medusajs/medusa · error · MedusaError

Invalid MFA verification code

Error message

Invalid MFA verification code

What it means

A method and code were supplied to disable MFA under the 'challenge' policy, but the provider's verify() rejected the code. The disable operation is aborted with NOT_ALLOWED.

Source

Thrown at packages/modules/auth/src/services/auth-module.ts:550

    ) {
      if (!data.method || !data.code) {
        throw new MedusaError(
          MedusaError.Types.INVALID_DATA,
          "MFA verification code is required to disable MFA"
        )
      }

      const valid = await this.authMfaProviderService_.verify(
        data.method,
        {
          auth_identity_id: factor.auth_identity_id,
          code: data.code,
        },
        sharedContext
      )

      if (!valid) {
        throw new MedusaError(
          MedusaError.Types.NOT_ALLOWED,
          "Invalid MFA verification code"
        )
      }
    }

    const disabledFactor = await this.authMfaFactorService_.update(
      {
        id: data.id,
        status: "disabled",
      },
      sharedContext
    )

    return await this.serializeMfaFactor_(disabledFactor)
  }

  @InjectManager()

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Enter the current code from the authenticator and retry
2. Ensure method matches the factor's provider
3. Sync authenticator device time if failures persist

try { await disableAuthMfa(...) } catch (e) { if (e.message === 'Invalid MFA verification code') { /* re-prompt for current code */ } throw e }

When it happens

Trigger: disableAuthMfa({ id, method: 'totp', code }) where the code fails TOTP verification — wrong code, expired window, or device clock drift.

Common situations: User typos the code; old code from a previous 30s TOTP window; method passed doesn't match the factor's provider, routing verification incorrectly.

Related errors

• An active TOTP factor already exists for this auth identity
• Only TOTP MFA factors can be verified with this method
• Disabled MFA factors cannot be verified
• Invalid TOTP code
• Invalid MFA challenge code

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/4f5eb8fe8af40606. Report an issue: GitHub.