Nearly same Problem at Android-App: Login using username and password results in "Caught exception of type TypeError" before asking for 2FA.
Android-App 50574-r-2026-03-20; Android 15 (05.01.2026).

I'm hitting the same issue. I think this might be related to ApiAuthManagerHelper::formatAuthenticationResponse() not handling a null $res->message. OATHAuth's recent commit (5dc1b42) started calling newUI() without a message, but the API helper still passes it to formatMessage(Message $message) on line 221, causing the TypeError. A null check there could fix it.

I'm seeing this API response from the action=clientlogin POST call:

{
  "error": {
    "code": "internal_api_error_TypeError",
    "info": "[96a98f64-eb54-47e4-bc6f-b7df26447f75] Caught exception of type TypeError",
    "errorclass": "TypeError"
  },
  "servedby": "mw-api-ext.eqiad.main-55487b8484-dt77f"
}

Fix from T422027 covered formatFields but this is the same issue in formatAuthenticationResponse, I can submit a similar patch if it would be helpful.

Testing locally in mw-docker, I was able to reproduce this issue using some python that I wrote which mimics the action=clientlogin walkthrough, and this step T422027#11779730, from the related bug. Based upon the solution in the related bug, this seems like a low-risk fix which got things working for me locally (I was able to use a test 2fa TOTP app to log in via action=clientlogin):

--- a/includes/Api/ApiAuthManagerHelper.php
+++ b/includes/Api/ApiAuthManagerHelper.php
@@ -218,6 +218,9 @@ class ApiAuthManagerHelper {
                        $res->status === AuthenticationResponse::UI ||
                        $res->status === AuthenticationResponse::RESTART
                ) {
+                       if ( !$res->message ) {
+                               $res->message = new RawMessage( '' );
+                       }
                        $this->formatMessage( $ret, 'message', $res->message );
                        $ret['messagecode'] = ApiMessage::create( $res->message )->getApiCode();
                }

If this seems reasonable, at least for now, we could push this through gerrit and get it deployed soon.

Change #1268273 had a related patch set uploaded (by SBassett; author: SBassett):

[mediawiki/core@master] Check for null value within $res->message

https://gerrit.wikimedia.org/r/1268273

Change #1268273 merged by jenkins-bot:

[mediawiki/core@master] Check if $res->message is null within ApiAuthManagerHelper

https://gerrit.wikimedia.org/r/1268273

Change #1268281 had a related patch set uploaded (by SBassett; author: SBassett):

[mediawiki/core@wmf/1.46.0-wmf.22] Check if $res->message is null within ApiAuthManagerHelper

https://gerrit.wikimedia.org/r/1268281

Change #1268281 merged by jenkins-bot:

[mediawiki/core@wmf/1.46.0-wmf.22] Check if $res->message is null within ApiAuthManagerHelper

https://gerrit.wikimedia.org/r/1268281

Mentioned in SAL (#wikimedia-operations) [2026-04-06T22:12:16Z] <sbassett@deploy1003> Started scap sync-world: Backport for [[gerrit:1268281|Check if $res->message is null within ApiAuthManagerHelper (T422320)]]

Mentioned in SAL (#wikimedia-operations) [2026-04-06T22:13:55Z] <sbassett@deploy1003> sbassett: Backport for [[gerrit:1268281|Check if $res->message is null within ApiAuthManagerHelper (T422320)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-04-06T22:18:34Z] <sbassett@deploy1003> Finished scap sync-world: Backport for [[gerrit:1268281|Check if $res->message is null within ApiAuthManagerHelper (T422320)]] (duration: 06m 18s)

Can any Mobile folks confirm this is working now? Testing against metawiki's action API, the action=clientlogin walkthrough works for me now.

Tested in iOS app. 2FA login flow works as expected.

Also tested in Android app. Works like expected using 2FA.