Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

i'm not deep into the details of Elements, but generally your login flow should have an AAL2 set.
this piece is actually buggy:
&gt; ``` !(flow.refresh || flow.requested_aal === 'aal2')
&gt;           ? 'Sign In'
&gt;           : 'Two-Factor Authentication'```
and we recently fixed it for Account Experience (but not sure if we fixed all places in elements) - when flow.refresh is true, the message should be "please confirm that it's you", not "two factor auth"