{"record":{"id":"2691b6d4a9011c0a","repo":"medusajs/medusa","slug":"oidc-does-not-support-registration-use-method-au","errorCode":null,"errorMessage":"OIDC does not support registration. Use method `authenticate` instead.","messagePattern":"OIDC does not support registration\\. Use method `authenticate` instead\\.","errorType":"exception","errorClass":"MedusaError","httpStatus":403,"severity":"error","filePath":"packages/modules/providers/auth-oidc/src/services/oidc.ts","lineNumber":76,"sourceCode":"  constructor(\n    { logger, cache }: InjectedDependencies,\n    options: OidcAuthProviderOptions\n  ) {\n    // @ts-ignore\n    super(...arguments)\n    this.config_ = options\n    this.logger_ = logger\n    this.engine_ = new OidcEngine(options, cache)\n  }\n\n  // The same OIDC package is registered once per IdP (okta, auth0, ...), so the\n  // display name is instance-specific.\n  get displayName() {\n    return this.config_.display_name ?? OidcAuthService.DISPLAY_NAME\n  }\n\n  async register(_: AuthenticationInput): Promise<AuthenticationResponse> {\n    throw new MedusaError(\n      MedusaError.Types.NOT_ALLOWED,\n      \"OIDC does not support registration. Use method `authenticate` instead.\"\n    )\n  }\n\n  async authenticate(\n    req: AuthenticationInput,\n    authIdentityService: AuthIdentityProviderService\n  ): Promise<AuthenticationResponse> {\n    const body: Record<string, string> = req.body ?? {}\n\n    const callbackUrl = body?.callback_url ?? this.config_.callback_url\n\n    // The allowlist is opt-in: when it isn't configured, validating the callback\n    // URL is left entirely to the identity provider.\n    const allowedCallbackUrls = this.config_.allowed_callback_urls\n\n    if (","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/providers/auth-oidc/src/services/oidc.ts#L58-L94","documentation":"The OIDC provider implements only the authenticate flow because user identity originates from the external identity provider; the register method is deliberately unsupported and throws NOT_ALLOWED with a pointer to authenticate.","triggerScenarios":"Anything invoking the provider's register() — e.g. a custom auth route calling authProvider.register(...), or framework code routing a /auth/customer/<strategy>/register request to an OIDC strategy.","commonSituations":"Frontend or route code that generically supports emailpass strategies and assumes register exists for all providers; a middleware that branches to register for first-time users; copy-pasted route handlers from a password-based strategy.","solutions":["Remove or guard the register call for OIDC strategies — use authenticate (i.e. GET /auth/customer/<provider-id> to start the redirect flow).","If you need signup semantics, they belong on the IdP side; after callback, complete registration with the auth callback/refresh-token routes as with other third-party strategies.","In shared route code, check the provider id/type before calling register."],"exampleFix":"// before\nconst result = await provider.register(credentials)\n// after\nconst result = await provider.authenticate(credentials) // OIDC has no registration; identity comes from the IdP","handlingStrategy":"type-guard","validationCode":"const canRegister = (p: { register?: unknown }): boolean =>\n  typeof p.register === \"function\" && p.constructor?.name !== \"OidcAuthService\"","typeGuard":"const supportsRegistration = (provider: unknown): provider is { register(input: AuthenticationInput): Promise<AuthenticationResponse> } =>\n  typeof (provider as { register?: unknown })?.register === \"function\" &&\n  !(provider instanceof (require(\"@medusajs/auth-oidc\").OidcAuthService ?? class {}))","tryCatchPattern":"try { await provider.register(input) } catch (e) { if (e instanceof MedusaError && e.type === MedusaError.Types.NOT_ALLOWED) { /* fall back to authenticate */ } throw e }","preventionTips":["Branch auth routes on the strategy type before calling register.","Treat OIDC/SSO strategies as authenticate-only by convention.","Keep third-party login flows on the framework's callback/refresh-token routes."],"tags":["oidc","unsupported-operation","registration","auth-provider"],"backgroundTag":"unsupported-operation","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}