Password + authenticator (2FA) — enroll 2FA under Settings after signing in. First-ever sign-in from an allowlisted email creates the founding account.