{"record":{"id":"2aaf164361098b3b","repo":"medusajs/medusa","slug":"unauthorized-2aaf16","errorCode":"UNAUTHORIZED","errorMessage":"The auth provider is not set while refreshing token","messagePattern":"The auth provider is not set while refreshing token","errorType":"exception","errorClass":"MedusaError","httpStatus":401,"severity":"error","filePath":"packages/medusa/src/api/auth/token/refresh/route.ts","lineNumber":25,"sourceCode":"  ContainerRegistrationKeys,\n  MedusaError,\n  Modules,\n} from \"@medusajs/framework/utils\"\nimport {\n  generateJwtTokenForAuthIdentity,\n  generateJwtTokenWithChecks,\n} from \"../../utils/generate-jwt-token\"\n\n// Retrieve a newly generated JWT token. Checking the existing token is valid already happens in the auth middleware.\n// Note: We probably want to disallow refreshes if the password changes, and require reauth.\nexport const POST = async (\n  req: AuthenticatedMedusaRequest,\n  res: MedusaResponse\n) => {\n  const service: IAuthModuleService = req.scope.resolve(Modules.AUTH)\n\n  if (!req.auth_context.auth_provider) {\n    throw new MedusaError(\n      MedusaError.Types.UNAUTHORIZED,\n      \"The auth provider is not set while refreshing token\"\n    )\n  }\n\n  /* A request would have the actor ID set on it only after it:\n    - Creates an actor after registration\n    - Passes MFA and other verifications\n  Once that is done we can safely just regenerate a token without performing any additional checks.\n\n  However, if the actor is not set we have to perform the MFA and verification checks - for the refresh\n  call we don't return verification/mfa required, but instead throw as the call to refresh the token is\n  not expected until mfa/verifications are completed.\n  */\n  if (req.auth_context.actor_id) {\n    const { http } = req.scope.resolve<ConfigModule>(\n      ContainerRegistrationKeys.CONFIG_MODULE\n    ).projectConfig","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/medusa/src/api/auth/token/refresh/route.ts#L7-L43","documentation":"Thrown by POST /auth/token/refresh when the request's auth context has no auth_provider. The refresh endpoint needs to know which provider authenticated the original token to re-run provider checks while minting the new JWT. Maps to HTTP 401 (UNAUTHORIZED).","triggerScenarios":"Calling /auth/token/refresh with a JWT that lacks the auth_provider claim — e.g. a custom-issued token, a malformed token, or an actor token minted by an older flow.","commonSituations":"Tokens signed by external services or with a different secret/claim layout; upgrading Medusa versions where refresh token claims changed; passing an opaque/refresh token instead of the expected JWT.","solutions":["Obtain a fresh token via the provider's authenticate route before refreshing","Ensure the JWT secret/config matches the one used to sign tokens","Check the token payload contains auth_provider; if minting tokens yourself, include the claim","Upgrade both client and server to matching Medusa versions"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const claims = parseJwt(token)\nif (!claims.auth_provider) {\n  token = await reauthenticateWithProvider()\n}","typeGuard":"function hasProviderClaim(c: Record<string, unknown>): c is { auth_provider: string } {\n  return typeof c.auth_provider === 'string' && c.auth_provider.length > 0\n}","tryCatchPattern":"catch (e) { if (e.type === 'unauthorized' && /auth provider is not set/.test(e.message)) reauthenticate() else throw e }","preventionTips":["Do not hand-mint tokens without standard auth claims","Keep JWT secret configuration consistent across environments"],"tags":["auth","jwt","token-refresh"],"backgroundTag":"jwt-token-invalid-claims","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}