# Complete Apple Account Trusted-Device Approval

Canonical: https://figment.so/blog/apple-account-trusted-device-approval

When you connect an Apple Account through Figment, a hosted Mac signs in to iCloud for the first time. Apple treats any new device sign-in as an identity check and issues a two-factor challenge before the sign-in can complete. You need to approve it on a trusted device — an iPhone, iPad, Apple Watch, Apple Vision Pro, or Mac already signed in to that Apple Account — before the connection continues. This page explains what happens at each stage of that challenge and the exact step that clears each one.

## Why trusted-device approval appears

Apple's two-factor authentication requires your password **and** a six-digit verification code every time an account signs in on a new device ([Apple Support — Two-factor authentication for Apple Account](https://support.apple.com/en-us/102660)). A trusted device is any iPhone, iPad, Apple Watch, Apple Vision Pro, or Mac on which you have already signed in with two-factor authentication ([Apple Support — About trusted phone numbers and trusted devices](https://support.apple.com/en-us/122621)). The hosted Mac Figment uses to run your connection counts as a new device on its first sign-in. Apple issues the challenge; Figment surfaces it inside the connection setup screen.

There is no path that skips this step — that is intentional. The goal here is to clear the challenge cleanly and move on.

**Before you start Figment setup**, confirm that at least one of the following is true for the Apple Account you plan to connect:

- You have an iPhone, iPad, Apple Watch, Apple Vision Pro, or Mac signed in to that account with two-factor authentication turned on.
- A trusted phone number is registered on the account and the SIM is active.

If neither is true, add a trusted phone number at [appleid.apple.com](https://appleid.apple.com) before starting the Figment setup flow. The approval challenge appears during setup; there is no opportunity to add a factor mid-flow.

## Complete the standard approval

When the sign-in attempt reaches your trusted device, here is the sequence:

1. A notification appears on your trusted device (iPhone, iPad, Apple Watch, Apple Vision Pro, or Mac): **"[Your name] is trying to sign in."** It shows an approximate sign-in location.
2. Tap or click **Allow**.
3. A six-digit code appears on that screen.
4. Enter that code into the Figment setup prompt before the timeout expires.

The code is single-use. Once you enter it correctly, Apple registers the hosted Mac as a trusted device for your account. You will not need to repeat this for the same connection unless you sign out, the Mac is reprovisioned, or you reset your Apple Account password ([Apple Support](https://support.apple.com/en-us/102660)).

Enter the code promptly. If the timeout passes, request a fresh code — do not attempt to reuse an expired one.

## Get a code when no trusted device is nearby

If none of your trusted devices are reachable, Apple can deliver the code to your trusted phone number instead ([Apple Support — Get a verification code](https://support.apple.com/en-us/102606)).

During the approval prompt, select **"Didn't get a code?"** (the exact label may vary by OS version). Then choose:

- **Text message** — Apple sends the six-digit code to your registered number via SMS.
- **Phone call** — Apple calls the number and reads the code aloud.

Your phone number must already be registered as a trusted number on your Apple Account before this point. You cannot add a new number during an active sign-in challenge.

## Challenge-state guide

The table below maps every state the approval step can land in to the specific action that resolves it. None of these states require creating a new Figment connection or cancelling setup — unless noted.

| State | What you see | How to clear |
|---|---|---|
| **Allow notification waiting** | Notification on a trusted device | Tap Allow, enter the displayed six-digit code in the Figment setup prompt |
| **Code expired or rejected** | "Incorrect verification code" or prompt timeout | Do not reuse the old code — select "Didn't get a code?" to request a fresh one |
| **No trusted device reachable** | No notification received on any device | Switch to SMS or phone-call delivery to your registered trusted phone number |
| **SMS not received** | Waiting for text that hasn't arrived | Confirm the correct number is registered; select the phone-call option as an alternative |
| **Account temporarily locked** | "Account locked for security reasons" | Follow Apple's on-screen recovery link; this process may take a few days or longer ([Apple Support](https://support.apple.com/en-us/102606)) |

If you no longer have access to any registered factor, select **"Can't use [phone number]"** on the Apple sign-in screen to begin Apple's account recovery process. Do not start additional Figment connection attempts while that recovery is pending — doing so creates duplicate partial connections that must each be cleaned up.

## Figment connection status after approval

Figment tracks connection state individually per service. While the approval challenge is open, your connection shows **`needs_approval`**. The dashboard does not advance until Apple's challenge is successfully cleared.

After a correct code is accepted:

- Status moves from `needs_approval` to **`syncing`** as the Mac begins downloading iCloud data for each permitted service.
- Status reaches **`ready`** per service once sync completes. Depending on account size, this can take minutes to hours.
- If a service shows `needs_approval` again after the main sign-in completes, that service may require a separate permission grant on the Mac itself — see [Grant the Mac Permissions Your Connector Needs](/blog/mac-connector-permissions) for that next step.

If the status has not moved from `needs_approval` several minutes after you confirmed the code was accepted, the approval itself may have succeeded but a downstream Mac permission may be blocking the next step. Check Mac permissions before opening a new connection. Creating a second connection does not speed up a stalled first one; it creates a second `needs_approval` entry that also needs to be cleared.

If iMessage history appears incomplete once the connection reaches `ready`, that is a sync lag issue — not a sign-in problem. See [Fix Missing iMessage History on a Connected Mac](/blog/imessage-history-not-syncing).

---

Ready to begin? [Connect Apple Account](/apple-connect/developers) to start setup. Apple Connect is $29/month per active live connection; sandbox access is free.

For background on how your app receives scoped access to iCloud data after the account is connected, see [OAuth for iCloud: Connect Apple Data to Your App](/oauth-for-icloud).