{"record":{"id":"4f5eb8fe8af40606","repo":"medusajs/medusa","slug":"invalid-mfa-verification-code","errorCode":null,"errorMessage":"Invalid MFA verification code","messagePattern":"Invalid MFA verification code","errorType":"exception","errorClass":"MedusaError","httpStatus":403,"severity":"error","filePath":"packages/modules/auth/src/services/auth-module.ts","lineNumber":550,"sourceCode":"    ) {\n      if (!data.method || !data.code) {\n        throw new MedusaError(\n          MedusaError.Types.INVALID_DATA,\n          \"MFA verification code is required to disable MFA\"\n        )\n      }\n\n      const valid = await this.authMfaProviderService_.verify(\n        data.method,\n        {\n          auth_identity_id: factor.auth_identity_id,\n          code: data.code,\n        },\n        sharedContext\n      )\n\n      if (!valid) {\n        throw new MedusaError(\n          MedusaError.Types.NOT_ALLOWED,\n          \"Invalid MFA verification code\"\n        )\n      }\n    }\n\n    const disabledFactor = await this.authMfaFactorService_.update(\n      {\n        id: data.id,\n        status: \"disabled\",\n      },\n      sharedContext\n    )\n\n    return await this.serializeMfaFactor_(disabledFactor)\n  }\n\n  @InjectManager()","sourceCodeStart":532,"sourceCodeEnd":568,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/services/auth-module.ts#L532-L568","documentation":"A method and code were supplied to disable MFA under the 'challenge' policy, but the provider's verify() rejected the code. The disable operation is aborted with NOT_ALLOWED.","triggerScenarios":"disableAuthMfa({ id, method: 'totp', code }) where the code fails TOTP verification — wrong code, expired window, or device clock drift.","commonSituations":"User typos the code; old code from a previous 30s TOTP window; method passed doesn't match the factor's provider, routing verification incorrectly.","solutions":["Enter the current code from the authenticator and retry","Ensure method matches the factor's provider","Sync authenticator device time if failures persist"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await disableAuthMfa(...) } catch (e) { if (e.message === 'Invalid MFA verification code') { /* re-prompt for current code */ } throw e }","preventionTips":["Ensure method matches the factor's provider","Enter the current TOTP code; sync device time on repeated failures"],"tags":["auth","mfa","totp","verification"],"backgroundTag":"totp-code-invalid","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}