TODO:

• sign-in-or-up
• email-phone-otp
• enterprise connections
• oauth connections
• passkeys

/email-password

the email-password custom flow guide examples are using totp (auth app) or backup codes. a few issues with this:

• that guide doesn't have any of the copy regarding configuring MFA
• this guide is meant to be more for basic usage. you have to manually enable under "multi-factor auth" in the dash, so most users won't have MFA enabled unless they've manually chosen to enable it - and in this case, they'd probably go to the MFA guide, not this guide.

email codes are probably a better route here instead of TOTP or backup codes, because email codes are the default second factor when you enable email address.

I've updated the examples to use email codes, and to point to the MFA guide if the user wants to see how to support other second factor strategies.

this led me to revamping the MFA guide, which is now called the second factor guide.

/email-password-mfa --> /second-factor

there are two ways that a second factor can be required for signing in: mfa, or client trust. this is why i've updated the introductory paragraph of the doc to read:

If you have Client Trust or multi-factor authentication (MFA) (or both) enabled for your application, the sign-in attempt will return a status of needs_second_factor. Your custom sign-in flow needs to support handling whichever second factor strategy you have enabled in the Clerk Dashboard.

the guide goes on to explain that if the user has both enabled, client trust will use whatever mfa strategies are enabled (TOTP, SMS verification code). if mfa is not enabled, client trust will fallback to whatever verification strategy is enabled for the application (email code, email link, or SMS verification code).

I've revamped this guide in a way to explain that. and to cover all the different strategies that a user may have enabled for second factor verification.