# X_MFA_REQUIRED

## Means

password proven, second factor outstanding

## Typical cause

the user has TOTP enrolled, and `login()` / `completeOAuthLogin()` throw before any session is written. `meta.challenge` is a sealed, five-minute credential for the second leg — `meta`, never `cause`: both public surfaces publish `cause` and drop `meta`, so the sign-in handler decides how it travels

## Fix

catch `X_MFA_REQUIRED` in your sign-in handler, hand `error.meta.challenge` to the caller, and finish with `await completeMfa(auth, challenge, code)`. No route ships. A wrong code is `X_UNAUTHENTICATED` and stays counted against the account, address and tenant buckets; past `rateLimit.maxAttempts` it is `X_ACCOUNT_LOCKED`. Sealing needs the app's master key — `X_SEAL_KEY_MISSING` without one

[Auth and sessions](/error-codes#auth-and-sessions)