medusajs/medusa · error · MedusaError

Provider identity with entity_id ${data.entity_id} and provi

Error message

Provider identity with entity_id ${data.entity_id} and provider ${data.provider} not found

What it means

Thrown by createPasswordResetToken when no provider identity exists for the given entity_id + provider pair, so there is no account to reset a password for. Note it uses INVALID_DATA rather than NOT_FOUND.

Source

Thrown at packages/modules/auth/src/services/auth-module.ts:875

    data: AuthTypes.CreatePasswordResetTokenDTO,
    @MedusaContext() sharedContext: Context = {}
  ): Promise<AuthTypes.CreatePasswordResetTokenResponse> {
    return await this.createPasswordResetToken_(data, sharedContext)
  }

  @InjectTransactionManager()
  protected async createPasswordResetToken_(
    data: AuthTypes.CreatePasswordResetTokenDTO,
    @MedusaContext() sharedContext: Context = {}
  ): Promise<AuthTypes.CreatePasswordResetTokenResponse> {
    const [providerIdentity] = await this.providerIdentityService_.list(
      { provider: data.provider, entity_id: data.entity_id },
      {},
      sharedContext
    )

    if (!providerIdentity) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        `Provider identity with entity_id ${data.entity_id} and provider ${data.provider} not found`
      )
    }

    await this.invalidatePasswordResetTokens_(
      providerIdentity.id,
      sharedContext
    )

    const jti = crypto.randomUUID()
    const expiresAt = new Date(
      Date.now() + this.getPasswordResetTokenTtlMs_(data.ttl_seconds ?? 900)
    )

    await this.authPasswordResetTokenService_.create(
      {
        auth_identity_id: providerIdentity.auth_identity_id,

View on GitHub (pinned to 5e06e544a2)

Solutions

Verify the provider string matches the one used at registration
Handle this error as 'no account found' and show a neutral message to avoid account enumeration
Check the provider identity exists with listProviderIdentities before creating the token

Example fix

// before
await authModule.createPasswordResetToken({ entity_id: email, provider })
// after
const [identity] = await authModule.listProviderIdentities({ entity_id: email, provider })
if (!identity) return { ok: true } // neutral response
await authModule.createPasswordResetToken({ entity_id: email, provider })

Defensive patterns

Strategy: validation

Validate before calling

const [pi] = await authModule.listProviderIdentities({ entity_id: email, provider })
if (!pi) return neutralResponse()

Type guard

null

Try / catch

try { await authModule.createPasswordResetToken(input) } catch (e) { if (/not found/.test(e.message)) return neutralResponse(); throw e }

Prevention

Return neutral responses on reset requests to avoid account enumeration
Verify provider strings match registration

When it happens

Trigger: Calling createPasswordResetToken({ entity_id: 'unknown@x.com', provider: 'emailpass' }); provider typo (e.g. 'emailpass' vs 'password'); entity registered under a different auth provider.

Common situations: Password-reset request for an email that never signed up; users who authenticated via Google SSO requesting password reset; provider mismatch between signup and reset flows.

Related errors

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/fbb3b8d7e66bffe3. Report an issue: GitHub.