medusajs/medusa · error · MedusaError

Github does not support registration. Use method `authentica

Error message

Github does not support registration. Use method `authenticate` instead.

What it means

Github's OAuth flow only supports sign-in (authenticate), not sign-up. Calling `register` on the Github auth provider always throws a NOT_ALLOWED MedusaError by design, since Github has no registration endpoint to drive.

Source

Thrown at packages/modules/providers/auth-github/src/services/github.ts:52

    }

    if (!options.callbackUrl) {
      throw new Error("Github callbackUrl is required")
    }
  }

  constructor(
    { logger }: InjectedDependencies,
    options: GithubAuthProviderOptions
  ) {
    // @ts-ignore
    super(...arguments)
    this.config_ = options
    this.logger_ = logger
  }

  async register(_): Promise<AuthenticationResponse> {
    throw new MedusaError(
      MedusaError.Types.NOT_ALLOWED,
      "Github does not support registration. Use method `authenticate` instead."
    )
  }

  async authenticate(
    req: AuthenticationInput,
    authIdentityService: AuthIdentityProviderService
  ): Promise<AuthenticationResponse> {
    const query: Record<string, string> = req.query ?? {}
    const body: Record<string, string> = req.body ?? {}

    if (query.error) {
      return {
        success: false,
        error: `${query.error_description}, read more at: ${query.error_uri}`,
      }
    }

View on GitHub (pinned to 5e06e544a2)

Solutions

Route Github sign-ins through the authenticate endpoint (`/auth/github/github/authenticate`) instead of register
In shared UI, hide the register step for OAuth providers and call authenticate directly

Example fix

// before
await sdk.auth.register('customer', 'github', { /* ... */ })
// after
await sdk.auth.authenticate('customer', 'github', {}) // redirects to Github OAuth

Defensive patterns

Strategy: try-catch

Validate before calling

const supportsRegister = (providerId: string) => !['github', 'google'].includes(providerId)

Try / catch

try { await provider.register(payload) } catch (e) { if (e.type === 'not_allowed') { /* route to authenticate instead */ } else throw e }

Prevention

Branch sign-up vs sign-in by provider type in the client
Treat OAuth providers as authenticate-only by convention

When it happens

Trigger: A client POSTing to `/auth/customer/github/register` or calling `authProvider.register(...)` directly.

Common situations: Building a unified sign-up form that routes all providers through register, or assuming all auth providers implement both methods.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/b75d4464a64930b1. Report an issue: GitHub.