Citation: Based on commit c8b5168 "Add requires_totp_mfa to JWT". The commit added requires_totp_mfa to tokens.tsx, schema-fields.ts, and the example JWT in jwt.mdx, but didn't add a description in the Stack Auth Specific Claims section. The field indicates whether the user has TOTP MFA enabled, as shown in the e2e tests in access-token-refresh.test.ts.
View source

Description diverges from internal OpenAPI spec

The added description says "Whether the user has TOTP multi-factor authentication enabled," but the internal OpenAPI spec in packages/stack-shared/src/interface/crud/users.ts describes this field as "Whether the user is required to use TOTP MFA to sign in". These are subtly different: a user could have TOTP configured without it being required at sign-in, or an admin could enforce MFA on users who already have TOTP set up. The claim name itself (requires_totp_mfa) and its SDK mapping to isMultiFactorRequired both reinforce the "required to use" semantics rather than simply "has enabled."

Consider aligning the docs with the existing internal description: