Like password reset URLs? Is that the only form of authentication in your application or is it secondary optional choice like in Amazon, Slack etc.? How do your users respond to the added friction (or) do they feel it's an added friction?

Can you share your application link here?