core 3: fix email pass custom flow

[alexisintech]

the email-password custom flow guide doesn't have the copy regarding MFA set up nor explanations of the code added, and its meant to be more for basic usage and users that don't have MFA enabled. if users want to enable MFA, they can go to the appropriate guide, so i've updated the code to point them there

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-docs	Error		Feb 9, 2026 10:10pm

[dstaley]

My thinking here was that with client trust enabled (which is the default for new instances I believe), signing in with email and password on a new client requires the handling of the needs_second_factor status. So if you follow the guide as this PR details you actually won't be able to sign in for the first time; you'd need to also incorporate the logic from the MFA guide. Since this is a default and not something you can turn off I think it makes sense to show that logic in the guide.

[alexisintech]

My thinking here was that with client trust enabled (which is the default for new instances I believe), signing in with email and password on a new client requires the handling of the needs_second_factor status. So if you follow the guide as this PR details you actually won't be able to sign in for the first time; you'd need to also incorporate the logic from the MFA guide. Since this is a default and not something you can turn off I think it makes sense to show that logic in the guide.

ahhh if its for client trust, two things:

1. the examples are using totp (auth app) or backup codes, both you have to manually enable under "multi-factor auth" in the dash. whereas email codes are probably a better route, because they are auto-enabled if email is enabled, which brings me to point two:
2. the dash says if the user hasn't configured a second factor, email code (default), phone code, or email link will be used

which is why i believe if we are going to add support for client trust to the custom flows, it should be using email code!
so i'm cool to keep the handling of needs_second_factor, and can add a comment about doing this due to client trust (with a link to that doc), and then using email code there

[alexisintech]

this is if the user has "verify at sign up" and "email verification code" enabled
they can have email link enabled - will need to think about this