medusajs/medusa · error · MedusaError

Verification code does not belong to provider "${data.code_p

Error message

Verification code does not belong to provider "${data.code_provider}"

What it means

The verification record was found by code, but its code_provider differs from the code_provider passed in the confirm payload. The provider scopes codes so a code issued for one flow (e.g. emailpass reset) can't confirm another.

Source

Thrown at packages/modules/auth/src/providers/verification/token.ts:129

          token_hash: hashVerificationToken(data.code),
        },
      },
      {},
      sharedContext
    )

    if (!verification || verification.verified_at) {
      throw new MedusaError(
        MedusaError.Types.NOT_ALLOWED,
        "Verification code is invalid or already used"
      )
    }

    if (
      data.code_provider &&
      data.code_provider !== verification.code_provider
    ) {
      throw new MedusaError(
        MedusaError.Types.NOT_ALLOWED,
        `Verification code does not belong to provider "${data.code_provider}"`
      )
    }

    const expiresAt =
      new Date(verification.requested_at).getTime() + this.getTokenTtlMs_()

    if (expiresAt <= Date.now()) {
      throw new MedusaError(
        MedusaError.Types.NOT_ALLOWED,
        "Verification code has expired"
      )
    }

    return await this.authVerificationService_.update(
      {
        id: verification.id,

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Pass the same code_provider that was used when the code was generated (the provider that started verification)
2. Or omit code_provider to skip the provider check if your flow doesn't need scoping

Example fix

// before
await confirmAuthVerification({ code, code_provider: 'google' })
// after
await confirmAuthVerification({ code, code_provider: 'emailpass' }) // matches issuing provider

if (data.code_provider && data.code_provider !== issuingProvider) throw new Error('provider mismatch')
// or omit code_provider when not needed

When it happens

Trigger: confirm({ code, code_provider: 'emailpass' }) where the stored verification's code_provider is something else (e.g. 'google' or another provider's flow).

Common situations: Hardcoding the wrong provider name in a custom confirm route; mixing codes between auth providers in multi-provider setups; typos in the provider string.

Related errors

• UNAUTHORIZED
• Verification code is required
• Verification code is invalid or already used
• Verification code has expired
• Invalid MFA challenge code

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/91138c2a1b7dedc1. Report an issue: GitHub.