medusajs/medusa · error · Error

MFA method "${method}" does not support recovery code genera

Error message

MFA method "${method}" does not support recovery code generation

What it means

Plain Error from generateCodes(): the resolved provider for the given method does not implement the recovery-code provider interface (isRecoveryCodeProvider_ false), so it cannot generate recovery codes.

Source

Thrown at packages/modules/auth/src/services/mfa-provider.ts:111

    if (!this.isAuthMfaProvider_(provider)) {
      throw new Error(
        `MFA provider "${method}" does not support setup verification`
      )
    }

    return await provider.verifySetup(data, sharedContext)
  }

  async generateCodes(
    method: string,
    data: { auth_identity_id: string; count: number },
    sharedContext?: Context
  ): Promise<string[]> {
    const provider = this.retrieveProviderRegistration(method)

    if (!this.isRecoveryCodeProvider_(provider)) {
      throw new Error(
        `MFA method "${method}" does not support recovery code generation`
      )
    }

    return await provider.generateCodes(data, sharedContext)
  }

  protected isAuthMfaProvider_(
    provider: IAuthMfaProvider
  ): provider is AuthMfaProvider {
    return "start" in provider && "verifySetup" in provider
  }

  protected isRecoveryCodeProvider_(
    provider: IAuthMfaProvider
  ): provider is RecoveryCodeAuthMfaProvider {
    return "generateCodes" in provider
  }

View on GitHub (pinned to 5e06e544a2)

Solutions

Use a provider that implements recovery-code generation, or omit recovery codes for that method
Implement generateCodes on the custom provider and mark it a recovery-code provider
Check the provider package version supports recovery codes

Example fix

// before
const codes = await authMfaProviderService.generateCodes('custom-mfa', { auth_identity_id, count })
// after
const codes = providerSupportsRecoveryCodes('custom-mfa')
  ? await authMfaProviderService.generateCodes('custom-mfa', { auth_identity_id, count })
  : []

Defensive patterns

Strategy: type-guard

Validate before calling

null

Type guard

const supportsRecoveryCodes = (method: string): boolean => ['totp'].includes(method)

Try / catch

try { return await authMfaProviderService.generateCodes(method, data) } catch (e) { if (/does not support recovery code/.test(e.message)) return []; throw e }

Prevention

Only offer recovery-code generation for providers that implement it
Implement generateCodes on custom providers

When it happens

Trigger: Calling generateCodes with a method whose provider supports MFA but not recovery-code generation (missing generateCodes implementation); wrong method key; provider plugin version predating recovery-code support.

Common situations: Custom MFA providers that implemented start/verify but not generateCodes; upgrading expectations without upgrading the provider package.

Related errors

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/ebda718b17629076. Report an issue: GitHub.