medusajs/medusa · warning · MedusaError

INVALID_DATA

INVALID_DATA

Error message

Request already authenticated as a customer.

What it means

Thrown by POST /store/customers (create customer account) when the request already carries customer authentication. Medusa rejects registering a new customer account on a request whose auth_context.actor_id is set, because the session/token already identifies a customer. It prevents accidentally creating a second account from an already-authenticated session.

Source

Thrown at packages/medusa/src/api/store/customers/route.ts:20

import {
  AuthenticatedMedusaRequest,
  MedusaResponse,
} from "@medusajs/framework/http"

import { createCustomerAccountWorkflow } from "@medusajs/core-flows"
import { HttpTypes } from "@medusajs/framework/types"
import { refetchCustomer } from "./helpers"

export const POST = async (
  req: AuthenticatedMedusaRequest<
    HttpTypes.StoreCreateCustomer,
    HttpTypes.SelectParams
  >,
  res: MedusaResponse<HttpTypes.StoreCustomerResponse>
) => {
  // If `actor_id` is present, the request carries authentication for an existing customer
  if (req.auth_context.actor_id) {
    throw new MedusaError(
      MedusaError.Types.INVALID_DATA,
      "Request already authenticated as a customer."
    )
  }

  const createCustomers = createCustomerAccountWorkflow(req.scope)
  const customerData = req.validatedBody

  const { result } = await createCustomers.run({
    input: { customerData, authIdentityId: req.auth_context.auth_identity_id },
  })

  const customer = await refetchCustomer(
    result.id,
    req.scope,
    req.queryConfig.fields
  )

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Clear the customer token/session (logout or use an unauthenticated request) before calling POST /store/customers
2. Use a separate SDK/fetch instance without Authorization headers or session cookies for registration
3. In the UI, hide/disable the register flow when a customer is already authenticated and prompt logout first

Example fix

// before
await sdk.store.customer.create({ email, password }) // fails: request already authenticated

// after
await sdk.auth.logout()
// or use a fresh unauthenticated client
await sdk.store.customer.create({ email, password })

const { customer } = await sdk.auth.me().catch(() => null)
if (customer) {
  // already logged in: don't call POST /store/customers
  redirect('/account')
}

try {
  await sdk.store.customer.create({ email, password })
} catch (e: any) {
  if (e.type === 'invalid_data' && /already authenticated/.test(e.message)) {
    await sdk.auth.logout()
  } else throw e
}

When it happens

Trigger: Calling POST /store/customers with a customer JWT/cookie still attached (e.g. logged-in user tries to sign up again, or the SDK reuses an authenticated fetch instance for registration).

Common situations: Frontend reuses the same SDK/fetch instance with automatic token attachment for both login and signup flows; testing signup while a session cookie persists; a user pressing 'register' while already logged in.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• NOT_FOUND
• invalid_data
• invalid_data
• Invalid step input
• Invalid step input

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/b45dabee3a1922f4. Report an issue: GitHub.