It is highly recommended to make your account safe and secure by creating a passkey. Alternatively you can also setup MFA using your email and phone number.
Keycloak will own the auth factor and OIDC identity, while FastAPI keeps the onboarding state, household permissions, and app-local access model.