Vault's TOTP API can validate a six-digit code. That is not yet a complete MFA flow. This Quarkus tutorial adds the missing boundaries: authenticated subject, stored enrollment mapping, strict input validation, a two-minute step-up JWT, normal RBAC, and a replay test against a patched Vault runtime. https://www.the-main-thread.com/p/quarkus-vault-totp-step-up-auth #Java #Quarkus #Vault #TOTP #APISecurity