medusajs/medusa · error · MedusaError

INVALID_DATA

INVALID_DATA

Error message

MFA challenge is missing an auth identity

What it means

Thrown when verifying an MFA challenge whose auth_identity_id is empty. Every valid challenge must reference the auth identity it was issued for; a null id means the challenge record is malformed or was created without an authenticated context. Maps to HTTP 400 (INVALID_DATA).

Source

Thrown at packages/medusa/src/api/auth/mfa/challenges/[id]/verify/route.ts:32

/**
 * @since 2.15.3
 */
export const POST = async (
  req: AuthenticatedMedusaRequest<AuthMfaVerifyChallengeRequestType>,
  res: MedusaResponse
) => {
  const { id } = req.params
  const { method, code } = req.validatedBody

  const authService = req.scope.resolve<IAuthModuleService>(Modules.AUTH)
  const challenge = await authService.verifyAuthMfaChallenge({
    id,
    method,
    code,
  })

  if (!challenge.auth_identity_id) {
    throw new MedusaError(
      MedusaError.Types.INVALID_DATA,
      "MFA challenge is missing an auth identity"
    )
  }

  const authIdentity = await authService.retrieveAuthIdentity(
    challenge.auth_identity_id,
    { relations: ["provider_identities"] }
  )

  if (
    challenge.auth_provider &&
    !authIdentity.provider_identities?.some(
      (identity) => identity.provider === challenge.auth_provider
    )
  ) {
    throw new MedusaError(
      MedusaError.Types.INVALID_DATA,

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Delete/recreate the MFA challenge through the auth service API
2. Check for orphan challenge rows: SELECT * FROM auth_mfa_challenge WHERE auth_identity_id IS NULL
3. Start a fresh MFA challenge via the proper initiation endpoint
4. Verify you are on a current Medusa version where challenges always store auth_identity_id

catch (e) { if (e.type === 'invalid_data' && /missing an auth identity/.test(e.message)) restartMfaChallenge() else throw e }

When it happens

Trigger: POST /auth/mfa/challenges/:id/verify where the challenge row has no auth_identity_id (seeded manually, corrupted, or created by an older version).

Common situations: Data corruption or manual DB edits to auth_mfa_challenge; challenges created before an upgrade that added the identity link; custom scripts inserting challenges directly.

Related errors

• NOT_ALLOWED
• An active TOTP factor already exists for this auth identity
• Only TOTP MFA factors can be verified with this method
• Disabled MFA factors cannot be verified
• Invalid TOTP code

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/ab576cbe7e9b22aa. Report an issue: GitHub.