Hi, I have been trying to ensure users should use 2FA for loggin in but due to certain constraints, I do not have an API key on the backend and can't make a call to check if the session uses aal2. However, as per the docs at https://www.ory.com/docs/kratos/mfa/overview#authenticator-assurance-level-aal, I have added a check to ensure the first and second amr values exist in the amr array of the id token. It seems to me the docs omitted

code

as a first level authentication because a user can request for code via email and then input another code from their authenticator app. Is this an omission? If so, I would be willing to make an addition to the docs for it

Hey @elegant-plumber-79804 yes that is an omission 🙂 You can use

code

as first or second factor (not both at the same time ofc); we probably just forgot to add it to this doc. A PR would be much appreciated, thanks!

created the PR. sorry it took so long as i got immersed in implementation details on my side of the project