medusajs/medusa · error · MedusaError

Google does not support registration. Use method `authentica

Error message

Google does not support registration. Use method `authenticate` instead.

What it means

Google's OAuth flow only supports sign-in, not account creation. The `register` method on the Google auth provider always throws a NOT_ALLOWED MedusaError by design.

Source

Thrown at packages/modules/providers/auth-google/src/services/google.ts:87

  protected getSigningKey_ = (
    header: JwtHeader,
    callback: (err: Error | null, key?: string) => void
  ) => {
    if (!header.kid) {
      callback(new Error("ID token is missing 'kid' header"))
      return
    }
    this.jwks_.getSigningKey(header.kid, (err, key) => {
      if (err || !key) {
        callback(err ?? new Error("Unable to resolve signing key"))
        return
      }
      callback(null, key.getPublicKey())
    })
  }

  async register(_): Promise<AuthenticationResponse> {
    throw new MedusaError(
      MedusaError.Types.NOT_ALLOWED,
      "Google does not support registration. Use method `authenticate` instead."
    )
  }

  async authenticate(
    req: AuthenticationInput,
    authIdentityService: AuthIdentityProviderService
  ): Promise<AuthenticationResponse> {
    const query: Record<string, string> = req.query ?? {}
    const body: Record<string, string> = req.body ?? {}

    if (query.error) {
      return {
        success: false,
        error: `${query.error_description}, read more at: ${query.error_uri}`,
      }
    }

View on GitHub (pinned to 5e06e544a2)

Solutions

Use the authenticate flow for Google sign-ins
Skip the register step for OAuth providers in shared auth UI

Example fix

// before
await sdk.auth.register('customer', 'google', {})
// after
await sdk.auth.authenticate('customer', 'google', {})

Defensive patterns

Strategy: try-catch

Validate before calling

const supportsRegister = (providerId: string) => !['github', 'google'].includes(providerId)

Try / catch

try { await provider.register(payload) } catch (e) { if (e.type === 'not_allowed') { await provider.authenticate(payload) } else throw e }

Prevention

Route OAuth providers directly to authenticate
Hide 'register' buttons for social login providers

When it happens

Trigger: A client calling `/auth/customer/google/register` or `authProvider.register(...)` for the google provider.

Common situations: Generic sign-up flows that call register for every configured provider, or assuming the auth provider interface's register is implemented everywhere.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/b42fbf235be60255. Report an issue: GitHub.