medusajs/medusa · error · MedusaError

Email not verified, cannot proceed with authentication

Error message

Email not verified, cannot proceed with authentication

What it means

After successfully validating the signature of the Medusa Cloud id_token, the provider requires the email_verified claim to be true. An unverified email halts authentication before an auth identity is created/updated.

Source

Thrown at packages/modules/auth/src/providers/medusa-cloud-auth.ts:217

    let payload: JwtPayload
    try {
      const decoded = await verifyJwt(idToken, this.getSigningKey_, {
        algorithms: ["RS256"],
        audience: this.config_.oauth_audience,
      })
      if (!decoded || typeof decoded === "string") {
        throw new Error("Invalid id_token")
      }
      payload = decoded
    } catch (err) {
      return {
        success: false,
        error: `Could not verify id_token: ${err.message}`,
      }
    }

    if (!payload.email_verified) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "Email not verified, cannot proceed with authentication"
      )
    }

    if (!payload.sub) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "id_token is missing 'sub' claim"
      )
    }

    const entity_id = payload.sub
    const userMetadata = {
      name: payload.name,
      email: payload.email,
      picture: payload.picture,
      given_name: payload.given_name,

View on GitHub (pinned to 5e06e544a2)

Solutions

Verify the email address in the Medusa Cloud / identity provider account, then retry login
If you control the IdP tenant, enable auto-verify for testing or verify the user manually

Defensive patterns

Strategy: fallback

Try / catch

try { await validateCallback(...) } catch (e) { if (e.message.includes('Email not verified')) { /* prompt user to verify email */ } throw e }

Prevention

Surface an actionable 'verify your email' message instead of a generic auth failure
Auto-verify emails in sandbox IdP tenants for testing

When it happens

Trigger: Authenticating via medusa-cloud where the user's email in the identity provider has not been confirmed yet — payload.email_verified is falsy in the decoded id_token.

Common situations: New signups that never clicked the IdP verification link; sandbox IdP tenants that don't auto-verify emails; changing the email on the Cloud account without re-verifying.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/93e14801ebe27deb. Report an issue: GitHub.