medusajs/medusa · error · MedusaError

Invalid MFA verification code

Error message

Invalid MFA verification code

What it means

A method and code were supplied to disable MFA under the 'challenge' policy, but the provider's verify() rejected the code. The disable operation is aborted with NOT_ALLOWED.

Solutions

1. Enter the current code from the authenticator and retry
2. Ensure method matches the factor's provider
3. Sync authenticator device time if failures persist

try { await disableAuthMfa(...) } catch (e) { if (e.message === 'Invalid MFA verification code') { /* re-prompt for current code */ } throw e }

When it happens

Trigger: disableAuthMfa({ id, method: 'totp', code }) where the code fails TOTP verification — wrong code, expired window, or device clock drift.

Common situations: User typos the code; old code from a previous 30s TOTP window; method passed doesn't match the factor's provider, routing verification incorrectly.

Related errors

• An active TOTP factor already exists for this auth identity
• Disabled MFA factors cannot be verified
• Invalid MFA challenge code
• Invalid TOTP code
• Only TOTP MFA factors can be verified with this method

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/4f5eb8fe8af40606. Report an issue: GitHub.

Appendix: source

Thrown at packages/modules/auth/src/services/auth-module.ts:550

    ) {
      if (!data.method || !data.code) {
        throw new MedusaError(
          MedusaError.Types.INVALID_DATA,
          "MFA verification code is required to disable MFA"
        )
      }

      const valid = await this.authMfaProviderService_.verify(
        data.method,
        {
          auth_identity_id: factor.auth_identity_id,
          code: data.code,
        },
        sharedContext
      )

      if (!valid) {
        throw new MedusaError(
          MedusaError.Types.NOT_ALLOWED,
          "Invalid MFA verification code"
        )
      }
    }

    const disabledFactor = await this.authMfaFactorService_.update(
      {
        id: data.id,
        status: "disabled",
      },
      sharedContext
    )

    return await this.serializeMfaFactor_(disabledFactor)
  }

  @InjectManager()

View on GitHub (pinned to 5e06e544a2)