Internal operators only. Security key sign-in is primary, with TOTP reserved for recovery and approved fallback.
Use TOTP only when your security key is unavailable or a recovery flow has been approved.