The caller's enrolled second factors + preferred method

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.