Hi Marek, if I can follow you correctly, you are talking about configuring the OTP challenge as an optional action during the authentication process of the Direct Grants API flow. This doesn’t help me with avoiding to unnecessarily prompt the user for a 2FA token, because it was never configured. My Setup: [Keycloak] - [Radius] - [NAS (VPN Gateway)] - [Client (VPN Client)] IMO my Radius server, which is talking via the OpenID Connect Direct Grants API to Keycloak, needs to determine whether a given user has a configured OTP device, so I can decide in my Radius module whether to send an additional Access-Challenge request to the NAS, which will trigger a 2FA input dialog at the VPN client. Radius is a session based protocol. A session consists of multiple corresponding requests and responses between the Radius server the NAS, the flow is like this: Client -> NAS: Login via Username=foo, Password=bar NAS -> Radius: Access-Request (Username=foo, User-Password=bar) Now I’d need to find out whether the user needs to be challenged via 2FA. In case it was configured, we continue like this: Radius -> NAS: Access-Challenge (Please provide OTP token.) NAS -> Client: Please provide OTP Token. Client -> NAS: TOTP=12345 NAS -> Radius: Access-Request (Username=foo, User-Password=12345) Radius -> Keycloak: username=foo&password&totp=12345 Keycloak -> Radius: 200 or 401 Radius -> NAS: Access-Accept or Access-Reject Best, Stefan.