It depends on the order that the user registered their 2FA, since they are ordered (and an admin can move factors up/down in the admin interface). If you move

It depends on the order that the user registered their 2FA, since they are ordered (and an admin can move factors up/down in the admin interface). If you move the WebAuthN devices above the TOTP, Keycloak will first ask for the WebAuthN key with a button to switch back to another method (TOTP). It's slightly annoying.