{"record":{"id":"cae5c9ef3b1879e3","repo":"medusajs/medusa","slug":"invalid-mfa-challenge-code","errorCode":null,"errorMessage":"Invalid MFA challenge code","messagePattern":"Invalid MFA challenge code","errorType":"exception","errorClass":"MedusaError","httpStatus":403,"severity":"error","filePath":"packages/modules/auth/src/services/auth-module.ts","lineNumber":500,"sourceCode":"\n    const valid = await this.authMfaProviderService_.verify(\n      data.method,\n      {\n        auth_identity_id: challenge.auth_identity_id!,\n        code: data.code,\n      },\n      sharedContext\n    )\n\n    if (!valid) {\n      const attempts = challenge.attempts + 1\n\n      await this.setMfaChallenge_({\n        ...challenge,\n        attempts,\n      })\n\n      throw new MedusaError(\n        MedusaError.Types.NOT_ALLOWED,\n        attempts >= challenge.max_attempts\n          ? \"MFA challenge has too many failed attempts\"\n          : \"Invalid MFA challenge code\"\n      )\n    }\n\n    const completedChallenge: AuthTypes.AuthMfaChallengeDTO = {\n      ...challenge,\n      completed_at: new Date(),\n    }\n\n    await this.setMfaChallenge_(completedChallenge)\n\n    return completedChallenge\n  }\n\n  @InjectManager()","sourceCodeStart":482,"sourceCodeEnd":518,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/services/auth-module.ts#L482-L518","documentation":"The submitted code doesn't match the current MFA challenge code and the attempt count is still below max_attempts. The attempt counter is persisted, then this NOT_ALLOWED error is thrown — one more failure may tip into the lockout message.","triggerScenarios":"verifyAuthMfaChallenge with an incorrect or expired code while attempts < max_attempts.","commonSituations":"Typo in the code, code refreshed between display and entry, device clock drift for TOTP, or UI resubmitting an old code after regeneration.","solutions":["Have the user request/enter a fresh code and retry","Show remaining attempts in the UI so users are careful before lockout","Sync the authenticator device time"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await verifyAuthMfaChallenge(...) } catch (e) { if (e.message === 'Invalid MFA challenge code') { /* re-prompt for code */ } throw e }","preventionTips":["Re-prompt for a fresh code on failure instead of resubmitting the same one","Sync authenticator device time"],"tags":["auth","mfa","verification"],"backgroundTag":"mfa-challenge-code-invalid","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}