First-time setup requires signing in normally, enabling TOTP, and adding a passkey from Security & Passkeys.