medusajs/medusa · error · Error

MFA provider "${method}" does not support setup verification

Error message

MFA provider "${method}" does not support setup verification

What it means

Same facade guard as 577 but for verifySetup(): the resolved provider registration does not implement the MFA provider interface, so setup verification is unsupported. Thrown as a plain Error before delegating to the provider.

Source

Thrown at packages/modules/auth/src/services/mfa-provider.ts:95

  ): Promise<AuthTypes.AuthMfaStartResponse> {
    const provider = this.retrieveProviderRegistration(method)

    if (!this.isAuthMfaProvider_(provider)) {
      throw new Error(`MFA provider "${method}" does not support setup`)
    }

    return await provider.start(data, sharedContext)
  }

  async verifySetup(
    method: string,
    data: AuthTypes.AuthMfaVerifyDTO,
    sharedContext?: Context
  ): Promise<AuthTypes.AuthMfaDTO> {
    const provider = this.retrieveProviderRegistration(method)

    if (!this.isAuthMfaProvider_(provider)) {
      throw new Error(
        `MFA provider "${method}" does not support setup verification`
      )
    }

    return await provider.verifySetup(data, sharedContext)
  }

  async generateCodes(
    method: string,
    data: { auth_identity_id: string; count: number },
    sharedContext?: Context
  ): Promise<string[]> {
    const provider = this.retrieveProviderRegistration(method)

    if (!this.isRecoveryCodeProvider_(provider)) {
      throw new Error(
        `MFA method "${method}" does not support recovery code generation`
      )

View on GitHub (pinned to 5e06e544a2)

Solutions

Pass the same MFA-capable provider key used for start()
Update the custom provider to implement verifySetup and declare MFA capability
Verify the provider registration loaded correctly (container resolution)

Example fix

// before
await authMfaProviderService.verifySetup('emailpass', data)
// after
await authMfaProviderService.verifySetup('totp', data)

Defensive patterns

Strategy: type-guard

Validate before calling

null

Type guard

const isMfaProviderKey = (key: string): boolean => ['totp', 'otp'].includes(key)

Try / catch

try { await authMfaProviderService.verifySetup(method, data) } catch (e) { if (/does not support setup verification/.test(e.message)) fixProviderRegistration(); throw e }

Prevention

Use the same MFA provider key as the start step
Ensure custom providers implement verifySetup

When it happens

Trigger: Calling verifySetup on a provider key that resolves to a non-MFA provider; using an auth-only (verification) provider key in the MFA setup verification step; stale registration after provider refactor.

Common situations: Custom providers missing MFA interface implementation; wrong provider key constant used in the setup-verify call path.

Related errors

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/94bdd5eb873f9eea. Report an issue: GitHub.