X_MFA_SECRET_UNSEALED

a stored totp secret is not sealed, so it is never read as one

x_users.mfa_secret holds a value written before second-factor secrets were sealed at rest (or written past saveTotpSecret); the framework does not read a plaintext secret, so that account cannot finish a second factor until the value is sealed

x auth seal-mfa --json