{"record":{"id":"94bdd5eb873f9eea","repo":"medusajs/medusa","slug":"mfa-provider-method-does-not-support-setup-ve","errorCode":null,"errorMessage":"MFA provider \"${method}\" does not support setup verification","messagePattern":"MFA provider \"(.+?)\" does not support setup verification","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/modules/auth/src/services/mfa-provider.ts","lineNumber":95,"sourceCode":"  ): Promise<AuthTypes.AuthMfaStartResponse> {\n    const provider = this.retrieveProviderRegistration(method)\n\n    if (!this.isAuthMfaProvider_(provider)) {\n      throw new Error(`MFA provider \"${method}\" does not support setup`)\n    }\n\n    return await provider.start(data, sharedContext)\n  }\n\n  async verifySetup(\n    method: string,\n    data: AuthTypes.AuthMfaVerifyDTO,\n    sharedContext?: Context\n  ): Promise<AuthTypes.AuthMfaDTO> {\n    const provider = this.retrieveProviderRegistration(method)\n\n    if (!this.isAuthMfaProvider_(provider)) {\n      throw new Error(\n        `MFA provider \"${method}\" does not support setup verification`\n      )\n    }\n\n    return await provider.verifySetup(data, sharedContext)\n  }\n\n  async generateCodes(\n    method: string,\n    data: { auth_identity_id: string; count: number },\n    sharedContext?: Context\n  ): Promise<string[]> {\n    const provider = this.retrieveProviderRegistration(method)\n\n    if (!this.isRecoveryCodeProvider_(provider)) {\n      throw new Error(\n        `MFA method \"${method}\" does not support recovery code generation`\n      )","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/services/mfa-provider.ts#L77-L113","documentation":"Same facade guard as 577 but for verifySetup(): the resolved provider registration does not implement the MFA provider interface, so setup verification is unsupported. Thrown as a plain Error before delegating to the provider.","triggerScenarios":"Calling verifySetup on a provider key that resolves to a non-MFA provider; using an auth-only (verification) provider key in the MFA setup verification step; stale registration after provider refactor.","commonSituations":"Custom providers missing MFA interface implementation; wrong provider key constant used in the setup-verify call path.","solutions":["Pass the same MFA-capable provider key used for start()","Update the custom provider to implement verifySetup and declare MFA capability","Verify the provider registration loaded correctly (container resolution)"],"exampleFix":"// before\nawait authMfaProviderService.verifySetup('emailpass', data)\n// after\nawait authMfaProviderService.verifySetup('totp', data)","handlingStrategy":"type-guard","validationCode":"null","typeGuard":"const isMfaProviderKey = (key: string): boolean => ['totp', 'otp'].includes(key)","tryCatchPattern":"try { await authMfaProviderService.verifySetup(method, data) } catch (e) { if (/does not support setup verification/.test(e.message)) fixProviderRegistration(); throw e }","preventionTips":["Use the same MFA provider key as the start step","Ensure custom providers implement verifySetup"],"tags":["mfa","provider","configuration"],"backgroundTag":"provider-not-supported","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}