appwrite/appwrite · error · Appwrite\Extend\Exception

user_recovery_codes_already_exists

user_recovery_codes_already_exists

Error message

The current user already generated recovery codes and they can only be read once for security reasons.

What it means

Error "The current user already generated recovery codes and they can only be read once for security reasons." thrown in appwrite/appwrite.

Source

Thrown at src/Appwrite/Platform/Modules/Users/Http/Users/MFA/RecoveryCodes/Create.php:92

            ->param('userId', '', fn (Database $dbForProject) => new UID($dbForProject->getAdapter()->getMaxUIDLength()), 'User ID.', false, ['dbForProject'])
            ->inject('response')
            ->inject('dbForProject')
            ->inject('queueForEvents')
            ->callback($this->action(...));
    }

    public function action(string $userId, Response $response, Database $dbForProject, Event $queueForEvents): void
    {
        $user = $dbForProject->getDocument('users', $userId);

        if ($user->isEmpty()) {
            throw new Exception(Exception::USER_NOT_FOUND);
        }

        $mfaRecoveryCodes = $user->getAttribute('mfaRecoveryCodes', []);

        if (!empty($mfaRecoveryCodes)) {
            throw new Exception(Exception::USER_RECOVERY_CODES_ALREADY_EXISTS);
        }

        $mfaRecoveryCodes = Type::generateBackupCodes();
        $user->setAttribute('mfaRecoveryCodes', $mfaRecoveryCodes);
        $dbForProject->updateDocument('users', $user->getId(), new Document(['mfaRecoveryCodes' => $mfaRecoveryCodes]));

        $queueForEvents->setParam('userId', $user->getId());

        $document = new Document([
            'recoveryCodes' => $mfaRecoveryCodes
        ]);

        $response->dynamic($document, Response::MODEL_MFA_RECOVERY_CODES);
    }
}

View on GitHub (pinned to a1d520eea4)

Solutions

1. Regenerate recovery codes via the update recovery codes endpoint.
2. Recovery codes can only be viewed once; store them securely when generated.

When it happens

Trigger: Thrown at src/Appwrite/Platform/Modules/Users/Http/Users/MFA/RecoveryCodes/Create.php:92 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of appwrite/appwrite@a1d520eea4 (2026-08-18). Data as JSON: /api/errors/658e77d89b7ab5b2. Report an issue: GitHub.