For me, the username/password gives you read-only access and any kind of transaction requires 2FA.