{"record":{"id":"91138c2a1b7dedc1","repo":"medusajs/medusa","slug":"verification-code-does-not-belong-to-provider-d","errorCode":null,"errorMessage":"Verification code does not belong to provider \"${data.code_provider}\"","messagePattern":"Verification code does not belong to provider \"(.+?)\"","errorType":"exception","errorClass":"MedusaError","httpStatus":403,"severity":"error","filePath":"packages/modules/auth/src/providers/verification/token.ts","lineNumber":129,"sourceCode":"          token_hash: hashVerificationToken(data.code),\n        },\n      },\n      {},\n      sharedContext\n    )\n\n    if (!verification || verification.verified_at) {\n      throw new MedusaError(\n        MedusaError.Types.NOT_ALLOWED,\n        \"Verification code is invalid or already used\"\n      )\n    }\n\n    if (\n      data.code_provider &&\n      data.code_provider !== verification.code_provider\n    ) {\n      throw new MedusaError(\n        MedusaError.Types.NOT_ALLOWED,\n        `Verification code does not belong to provider \"${data.code_provider}\"`\n      )\n    }\n\n    const expiresAt =\n      new Date(verification.requested_at).getTime() + this.getTokenTtlMs_()\n\n    if (expiresAt <= Date.now()) {\n      throw new MedusaError(\n        MedusaError.Types.NOT_ALLOWED,\n        \"Verification code has expired\"\n      )\n    }\n\n    return await this.authVerificationService_.update(\n      {\n        id: verification.id,","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/providers/verification/token.ts#L111-L147","documentation":"The verification record was found by code, but its code_provider differs from the code_provider passed in the confirm payload. The provider scopes codes so a code issued for one flow (e.g. emailpass reset) can't confirm another.","triggerScenarios":"confirm({ code, code_provider: 'emailpass' }) where the stored verification's code_provider is something else (e.g. 'google' or another provider's flow).","commonSituations":"Hardcoding the wrong provider name in a custom confirm route; mixing codes between auth providers in multi-provider setups; typos in the provider string.","solutions":["Pass the same code_provider that was used when the code was generated (the provider that started verification)","Or omit code_provider to skip the provider check if your flow doesn't need scoping"],"exampleFix":"// before\nawait confirmAuthVerification({ code, code_provider: 'google' })\n// after\nawait confirmAuthVerification({ code, code_provider: 'emailpass' }) // matches issuing provider","handlingStrategy":"validation","validationCode":"if (data.code_provider && data.code_provider !== issuingProvider) throw new Error('provider mismatch')\n// or omit code_provider when not needed","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Thread the issuing provider through the whole verification flow","Don't hardcode provider names in confirm routes"],"tags":["auth","verification","provider-mismatch"],"backgroundTag":"provider-mismatch","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}