[keycloak-user] Logging in using REST-API to realm with customized browser flow

[Lukasz Lech]

Hello,

I've created custom browser flow with additional 2fa step (based on https://github.com/gwallet/keycloak-sms-authenticator).
If I log in using browser, I'm challenged to enter the code sent by SMS.

However, I was able to log in using REST-API, bypassing the extra security.
Is it some misconfiguration or known behavior?
Custom flow is chosen under Authentication->Bindings.

Best regards,
Lukasz Lech