{"record":{"id":"f4e499236988e65f","repo":"medusajs/medusa","slug":"mfa-provider-method-does-not-support-setup","errorCode":null,"errorMessage":"MFA provider \"${method}\" does not support setup","messagePattern":"MFA provider \"(.+?)\" does not support setup","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/modules/auth/src/services/mfa-provider.ts","lineNumber":81,"sourceCode":"    method: string,\n    data: { auth_identity_id: string; code: string },\n    sharedContext?: Context\n  ): Promise<boolean> {\n    return await this.retrieveProviderRegistration(method).verify(\n      data,\n      sharedContext\n    )\n  }\n\n  async start(\n    method: string,\n    data: AuthTypes.AuthMfaStartDTO,\n    sharedContext?: Context\n  ): Promise<AuthTypes.AuthMfaStartResponse> {\n    const provider = this.retrieveProviderRegistration(method)\n\n    if (!this.isAuthMfaProvider_(provider)) {\n      throw new Error(`MFA provider \"${method}\" does not support setup`)\n    }\n\n    return await provider.start(data, sharedContext)\n  }\n\n  async verifySetup(\n    method: string,\n    data: AuthTypes.AuthMfaVerifyDTO,\n    sharedContext?: Context\n  ): Promise<AuthTypes.AuthMfaDTO> {\n    const provider = this.retrieveProviderRegistration(method)\n\n    if (!this.isAuthMfaProvider_(provider)) {\n      throw new Error(\n        `MFA provider \"${method}\" does not support setup verification`\n      )\n    }\n","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/services/mfa-provider.ts#L63-L99","documentation":"Plain Error thrown by the MFA provider facade when start() is called for a provider registration that does not implement the MFA provider interface (isAuthMfaProvider_ check failed). The provider resolved in the container is not an auth-MFA-capable provider.","triggerScenarios":"Calling authMfaProviderService.start('someProvider', data) where 'someProvider' resolves to a non-MFA provider or a plain auth provider; provider key registered without the isMfa flag; typo resolving to a default/legacy registration.","commonSituations":"Custom providers that forgot to set/declare MFA capability; referencing an auth verification provider in an MFA context; plugin providers not built against the MFA interface.","solutions":["Ensure the provider registration declares MFA support (implements the auth MFA provider interface, isAuthMfaProvider_ true)","Use a provider that is actually an MFA provider (e.g. totp-based providers) for setup","Fix the provider key string so it resolves to the intended MFA provider"],"exampleFix":"// before\nawait authMfaProviderService.start('emailpass', data)\n// after\nawait authMfaProviderService.start('totp', data) // an MFA-capable provider","handlingStrategy":"type-guard","validationCode":"null","typeGuard":"const isMfaProviderKey = (key: string): boolean => ['totp', 'otp'].includes(key)","tryCatchPattern":"try { await authMfaProviderService.start(method, data) } catch (e) { if (/does not support setup/.test(e.message)) fixProviderRegistration(); throw e }","preventionTips":["Register only MFA-capable providers for MFA setup","Keep a whitelist of valid MFA method keys"],"tags":["mfa","provider","configuration"],"backgroundTag":"provider-not-supported","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}