Email, password, TOTP, merchant context, and session device/IP logging are required.