{"record":{"id":"93e14801ebe27deb","repo":"medusajs/medusa","slug":"email-not-verified-cannot-proceed-with-authentica","errorCode":null,"errorMessage":"Email not verified, cannot proceed with authentication","messagePattern":"Email not verified, cannot proceed with authentication","errorType":"exception","errorClass":"MedusaError","httpStatus":400,"severity":"error","filePath":"packages/modules/auth/src/providers/medusa-cloud-auth.ts","lineNumber":217,"sourceCode":"    let payload: JwtPayload\n    try {\n      const decoded = await verifyJwt(idToken, this.getSigningKey_, {\n        algorithms: [\"RS256\"],\n        audience: this.config_.oauth_audience,\n      })\n      if (!decoded || typeof decoded === \"string\") {\n        throw new Error(\"Invalid id_token\")\n      }\n      payload = decoded\n    } catch (err) {\n      return {\n        success: false,\n        error: `Could not verify id_token: ${err.message}`,\n      }\n    }\n\n    if (!payload.email_verified) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"Email not verified, cannot proceed with authentication\"\n      )\n    }\n\n    if (!payload.sub) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"id_token is missing 'sub' claim\"\n      )\n    }\n\n    const entity_id = payload.sub\n    const userMetadata = {\n      name: payload.name,\n      email: payload.email,\n      picture: payload.picture,\n      given_name: payload.given_name,","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/providers/medusa-cloud-auth.ts#L199-L235","documentation":"After successfully validating the signature of the Medusa Cloud id_token, the provider requires the email_verified claim to be true. An unverified email halts authentication before an auth identity is created/updated.","triggerScenarios":"Authenticating via medusa-cloud where the user's email in the identity provider has not been confirmed yet — payload.email_verified is falsy in the decoded id_token.","commonSituations":"New signups that never clicked the IdP verification link; sandbox IdP tenants that don't auto-verify emails; changing the email on the Cloud account without re-verifying.","solutions":["Verify the email address in the Medusa Cloud / identity provider account, then retry login","If you control the IdP tenant, enable auto-verify for testing or verify the user manually"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await validateCallback(...) } catch (e) { if (e.message.includes('Email not verified')) { /* prompt user to verify email */ } throw e }","preventionTips":["Surface an actionable 'verify your email' message instead of a generic auth failure","Auto-verify emails in sandbox IdP tenants for testing"],"tags":["auth","medusa-cloud","email-verification"],"backgroundTag":"email-not-verified","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}