Account settings

Security

Password + TOTP first. Passkeys are listed but blocked until Nest locks the WebAuthn RP ID.

Password

TOTP

Enrollment would bind a TOTP secret to a credentials row of kind totp.

Passkeys

Do not call navigator.credentials.create against this host. RP ID waits on Nest’s production hostname.