Login fails with "api request returned error: 400" when using 2FA for email

[dvaerum]

Problem

rbw login fails with a generic 400 error when connecting to the official Bitwarden server (bitwarden.com).

Bitwarden seems to have changed the 2FA workflow, I am guessing that it is a bug/issue which only get triggered the 1st time one tries to login, but I could be wrong here.

When I try to login to Bitwarden and get the error rbw login: failed to log in to bitwarden instance: api request returned error: 400, I also receive an email with my 2FA code from Bitwarden, so something is working.

If you need anything else is need, please tell me and I will do what I can

Environment

• rbw 1.15.0
• Official Bitwarden server (bitwarden.com)
• Email 2FA enabled
• NixOS

Agent log (RUST_LOG=trace)

env RUST_LOG=trace rbw-agent --no-daemonize
[2026-02-21T15:27:31Z DEBUG rbw_agent::sock] listening on socket /run/user/1000/rbw/socket
[2026-02-21T15:27:31Z TRACE arboard::platform::linux] Successfully initialized the Wayland data control clipboard.
[2026-02-21T15:27:31Z INFO  ssh_agent_lib::agent] Listening; socket = UnixListener { fd: FileDesc(OwnedFd { fd: 11 }), local: "/run/user/1000/rbw/ssh-agent-socket" (pathname) }
qt.qpa.services: Failed to register with host portal QDBusError("org.freedesktop.portal.Error.Failed", "Could not register app ID: App info not found for 'org.gnupg.pinentry-qt'")
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::pool] checkout waiting for idle connection: ("https", identity.bitwarden.com)
[2026-02-21T15:27:47Z DEBUG reqwest::connect] starting new connection: https://identity.bitwarden.com/
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::connect::http] Http::connect; scheme=Some("https"), host=Some("identity.bitwarden.com"), port=None
[2026-02-21T15:27:47Z DEBUG hyper_util::client::legacy::connect::http] connecting to [2a04:4e42:4d::347]:443
[2026-02-21T15:27:47Z DEBUG hyper_util::client::legacy::connect::http] connected to [2a04:4e42:4d::347]:443
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::client] http1 handshake complete, spawning background dispatcher task
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::client] waiting for connection to be ready
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::client] connection is ready
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::pool] checkout dropped for ("https", identity.bitwarden.com)
[2026-02-21T15:27:47Z TRACE reqwest::retry] shouldn't retry!
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::pool] pool dropped, dropping pooled (("https", identity.bitwarden.com))
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::pool] checkout waiting for idle connection: ("https", identity.bitwarden.com)
[2026-02-21T15:27:47Z DEBUG reqwest::connect] starting new connection: https://identity.bitwarden.com/
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::connect::http] Http::connect; scheme=Some("https"), host=Some("identity.bitwarden.com"), port=None
[2026-02-21T15:27:47Z DEBUG hyper_util::client::legacy::connect::http] connecting to [2a04:4e42:4d::347]:443
[2026-02-21T15:27:47Z DEBUG hyper_util::client::legacy::connect::http] connected to [2a04:4e42:4d::347]:443
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::client] http1 handshake complete, spawning background dispatcher task
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::client] waiting for connection to be ready
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::client] connection is ready
[2026-02-21T15:27:47Z TRACE hyper_util::client::legacy::pool] checkout dropped for ("https", identity.bitwarden.com)
[2026-02-21T15:27:50Z TRACE reqwest::retry] shouldn't retry!
[2026-02-21T15:27:50Z WARN  rbw::api] unexpected error received during login: ConnectErrorRes { error: "device_error", error_description: Some("New device verification required"), error_model: Some(ConnectErrorResErrorModel { message: "new device verification required" }), two_factor_providers: None, sso_email_2fa_session_token: None }
[2026-02-21T15:27:50Z TRACE hyper_util::client::legacy::pool] put; add idle connection for ("https", identity.bitwarden.com)
[2026-02-21T15:27:50Z DEBUG hyper_util::client::legacy::pool] pooling idle connection for ("https", identity.bitwarden.com)
[2026-02-21T15:27:50Z TRACE hyper_util::client::legacy::pool] pool closed, canceling idle interval
[2026-02-21T15:27:50Z WARN  rbw_agent::sock] failed to log in to bitwarden instance: api request returned error: 400

[bileamScheuvens]

Note to users of the official Bitwarden server (at bitwarden.com): The official server has a tendency to detect command line traffic as bot traffic (see this issue for details). In order to use rbw with the official Bitwarden server, you will need to first run rbw register to register each device using rbw with the Bitwarden server. This will prompt you for your personal API key which you can find using the instructions here

Relevant?

[musjj]

rbw register is also suffering the same issue.

[xanri44934776]

facing the same issue as well

[orrp]

@bileamScheuvens in trying your solution, I'm encountering the following usability issue: rbw register requires inputting client_id and client_secret in succession. On GNOME, you cannot switch focus (alt+tab) when a password prompt is focused. Effectively this means the user has to choose whether to have the client_id or the client_secret in their clipboard, and manually type in the other one, reading it from a separate screen.

This is a more minor issue than the issue in this thread. Do you think it's worth opening an issue for, or is there an obvious workaround I'm missing here? (I'll just install a multi clipboard for now)

[myNicole98]

I'm also unable to login anymore with 2FA, in my case I use a generic TOTP code. It happens with bitwarden and vaultwarden too

rbw login
Log in to vaultwarden.myserver.com
Master Password: 
Enter the 6 digit verification code from your authenticator app.
Authenticator App: 
rbw login: failed to log in to bitwarden instance: error making api request: error sending request for url (https://vaultwarden.myserver.com/identity/accounts/prelogin): client error (SendRequest): connection error: peer closed connection without sending TLS close_notify: https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eof

[jibsaram]

Chiming in to say that I'm seeing the same issue whilst trying to register rbw (with api.vaultwarden.eu). Checking the logs I'm seeing the following, which made me wonder if this is perhaps the real culprit others here are running into as-well:

WARN  rbw::api] unexpected error received during login: ConnectErrorRes { error: "version_header_missing", error_description: Some("No client version header found, required to prevent encryption errors. Please confirm your client is supplying the header: \"Bitwarden-Client-Version\""), error_model: Some(ConnectErrorResErrorModel { message: "No client version header found, required to prevent encryption errors. Please confirm your client is supplying the header: \"Bitwarden-Client-Version\"" }), two_factor_providers: None }

I wonder if Bitwarden has recently made this a required field?

This may already be fixed via #328, though I could be wrong.

[deade1e]

Hello,

the Bitwarden-Client-Version sometimes is set to "2024.12.0" (https://github.com/doy/rbw/blob/main/src/api.rs#L1162C50-L1162C59) and sometimes is taken from the Cargo declared version (https://github.com/doy/rbw/blob/main/src/api.rs#L1162C50-L1162C59).

The register() and login() methods use the value set from Cargo, and maybe that's triggering the check on the backend.

As I said on another thread (#338) I am refactoring the code (https://github.com/deade1e/rbw/tree/refactor), so if anyone is available I would be happy to test my version with these patches.

You can also fork the original repo and modify it yourself, as it should be an easy task.

Just try to put "2024.12.0" as the Bitwarden-Client-Version header in the reqwest_client() function.

EDIT: That's exactly what #328 is doing.