medusajs/medusa · error · MedusaError

MFA challenge with id "${id}" was not found

Error message

MFA challenge with id "${id}" was not found

What it means

Thrown when retrieving an MFA challenge by id from the cache and nothing is stored under that key — the challenge never existed, expired from cache, or the cache was flushed.

Source

Thrown at packages/modules/auth/src/services/auth-module.ts:1039

    if (policy !== "challenge" && policy !== "session") {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        'MFA disable policy must be either "challenge" or "session"'
      )
    }

    return policy
  }

  protected async retrieveMfaChallenge_(
    id: string
  ): Promise<AuthTypes.AuthMfaChallengeDTO> {
    const challenge = await this.getCache_().get<AuthTypes.AuthMfaChallengeDTO>(
      this.getMfaChallengeCacheKey_(id)
    )

    if (!challenge) {
      throw new MedusaError(
        MedusaError.Types.NOT_FOUND,
        `MFA challenge with id "${id}" was not found`
      )
    }

    return {
      ...challenge,
      expires_at: new Date(challenge.expires_at),
      completed_at: challenge.completed_at
        ? new Date(challenge.completed_at)
        : null,
    }
  }

  protected async setMfaChallenge_(
    challenge: AuthTypes.AuthMfaChallengeDTO,
    ttlSeconds?: number
  ): Promise<void> {

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Use a shared cache (e.g. Redis) for the MFA challenge cache in multi-instance deployments
2. Catch NOT_FOUND and restart the MFA flow to create a new challenge
3. Verify the challenge id round-trips unmodified between create and verify

Example fix

// before
const challenge = await authModule.retrieveAuthMfaChallenge(challengeId)
// after
let challenge
try { challenge = await authModule.retrieveAuthMfaChallenge(challengeId) }
catch (e) { if (e.type === 'not_found') return createNewMfaChallenge() ; throw e }

null

null

try { return await authModule.retrieveAuthMfaChallenge(id) } catch (e) { if (e.type === 'not_found') return createNewMfaChallenge(); throw e }

When it happens

Trigger: Calling retrieveAuthMfaChallenge with an unknown/typo'd id; cache TTL elapsed or Redis restarted; multi-instance deployment where the challenge was created on a node with a different cache.

Common situations: In-memory cache with multiple app instances (challenge on instance A, verify hits instance B); cache eviction; long user idle time beyond TTL.

Related errors

• Auth identity does not have any enabled MFA methods
• MFA factor with id "${id}" was not found
• MFA challenge has already been completed
• MFA challenge has expired
• MFA challenge does not support method "${method}"

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/f151461e15729981. Report an issue: GitHub.