medusajs/medusa · error · MedusaError

Verification provider is required

Error message

Verification provider is required

What it means

Thrown by requestAuthVerification when the DTO lacks code_provider, which selects the verification provider (e.g. email, sms) responsible for sending the code. It is an INVALID_DATA error raised before any provider call.

Source

Thrown at packages/modules/auth/src/services/auth-module.ts:691

      data,
      sharedContext
    )

    if (!valid) {
      throw new MedusaError(
        MedusaError.Types.NOT_ALLOWED,
        "Recovery code is invalid or already used"
      )
    }
  }

  @InjectManager()
  async requestAuthVerification(
    data: AuthTypes.RequestAuthVerificationDTO,
    @MedusaContext() sharedContext: Context = {}
  ): Promise<AuthTypes.RequestAuthVerificationResponse> {
    if (!data.code_provider) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "Verification provider is required"
      )
    }

    return await this.authVerificationProviderService_.request(
      data.code_provider,
      data,
      sharedContext
    )
  }

  @InjectManager()
  async confirmAuthVerification(
    data: AuthTypes.ConfirmAuthVerificationDTO,
    @MedusaContext() sharedContext: Context = {}
  ): Promise<AuthTypes.ConfirmAuthVerificationResponse> {
    const codeProvider = data.code_provider ?? "token"

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Include a valid code_provider (e.g. 'email') in the request DTO
2. Make code_provider required in your route's validation schema so it fails early with a clear message
3. Check for typos in the field name (code_provider, not provider)

Example fix

// before
await authModule.requestAuthVerification({ identifier: email })
// after
await authModule.requestAuthVerification({ identifier: email, code_provider: 'email' })

if (!data.code_provider) throw new Error('code_provider is required')
await authModule.requestAuthVerification(data)

const hasCodeProvider = (d: RequestAuthVerificationDTO): boolean => Boolean(d.code_provider)

null

When it happens

Trigger: Calling authModuleService.requestAuthVerification({ identifier: 'a@b.c' }) without code_provider; passing code_provider: undefined or empty string due to a misbuilt request body.

Common situations: API route not forwarding the code_provider field from req.body/validatedBody; frontend form missing the provider select; zod/schema validation not marking the field required.

Understand the failure class

Background: "Missing required field" and "field is required" errors: why libraries reject payloads that omit mandatory fields — this error's family across 20 libraries.

Related errors

• Verification code is required
• Only TOTP MFA factors can be verified with this method
• Verification code is invalid or already used
• Verification code does not belong to provider "${data.code_p
• Verification code has expired

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/12dba57f8f80de82. Report an issue: GitHub.