medusajs/medusa · error · MedusaError

UNAUTHORIZED

UNAUTHORIZED

Error message

The auth provider is not set while refreshing token

What it means

Thrown by POST /auth/token/refresh when the request's auth context has no auth_provider. The refresh endpoint needs to know which provider authenticated the original token to re-run provider checks while minting the new JWT. Maps to HTTP 401 (UNAUTHORIZED).

Source

Thrown at packages/medusa/src/api/auth/token/refresh/route.ts:25

  ContainerRegistrationKeys,
  MedusaError,
  Modules,
} from "@medusajs/framework/utils"
import {
  generateJwtTokenForAuthIdentity,
  generateJwtTokenWithChecks,
} from "../../utils/generate-jwt-token"

// Retrieve a newly generated JWT token. Checking the existing token is valid already happens in the auth middleware.
// Note: We probably want to disallow refreshes if the password changes, and require reauth.
export const POST = async (
  req: AuthenticatedMedusaRequest,
  res: MedusaResponse
) => {
  const service: IAuthModuleService = req.scope.resolve(Modules.AUTH)

  if (!req.auth_context.auth_provider) {
    throw new MedusaError(
      MedusaError.Types.UNAUTHORIZED,
      "The auth provider is not set while refreshing token"
    )
  }

  /* A request would have the actor ID set on it only after it:
    - Creates an actor after registration
    - Passes MFA and other verifications
  Once that is done we can safely just regenerate a token without performing any additional checks.

  However, if the actor is not set we have to perform the MFA and verification checks - for the refresh
  call we don't return verification/mfa required, but instead throw as the call to refresh the token is
  not expected until mfa/verifications are completed.
  */
  if (req.auth_context.actor_id) {
    const { http } = req.scope.resolve<ConfigModule>(
      ContainerRegistrationKeys.CONFIG_MODULE
    ).projectConfig

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Obtain a fresh token via the provider's authenticate route before refreshing
2. Ensure the JWT secret/config matches the one used to sign tokens
3. Check the token payload contains auth_provider; if minting tokens yourself, include the claim
4. Upgrade both client and server to matching Medusa versions

const claims = parseJwt(token)
if (!claims.auth_provider) {
  token = await reauthenticateWithProvider()
}

function hasProviderClaim(c: Record<string, unknown>): c is { auth_provider: string } {
  return typeof c.auth_provider === 'string' && c.auth_provider.length > 0
}

catch (e) { if (e.type === 'unauthorized' && /auth provider is not set/.test(e.message)) reauthenticate() else throw e }

When it happens

Trigger: Calling /auth/token/refresh with a JWT that lacks the auth_provider claim — e.g. a custom-issued token, a malformed token, or an actor token minted by an older flow.

Common situations: Tokens signed by external services or with a different secret/claim layout; upgrading Medusa versions where refresh token claims changed; passing an opaque/refresh token instead of the expected JWT.

Related errors

• id_token is missing 'sub' claim
• Customer with this email already has an account
• The user is already authenticated and cannot accept an invit
• User ID not found
• User with id: ${id} was not found

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/2aaf164361098b3b. Report an issue: GitHub.