# X_MFA_SECRET_UNSEALED

## Means

a stored totp secret is not sealed, so it is never read as one

## Typical cause

x_users.mfa_secret holds a value written before second-factor secrets were sealed at rest (or written past saveTotpSecret); the framework does not read a plaintext secret, so that account cannot finish a second factor until the value is sealed

## Fix

`x auth seal-mfa --json`

[Auth and sessions](/error-codes#auth-and-sessions)