{"record":{"id":"b45dabee3a1922f4","repo":"medusajs/medusa","slug":"invalid-data-b45dab","errorCode":"INVALID_DATA","errorMessage":"Request already authenticated as a customer.","messagePattern":"Request already authenticated as a customer\\.","errorType":"exception","errorClass":"MedusaError","httpStatus":400,"severity":"warning","filePath":"packages/medusa/src/api/store/customers/route.ts","lineNumber":20,"sourceCode":"import {\n  AuthenticatedMedusaRequest,\n  MedusaResponse,\n} from \"@medusajs/framework/http\"\n\nimport { createCustomerAccountWorkflow } from \"@medusajs/core-flows\"\nimport { HttpTypes } from \"@medusajs/framework/types\"\nimport { refetchCustomer } from \"./helpers\"\n\nexport const POST = async (\n  req: AuthenticatedMedusaRequest<\n    HttpTypes.StoreCreateCustomer,\n    HttpTypes.SelectParams\n  >,\n  res: MedusaResponse<HttpTypes.StoreCustomerResponse>\n) => {\n  // If `actor_id` is present, the request carries authentication for an existing customer\n  if (req.auth_context.actor_id) {\n    throw new MedusaError(\n      MedusaError.Types.INVALID_DATA,\n      \"Request already authenticated as a customer.\"\n    )\n  }\n\n  const createCustomers = createCustomerAccountWorkflow(req.scope)\n  const customerData = req.validatedBody\n\n  const { result } = await createCustomers.run({\n    input: { customerData, authIdentityId: req.auth_context.auth_identity_id },\n  })\n\n  const customer = await refetchCustomer(\n    result.id,\n    req.scope,\n    req.queryConfig.fields\n  )\n","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/medusa/src/api/store/customers/route.ts#L2-L38","documentation":"Thrown by POST /store/customers (create customer account) when the request already carries customer authentication. Medusa rejects registering a new customer account on a request whose auth_context.actor_id is set, because the session/token already identifies a customer. It prevents accidentally creating a second account from an already-authenticated session.","triggerScenarios":"Calling POST /store/customers with a customer JWT/cookie still attached (e.g. logged-in user tries to sign up again, or the SDK reuses an authenticated fetch instance for registration).","commonSituations":"Frontend reuses the same SDK/fetch instance with automatic token attachment for both login and signup flows; testing signup while a session cookie persists; a user pressing 'register' while already logged in.","solutions":["Clear the customer token/session (logout or use an unauthenticated request) before calling POST /store/customers","Use a separate SDK/fetch instance without Authorization headers or session cookies for registration","In the UI, hide/disable the register flow when a customer is already authenticated and prompt logout first"],"exampleFix":"// before\nawait sdk.store.customer.create({ email, password }) // fails: request already authenticated\n\n// after\nawait sdk.auth.logout()\n// or use a fresh unauthenticated client\nawait sdk.store.customer.create({ email, password })","handlingStrategy":"validation","validationCode":"const { customer } = await sdk.auth.me().catch(() => null)\nif (customer) {\n  // already logged in: don't call POST /store/customers\n  redirect('/account')\n}","typeGuard":null,"tryCatchPattern":"try {\n  await sdk.store.customer.create({ email, password })\n} catch (e: any) {\n  if (e.type === 'invalid_data' && /already authenticated/.test(e.message)) {\n    await sdk.auth.logout()\n  } else throw e\n}","preventionTips":["Use an unauthenticated SDK instance for signup","Guard register UI behind logged-out state","Clear session cookies before registration calls"],"tags":["store-api","customer","registration","authentication"],"backgroundTag":"authenticated-request-rejected","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}