# WebAuthn or OTP as required 2FA in a browser flow

**URL:** <https://forum.keycloak.org/t/webauthn-or-otp-as-required-2fa-in-a-browser-flow/30329>\
**Category:** Miscellanaeous\
**Tags:** authentication\
**Created:** [August 26, 2025, 1:42pm UTC](https://forum.keycloak.org/t/webauthn-or-otp-as-required-2fa-in-a-browser-flow/30329 "2025-08-26T13:42:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Garptz](https://avatars.discourse-cdn.com/v4/letter/g/7ea924/32.png) [@Garptz](https://forum.keycloak.org/u/Garptz)\
**Post date:** [August 26, 2025, 1:42pm UTC](https://forum.keycloak.org/t/webauthn-or-otp-as-required-2fa-in-a-browser-flow/30329/1 "2025-08-26T13:42:44Z")

</div>

Hello there,

I would like to set up a **browser** authentication flow where :

1. A user must first enter their username/password.
2. A user must use a second authentication factor :  
2a) If the user has already a WebAuthn credential, then he must use it.  
2b) If that user don’t have a WebAuthn credential, then he must use his OTP without even be prompted for WebAuthn. All the users have an OTP.

As weird as it seems, I cannot get that work. My authentication flow is the following :

- Cookie [**alternative**]
- Identity Provider Redirector [**alternative**]
- Browser 2FA [**alternative**]
  - Username Password Form [**required**]
  - Second Factor [**required**]
    - WebAuthn [**conditional**]
      - Condition - User Configured [**required**]
      - WebAuthn Authenticator [**required**]

    - OTP [**alternative**]
      - OTP Form [**required**]

If I use this flow, it works for a user with webauthn credentials already configured.

But with a user without webauthn credentials, after having entered username + password, “invalid username or password” is displayed and the following error is generated in the server logs :  
_REQUIRED and ALTERNATIVE elements at same level! Those alternative executions will be ignored_

If I switch the WebAuthn to [**alternative**], then it always ask to register webauthn credentials for user that don’t already have one, which is not what I want.

How can I make it work ?