So, what happens the second time they hit that flow, as they're not being directed to any specific url to sign in for the first time?

Great question!! On subsequent logins, the behavior depends on how you branch the Flow after the OTP step. A common pattern is: • Start with Email OTP • After OTP success → check if the user already has a password set If no password → route to Set Password If password already exists → skip that step and continue into the app (or even route to a password login step if you prefer) So effectively, OTP becomes the entry point, but the Flow decides whether it’s a first-time setup vs returning user. If you want a more traditional experience later, you can also expose a separate password login entry point and keep the OTP flow mainly for first-time / recovery scenarios.

To be sure I understand, they'd have do the OTP process every time they log in? One thing I didn't specify was we have a single Flow for signing up or in.

Ahh got it — thanks for the clarification! No — they don’t have to go through OTP every time. Since you have a single combined sign-in / sign-up Flow, the usual pattern is to let the Flow decide the path dynamically: Typical setup: 1. Start with an identifier step (email) 2. Then branch: If the user already has a password → go to password login If the user does NOT have a password yet (first login) → go to Email OTP → Set Password So OTP is only used for the first-time activation, not for every login. This way: • First login → OTP + set password • Future logins → standard password login

That's the part I was missing, that you could create a non-sso user without a password and use that to determine whether or not to show OTP.

Great! Hope your issue is resolved now.