medusajs/medusa · error · Error

MFA provider "${method}" does not support setup

Error message

MFA provider "${method}" does not support setup

What it means

Plain Error thrown by the MFA provider facade when start() is called for a provider registration that does not implement the MFA provider interface (isAuthMfaProvider_ check failed). The provider resolved in the container is not an auth-MFA-capable provider.

Source

Thrown at packages/modules/auth/src/services/mfa-provider.ts:81

    method: string,
    data: { auth_identity_id: string; code: string },
    sharedContext?: Context
  ): Promise<boolean> {
    return await this.retrieveProviderRegistration(method).verify(
      data,
      sharedContext
    )
  }

  async start(
    method: string,
    data: AuthTypes.AuthMfaStartDTO,
    sharedContext?: Context
  ): Promise<AuthTypes.AuthMfaStartResponse> {
    const provider = this.retrieveProviderRegistration(method)

    if (!this.isAuthMfaProvider_(provider)) {
      throw new Error(`MFA provider "${method}" does not support setup`)
    }

    return await provider.start(data, sharedContext)
  }

  async verifySetup(
    method: string,
    data: AuthTypes.AuthMfaVerifyDTO,
    sharedContext?: Context
  ): Promise<AuthTypes.AuthMfaDTO> {
    const provider = this.retrieveProviderRegistration(method)

    if (!this.isAuthMfaProvider_(provider)) {
      throw new Error(
        `MFA provider "${method}" does not support setup verification`
      )
    }

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Ensure the provider registration declares MFA support (implements the auth MFA provider interface, isAuthMfaProvider_ true)
2. Use a provider that is actually an MFA provider (e.g. totp-based providers) for setup
3. Fix the provider key string so it resolves to the intended MFA provider

Example fix

// before
await authMfaProviderService.start('emailpass', data)
// after
await authMfaProviderService.start('totp', data) // an MFA-capable provider

null

const isMfaProviderKey = (key: string): boolean => ['totp', 'otp'].includes(key)

try { await authMfaProviderService.start(method, data) } catch (e) { if (/does not support setup/.test(e.message)) fixProviderRegistration(); throw e }

When it happens

Trigger: Calling authMfaProviderService.start('someProvider', data) where 'someProvider' resolves to a non-MFA provider or a plain auth provider; provider key registered without the isMfa flag; typo resolving to a default/legacy registration.

Common situations: Custom providers that forgot to set/declare MFA capability; referencing an auth verification provider in an MFA context; plugin providers not built against the MFA interface.

Related errors

• MFA provider "${method}" does not support setup verification
• MFA method "${method}" does not support recovery code genera
• Unable to retrieve the payment provider with id: ${providerI
• INVALID_DATA
• NOT_ALLOWED

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/f4e499236988e65f. Report an issue: GitHub.