Have you considered how to handle mobile verification codes, graphic verification codes, and "proving you are not a robot" verification methods?

Quoting my cofounder from another thread:

For 2FA, different users take different approaches. Everything from teaching Autotab to pull auth codes from their email, to setting intervention requests at the top of their skills, to enterprise integrations that we support with SSO and dedicated machine accounts.

Autotab also has the ability to securely sync session data from your local app to cloud instances. This usually removes the need for doing 2FA again for sites with “remember this device” functionality.

We can enable captcha solving for select customers, but don’t allow that in the public app to prevent abuse.