I see many people in this thread dread existing auth scene and ask for a better solution. Client certificates, but usable and no hardware - https://github.com/sakurity/securelogin this is the only sovereign answer to auth battles.