One time passwords stop working

Nextcloud version (eg, 18.0.2): 18.0.8
Operating system and version (eg, Ubuntu 20.04): Debian 10.5
Apache or nginx version (eg, Apache 2.4.25): 2.4.38
PHP version (eg, 7.1): 7.3.19

The issue you are facing:
I’m using one time passwords to authenticate, I am configuring it in my clients as well. For example Davx5 on Android works once I create the app password, but stops working after several days. I start to see the following in the logs:

{"reqId":"JE4ZPOACJJ6JrXi2Alqb","level":0,"time":"2020-08-31T19:42:41+00:00","remoteAddr":"192.168.100.79","user":"--","app":"webdav","method":"PROPFIND","url":"/nc/remote.php/dav/calendars/mmm/cal/","message":{"Exception":"Sabre\\DAV\\Exception\\NotAuthenticated","Message":"No public access to this resource., Username or password was incorrect, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured, Username or password was incorrect","Code":0,"Trace":[{"function":"beforeMethod","class":"Sabre\\DAV\\Auth\\Plugin","type":"->","args":[{"absoluteUrl":"https://hostname/nc/remote.php/dav/calendars/mmm/cal/","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/home/var/www/nc18.0.8/3rdparty/sabre/event/lib/EventEmitterTrait.php","line":105,"function":"call_user_func_array","args":[[{"calRequireLogin":true,"__class__":"Sabre\\DAV\\Auth\\Plugin"},"beforeMethod"],[{"absoluteUrl":"https://hostname/nc/remote.php/dav/calendars/mmm/cal/","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"/home/var/www/nc18.0.8/3rdparty/sabre/dav/lib/DAV/Server.php","line":466,"function":"emit","class":"Sabre\\Event\\EventEmitter","type":"->","args":["beforeMethod",[{"absoluteUrl":"https://hostname/nc/remote.php/dav/calendars/mmm/cal/","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"/home/var/www/nc18.0.8/3rdparty/sabre/dav/lib/DAV/Server.php","line":254,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"absoluteUrl":"https://hostname/nc/remote.php/dav/calendars/mmm/cal/","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/home/var/www/nc18.0.8/apps/dav/lib/Server.php","line":319,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"/home/var/www/nc18.0.8/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\\DAV\\Server","type":"->","args":[]},{"file":"/home/var/www/nc18.0.8/remote.php","line":165,"args":["/home/var/www/nc18.0.8/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/home/var/www/nc18.0.8/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","Line":168,"CustomMessage":"--"},"userAgent":"DAVx5/3.3-gplay (2020/08/22; dav4jvm; okhttp/4.8.1) Android/10","version":"18.0.8.2"}

I get the same error when I try to run curl with this app password.

Is this the first time you’ve seen this error? (Y/N): N
I’ve seen this error with 18.0.6 as well.

Steps to replicate it:

  1. create app password and configure it in davx5 on Android
  2. verify that davx5 can synchronize correctly (calendar, contacts)
  3. wait several days until problem occurs

The output of your Nextcloud log in Admin > Logging:

PASTE HERE

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

PASTE HERE

The output of your Apache/nginx/system log in /var/log/____:

PASTE HERE