medusajs/medusa · error · MedusaError

MFA factor with id "${id}" was not found

Error message

MFA factor with id "${id}" was not found

What it means

Thrown by AuthModuleService.retrieveAuthMfa when no MFA factor matches the given selector (id string or selector object). It is a NOT_FOUND MedusaError, meaning the caller referenced an MFA factor that does not exist (or was already deleted) in the auth module.

Source

Thrown at packages/modules/auth/src/services/auth-module.ts:591

  ): Promise<AuthTypes.AuthMfaDTO> {
    const filters =
      typeof selector === "string"
        ? { id: [selector] }
        : {
            id: [selector.id],
            auth_identity_id: selector.auth_identity_id,
          }

    const [factor] = await this.authMfaFactorService_.list(
      filters,
      config,
      sharedContext
    )

    if (!factor) {
      const id = typeof selector === "string" ? selector : selector.id

      throw new MedusaError(
        MedusaError.Types.NOT_FOUND,
        `MFA factor with id "${id}" was not found`
      )
    }

    return await this.serializeMfaFactor_(factor)
  }

  @InjectManager()
  async listAuthMfa(
    filters: AuthTypes.FilterableAuthMfaProps = {},
    config: FindConfig<AuthTypes.AuthMfaDTO> = {},
    @MedusaContext() sharedContext: Context = {}
  ): Promise<AuthTypes.AuthMfaDTO[]> {
    const factors = await this.authMfaFactorService_.list(
      filters,
      config,
      sharedContext

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Verify the factor id exists first with listAuthMfaFactors({ auth_identity_id }) before retrieving
2. Catch MedusaError with type NOT_FOUND and prompt the user to re-enroll MFA
3. Ensure you are not reusing ids from a previous database/seed

Example fix

// before
const factor = await authModule.retrieveAuthMfa(factorId)
// after
const factors = await authModule.listAuthMfaFactors({ auth_identity_id: identityId })
const factor = factors.find((f) => f.id === factorId)
if (!factor) throw new Error('Factor no longer enrolled; re-enroll MFA')

const factors = await authModule.listAuthMfaFactors({ auth_identity_id: identityId })
const exists = factors.some((f) => f.id === factorId)
if (!exists) return reenrollMfa()

const isMfaFactorId = (id: string): boolean => /^mfactor_/.test(id)

try { return await authModule.retrieveAuthMfa(factorId) } catch (e) { if (e.type === 'not_found') return reenrollMfa(); throw e }

When it happens

Trigger: Calling authModuleService.retrieveAuthMfa('mfactor_123') or with a selector object whose id does not exist; calling after the factor was removed via removeAuthMfaFactor; passing an id belonging to a different auth identity.

Common situations: Stale factor id persisted in client/UI state after re-registering MFA; deleting and recreating factors during testing; race where another session removed the factor.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Recovery code count must be between 1 and 50
• Recovery code is invalid or already used
• MFA challenge has already been completed
• MFA challenge has expired
• MFA challenge with id "${id}" was not found

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/eeeab95fd48b75c1. Report an issue: GitHub.