{"record":{"id":"ff6387ae9eb47c3a","repo":"medusajs/medusa","slug":"email-not-verified-cannot-proceed-with-authentica-ff6387","errorCode":null,"errorMessage":"Email not verified, cannot proceed with authentication","messagePattern":"Email not verified, cannot proceed with authentication","errorType":"exception","errorClass":"MedusaError","httpStatus":400,"severity":"error","filePath":"packages/modules/providers/auth-google/src/services/google.ts","lineNumber":200,"sourceCode":"    try {\n      const decoded = await verifyJwt(idToken, this.getSigningKey_, {\n        algorithms: [\"RS256\"],\n        audience: this.config_.clientId,\n        issuer: GOOGLE_ISSUERS,\n      })\n      if (!decoded || typeof decoded === \"string\") {\n        throw new Error(\"Invalid id_token\")\n      }\n      payload = decoded\n    } catch (err) {\n      throw new MedusaError(\n        MedusaError.Types.UNAUTHORIZED,\n        `Could not verify Google id_token: ${err.message}`\n      )\n    }\n\n    if (!payload.email_verified) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"Email not verified, cannot proceed with authentication\"\n      )\n    }\n\n    if (!payload.sub) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"id_token is missing 'sub' claim\"\n      )\n    }\n\n    const entity_id = payload.sub\n    const userMetadata = {\n      name: payload.name,\n      email: payload.email,\n      picture: payload.picture,\n      given_name: payload.given_name,","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/providers/auth-google/src/services/google.ts#L182-L218","documentation":"After verifying the id_token, the provider requires the `email_verified` claim to be true before proceeding. Google can issue tokens for unverified emails, and Medusa refuses to authenticate them.","triggerScenarios":"A Google account whose email is not verified returns an id_token with `email_verified: false`, causing verify_ to throw INVALID_DATA.","commonSituations":"Newly created Google accounts, accounts with pending email changes, or Workspace domains with unusual verification states. Rare for normal consumer accounts.","solutions":["Verify the email on the Google account, then retry sign-in","If it persists for a Workspace domain, check the domain's email verification settings","Do not bypass: instead surface a 'verify your email' message in the storefront UI"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await provider.validateCallback(query) } catch (e) { if (/Email not verified/.test(e.message)) res.redirect('/login?error=email_not_verified') else throw e }","preventionTips":["Show a clear 'verify your Google email' message in the storefront","Don't attempt to bypass the check; it protects identity integrity"],"tags":["google","oauth","email-verification","id-token"],"backgroundTag":"oauth-email-not-verified","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}