Sign-in is always email + password. If you have a passkey or an
authenticator app enrolled, you are prompted for that second factor next.
- Authenticator app (TOTP) is opt-in. Enrolment is not complete until you
confirm a code. Recovery codes are shown once — store them. - Passkeys are also a second factor, not a password replacement. There is
no passwordless sign-in.
If you lose the phone and the recovery codes, open a ticket. Staff can reset
MFA; a password reset alone does not remove the second factor.