medusajs/medusa · error · MedusaError

Verification code is required

Error message

Verification code is required

What it means

The token verification provider requires a code to confirm a verification request. Calling confirm() without data.code (empty/undefined) fails validation before any lookup.

Source

Thrown at packages/modules/auth/src/providers/verification/token.ts:102

          metadata: data.metadata ?? null,
        },
        sharedContext
      )
    }

    return {
      ...verification,
      code: token,
      expires_at: expiresAt,
    }
  }

  async confirm(
    data: AuthTypes.ConfirmAuthVerificationDTO,
    sharedContext: Context = {}
  ): Promise<AuthTypes.ConfirmAuthVerificationResponse> {
    if (!data.code) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "Verification code is required"
      )
    }

    const [verification] = await this.authVerificationService_.list(
      {
        provider_metadata: {
          token_hash: hashVerificationToken(data.code),
        },
      },
      {},
      sharedContext
    )

    if (!verification || verification.verified_at) {
      throw new MedusaError(
        MedusaError.Types.NOT_ALLOWED,

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Ensure the confirm payload includes the non-empty code field
2. Add client-side required validation on the code input before calling the API

Example fix

// before
await authModuleService.confirmAuthVerification({ verification_id })
// after
await authModuleService.confirmAuthVerification({
  verification_id,
  code: enteredCode.trim(),
})

if (!data.code?.trim()) throw new Error('code required')
await authModuleService.confirmAuthVerification({ ...data, code: data.code.trim() })

const hasCode = (d: { code?: string }) => typeof d.code === 'string' && d.code.trim().length > 0

When it happens

Trigger: confirmAuthVerification({ verification_id }) with the code field missing or empty string — e.g. the user submitted the form without entering the emailed code.

Common situations: Frontend forms that allow empty submission; API consumers passing token instead of code field name.

Understand the failure class

Background: "Missing required field" and "field is required" errors: why libraries reject payloads that omit mandatory fields — this error's family across 20 libraries.

Related errors

• Verification provider is required
• Only TOTP MFA factors can be verified with this method
• Verification code is invalid or already used
• Verification code does not belong to provider "${data.code_p
• Verification code has expired

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/22dcae8c346fc6ed. Report an issue: GitHub.