{"record":{"id":"22dcae8c346fc6ed","repo":"medusajs/medusa","slug":"verification-code-is-required","errorCode":null,"errorMessage":"Verification code is required","messagePattern":"Verification code is required","errorType":"exception","errorClass":"MedusaError","httpStatus":400,"severity":"error","filePath":"packages/modules/auth/src/providers/verification/token.ts","lineNumber":102,"sourceCode":"          metadata: data.metadata ?? null,\n        },\n        sharedContext\n      )\n    }\n\n    return {\n      ...verification,\n      code: token,\n      expires_at: expiresAt,\n    }\n  }\n\n  async confirm(\n    data: AuthTypes.ConfirmAuthVerificationDTO,\n    sharedContext: Context = {}\n  ): Promise<AuthTypes.ConfirmAuthVerificationResponse> {\n    if (!data.code) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"Verification code is required\"\n      )\n    }\n\n    const [verification] = await this.authVerificationService_.list(\n      {\n        provider_metadata: {\n          token_hash: hashVerificationToken(data.code),\n        },\n      },\n      {},\n      sharedContext\n    )\n\n    if (!verification || verification.verified_at) {\n      throw new MedusaError(\n        MedusaError.Types.NOT_ALLOWED,","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/providers/verification/token.ts#L84-L120","documentation":"The token verification provider requires a code to confirm a verification request. Calling confirm() without data.code (empty/undefined) fails validation before any lookup.","triggerScenarios":"confirmAuthVerification({ verification_id }) with the code field missing or empty string — e.g. the user submitted the form without entering the emailed code.","commonSituations":"Frontend forms that allow empty submission; API consumers passing token instead of code field name.","solutions":["Ensure the confirm payload includes the non-empty code field","Add client-side required validation on the code input before calling the API"],"exampleFix":"// before\nawait authModuleService.confirmAuthVerification({ verification_id })\n// after\nawait authModuleService.confirmAuthVerification({\n  verification_id,\n  code: enteredCode.trim(),\n})","handlingStrategy":"validation","validationCode":"if (!data.code?.trim()) throw new Error('code required')\nawait authModuleService.confirmAuthVerification({ ...data, code: data.code.trim() })","typeGuard":"const hasCode = (d: { code?: string }) => typeof d.code === 'string' && d.code.trim().length > 0","tryCatchPattern":null,"preventionTips":["Make the code input required client-side","Trim whitespace before sending"],"tags":["auth","verification","validation"],"backgroundTag":"missing-required-field","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}