medusajs/medusa · error · MedusaError

Recovery code count must be between 1 and 50

Error message

Recovery code count must be between 1 and 50

What it means

Thrown when generating MFA recovery codes with an explicit count that is not an integer between 1 and 50. The count defaults to data.count, then moduleOptions.mfa.recovery_code_count, then 10; whichever resolves must pass the integer range check.

Source

Thrown at packages/modules/auth/src/services/auth-module.ts:634

  @InjectManager()
  async generateAuthMfaRecoveryCodes(
    data: AuthTypes.GenerateAuthMfaRecoveryCodesDTO,
    @MedusaContext() sharedContext: Context = {}
  ): Promise<AuthTypes.GenerateAuthMfaRecoveryCodesResponse> {
    return await this.generateAuthMfaRecoveryCodes_(data, sharedContext)
  }

  @InjectTransactionManager()
  protected async generateAuthMfaRecoveryCodes_(
    data: AuthTypes.GenerateAuthMfaRecoveryCodesDTO,
    @MedusaContext() sharedContext: Context = {}
  ): Promise<AuthTypes.GenerateAuthMfaRecoveryCodesResponse> {
    const count =
      data.count ?? this.moduleOptions_.mfa?.recovery_code_count ?? 10

    if (!Number.isInteger(count) || count < 1 || count > 50) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "Recovery code count must be between 1 and 50"
      )
    }

    await this.authIdentityService_.retrieve(
      data.auth_identity_id,
      {},
      sharedContext
    )

    const codes = await this.authMfaProviderService_.generateCodes(
      "recovery_code",
      {
        auth_identity_id: data.auth_identity_id,
        count,
      },
      sharedContext

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Clamp/validate count to an integer 1-50 before calling
2. Fix the recovery_code_count value in medusa-config auth module options
3. If count is optional, omit it to use the default of 10

Example fix

// before
await authModule.generateAuthMfaRecoveryCodes({ auth_identity_id: id, count })
// after
const safeCount = Math.min(50, Math.max(1, Math.floor(Number(count) || 10)))
await authModule.generateAuthMfaRecoveryCodes({ auth_identity_id: id, count: safeCount })

const count = Math.min(50, Math.max(1, Math.floor(Number(rawCount) || 10)))

const isValidCount = (c: unknown): c is number => Number.isInteger(c) && c >= 1 && c <= 50

null

When it happens

Trigger: Calling generateAuthMfaRecoveryCodes({ count: 0 }), count: 51, count: 5.5, or a non-numeric value; configuring mfa.recovery_code_count in medusa-config to an out-of-range value.

Common situations: Typos in the module options (e.g. recovery_code_count: 100); passing user-supplied count from an API without validating; passing a string count like "10".

Related errors

• Recovery code is invalid or already used
• NOT_ALLOWED
• Only TOTP MFA factors can be verified with this method
• MFA verification code is required to disable MFA
• MFA factor with id "${id}" was not found

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/f324e9a1d0ed59b3. Report an issue: GitHub.