medusajs/medusa · error · MedusaError

Email not verified, cannot proceed with authentication

Error message

Email not verified, cannot proceed with authentication

What it means

After verifying the id_token, the provider requires the `email_verified` claim to be true before proceeding. Google can issue tokens for unverified emails, and Medusa refuses to authenticate them.

Source

Thrown at packages/modules/providers/auth-google/src/services/google.ts:200

    try {
      const decoded = await verifyJwt(idToken, this.getSigningKey_, {
        algorithms: ["RS256"],
        audience: this.config_.clientId,
        issuer: GOOGLE_ISSUERS,
      })
      if (!decoded || typeof decoded === "string") {
        throw new Error("Invalid id_token")
      }
      payload = decoded
    } catch (err) {
      throw new MedusaError(
        MedusaError.Types.UNAUTHORIZED,
        `Could not verify Google id_token: ${err.message}`
      )
    }

    if (!payload.email_verified) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "Email not verified, cannot proceed with authentication"
      )
    }

    if (!payload.sub) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "id_token is missing 'sub' claim"
      )
    }

    const entity_id = payload.sub
    const userMetadata = {
      name: payload.name,
      email: payload.email,
      picture: payload.picture,
      given_name: payload.given_name,

View on GitHub (pinned to 5e06e544a2)

Solutions

Verify the email on the Google account, then retry sign-in
If it persists for a Workspace domain, check the domain's email verification settings
Do not bypass: instead surface a 'verify your email' message in the storefront UI

Defensive patterns

Strategy: try-catch

Try / catch

try { await provider.validateCallback(query) } catch (e) { if (/Email not verified/.test(e.message)) res.redirect('/login?error=email_not_verified') else throw e }

Prevention

Show a clear 'verify your Google email' message in the storefront
Don't attempt to bypass the check; it protects identity integrity

When it happens

Trigger: A Google account whose email is not verified returns an id_token with `email_verified: false`, causing verify_ to throw INVALID_DATA.

Common situations: Newly created Google accounts, accounts with pending email changes, or Workspace domains with unusual verification states. Rare for normal consumer accounts.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/ff6387ae9eb47c3a. Report an issue: GitHub.