{"record":{"id":"d973d070a8e280d8","repo":"medusajs/medusa","slug":"invalid-totp-code","errorCode":null,"errorMessage":"Invalid TOTP code","messagePattern":"Invalid TOTP code","errorType":"exception","errorClass":"MedusaError","httpStatus":403,"severity":"error","filePath":"packages/modules/auth/src/providers/mfa/totp.ts","lineNumber":148,"sourceCode":"\n    if (factor.provider !== this.method) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"Only TOTP MFA factors can be verified with this method\"\n      )\n    }\n\n    if (factor.status === \"disabled\") {\n      throw new MedusaError(\n        MedusaError.Types.NOT_ALLOWED,\n        \"Disabled MFA factors cannot be verified\"\n      )\n    }\n\n    const valid = this.verifyCode_(factor, data.code)\n\n    if (!valid) {\n      throw new MedusaError(MedusaError.Types.NOT_ALLOWED, \"Invalid TOTP code\")\n    }\n\n    const verifiedFactor =\n      factor.status === \"pending\"\n        ? await this.authMfaFactorService_.update(\n            { id: factor.id, status: \"enabled\" },\n            sharedContext\n          )\n        : factor\n\n    return await this.serializeFactor_(verifiedFactor)\n  }\n\n  async verify(\n    data: { auth_identity_id: string; code: string },\n    sharedContext: Context = {}\n  ): Promise<boolean> {\n    const [factor] = await this.authMfaFactorService_.list(","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/providers/mfa/totp.ts#L130-L166","documentation":"The submitted TOTP code failed verification against the factor's stored secret (typically outside the allowed time window). This is a NOT_ALLOWED business rejection, not a crash.","triggerScenarios":"confirmAuthMfaFactor/verifySetup where data.code doesn't match the current time-based code from the secret — wrong device clock, typo, drifted server time, or old code already used.","commonSituations":"Phone clock out of sync; user scanning QR with the wrong account entry; server clock drift; replaying an old code after page refresh.","solutions":["Re-scan the QR / re-enter the current 6-digit code and retry","Sync the authenticator app's time (most apps have a 'time sync' setting) and verify server NTP","If it persists, delete the pending factor and restart TOTP setup"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await verifySetup(...) } catch (e) { if (e.message === 'Invalid TOTP code') { /* prompt re-entry, sync device time */ } throw e }","preventionTips":["Sync authenticator app time before setup","Limit verify attempts to avoid user lockout frustration"],"tags":["auth","mfa","totp"],"backgroundTag":"totp-code-invalid","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}