://localhost:4445>

if running locally. If you use

localhost

inside a Docker container, it refers to the container itself, not your host or another container [Deploy Login & Consent App](https://www.ory.sh/docs/hydra/self-hosted/configure-deploy#deploy-login--consent-app). 3. Network Configuration If you are running your consent app and Hydra in separate containers, ensure they are on the same Docker network. Use the service name (e.g.,

hydra

) as the hostname in

HYDRA_ADMIN_URL

 [Deploy Login & Consent App](https://www.ory.sh/docs/hydra/self-hosted/configure-deploy#deploy-login--consent-app). 4. Hydra Not Started or Crashed Check that the Hydra service is up and running. You can verify this by running

docker ps

and checking the logs with

docker logs <hydra-container-name>

. Summary of what to check: - Is Hydra running and healthy? - Is the admin API accessible at the URL and port you are using? - Are your network and Docker Compose settings correct? - Are you using the correct hostname for inter-container communication? If you need to see a working example, refer to the [reference implementation](https://github.com/ory/hydra-login-consent-node) and the [official deployment guide](https://www.ory.sh/docs/hydra/self-hosted/configure-deploy#deploy-login--consent-app). If you continue to have issues, please provide your

HYDRA_ADMIN_URL

value and details about your deployment setup.

The redirect to

localhost:4445

(the default Hydra admin port) typically happens if the public and admin URLs are not correctly set in your Hydra configuration. According to the knowledge sources, you should configure the URLs in your

hydra.yml

(or environment variables) under the

urls.self

section:

yaml urls:   self:     issuer: <http://127.0.0.1:4444>     public: <http://127.0.0.1:4444>     admin: <http://127.0.0.1:4445>   consent: <http://127.0.0.1:3000/consent>   login: <http://127.0.0.1:3000/login>   logout: <http://127.0.0.1:3000/logout>

If these are not set correctly, Hydra may fall back to

localhost:4445

for admin operations, which can cause unwanted redirects. This is also mentioned in a user report, where the fallback to

localhost

occurred if

SERVE_ADMIN_HOST

was not set, or if the configuration was missing or incorrect [Error: connect ECONNREFUSED 127.0.0.1:4445](https://github.com/ory/hydra/issues/3335). Action steps: - Check your

hydra.yml

or environment variables for the

urls.self.admin

and

urls.self.public

settings. - Make sure they point to the correct externally accessible URLs for your deployment. - If you are using Docker Compose, ensure that the hostnames match your service names and network setup. If you are still being redirected to

localhost:4445

, review your configuration for any missing or incorrect URL settings as described above.