diff --git a/.docker/Dockerfile-build b/.docker/Dockerfile-build
index bd619930f0a9..687d8834012f 100644
--- a/.docker/Dockerfile-build
+++ b/.docker/Dockerfile-build
@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1-experimental
-FROM golang:1.22-bullseye AS builder
+FROM golang:1.23-bullseye AS builder
 
 RUN apt-get update && apt-get upgrade -y &&\
   mkdir -p /var/lib/sqlite
diff --git a/.docker/Dockerfile-debug b/.docker/Dockerfile-debug
index a309b5ad92bb..97a0e2b72525 100644
--- a/.docker/Dockerfile-debug
+++ b/.docker/Dockerfile-debug
@@ -1,4 +1,4 @@
-FROM golang:1.22-bullseye
+FROM golang:1.23-bullseye
 ENV CGO_ENABLED 1
 
 RUN apt-get update && apt-get install -y --no-install-recommends inotify-tools psmisc
diff --git a/.github/ISSUE_TEMPLATE/BUG-REPORT.yml b/.github/ISSUE_TEMPLATE/BUG-REPORT.yml
index b40a9c1be15d..4048324eb8a7 100644
--- a/.github/ISSUE_TEMPLATE/BUG-REPORT.yml
+++ b/.github/ISSUE_TEMPLATE/BUG-REPORT.yml
@@ -23,11 +23,13 @@ body:
           required: true
         - label: "I have joined the [Ory Community Slack](https://slack.ory.sh)."
         - label: "I am signed up to the [Ory Security Patch
-            Newsletter](https://ory.us10.list-manage.com/subscribe?u=ffb1a878e4ec6c0ed312a3480&id=f605a41b53)."
+            Newsletter](https://www.ory.sh/l/sign-up-newsletter)."
     id: checklist
     type: checkboxes
   - attributes:
-      description: "Enter the slug or API URL of the affected Ory Network project. Leave empty when you are self-hosting."
+      description:
+        "Enter the slug or API URL of the affected Ory Network project. Leave
+        empty when you are self-hosting."
       label: "Ory Network Project"
       placeholder: "https://<your-project-slug>.projects.oryapis.com"
     id: ory-network-project
diff --git a/.github/ISSUE_TEMPLATE/DESIGN-DOC.yml b/.github/ISSUE_TEMPLATE/DESIGN-DOC.yml
index 36bf7935a008..b5741119698b 100644
--- a/.github/ISSUE_TEMPLATE/DESIGN-DOC.yml
+++ b/.github/ISSUE_TEMPLATE/DESIGN-DOC.yml
@@ -33,11 +33,13 @@ body:
           required: true
         - label: "I have joined the [Ory Community Slack](https://slack.ory.sh)."
         - label: "I am signed up to the [Ory Security Patch
-            Newsletter](https://ory.us10.list-manage.com/subscribe?u=ffb1a878e4ec6c0ed312a3480&id=f605a41b53)."
+            Newsletter](https://www.ory.sh/l/sign-up-newsletter)."
     id: checklist
     type: checkboxes
   - attributes:
-      description: "Enter the slug or API URL of the affected Ory Network project. Leave empty when you are self-hosting."
+      description:
+        "Enter the slug or API URL of the affected Ory Network project. Leave
+        empty when you are self-hosting."
       label: "Ory Network Project"
       placeholder: "https://<your-project-slug>.projects.oryapis.com"
     id: ory-network-project
diff --git a/.github/ISSUE_TEMPLATE/FEATURE-REQUEST.yml b/.github/ISSUE_TEMPLATE/FEATURE-REQUEST.yml
index 5e203aacfce9..7152fbdde4cf 100644
--- a/.github/ISSUE_TEMPLATE/FEATURE-REQUEST.yml
+++ b/.github/ISSUE_TEMPLATE/FEATURE-REQUEST.yml
@@ -26,11 +26,13 @@ body:
           required: true
         - label: "I have joined the [Ory Community Slack](https://slack.ory.sh)."
         - label: "I am signed up to the [Ory Security Patch
-            Newsletter](https://ory.us10.list-manage.com/subscribe?u=ffb1a878e4ec6c0ed312a3480&id=f605a41b53)."
+            Newsletter](https://www.ory.sh/l/sign-up-newsletter)."
     id: checklist
     type: checkboxes
   - attributes:
-      description: "Enter the slug or API URL of the affected Ory Network project. Leave empty when you are self-hosting."
+      description:
+        "Enter the slug or API URL of the affected Ory Network project. Leave
+        empty when you are self-hosting."
       label: "Ory Network Project"
       placeholder: "https://<your-project-slug>.projects.oryapis.com"
     id: ory-network-project
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 26df4ffc97a3..fd01491e2a9a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -28,7 +28,7 @@ jobs:
       - sdk-generate
     services:
       postgres:
-        image: postgres:11.8
+        image: postgres:14
         env:
           POSTGRES_DB: postgres
           POSTGRES_PASSWORD: test
@@ -79,22 +79,24 @@ jobs:
           fetch-depth: 2
       - uses: actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       - run: go list -json > go.list
       - name: Run nancy
         uses: sonatype-nexus-community/nancy-github-action@v1.0.2
         with:
           nancyVersion: v1.0.42
+      - run: |
+          sudo apt-get update
+        name: apt-get update
       - run: npm install
         name: Install node deps
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v4
+        uses: golangci/golangci-lint-action@v6
         env:
           GOGC: 100
         with:
           args: --timeout 10m0s
-          version: v1.56.2
-          skip-pkg-cache: true
+          version: v1.61.0
       - name: Build Kratos
         run: make install
       - name: Run go-acc (tests)
@@ -112,7 +114,7 @@ jobs:
       - sdk-generate
     services:
       postgres:
-        image: postgres:11.8
+        image: postgres:14
         env:
           POSTGRES_DB: postgres
           POSTGRES_PASSWORD: test
@@ -120,7 +122,7 @@ jobs:
         ports:
           - 5432:5432
       mysql:
-        image: mysql:5.7
+        image: mysql:8.0
         env:
           MYSQL_ROOT_PASSWORD: test
         ports:
@@ -159,6 +161,9 @@ jobs:
       - uses: ory/ci/checkout@master
         with:
           fetch-depth: 2
+      - run: |
+          sudo apt-get update
+        name: apt-get update
       - run: |
           npm ci
           cd test/e2e; npm ci
@@ -170,7 +175,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.23"
 
       - name: Install selfservice-ui-react-native
         uses: actions/checkout@v3
@@ -211,9 +216,9 @@ jobs:
           REACT_UI_PATH: react-ui
           CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}
       - if: failure()
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
-          name: logs
+          name: cypress-${{ matrix.database }}-logs
           path: test/e2e/*.e2e.log
 
   test-e2e-playwright:
@@ -223,7 +228,7 @@ jobs:
       - sdk-generate
     services:
       postgres:
-        image: postgres:11.8
+        image: postgres:14
         env:
           POSTGRES_DB: postgres
           POSTGRES_PASSWORD: test
@@ -231,7 +236,7 @@ jobs:
         ports:
           - 5432:5432
       mysql:
-        image: mysql:5.7
+        image: mysql:8.0
         env:
           MYSQL_ROOT_PASSWORD: test
         ports:
@@ -262,6 +267,9 @@ jobs:
       - uses: ory/ci/checkout@master
         with:
           fetch-depth: 2
+      - run: |
+          sudo apt-get update
+        name: apt-get update
       - run: |
           npm ci
           cd test/e2e; npm ci
@@ -274,7 +282,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       - run: go build -tags sqlite,json1 .
 
       - name: Install selfservice-ui-react-native
@@ -321,14 +329,14 @@ jobs:
           NODE_UI_PATH: node-ui
           REACT_UI_PATH: react-ui
       - if: failure()
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
-          name: logs
+          name: playwright-${{ matrix.database }}-logs
           path: test/e2e/*.e2e.log
       - if: failure()
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
-          name: playwright-test-results-${{ github.sha }}
+          name: playwright-test-results-${{ matrix.database }}-${{ github.sha }}
           path: |
             test/e2e/test-results/
             test/e2e/playwright-report/
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index a4d098e9826a..1c5519d95843 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -39,7 +39,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v2
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql/codeql-config.yml
@@ -51,7 +51,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v1
+        uses: github/codeql-action/autobuild@v2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -65,4 +65,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v2
diff --git a/.github/workflows/cve-scan.yaml b/.github/workflows/cve-scan.yaml
index 5b4519f66488..b8aa0197182a 100644
--- a/.github/workflows/cve-scan.yaml
+++ b/.github/workflows/cve-scan.yaml
@@ -1,5 +1,9 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/server/.github/workflows/cve-scan.yaml
+
 name: Docker Image Scanners
 on:
+  workflow_dispatch:
   push:
     branches:
       - "master"
@@ -9,30 +13,69 @@ on:
     branches:
       - "master"
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   scanners:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Setup Env
         id: vars
         shell: bash
         run: |
-          echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> "${GITHUB_ENV}"
+          # Store values in local variables
+          SHA_SHORT=$(git rev-parse --short HEAD)
+          REPO_NAME=${{ github.event.repository.name }}
+
+          # Append -sqlite to SHA_SHORT if repo is hydra
+          if [ "${REPO_NAME}" = "hydra" ]; then
+            echo "Repo is hydra, appending -sqlite to SHA_SHORT"
+            IMAGE_NAME="oryd/${REPO_NAME}:${SHA_SHORT}-sqlite"
+          else
+            echo "Repo is not hydra, using default IMAGE_NAME"
+            IMAGE_NAME="oryd/${REPO_NAME}:${SHA_SHORT}"
+          fi
+
+          # Output values for debugging
+          echo "Values to be set:"
+          echo "SHA_SHORT:  ${SHA_SHORT}"
+          echo "REPO_NAME:  ${REPO_NAME}"
+          echo "IMAGE_NAME: ${IMAGE_NAME}"
+
+          # Set GitHub Environment variables
+          echo "SHA_SHORT=${SHA_SHORT}" >> "${GITHUB_ENV}"
+          echo "IMAGE_NAME=${IMAGE_NAME}" >> "${GITHUB_ENV}"
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       - name: Build images
         shell: bash
         run: |
           IMAGE_TAG="${{ env.SHA_SHORT }}" make docker
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Configure Trivy
+        run: |
+          mkdir -p $HOME/.cache/trivy
+          echo "TRIVY_USERNAME=${{ github.actor }}" >> $GITHUB_ENV
+          echo "TRIVY_PASSWORD=${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_ENV
+
       - name: Anchore Scanner
-        uses: anchore/scan-action@v3
+        uses: anchore/scan-action@v5
         id: grype-scan
         with:
-          image: oryd/kratos:${{ env.SHA_SHORT }}
+          image: ${{ env.IMAGE_NAME }}
           fail-build: true
           severity-cutoff: high
           add-cpes-if-none: true
@@ -45,14 +88,14 @@ jobs:
           echo "::endgroup::"
       - name: Anchore upload scan SARIF report
         if: always()
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: ${{ steps.grype-scan.outputs.sarif }}
       - name: Kubescape scanner
         uses: kubescape/github-action@main
         id: kubescape
         with:
-          image: oryd/kratos:${{ env.SHA_SHORT }}
+          image: ${{ env.IMAGE_NAME }}
           verbose: true
           format: pretty-printer
           # can't whitelist CVE yet: https://github.com/kubescape/kubescape/pull/1568
@@ -61,18 +104,23 @@ jobs:
         uses: aquasecurity/trivy-action@master
         if: ${{ always() }}
         with:
-          image-ref: oryd/kratos:${{ env.SHA_SHORT }}
+          image-ref: ${{ env.IMAGE_NAME }}
           format: "table"
           exit-code: "42"
           ignore-unfixed: true
           vuln-type: "os,library"
           severity: "CRITICAL,HIGH"
-          scanners: "vuln,secret,config"
+          scanners: "vuln,secret,misconfig"
+        env:
+          TRIVY_SKIP_JAVA_DB_UPDATE: "true"
+          TRIVY_DISABLE_VEX_NOTICE: "true"
+          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
+
       - name: Dockle Linter
-        uses: erzz/dockle-action@v1.3.2
+        uses: erzz/dockle-action@v1
         if: ${{ always() }}
         with:
-          image: oryd/kratos:${{ env.SHA_SHORT }}
+          image: ${{ env.IMAGE_NAME }}
           exit-code: 42
           failure-threshold: high
       - name: Hadolint
@@ -89,5 +137,5 @@ jobs:
         shell: bash
         run: |
           echo "::group::Hadolint Scan Details"
-          echo "${HADOLINT_RESULTS}" | jq '.' 
+          echo "${HADOLINT_RESULTS}" | jq '.'
           echo "::endgroup::"
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 7e243923b8ca..bb107819d849 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       - run: make format
       - name: Indicate formatting issues
         run: git diff HEAD --exit-code --color
diff --git a/.github/workflows/licenses.yml b/.github/workflows/licenses.yml
index 8a86486031de..9d1589506da2 100644
--- a/.github/workflows/licenses.yml
+++ b/.github/workflows/licenses.yml
@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       - uses: actions/setup-node@v2
         with:
           node-version: "18"
diff --git a/.github/workflows/pm.yml b/.github/workflows/pm.yml
index 09b9fd6f83a2..dc6a5bcd129f 100644
--- a/.github/workflows/pm.yml
+++ b/.github/workflows/pm.yml
@@ -7,14 +7,23 @@ on:
   pull_request:
     types:
       - opened
+      - ready_for_review
 
 jobs:
-  add-to-project:
+  automate:
     if: github.event.pull_request.head.repo.fork == false
     name: Add issue to project
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
-      - uses: actions/add-to-project@v0.5.0
+      - uses: ory-corp/planning-automation-action@v0.1
         with:
-          project-url: https://github.com/orgs/ory-corp/projects/5
-          github-token: ${{ secrets.ORY_BOT_PAT }}
+          project: 5
+          organization: ory-corp
+          token: ${{ secrets.ORY_BOT_PAT }}
+          todoLabel: "Needs Triage"
+          statusName: Status
+          statusValue: "Needs Triage"
+          includeEffort: "false"
+          monthlyMilestoneName: Roadmap Monthly
+          quarterlyMilestoneName: Roadmap
diff --git a/.gitignore b/.gitignore
index f792761b2b71..42d798e427ad 100644
--- a/.gitignore
+++ b/.gitignore
@@ -65,3 +65,4 @@ test/e2e/kratos.*.yml
 # VSCode debug artifact
 __debug_bin
 .debug.sqlite.db
+.last-run.json
\ No newline at end of file
diff --git a/.golangci.yml b/.golangci.yml
index 374c9204ed1b..81b4a23960df 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -19,15 +19,14 @@ linters-settings:
   goimports:
     local-prefixes: github.com/ory
 
-run:
-  skip-dirs:
+issues:
+  exclude-dirs:
     - sdk/
-  skip-files:
+  exclude-files:
     - ".+_test.go"
     - "corpx/faker.go"
-
-issues:
   exclude:
     - "Set is deprecated: use context-based WithConfigValue instead"
     - "SetDefaultIdentitySchemaFromRaw is deprecated: Use context-based WithDefaultIdentitySchemaFromRaw instead"
     - "SetDefaultIdentitySchema is deprecated: Use context-based WithDefaultIdentitySchema instead"
+    - "G115"
diff --git a/.goreleaser.yml b/.goreleaser.yml
index b45adb94eceb..dd9755c68390 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -1,6 +1,8 @@
+version: 2
+
 includes:
   - from_url:
-      url: https://raw.githubusercontent.com/ory/xgoreleaser/master/build.tmpl.yml
+      url: https://raw.githubusercontent.com/ory/xgoreleaser/acbadd5d1b947b046fdd0a534b132509eba8e3c8/build.tmpl.yml
 
 variables:
   brew_name: kratos
diff --git a/.schema/openapi/patches/schema.yaml b/.schema/openapi/patches/schema.yaml
index 206aceb2708e..ff661ce4079d 100644
--- a/.schema/openapi/patches/schema.yaml
+++ b/.schema/openapi/patches/schema.yaml
@@ -43,6 +43,7 @@
       set_ory_session_token: "#/components/schemas/continueWithSetOrySessionToken"
       show_settings_ui: "#/components/schemas/continueWithSettingsUi"
       show_recovery_ui: "#/components/schemas/continueWithRecoveryUi"
+      redirect_browser_to: "#/components/schemas/continueWithRedirectBrowserTo"
 
 - op: add
   path: /components/schemas/continueWith/oneOf
@@ -51,3 +52,4 @@
     - "$ref": "#/components/schemas/continueWithSetOrySessionToken"
     - "$ref": "#/components/schemas/continueWithSettingsUi"
     - "$ref": "#/components/schemas/continueWithRecoveryUi"
+    - "$ref": "#/components/schemas/continueWithRedirectBrowserTo"
diff --git a/.schema/openapi/patches/selfservice.yaml b/.schema/openapi/patches/selfservice.yaml
index 81d82247586b..39a329bf5928 100644
--- a/.schema/openapi/patches/selfservice.yaml
+++ b/.schema/openapi/patches/selfservice.yaml
@@ -19,6 +19,7 @@
     - "$ref": "#/components/schemas/updateRegistrationFlowWithWebAuthnMethod"
     - "$ref": "#/components/schemas/updateRegistrationFlowWithCodeMethod"
     - "$ref": "#/components/schemas/updateRegistrationFlowWithPasskeyMethod"
+    - "$ref": "#/components/schemas/updateRegistrationFlowWithProfileMethod"
 - op: add
   path: /components/schemas/updateRegistrationFlowBody/discriminator
   value:
@@ -28,13 +29,18 @@
       oidc: "#/components/schemas/updateRegistrationFlowWithOidcMethod"
       webauthn: "#/components/schemas/updateRegistrationFlowWithWebAuthnMethod"
       code: "#/components/schemas/updateRegistrationFlowWithCodeMethod"
-      passKey: "#/components/schemas/updateRegistrationFlowWithPasskeyMethod"
+      passkey: "#/components/schemas/updateRegistrationFlowWithPasskeyMethod"
+      profile: "#/components/schemas/updateRegistrationFlowWithProfileMethod"
 - op: add
-  path: /components/schemas/registrationFlowState/enum
+  path: /components/schemas/registrationFlowState
   value:
-    - choose_method
-    - sent_email
-    - passed_challenge
+    title: Registration flow state (experimental)
+    description: The experimental state represents the state of a registration flow. This field is EXPERIMENTAL and subject to change!
+    type: string
+    enum:
+      - choose_method
+      - sent_email
+      - passed_challenge
 # end
 
 # All modifications for the login flow
@@ -50,6 +56,7 @@
     - "$ref": "#/components/schemas/updateLoginFlowWithLookupSecretMethod"
     - "$ref": "#/components/schemas/updateLoginFlowWithCodeMethod"
     - "$ref": "#/components/schemas/updateLoginFlowWithPasskeyMethod"
+    - "$ref": "#/components/schemas/updateLoginFlowWithIdentifierFirstMethod"
 - op: add
   path: /components/schemas/updateLoginFlowBody/discriminator
   value:
@@ -62,12 +69,17 @@
       lookup_secret: "#/components/schemas/updateLoginFlowWithLookupSecretMethod"
       code: "#/components/schemas/updateLoginFlowWithCodeMethod"
       passkey: "#/components/schemas/updateLoginFlowWithPasskeyMethod"
+      identifier_first: "#/components/schemas/updateLoginFlowWithIdentifierFirstMethod"
 - op: add
-  path: /components/schemas/loginFlowState/enum
+  path: /components/schemas/loginFlowState
   value:
-    - choose_method
-    - sent_email
-    - passed_challenge
+    title: Login flow state (experimental)
+    description: The experimental state represents the state of a login flow. This field is EXPERIMENTAL and subject to change!
+    type: string
+    enum:
+      - choose_method
+      - sent_email
+      - passed_challenge
 # end
 
 # All modifications for the recovery flow
@@ -86,11 +98,15 @@
       link: "#/components/schemas/updateRecoveryFlowWithLinkMethod"
       code: "#/components/schemas/updateRecoveryFlowWithCodeMethod"
 - op: add
-  path: /components/schemas/recoveryFlowState/enum
+  path: /components/schemas/recoveryFlowState
+  type: string
   value:
-    - choose_method
-    - sent_email
-    - passed_challenge
+    title: Recovery flow state (experimental)
+    description: The experimental state represents the state of a recovery flow. This field is EXPERIMENTAL and subject to change!
+    enum:
+      - choose_method
+      - sent_email
+      - passed_challenge
 # End
 
 # All modifications for the verification flow
@@ -109,11 +125,15 @@
       link: "#/components/schemas/updateVerificationFlowWithLinkMethod"
       code: "#/components/schemas/updateVerificationFlowWithCodeMethod"
 - op: add
-  path: /components/schemas/verificationFlowState/enum
+  path: /components/schemas/verificationFlowState
+  type: string
   value:
-    - choose_method
-    - sent_email
-    - passed_challenge
+    title: Verification flow state (experimental)
+    description: The experimental state represents the state of a verification flow. This field is EXPERIMENTAL and subject to change!
+    enum:
+      - choose_method
+      - sent_email
+      - passed_challenge
 # End
 
 # All modifications for the settings flow
@@ -142,8 +162,20 @@
       passkey: "#/components/schemas/updateSettingsFlowWithPasskeyMethod"
       lookup_secret: "#/components/schemas/updateSettingsFlowWithLookupMethod"
 - op: add
-  path: /components/schemas/settingsFlowState/enum
+  path: /components/schemas/settingsFlowState
   value:
-    - show_form
-    - success
+    title: Settings flow state (experimental)
+    description: The experimental state represents the state of a settings flow. This field is EXPERIMENTAL and subject to change!
+    type: string
+    enum:
+      - show_form
+      - success
 # end
+
+# Some issues with AdditionalProperties
+- op: remove
+  path: "#/components/schemas/OAuth2LoginRequest/properties/AdditionalProperties"
+- op: remove
+  path: "#/components/schemas/OAuth2ConsentRequestOpenIDConnectContext/properties/AdditionalProperties"
+- op: remove
+  path: "#/components/schemas/OAuth2Client/properties/AdditionalProperties"
diff --git a/.schema/version.schema.json b/.schema/version.schema.json
index 14192708b3c7..f82ab21fa546 100644
--- a/.schema/version.schema.json
+++ b/.schema/version.schema.json
@@ -2,6 +2,23 @@
     "$id": "https://github.com/ory/kratos/.schema/versions.config.schema.json",
     "$schema": "http://json-schema.org/draft-07/schema#",
     "oneOf": [
+        {
+            "allOf": [
+                {
+                    "properties": {
+                        "version": {
+                            "const": "v1.3.0"
+                        }
+                    },
+                    "required": [
+                        "version"
+                    ]
+                },
+                {
+                    "$ref": "https://raw.githubusercontent.com/ory/kratos/v1.3.0/.schemastore/config.schema.json"
+                }
+            ]
+        },
         {
             "allOf": [
                 {
diff --git a/.schemastore/config.schema.json b/.schemastore/config.schema.json
index 8a0e0df31129..87ee9aab7cc6 100644
--- a/.schemastore/config.schema.json
+++ b/.schemastore/config.schema.json
@@ -432,7 +432,7 @@
         },
         "provider": {
           "title": "Provider",
-          "description": "Can be one of github, github-app, gitlab, generic, google, microsoft, discord, slack, facebook, auth0, vk, yandex, apple, spotify, netid, dingtalk, patreon.",
+          "description": "Can be one of github, github-app, gitlab, generic, google, microsoft, discord, salesforce, slack, facebook, auth0, vk, yandex, apple, spotify, netid, dingtalk, patreon.",
           "type": "string",
           "enum": [
             "github",
@@ -442,6 +442,7 @@
             "google",
             "microsoft",
             "discord",
+            "salesforce",
             "slack",
             "facebook",
             "auth0",
@@ -521,7 +522,7 @@
           "title": "Microsoft subject source",
           "description": "Controls which source the subject identifier is taken from by microsoft provider. If set to `userinfo` (the default) then the identifier is taken from the `sub` field of OIDC ID token or data received from `/userinfo` standard OIDC endpoint. If set to `me` then the `id` field of data structure received from `https://graph.microsoft.com/v1.0/me` is taken as an identifier.",
           "type": "string",
-          "enum": ["userinfo", "me"],
+          "enum": ["userinfo", "me", "oid"],
           "default": "userinfo",
           "examples": ["userinfo"]
         },
@@ -569,6 +570,13 @@
           "enum": ["id_token", "userinfo"],
           "default": "id_token",
           "examples": ["id_token", "userinfo"]
+        },
+        "pkce": {
+          "title": "Proof Key for Code Exchange",
+          "description": "PKCE controls if the OpenID Connect OAuth2 flow should use PKCE (Proof Key for Code Exchange). IMPORTANT: If you set this to `force`, you must whitelist a different return URL for your OAuth2 client in the provider's configuration. Instead of <base-url>/self-service/methods/oidc/callback/<provider>, you must use <base-url>/self-service/methods/oidc/callback",
+          "type": "string",
+          "enum": ["auto", "never", "force"],
+          "default": "auto"
         }
       },
       "additionalProperties": false,
@@ -1299,6 +1307,13 @@
                   "default": "1h",
                   "examples": ["1h", "1m", "1s"]
                 },
+                "style": {
+                  "title": "Login Flow Style",
+                  "description": "The style of the login flow. If set to `unified` the login flow will be a one-step process. If set to `identifier_first` (experimental!) the login flow will first ask for the identifier and then the credentials.",
+                  "type": "string",
+                  "enum": ["unified", "identifier_first"],
+                  "default": "unified"
+                },
                 "before": {
                   "$ref": "#/definitions/selfServiceBeforeLogin"
                 },
@@ -1423,6 +1438,48 @@
           "type": "object",
           "additionalProperties": false,
           "properties": {
+            "b2b": {
+              "title": "Single Sign-On for B2B",
+              "description": "Single Sign-On for B2B allows your customers to bring their own (workforce) identity server (e.g. OneLogin). This feature is not available in the open source licensed code.",
+              "type": "object",
+              "properties": {
+                "config": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": {
+                    "organizations": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "id": {
+                            "type": "string",
+                            "description": "The ID of the organization.",
+                            "format": "uuid",
+                            "examples": ["00000000-0000-0000-0000-000000000000"]
+                          },
+                          "label": {
+                            "type": "string",
+                            "description": "The label of the organization.",
+                            "examples": ["ACME SSO"]
+                          },
+                          "domains": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "format": "hostname",
+                              "examples": ["my-app.com"],
+                              "description": "If this domain matches the email's domain, this provider is shown."
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "additionalProperties": false
+            },
             "profile": {
               "type": "object",
               "additionalProperties": false,
@@ -1466,24 +1523,36 @@
             },
             "code": {
               "type": "object",
-              "additionalProperties": false,
+              "additionalProperties": true,
               "anyOf": [
                 {
                   "properties": {
-                    "passwordless_enabled": { "const": true },
-                    "mfa_enabled": { "const": false }
+                    "passwordless_enabled": {
+                      "const": true
+                    },
+                    "mfa_enabled": {
+                      "const": false
+                    }
                   }
                 },
                 {
                   "properties": {
-                    "mfa_enabled": { "const": true },
-                    "passwordless_enabled": { "const": false }
+                    "mfa_enabled": {
+                      "const": true
+                    },
+                    "passwordless_enabled": {
+                      "const": false
+                    }
                   }
                 },
                 {
                   "properties": {
-                    "mfa_enabled": { "const": false },
-                    "passwordless_enabled": { "const": false }
+                    "mfa_enabled": {
+                      "const": false
+                    },
+                    "passwordless_enabled": {
+                      "const": false
+                    }
                   }
                 }
               ],
@@ -1499,12 +1568,6 @@
                   "title": "Enables login flows code method to fulfil MFA requests",
                   "default": false
                 },
-                "passwordless_login_fallback_enabled": {
-                  "type": "boolean",
-                  "title": "Passwordless Login Fallback Enabled",
-                  "description": "This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.",
-                  "default": false
-                },
                 "enabled": {
                   "type": "boolean",
                   "title": "Enables Code Method",
@@ -1521,6 +1584,13 @@
                       "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
                       "default": "1h",
                       "examples": ["1h", "1m", "1s"]
+                    },
+                    "missing_credential_fallback_enabled": {
+                      "type": "boolean",
+                      "title": "Enable Code OTP as a Fallback",
+                      "description": "Enabling this allows users to sign in with the code method, even if their identity schema or their credentials are not set up to use the code method. If enabled, a verified address (such as an email) will be used to send the code to the user. Use with caution and only if actually needed.",
+
+                      "default": false
                     }
                   }
                 }
@@ -1578,6 +1648,61 @@
                       "description": "If set to false the password validation does not check for similarity between the password and the user identifier.",
                       "type": "boolean",
                       "default": true
+                    },
+                    "migrate_hook": {
+                      "type": "object",
+                      "additionalProperties": false,
+                      "properties": {
+                        "enabled": {
+                          "type": "boolean",
+                          "title": "Enable Password Migration",
+                          "description": "If set to true will enable password migration.",
+                          "default": false
+                        },
+                        "config": {
+                          "type": "object",
+                          "additionalProperties": false,
+                          "properties": {
+                            "url": {
+                              "type": "string",
+                              "description": "The URL the password migration hook should call",
+                              "format": "uri"
+                            },
+                            "method": {
+                              "type": "string",
+                              "description": "The HTTP method to use (GET, POST, etc).",
+                              "const": "POST",
+                              "default": "POST"
+                            },
+                            "headers": {
+                              "type": "object",
+                              "description": "The HTTP headers that must be applied to the password migration hook.",
+                              "additionalProperties": {
+                                "type": "string"
+                              }
+                            },
+                            "emit_analytics_event": {
+                              "type": "boolean",
+                              "default": true,
+                              "description": "Emit tracing events for this hook on delivery or error"
+                            },
+                            "auth": {
+                              "type": "object",
+                              "title": "Auth mechanisms",
+                              "description": "Define which auth mechanism the Web-Hook should use",
+                              "oneOf": [
+                                {
+                                  "$ref": "#/definitions/webHookAuthApiKeyProperties"
+                                },
+                                {
+                                  "$ref": "#/definitions/webHookAuthBasicAuthProperties"
+                                }
+                              ]
+                            },
+                            "additionalProperties": false
+                          }
+                        }
+                      }
                     }
                   },
                   "additionalProperties": false
@@ -2414,7 +2539,7 @@
       "additionalProperties": false
     },
     "tracing": {
-      "$ref": "https://raw.githubusercontent.com/ory/x/v0.0.623/otelx/config.schema.json"
+      "$ref": "https://raw.githubusercontent.com/ory/x/v0.0.660/otelx/config.schema.json"
     },
     "log": {
       "title": "Log",
@@ -2766,6 +2891,21 @@
         }
       }
     },
+    "security": {
+      "type": "object",
+      "properties": {
+        "account_enumeration": {
+          "type": "object",
+          "properties": {
+            "mitigate": {
+              "type": "boolean",
+              "default": false,
+              "description": "Mitigate account enumeration by making it harder to figure out if an identifier (email, phone number) exists or not. Enabling this setting degrades user experience. This setting does not mitigate all possible attack vectors yet."
+            }
+          }
+        }
+      }
+    },
     "version": {
       "title": "The kratos version this config is written for.",
       "description": "SemVer according to https://semver.org/ prefixed with `v` as in our releases.",
@@ -2855,13 +2995,19 @@
           "title": "Enable new flow transitions using `continue_with` items",
           "description": "If enabled allows new flow transitions using `continue_with` items.",
           "default": false
+        },
+        "faster_session_extend": {
+          "type": "boolean",
+          "title": "Enable faster session extension",
+          "description": "If enabled allows faster session extension by skipping the session lookup. Disabling this feature will be deprecated in the future.",
+          "default": false
         }
       },
       "additionalProperties": false
     },
     "organizations": {
       "title": "Organizations",
-      "description": "Secifies which organizations are available. Only effective in the Ory Network.",
+      "description": "Please use selfservice.methods.b2b instead. This key will be removed. Only effective in the Ory Network.",
       "type": "array",
       "default": []
     },
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e9a081e3be7f..c7f68260ed27 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,324 +5,1196 @@
 
 **Table of Contents**
 
-- [ (2024-04-26)](#2024-04-26)
+- [ (2024-12-27)](#2024-12-27)
   - [Breaking Changes](#breaking-changes)
     - [Bug Fixes](#bug-fixes)
+    - [Code Refactoring](#code-refactoring)
+    - [Documentation](#documentation)
     - [Features](#features)
     - [Tests](#tests)
-    - [Unclassified](#unclassified)
-- [1.1.0 (2024-02-20)](#110-2024-02-20)
+- [1.3.0 (2024-09-26)](#130-2024-09-26)
   - [Breaking Changes](#breaking-changes-1)
     - [Bug Fixes](#bug-fixes-1)
     - [Code Generation](#code-generation)
-    - [Documentation](#documentation)
+    - [Documentation](#documentation-1)
     - [Features](#features-1)
-    - [Reverts](#reverts)
     - [Tests](#tests-1)
-    - [Unclassified](#unclassified-1)
-- [1.0.0 (2023-07-12)](#100-2023-07-12)
-  - [Bug Fixes](#bug-fixes-2)
-  - [Code Generation](#code-generation-1)
-  - [Documentation](#documentation-1)
-  - [Features](#features-2)
-  - [Tests](#tests-2)
-  - [Unclassified](#unclassified-2)
-- [0.13.0 (2023-04-18)](#0130-2023-04-18)
+    - [Unclassified](#unclassified)
+- [1.2.0 (2024-06-05)](#120-2024-06-05)
   - [Breaking Changes](#breaking-changes-2)
+    - [Bug Fixes](#bug-fixes-2)
+    - [Code Generation](#code-generation-1)
+    - [Documentation](#documentation-2)
+    - [Features](#features-2)
+    - [Tests](#tests-2)
+    - [Unclassified](#unclassified-1)
+- [1.1.0 (2024-02-20)](#110-2024-02-20)
+  - [Breaking Changes](#breaking-changes-3)
     - [Bug Fixes](#bug-fixes-3)
     - [Code Generation](#code-generation-2)
-    - [Code Refactoring](#code-refactoring)
-    - [Documentation](#documentation-2)
+    - [Documentation](#documentation-3)
     - [Features](#features-3)
+    - [Reverts](#reverts)
     - [Tests](#tests-3)
-    - [Unclassified](#unclassified-3)
-- [0.11.1 (2023-01-14)](#0111-2023-01-14)
-  - [Breaking Changes](#breaking-changes-3)
-    - [Bug Fixes](#bug-fixes-4)
-    - [Code Generation](#code-generation-3)
-    - [Documentation](#documentation-3)
-    - [Features](#features-4)
-    - [Tests](#tests-4)
-- [0.11.0 (2022-12-02)](#0110-2022-12-02)
-  - [Code Generation](#code-generation-4)
-  - [Features](#features-5)
-- [0.11.0-alpha.0.pre.2 (2022-11-28)](#0110-alpha0pre2-2022-11-28)
+    - [Unclassified](#unclassified-2)
+- [1.0.0 (2023-07-12)](#100-2023-07-12)
+  - [Bug Fixes](#bug-fixes-4)
+  - [Code Generation](#code-generation-3)
+  - [Documentation](#documentation-4)
+  - [Features](#features-4)
+  - [Tests](#tests-4)
+  - [Unclassified](#unclassified-3)
+- [0.13.0 (2023-04-18)](#0130-2023-04-18)
   - [Breaking Changes](#breaking-changes-4)
     - [Bug Fixes](#bug-fixes-5)
-    - [Code Generation](#code-generation-5)
+    - [Code Generation](#code-generation-4)
     - [Code Refactoring](#code-refactoring-1)
-    - [Documentation](#documentation-4)
-    - [Features](#features-6)
-    - [Reverts](#reverts-1)
+    - [Documentation](#documentation-5)
+    - [Features](#features-5)
     - [Tests](#tests-5)
     - [Unclassified](#unclassified-4)
-- [0.10.1 (2022-06-01)](#0101-2022-06-01)
-  - [Bug Fixes](#bug-fixes-6)
-  - [Code Generation](#code-generation-6)
-- [0.10.0 (2022-05-30)](#0100-2022-05-30)
+- [0.11.1 (2023-01-14)](#0111-2023-01-14)
   - [Breaking Changes](#breaking-changes-5)
+    - [Bug Fixes](#bug-fixes-6)
+    - [Code Generation](#code-generation-5)
+    - [Documentation](#documentation-6)
+    - [Features](#features-6)
+    - [Tests](#tests-6)
+- [0.11.0 (2022-12-02)](#0110-2022-12-02)
+  - [Code Generation](#code-generation-6)
+  - [Features](#features-7)
+- [0.11.0-alpha.0.pre.2 (2022-11-28)](#0110-alpha0pre2-2022-11-28)
+  - [Breaking Changes](#breaking-changes-6)
     - [Bug Fixes](#bug-fixes-7)
     - [Code Generation](#code-generation-7)
     - [Code Refactoring](#code-refactoring-2)
-    - [Documentation](#documentation-5)
-    - [Features](#features-7)
-    - [Tests](#tests-6)
-    - [Unclassified](#unclassified-5)
-- [0.9.0-alpha.3 (2022-03-25)](#090-alpha3-2022-03-25)
-  - [Breaking Changes](#breaking-changes-6)
-    - [Bug Fixes](#bug-fixes-8)
-    - [Code Generation](#code-generation-8)
-    - [Documentation](#documentation-6)
-- [0.9.0-alpha.2 (2022-03-22)](#090-alpha2-2022-03-22)
-  - [Bug Fixes](#bug-fixes-9)
-  - [Code Generation](#code-generation-9)
-- [0.9.0-alpha.1 (2022-03-21)](#090-alpha1-2022-03-21)
-  - [Breaking Changes](#breaking-changes-7)
-    - [Bug Fixes](#bug-fixes-10)
-    - [Code Generation](#code-generation-10)
-    - [Code Refactoring](#code-refactoring-3)
     - [Documentation](#documentation-7)
     - [Features](#features-8)
+    - [Reverts](#reverts-1)
     - [Tests](#tests-7)
-    - [Unclassified](#unclassified-6)
-- [0.8.3-alpha.1.pre.0 (2022-01-21)](#083-alpha1pre0-2022-01-21)
-  - [Breaking Changes](#breaking-changes-8)
-    - [Bug Fixes](#bug-fixes-11)
-    - [Code Generation](#code-generation-11)
-    - [Code Refactoring](#code-refactoring-4)
+    - [Unclassified](#unclassified-5)
+- [0.10.1 (2022-06-01)](#0101-2022-06-01)
+  - [Bug Fixes](#bug-fixes-8)
+  - [Code Generation](#code-generation-8)
+- [0.10.0 (2022-05-30)](#0100-2022-05-30)
+  - [Breaking Changes](#breaking-changes-7)
+    - [Bug Fixes](#bug-fixes-9)
+    - [Code Generation](#code-generation-9)
+    - [Code Refactoring](#code-refactoring-3)
     - [Documentation](#documentation-8)
     - [Features](#features-9)
     - [Tests](#tests-8)
-- [0.8.2-alpha.1 (2021-12-17)](#082-alpha1-2021-12-17)
-  - [Bug Fixes](#bug-fixes-12)
-  - [Code Generation](#code-generation-12)
-  - [Documentation](#documentation-9)
-- [0.8.1-alpha.1 (2021-12-13)](#081-alpha1-2021-12-13)
-  - [Bug Fixes](#bug-fixes-13)
-  - [Code Generation](#code-generation-13)
-  - [Documentation](#documentation-10)
-  - [Features](#features-10)
-  - [Tests](#tests-9)
-- [0.8.0-alpha.4.pre.0 (2021-11-09)](#080-alpha4pre0-2021-11-09)
+    - [Unclassified](#unclassified-6)
+- [0.9.0-alpha.3 (2022-03-25)](#090-alpha3-2022-03-25)
+  - [Breaking Changes](#breaking-changes-8)
+    - [Bug Fixes](#bug-fixes-10)
+    - [Code Generation](#code-generation-10)
+    - [Documentation](#documentation-9)
+- [0.9.0-alpha.2 (2022-03-22)](#090-alpha2-2022-03-22)
+  - [Bug Fixes](#bug-fixes-11)
+  - [Code Generation](#code-generation-11)
+- [0.9.0-alpha.1 (2022-03-21)](#090-alpha1-2022-03-21)
   - [Breaking Changes](#breaking-changes-9)
-    - [Bug Fixes](#bug-fixes-14)
-    - [Code Generation](#code-generation-14)
+    - [Bug Fixes](#bug-fixes-12)
+    - [Code Generation](#code-generation-12)
+    - [Code Refactoring](#code-refactoring-4)
+    - [Documentation](#documentation-10)
+    - [Features](#features-10)
+    - [Tests](#tests-9)
+    - [Unclassified](#unclassified-7)
+- [0.8.3-alpha.1.pre.0 (2022-01-21)](#083-alpha1pre0-2022-01-21)
+  - [Breaking Changes](#breaking-changes-10)
+    - [Bug Fixes](#bug-fixes-13)
+    - [Code Generation](#code-generation-13)
+    - [Code Refactoring](#code-refactoring-5)
     - [Documentation](#documentation-11)
     - [Features](#features-11)
     - [Tests](#tests-10)
-- [0.8.0-alpha.3 (2021-10-28)](#080-alpha3-2021-10-28)
+- [0.8.2-alpha.1 (2021-12-17)](#082-alpha1-2021-12-17)
+  - [Bug Fixes](#bug-fixes-14)
+  - [Code Generation](#code-generation-14)
+  - [Documentation](#documentation-12)
+- [0.8.1-alpha.1 (2021-12-13)](#081-alpha1-2021-12-13)
   - [Bug Fixes](#bug-fixes-15)
   - [Code Generation](#code-generation-15)
+  - [Documentation](#documentation-13)
+  - [Features](#features-12)
+  - [Tests](#tests-11)
+- [0.8.0-alpha.4.pre.0 (2021-11-09)](#080-alpha4pre0-2021-11-09)
+  - [Breaking Changes](#breaking-changes-11)
+    - [Bug Fixes](#bug-fixes-16)
+    - [Code Generation](#code-generation-16)
+    - [Documentation](#documentation-14)
+    - [Features](#features-13)
+    - [Tests](#tests-12)
+- [0.8.0-alpha.3 (2021-10-28)](#080-alpha3-2021-10-28)
+  - [Bug Fixes](#bug-fixes-17)
+  - [Code Generation](#code-generation-17)
 - [0.8.0-alpha.2 (2021-10-28)](#080-alpha2-2021-10-28)
-  - [Code Generation](#code-generation-16)
+  - [Code Generation](#code-generation-18)
 - [0.8.0-alpha.1 (2021-10-27)](#080-alpha1-2021-10-27)
-  - [Breaking Changes](#breaking-changes-10)
-    - [Bug Fixes](#bug-fixes-16)
-    - [Code Generation](#code-generation-17)
-    - [Code Refactoring](#code-refactoring-5)
-    - [Documentation](#documentation-12)
-    - [Features](#features-12)
+  - [Breaking Changes](#breaking-changes-12)
+    - [Bug Fixes](#bug-fixes-18)
+    - [Code Generation](#code-generation-19)
+    - [Code Refactoring](#code-refactoring-6)
+    - [Documentation](#documentation-15)
+    - [Features](#features-14)
     - [Reverts](#reverts-2)
-    - [Tests](#tests-11)
-    - [Unclassified](#unclassified-7)
+    - [Tests](#tests-13)
+    - [Unclassified](#unclassified-8)
 - [0.7.6-alpha.1 (2021-09-12)](#076-alpha1-2021-09-12)
-  - [Code Generation](#code-generation-18)
-- [0.7.5-alpha.1 (2021-09-11)](#075-alpha1-2021-09-11)
-  - [Code Generation](#code-generation-19)
-- [0.7.4-alpha.1 (2021-09-09)](#074-alpha1-2021-09-09)
-  - [Bug Fixes](#bug-fixes-17)
   - [Code Generation](#code-generation-20)
-  - [Documentation](#documentation-13)
-  - [Features](#features-13)
-  - [Tests](#tests-12)
-- [0.7.3-alpha.1 (2021-08-28)](#073-alpha1-2021-08-28)
-  - [Bug Fixes](#bug-fixes-18)
+- [0.7.5-alpha.1 (2021-09-11)](#075-alpha1-2021-09-11)
   - [Code Generation](#code-generation-21)
-  - [Documentation](#documentation-14)
-  - [Features](#features-14)
-- [0.7.1-alpha.1 (2021-07-22)](#071-alpha1-2021-07-22)
+- [0.7.4-alpha.1 (2021-09-09)](#074-alpha1-2021-09-09)
   - [Bug Fixes](#bug-fixes-19)
   - [Code Generation](#code-generation-22)
-  - [Documentation](#documentation-15)
-  - [Tests](#tests-13)
-- [0.7.0-alpha.1 (2021-07-13)](#070-alpha1-2021-07-13)
-  - [Breaking Changes](#breaking-changes-11)
-    - [Bug Fixes](#bug-fixes-20)
-    - [Code Generation](#code-generation-23)
-    - [Code Refactoring](#code-refactoring-6)
-    - [Documentation](#documentation-16)
-    - [Features](#features-15)
-    - [Tests](#tests-14)
-    - [Unclassified](#unclassified-8)
-- [0.6.3-alpha.1 (2021-05-17)](#063-alpha1-2021-05-17)
-  - [Breaking Changes](#breaking-changes-12)
-    - [Bug Fixes](#bug-fixes-21)
-    - [Code Generation](#code-generation-24)
-    - [Code Refactoring](#code-refactoring-7)
-- [0.6.2-alpha.1 (2021-05-14)](#062-alpha1-2021-05-14)
-  - [Code Generation](#code-generation-25)
+  - [Documentation](#documentation-16)
+  - [Features](#features-15)
+  - [Tests](#tests-14)
+- [0.7.3-alpha.1 (2021-08-28)](#073-alpha1-2021-08-28)
+  - [Bug Fixes](#bug-fixes-20)
+  - [Code Generation](#code-generation-23)
   - [Documentation](#documentation-17)
-- [0.6.1-alpha.1 (2021-05-11)](#061-alpha1-2021-05-11)
-  - [Code Generation](#code-generation-26)
   - [Features](#features-16)
-- [0.6.0-alpha.2 (2021-05-07)](#060-alpha2-2021-05-07)
-  - [Bug Fixes](#bug-fixes-22)
-  - [Code Generation](#code-generation-27)
-  - [Features](#features-17)
-- [0.6.0-alpha.1 (2021-05-05)](#060-alpha1-2021-05-05)
+- [0.7.1-alpha.1 (2021-07-22)](#071-alpha1-2021-07-22)
+  - [Bug Fixes](#bug-fixes-21)
+  - [Code Generation](#code-generation-24)
+  - [Documentation](#documentation-18)
+  - [Tests](#tests-15)
+- [0.7.0-alpha.1 (2021-07-13)](#070-alpha1-2021-07-13)
   - [Breaking Changes](#breaking-changes-13)
+    - [Bug Fixes](#bug-fixes-22)
+    - [Code Generation](#code-generation-25)
+    - [Code Refactoring](#code-refactoring-7)
+    - [Documentation](#documentation-19)
+    - [Features](#features-17)
+    - [Tests](#tests-16)
+    - [Unclassified](#unclassified-9)
+- [0.6.3-alpha.1 (2021-05-17)](#063-alpha1-2021-05-17)
+  - [Breaking Changes](#breaking-changes-14)
     - [Bug Fixes](#bug-fixes-23)
-    - [Code Generation](#code-generation-28)
+    - [Code Generation](#code-generation-26)
     - [Code Refactoring](#code-refactoring-8)
-    - [Documentation](#documentation-18)
-    - [Features](#features-18)
-    - [Tests](#tests-15)
-    - [Unclassified](#unclassified-9)
-- [0.5.5-alpha.1 (2020-12-09)](#055-alpha1-2020-12-09)
+- [0.6.2-alpha.1 (2021-05-14)](#062-alpha1-2021-05-14)
+  - [Code Generation](#code-generation-27)
+  - [Documentation](#documentation-20)
+- [0.6.1-alpha.1 (2021-05-11)](#061-alpha1-2021-05-11)
+  - [Code Generation](#code-generation-28)
+  - [Features](#features-18)
+- [0.6.0-alpha.2 (2021-05-07)](#060-alpha2-2021-05-07)
   - [Bug Fixes](#bug-fixes-24)
   - [Code Generation](#code-generation-29)
-  - [Documentation](#documentation-19)
   - [Features](#features-19)
-  - [Tests](#tests-16)
-  - [Unclassified](#unclassified-10)
-- [0.5.4-alpha.1 (2020-11-11)](#054-alpha1-2020-11-11)
-  - [Bug Fixes](#bug-fixes-25)
-  - [Code Generation](#code-generation-30)
-  - [Code Refactoring](#code-refactoring-9)
-  - [Documentation](#documentation-20)
-  - [Features](#features-20)
-- [0.5.3-alpha.1 (2020-10-27)](#053-alpha1-2020-10-27)
+- [0.6.0-alpha.1 (2021-05-05)](#060-alpha1-2021-05-05)
+  - [Breaking Changes](#breaking-changes-15)
+    - [Bug Fixes](#bug-fixes-25)
+    - [Code Generation](#code-generation-30)
+    - [Code Refactoring](#code-refactoring-9)
+    - [Documentation](#documentation-21)
+    - [Features](#features-20)
+    - [Tests](#tests-17)
+    - [Unclassified](#unclassified-10)
+- [0.5.5-alpha.1 (2020-12-09)](#055-alpha1-2020-12-09)
   - [Bug Fixes](#bug-fixes-26)
   - [Code Generation](#code-generation-31)
-  - [Documentation](#documentation-21)
+  - [Documentation](#documentation-22)
   - [Features](#features-21)
-  - [Tests](#tests-17)
-- [0.5.2-alpha.1 (2020-10-22)](#052-alpha1-2020-10-22)
+  - [Tests](#tests-18)
+  - [Unclassified](#unclassified-11)
+- [0.5.4-alpha.1 (2020-11-11)](#054-alpha1-2020-11-11)
   - [Bug Fixes](#bug-fixes-27)
   - [Code Generation](#code-generation-32)
-  - [Documentation](#documentation-22)
-  - [Tests](#tests-18)
-- [0.5.1-alpha.1 (2020-10-20)](#051-alpha1-2020-10-20)
-  - [Bug Fixes](#bug-fixes-28)
-  - [Code Generation](#code-generation-33)
+  - [Code Refactoring](#code-refactoring-10)
   - [Documentation](#documentation-23)
   - [Features](#features-22)
+- [0.5.3-alpha.1 (2020-10-27)](#053-alpha1-2020-10-27)
+  - [Bug Fixes](#bug-fixes-28)
+  - [Code Generation](#code-generation-33)
+  - [Documentation](#documentation-24)
+  - [Features](#features-23)
   - [Tests](#tests-19)
-  - [Unclassified](#unclassified-11)
-- [0.5.0-alpha.1 (2020-10-15)](#050-alpha1-2020-10-15)
-  - [Breaking Changes](#breaking-changes-14)
-    - [Bug Fixes](#bug-fixes-29)
-    - [Code Generation](#code-generation-34)
-    - [Code Refactoring](#code-refactoring-10)
-    - [Documentation](#documentation-24)
-    - [Features](#features-23)
-    - [Tests](#tests-20)
-    - [Unclassified](#unclassified-12)
-- [0.4.6-alpha.1 (2020-07-13)](#046-alpha1-2020-07-13)
+- [0.5.2-alpha.1 (2020-10-22)](#052-alpha1-2020-10-22)
+  - [Bug Fixes](#bug-fixes-29)
+  - [Code Generation](#code-generation-34)
+  - [Documentation](#documentation-25)
+  - [Tests](#tests-20)
+- [0.5.1-alpha.1 (2020-10-20)](#051-alpha1-2020-10-20)
   - [Bug Fixes](#bug-fixes-30)
   - [Code Generation](#code-generation-35)
-- [0.4.5-alpha.1 (2020-07-13)](#045-alpha1-2020-07-13)
-  - [Bug Fixes](#bug-fixes-31)
-  - [Code Generation](#code-generation-36)
-- [0.4.4-alpha.1 (2020-07-10)](#044-alpha1-2020-07-10)
+  - [Documentation](#documentation-26)
+  - [Features](#features-24)
+  - [Tests](#tests-21)
+  - [Unclassified](#unclassified-12)
+- [0.5.0-alpha.1 (2020-10-15)](#050-alpha1-2020-10-15)
+  - [Breaking Changes](#breaking-changes-16)
+    - [Bug Fixes](#bug-fixes-31)
+    - [Code Generation](#code-generation-36)
+    - [Code Refactoring](#code-refactoring-11)
+    - [Documentation](#documentation-27)
+    - [Features](#features-25)
+    - [Tests](#tests-22)
+    - [Unclassified](#unclassified-13)
+- [0.4.6-alpha.1 (2020-07-13)](#046-alpha1-2020-07-13)
   - [Bug Fixes](#bug-fixes-32)
   - [Code Generation](#code-generation-37)
-  - [Documentation](#documentation-25)
-- [0.4.3-alpha.1 (2020-07-08)](#043-alpha1-2020-07-08)
+- [0.4.5-alpha.1 (2020-07-13)](#045-alpha1-2020-07-13)
   - [Bug Fixes](#bug-fixes-33)
   - [Code Generation](#code-generation-38)
-- [0.4.2-alpha.1 (2020-07-08)](#042-alpha1-2020-07-08)
+- [0.4.4-alpha.1 (2020-07-10)](#044-alpha1-2020-07-10)
   - [Bug Fixes](#bug-fixes-34)
   - [Code Generation](#code-generation-39)
+  - [Documentation](#documentation-28)
+- [0.4.3-alpha.1 (2020-07-08)](#043-alpha1-2020-07-08)
+  - [Bug Fixes](#bug-fixes-35)
+  - [Code Generation](#code-generation-40)
+- [0.4.2-alpha.1 (2020-07-08)](#042-alpha1-2020-07-08)
+  - [Bug Fixes](#bug-fixes-36)
+  - [Code Generation](#code-generation-41)
 - [0.4.0-alpha.1 (2020-07-08)](#040-alpha1-2020-07-08)
-  - [Breaking Changes](#breaking-changes-15)
-    - [Bug Fixes](#bug-fixes-35)
-    - [Code Generation](#code-generation-40)
-    - [Code Refactoring](#code-refactoring-11)
-    - [Documentation](#documentation-26)
-    - [Features](#features-24)
-    - [Unclassified](#unclassified-13)
-- [0.3.0-alpha.1 (2020-05-15)](#030-alpha1-2020-05-15)
-  - [Breaking Changes](#breaking-changes-16)
-    - [Bug Fixes](#bug-fixes-36)
-    - [Chores](#chores)
+  - [Breaking Changes](#breaking-changes-17)
+    - [Bug Fixes](#bug-fixes-37)
+    - [Code Generation](#code-generation-42)
     - [Code Refactoring](#code-refactoring-12)
-    - [Documentation](#documentation-27)
-    - [Features](#features-25)
+    - [Documentation](#documentation-29)
+    - [Features](#features-26)
     - [Unclassified](#unclassified-14)
+- [0.3.0-alpha.1 (2020-05-15)](#030-alpha1-2020-05-15)
+  - [Breaking Changes](#breaking-changes-18)
+    - [Bug Fixes](#bug-fixes-38)
+    - [Chores](#chores)
+    - [Code Refactoring](#code-refactoring-13)
+    - [Documentation](#documentation-30)
+    - [Features](#features-27)
+    - [Unclassified](#unclassified-15)
 - [0.2.1-alpha.1 (2020-05-05)](#021-alpha1-2020-05-05)
   - [Chores](#chores-1)
-  - [Documentation](#documentation-28)
+  - [Documentation](#documentation-31)
 - [0.2.0-alpha.2 (2020-05-04)](#020-alpha2-2020-05-04)
-  - [Breaking Changes](#breaking-changes-17)
-    - [Bug Fixes](#bug-fixes-37)
+  - [Breaking Changes](#breaking-changes-19)
+    - [Bug Fixes](#bug-fixes-39)
     - [Chores](#chores-2)
-    - [Code Refactoring](#code-refactoring-13)
-    - [Documentation](#documentation-29)
-    - [Features](#features-26)
-    - [Unclassified](#unclassified-15)
+    - [Code Refactoring](#code-refactoring-14)
+    - [Documentation](#documentation-32)
+    - [Features](#features-28)
+    - [Unclassified](#unclassified-16)
 - [0.1.1-alpha.1 (2020-02-18)](#011-alpha1-2020-02-18)
-  - [Bug Fixes](#bug-fixes-38)
-  - [Code Refactoring](#code-refactoring-14)
-  - [Documentation](#documentation-30)
-- [0.1.0-alpha.6 (2020-02-16)](#010-alpha6-2020-02-16)
-  - [Bug Fixes](#bug-fixes-39)
+  - [Bug Fixes](#bug-fixes-40)
   - [Code Refactoring](#code-refactoring-15)
-  - [Documentation](#documentation-31)
-  - [Features](#features-27)
+  - [Documentation](#documentation-33)
+- [0.1.0-alpha.6 (2020-02-16)](#010-alpha6-2020-02-16)
+  - [Bug Fixes](#bug-fixes-41)
+  - [Code Refactoring](#code-refactoring-16)
+  - [Documentation](#documentation-34)
+  - [Features](#features-29)
 - [0.1.0-alpha.5 (2020-02-06)](#010-alpha5-2020-02-06)
-  - [Documentation](#documentation-32)
-  - [Features](#features-28)
+  - [Documentation](#documentation-35)
+  - [Features](#features-30)
 - [0.1.0-alpha.4 (2020-02-06)](#010-alpha4-2020-02-06)
   - [Continuous Integration](#continuous-integration)
-  - [Documentation](#documentation-33)
+  - [Documentation](#documentation-36)
 - [0.1.0-alpha.3 (2020-02-06)](#010-alpha3-2020-02-06)
   - [Continuous Integration](#continuous-integration-1)
 - [0.1.0-alpha.2 (2020-02-03)](#010-alpha2-2020-02-03)
-  - [Bug Fixes](#bug-fixes-40)
-  - [Documentation](#documentation-34)
-  - [Features](#features-29)
-  - [Unclassified](#unclassified-16)
+  - [Bug Fixes](#bug-fixes-42)
+  - [Documentation](#documentation-37)
+  - [Features](#features-31)
+  - [Unclassified](#unclassified-17)
 - [0.1.0-alpha.1 (2020-01-31)](#010-alpha1-2020-01-31)
-  - [Documentation](#documentation-35)
+  - [Documentation](#documentation-38)
 - [0.0.3-alpha.15 (2020-01-31)](#003-alpha15-2020-01-31)
-  - [Unclassified](#unclassified-17)
-- [0.0.3-alpha.14 (2020-01-31)](#003-alpha14-2020-01-31)
   - [Unclassified](#unclassified-18)
-- [0.0.3-alpha.13 (2020-01-31)](#003-alpha13-2020-01-31)
+- [0.0.3-alpha.14 (2020-01-31)](#003-alpha14-2020-01-31)
   - [Unclassified](#unclassified-19)
-- [0.0.3-alpha.11 (2020-01-31)](#003-alpha11-2020-01-31)
+- [0.0.3-alpha.13 (2020-01-31)](#003-alpha13-2020-01-31)
   - [Unclassified](#unclassified-20)
-- [0.0.3-alpha.10 (2020-01-31)](#003-alpha10-2020-01-31)
+- [0.0.3-alpha.11 (2020-01-31)](#003-alpha11-2020-01-31)
   - [Unclassified](#unclassified-21)
-- [0.0.3-alpha.7 (2020-01-30)](#003-alpha7-2020-01-30)
+- [0.0.3-alpha.10 (2020-01-31)](#003-alpha10-2020-01-31)
   - [Unclassified](#unclassified-22)
+- [0.0.3-alpha.7 (2020-01-30)](#003-alpha7-2020-01-30)
+  - [Unclassified](#unclassified-23)
 - [0.0.3-alpha.5 (2020-01-30)](#003-alpha5-2020-01-30)
   - [Continuous Integration](#continuous-integration-2)
-  - [Unclassified](#unclassified-23)
-- [0.0.3-alpha.4 (2020-01-30)](#003-alpha4-2020-01-30)
   - [Unclassified](#unclassified-24)
-- [0.0.3-alpha.2 (2020-01-30)](#003-alpha2-2020-01-30)
+- [0.0.3-alpha.4 (2020-01-30)](#003-alpha4-2020-01-30)
   - [Unclassified](#unclassified-25)
-- [0.0.3-alpha.1 (2020-01-30)](#003-alpha1-2020-01-30)
+- [0.0.3-alpha.2 (2020-01-30)](#003-alpha2-2020-01-30)
   - [Unclassified](#unclassified-26)
+- [0.0.3-alpha.1 (2020-01-30)](#003-alpha1-2020-01-30)
+  - [Unclassified](#unclassified-27)
 - [0.0.1-alpha.9 (2020-01-29)](#001-alpha9-2020-01-29)
   - [Continuous Integration](#continuous-integration-3)
 - [0.0.2-alpha.1 (2020-01-29)](#002-alpha1-2020-01-29)
-  - [Unclassified](#unclassified-27)
+  - [Unclassified](#unclassified-28)
 - [0.0.1-alpha.6 (2020-01-29)](#001-alpha6-2020-01-29)
   - [Continuous Integration](#continuous-integration-4)
 - [0.0.1-alpha.5 (2020-01-29)](#001-alpha5-2020-01-29)
   - [Continuous Integration](#continuous-integration-5)
-  - [Unclassified](#unclassified-28)
+  - [Unclassified](#unclassified-29)
 - [0.0.1-alpha.3 (2020-01-28)](#001-alpha3-2020-01-28)
   - [Continuous Integration](#continuous-integration-6)
-  - [Documentation](#documentation-36)
-  - [Unclassified](#unclassified-29)
+  - [Documentation](#documentation-39)
+  - [Unclassified](#unclassified-30)
 
 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
 
-# [](https://github.com/ory/kratos/compare/v1.1.0...v) (2024-04-26)
+# [](https://github.com/ory/kratos/compare/v1.3.0...v) (2024-12-27)
+
+## Breaking Changes
+
+The total count header `x-total-count` will no longer be sent in response to
+`GET /admin/sessions` requests.
+
+Closes https://github.com/ory-corp/cloud/issues/7177 Closes
+https://github.com/ory-corp/cloud/issues/7175 Closes
+https://github.com/ory-corp/cloud/issues/7176
+
+### Bug Fixes
+
+- Account linking should only happen after 2fa when required
+  ([#4174](https://github.com/ory/kratos/issues/4174))
+  ([8e29b68](https://github.com/ory/kratos/commit/8e29b68a595d2ef18e48c2a01072335cefa36d86))
+- Account linking with 2FA ([#4188](https://github.com/ory/kratos/issues/4188))
+  ([4a870a6](https://github.com/ory/kratos/commit/4a870a678dd3676abda7afc9803399dec4411b05)):
+
+  This fixes some edge cases with OIDC account linking for accounts with 2FA
+  enabled.
+
+- Add exists clause ([#4191](https://github.com/ory/kratos/issues/4191))
+  ([a313dd6](https://github.com/ory/kratos/commit/a313dd6ba6d823deb40f14c738e3b609dbaad56c))
+- Add missing autocomplete attributes to identifier_first strategy
+  ([#4215](https://github.com/ory/kratos/issues/4215))
+  ([e1f29c2](https://github.com/ory/kratos/commit/e1f29c2d3524f9444ec067c52d2c9f1d44fa6539))
+- Cancel conditional passkey before trying again
+  ([#4247](https://github.com/ory/kratos/issues/4247))
+  ([d9f6f75](https://github.com/ory/kratos/commit/d9f6f75b6a43aad996f6390f73616a2cf596c6e4))
+- Do not roll back transaction on partial identity insert error
+  ([#4211](https://github.com/ory/kratos/issues/4211))
+  ([82660f0](https://github.com/ory/kratos/commit/82660f04e2f33d0aa86fccee42c90773a901d400))
+- Duplicate autocomplete trigger
+  ([6bbf915](https://github.com/ory/kratos/commit/6bbf91593a37e4973a86f610290ebab44df8dc81))
+- Enable b2b_sso hook in more places
+  ([#4168](https://github.com/ory/kratos/issues/4168))
+  ([0c48ad1](https://github.com/ory/kratos/commit/0c48ad12b978bf58b6bc68b0684a7879f93ebf06)):
+
+  fix: allow b2b_sso hook in more places
+
+- Explicity set updated_at field when updating identity
+  ([#4131](https://github.com/ory/kratos/issues/4131))
+  ([66afac1](https://github.com/ory/kratos/commit/66afac173dc08b1d6666b107cf7050a2b0b27774))
+- Gracefully handle unused index
+  ([#4196](https://github.com/ory/kratos/issues/4196))
+  ([3dbeb64](https://github.com/ory/kratos/commit/3dbeb64b3f99a3aeba5f7126c301b72fda4c3e3c))
+- Incorrect query plan ([#4218](https://github.com/ory/kratos/issues/4218))
+  ([7d0e78a](https://github.com/ory/kratos/commit/7d0e78a4f6631b0662beee3b8e9dd0d774b875ea))
+- Order-by clause and span names
+  ([#4200](https://github.com/ory/kratos/issues/4200))
+  ([b6278af](https://github.com/ory/kratos/commit/b6278af5c7ed7fb845a71ad0e64f8b87402a8f4b))
+- Pass on correct context during verification
+  ([#4151](https://github.com/ory/kratos/issues/4151))
+  ([7e0b500](https://github.com/ory/kratos/commit/7e0b500aada9c1931c759a43db7360e85afb57e3))
+- Preview_credentials_identifier_similar
+  ([#4246](https://github.com/ory/kratos/issues/4246))
+  ([5ee54ed](https://github.com/ory/kratos/commit/5ee54eda909638fa10c543f156042a217b34cba6))
+- Registration post persist hooks should not be cancelable
+  ([#4148](https://github.com/ory/kratos/issues/4148))
+  ([18056a0](https://github.com/ory/kratos/commit/18056a0f1cfdf42769e5a974b2526ccf5c608cc2))
+- **sdk:** Remove incorrect attributes
+  ([#4163](https://github.com/ory/kratos/issues/4163))
+  ([88c68aa](https://github.com/ory/kratos/commit/88c68aa07281a638c9897e76d300d1095b17601d))
+- Send correct verification status in post-recovery hook
+  ([#4224](https://github.com/ory/kratos/issues/4224))
+  ([7f50400](https://github.com/ory/kratos/commit/7f5040080578e194dde3605dbb1a344fe9ff27ae)):
+
+  The verification status is now correctly being transported when executing a
+  recovery hook.
+
+- Span names ([#4232](https://github.com/ory/kratos/issues/4232))
+  ([dbae98a](https://github.com/ory/kratos/commit/dbae98a26b8e2a3328d8510745ddb58c18b7ad3d))
+- Truncate updated at ([#4149](https://github.com/ory/kratos/issues/4149))
+  ([2f8aaee](https://github.com/ory/kratos/commit/2f8aaee0716835caaba0dff9b6cc457c2cdff5d4))
+- Use context for readiness probes
+  ([#4219](https://github.com/ory/kratos/issues/4219))
+  ([e6d2d4d](https://github.com/ory/kratos/commit/e6d2d4d0c04e60ab5b0658b9e5c4c52104446368))
+
+### Code Refactoring
+
+- Hash comparator instantiation
+  ([#4195](https://github.com/ory/kratos/issues/4195))
+  ([53a5a8b](https://github.com/ory/kratos/commit/53a5a8b93cec274456df3d988eb3bd12bc11fa87))
+- Remove total count from listSessions and improve secondary indices
+  ([#4173](https://github.com/ory/kratos/issues/4173))
+  ([e24f993](https://github.com/ory/kratos/commit/e24f993ea4236bac4e23bd4250c11b5932040fd9)):
+
+  This patch changes sorting to improve performance on list session endpoints.
+  It also removes the `x-total-count` header from list responses.
+
+### Documentation
+
+- Add return_to query parameter to OAS Verification Flow for Native Apps
+  ([#4086](https://github.com/ory/kratos/issues/4086))
+  ([b22135f](https://github.com/ory/kratos/commit/b22135fa05d7fb47dfeaccd7cdc183d16921a7ac))
+- Clarify facebook graph API versioning
+  ([#4208](https://github.com/ory/kratos/issues/4208))
+  ([a90df58](https://github.com/ory/kratos/commit/a90df5852ba96704863cc576edcb8286eaa9b3f9))
+- Improve SecurityError error message for ory elements local
+  ([#4205](https://github.com/ory/kratos/issues/4205))
+  ([0062d45](https://github.com/ory/kratos/commit/0062d45b6c9a6323f9dccb10f63dce752836c29e))
+- Remove unused SMS config from schema
+  ([#4212](https://github.com/ory/kratos/issues/4212))
+  ([f076fe4](https://github.com/ory/kratos/commit/f076fe4e1487f67f355eaa7f238090abf3796578))
+- Usage of `organization` parameter in native self-service flows
+  ([#4176](https://github.com/ory/kratos/issues/4176))
+  ([cb71e38](https://github.com/ory/kratos/commit/cb71e38147d21f73e9bd1e081dc3443abb63353e))
+
+### Features
+
+- Add attributes to webhook events for better debugging
+  ([#4206](https://github.com/ory/kratos/issues/4206))
+  ([00da05d](https://github.com/ory/kratos/commit/00da05da9f77bbfb68b364b3ba2a5d0a2d9e4f15))
+- Add explicit config flag for secure cookies
+  ([#4180](https://github.com/ory/kratos/issues/4180))
+  ([2aabe12](https://github.com/ory/kratos/commit/2aabe12e5329acc807c495445999e5591bdf982b)):
+
+  Adds a new config flag for session and all other cookies. Falls back to the
+  previous behavior of using the dev mode to decide if the cookie should be
+  secure or not.
+
+- Add failure reason to events
+  ([#4203](https://github.com/ory/kratos/issues/4203))
+  ([afa7618](https://github.com/ory/kratos/commit/afa76180e77df0ee0f96eef3b3f2b2d3fe08a33d))
+- Add migrate sql up|down|status
+  ([#4228](https://github.com/ory/kratos/issues/4228))
+  ([e6fa520](https://github.com/ory/kratos/commit/e6fa520058ca778e01d4e93a8ab4b31a74dd2e11)):
+
+  This patch adds the ability to execute down migrations using:
+
+  ```
+  kratos migrate sql down -e --steps {num_of_steps}
+  ```
+
+  Please read `kratos migrate sql down --help` carefully.
+
+  Going forward, please use the following commands
+
+  ```
+  kratos migrate sql up ...
+  kratos migrate sql status ...
+  ```
+
+  instead of the previous, now deprecated
+
+  ```
+  kratos migrate sql ...
+  kratos migrate status ...
+  ```
+
+  commands.
+
+  See https://github.com/ory-corp/cloud/issues/7350
+
+- Add oid as subject source for microsoft
+  ([#4171](https://github.com/ory/kratos/issues/4171))
+  ([77beb4d](https://github.com/ory/kratos/commit/77beb4de5209cee0bea4b63dfec21d656cf64473)),
+  closes [#4170](https://github.com/ory/kratos/issues/4170):
+
+  In the case of Microsoft, using `sub` as an identifier can lead to problems.
+  Because the use of OIDC at Microsoft is based on an app registration, the
+  content of `sub` changes with every new app registration. `Sub` is therefore
+  not uniquely related to the user. It is therefore not possible to transfer
+  users from one app registration to another without further problems.
+  https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference#payload-claims
+
+  With the use of `oid` it is possible to identify a user by a unique id.
+
+- Allow extra go migrations in persister
+  ([#4183](https://github.com/ory/kratos/issues/4183))
+  ([7bec935](https://github.com/ory/kratos/commit/7bec935c33b9adb6033aaecfa9a6dbe6c9c3daa1))
+- Allow listing identities by organization ID
+  ([#4115](https://github.com/ory/kratos/issues/4115))
+  ([b4c453b](https://github.com/ory/kratos/commit/b4c453b0472f67d0a52b345691f66aa48777a897))
+- Cache OIDC providers ([#4222](https://github.com/ory/kratos/issues/4222))
+  ([30485c4](https://github.com/ory/kratos/commit/30485c44e61c17231e0c46b321be842b19ea5a5f)):
+
+  This change significantly reduces the number of requests to
+  `/.well-known/openid-configuration` endpoints.
+
+- Drop unused indices post index migration
+  ([#4201](https://github.com/ory/kratos/issues/4201))
+  ([1008639](https://github.com/ory/kratos/commit/1008639428a6b72e0aa47bd13fe9c1d120aafb6e))
+- Emit admin recovery code event
+  ([#4230](https://github.com/ory/kratos/issues/4230))
+  ([a7cdc3a](https://github.com/ory/kratos/commit/a7cdc3a6911e265f4e78c780d8e4b8922066875c))
+- Fast add credential type lookups
+  ([#4177](https://github.com/ory/kratos/issues/4177))
+  ([eeb1355](https://github.com/ory/kratos/commit/eeb13552118504f17b48f2c7e002e777f5ee73f4))
+- Gracefully handle failing password rehashing during login
+  ([#4235](https://github.com/ory/kratos/issues/4235))
+  ([3905787](https://github.com/ory/kratos/commit/39057879821b387b49f5d4f7cb19b9e02ec924a7)):
+
+  This fixes an issue where we would successfully import long passwords (>72
+  chars), but fail when the user attempts to login with the correct password
+  because we can't rehash it. In this case, we simply issue a warning to the
+  logs, keep the old hash intact, and continue logging in the user.
+
+- Improve QueryForCredentials
+  ([#4181](https://github.com/ory/kratos/issues/4181))
+  ([ca0d6a7](https://github.com/ory/kratos/commit/ca0d6a7ea717495429b8bac7fd843ac69c1ebf16))
+- Improve secondary indices for self service tables
+  ([#4179](https://github.com/ory/kratos/issues/4179))
+  ([825aec2](https://github.com/ory/kratos/commit/825aec208d966b54df9eeac6643e6d8129cf2253))
+- Improved tracing for courier
+  ([85a7071](https://github.com/ory/kratos/commit/85a7071d20d0f072316c74bee82c76ee690276f8))
+- Jackson provider ([#4242](https://github.com/ory/kratos/issues/4242))
+  ([f18d1b2](https://github.com/ory/kratos/commit/f18d1b24539f7d8dcf9c27986af861d0f8cb9683)):
+
+  This adds a jackson provider to Kratos.
+
+- Load session only once when middleware is used
+  ([#4187](https://github.com/ory/kratos/issues/4187))
+  ([234b6f2](https://github.com/ory/kratos/commit/234b6f2f6435c62b7e161c032b888c4e2b3328d4))
+- Optimize identity-related secondary indices
+  ([#4182](https://github.com/ory/kratos/issues/4182))
+  ([53874c1](https://github.com/ory/kratos/commit/53874c1753940e08e0bf50753a1d3126add77af1))
+- Passwordless SMS and expiry notice in code / link templates
+  ([#4104](https://github.com/ory/kratos/issues/4104))
+  ([462cea9](https://github.com/ory/kratos/commit/462cea91448a00a0db21e20c2c347bf74957dc8f)):
+
+  This feature allows Ory Kratos to use the SMS gateway for login and
+  registration with code via SMS.
+
+  Additionally, the default email and sms templates have been updated. We now
+  also expose `ExpiresInMinutes` / `expires_in_minutes` in the templates, making
+  it easier to remind the user how long the code or link is valid for.
+
+  Closes https://github.com/ory/kratos/issues/1570 Closes
+  https://github.com/ory/kratos/issues/3779
+
+- Remove duplicate queries during settings flow and use better index hint for
+  credentials lookup ([#4193](https://github.com/ory/kratos/issues/4193))
+  ([c33965e](https://github.com/ory/kratos/commit/c33965e5735ead3acddac87ef84c3a730874f9ab)):
+
+  This patch reduces duplicate GetIdentity queries as part of submitting the
+  settings flow, and improves an index to significantly reduce credential
+  lookup.
+
+  For better debugging, more tracing ha been added to the settings module.
+
+- Remove more unused indices
+  ([#4186](https://github.com/ory/kratos/issues/4186))
+  ([b294804](https://github.com/ory/kratos/commit/b2948044de4eee1841110162fe874055182bd2d2))
+- Rework the OTP code submit count mechanism
+  ([#4251](https://github.com/ory/kratos/issues/4251))
+  ([4ca4d79](https://github.com/ory/kratos/commit/4ca4d79cff5185caad27eddee7e6f8d0e58463ba)):
+
+  - feat: rework the OTP code submit count mechanism
+
+  Unlike what the previous comment suggested, incrementing and checking the
+  submit count inside the database transaction is not actually optimal
+  peformance- or security-wise.
+
+  We now check atomically increment and check the submit count as the first part
+  of the operation, and abort as early as possible if we detect brute-forcing.
+  This prevents a situation where the check works only on certain transaction
+  isolation levels.
+
+  - chore: bump dependencies
+
+- Support android webauthn origins
+  ([#4155](https://github.com/ory/kratos/issues/4155))
+  ([a82d288](https://github.com/ory/kratos/commit/a82d288014411ae4eb82c718bfe825ca55b4fab0)):
+
+  This patch adds the ability to verify Android APK origins used during
+  WebAuthn/Passkey exchange.
+
+  Upgrades go-webauthn and includes fixes for Go 1.23 and workarounds for
+  Swagger.
+
+- Use one transaction for `/admin/recovery/code`
+  ([#4225](https://github.com/ory/kratos/issues/4225))
+  ([3e87e0c](https://github.com/ory/kratos/commit/3e87e0c4559736f9476eba943bac8d67cde91aad))
+
+### Tests
+
+- Update snapshots ([#4167](https://github.com/ory/kratos/issues/4167))
+  ([b51f780](https://github.com/ory/kratos/commit/b51f780b7e4abc79a757ac1efe1cb65b3d35c8a4))
+
+# [1.3.0](https://github.com/ory/kratos/compare/v1.2.0...v1.3.0) (2024-09-26)
+
+We are thrilled to announce the release
+of [Ory Kratos v1.3.0](https://www.ory.sh/kratos)! This release includes
+significant updates, enhancements, and fixes to improve your experience with Ory
+Kratos.
+
+![Ory Kratos 1.3.0 Release](https://www.ory.sh/images/newsletter/kratos-1.3.0/kratos-1.3-release.png)
+
+Enhance your sign-in experience with Identifier First Authentication. This
+feature allows users to first identify themselves (e.g., by providing their
+email or username) and then proceed with the chosen authentication method,
+whether it be OTP code, passkeys, passwords, or social login. By streamlining
+the sign-in process, users can select the authentication method that best suits
+their needs, reducing friction and enhancing security. Identifier First
+Authentication improves user flow and reduces the likelihood of errors,
+resulting in a more user-friendly and efficient login experience.
+
+![Identifier First Authentication](https://www.ory.sh/images/newsletter/kratos-1.3.0/identifier-first-demo.png)
+
+The UI for OpenID Connect (OIDC) account linking has been improved to provide
+better user guidance and error messages during the linking process. As a result,
+account linking error rates have dropped significantly, making it easier for
+users to link multiple identities (e.g., social login and email-based accounts)
+to the same profile. This improvement enhances user convenience, reduces support
+inquiries, and offers a seamless multi-account experience.
+
+You can now use Salesforce as an identity provider, expanding the range of
+supported identity providers. This integration allows organizations already
+using Salesforce for identity management to leverage their existing
+infrastructure, simplifying user management and enhancing the authentication
+experience.
+
+Social sign-in has been enhanced with better detection and handling of
+double-submit issues, especially for platforms like Facebook and Apple mobile
+login. These changes make the social login process more reliable, reducing
+errors and improving the user experience. Additionally, Ory Kratos now supports
+social providers in credential discovery, offering more flexibility during
+sign-up and sign-in flows.
+
+One-Time Password (OTP) MFA has been improved with more robust handling of
+code-based authentication. The enhancements ensure a smoother flow when using
+OTP for multi-factor authentication (MFA), providing clearer guidance to users
+and improving fallback mechanisms. These updates help to prevent users from
+being locked out due to misconfigurations or errors during the MFA process,
+increasing security without compromising user convenience.
+
+- **Deprecated `via` Parameter for SMS 2FA**: The `via` parameter is now
+  deprecated when performing SMS 2FA. If not included, users will see all their
+  phone/email addresses to perform the flow. This parameter will be removed in a
+  future version. Ensure your identity schema has the appropriate code
+  configuration for passwordless or 2FA login.
+- **Endpoint Change**: The `/admin/session/.../extend` endpoint will now return
+  204 No Content for new Ory Network projects. Returning 200 with the session
+  body will be deprecated in future versions.
+
+- **SDK Enhancements**: Added new methods and support for additional actions in
+  the SDK, improving integration capabilities.
+- **Password Migration Hook**: Added a password migration hook to facilitate
+  migrating passwords where the hash is unavailable, easing the transition to
+  Ory Kratos.
+- **Partially Failing Batch Inserts:** When batch-inserting multiple identities,
+  conflicts or validation errors of a subset of identities in the batch still
+  allow the rest of the identities to be inserted. The returned JSON contains
+  the error details that led to the failure.
+
+- **Security Fixes**: Fixed a security vulnerability where the `code` method did
+  not respect the `highest_available`setting. Refer to
+  the [security advisory](https://github.com/ory/kratos/security/advisories/GHSA-wc43-73w7-x2f5) for
+  more details.
+- **Session Extension Issues**: Fixed issues related to session extension to
+  prevent long response times on `/session/whoami` when extending sessions
+  simultaneously.
+- **OIDC and Social Sign-In**: Fixed UI and error handling for OpenID Connect
+  and social sign-in flows, improving the overall experience.
+- **Credential Identifier Handling**: Corrected handling of code credential
+  identifiers, ensuring proper detection of phone numbers and correct
+  functioning of SMS/email MFA.
+- **Concurrent Updates for Webhooks**: Fixed concurrent map update issues for
+  webhook headers, improving webhook reliability.
+
+- **Passwordless & 2FA Login**: Before upgrading, ensure your identity schema
+  has the appropriate code configuration when using the code method for
+  passwordless or 2FA login.
+- **Code Method for 2FA**: If you use the code method for 2FA or 1FA login but
+  haven't configured the code identifier,
+  set `selfservice.methods.code.config.missing_credential_fallback_enabled` to `true` to
+  avoid user lockouts.
+
+We hope you enjoy the new features and improvements in Ory Kratos v1.3.0. Please
+remember to leave a [GitHub star](https://github.com/ory/kratos) and check out
+our other [open-source projects](https://github.com/ory). Your feedback is
+valuable to us, so join the [Ory community](https://slack.ory.sh/) and help us
+shape the future of identity management.
+
+## Breaking Changes
+
+When using two-step registration, it was previously possible to send
+`method=profile:back` to get to the previous screen. This feature was not
+documented in the SDK API yet. Going forward, please instead use
+`screen=previous`.
+
+Please note that the `via` parameter is deprecated when performing SMS 2FA. It
+will be removed in a future version. If the parameter is not included in the
+request, the user will see all their phone/email addresses from which to perform
+the flow.
+
+Before upgrading, ensure that your identity schema has the appropriate code
+configuration when using the code method for passwordless or 2fa login.
+
+If you are using the code method for 2FA login already, or you are using it for
+1FA login but have not yet configured the code identifier, set
+`selfservice.methods.code.config.missing_credential_fallback_enabled` to `true`
+to prevent users from being locked out.
+
+Please note that the `via` parameter is deprecated when performing SMS 2FA. It
+will be removed in a future version. If the parameter is not included in the
+request, the user will see all their phone/email addresses from which to perform
+the flow.
+
+Before upgrading, ensure that your identity schema has the appropriate code
+configuration when using the code method for passwordless or 2fa login.
+
+If you are using the code method for 2FA login already, or you are using it for
+1FA login but have not yet configured the code identifier, set
+`selfservice.methods.code.config.missing_credential_fallback_enabled` to `true`
+to prevent users from being locked out.
+
+Going forward, the `/admin/session/.../extend` endpoint will return 204 no
+content for new Ory Network projects. We will deprecate returning 200 + session
+body in the future.
+
+### Bug Fixes
+
+- Add continue with only for json browser requests
+  ([#4002](https://github.com/ory/kratos/issues/4002))
+  ([e0a4010](https://github.com/ory/kratos/commit/e0a4010b84b43f364be14414a380c872b166274d))
+- Add fallback to providerLabel
+  ([#3999](https://github.com/ory/kratos/issues/3999))
+  ([d26f204](https://github.com/ory/kratos/commit/d26f2042eb5325a8d639c08d95a005724e61cb8e)):
+
+  This adds a fallback to the provider label when trying to register a duplicate
+  identifier with an oidc.
+
+  Current error message:
+
+  `Signing in will link your account to "test@test.com" at provider "". If you do not wish to link that account, please start a new login flow.`
+
+  The label represents an optional label for the UI, but in my case it's always
+  empty. I suggest we fallback to the provider when the label is not present. In
+  case the label is present, the behaviour won't change.
+
+  Fallback to provider:
+
+  `Signing in will link your account to "test@test.com" at provider "google". If you do not wish to link that account, please start a new login flow.`
+
+- Add missing JS triggers
+  ([7597bc6](https://github.com/ory/kratos/commit/7597bc6345848b66161d5a9b7a42307bbc85c978))
+- Add PKCE config key to config schema
+  ([#4098](https://github.com/ory/kratos/issues/4098))
+  ([2c7ff3c](https://github.com/ory/kratos/commit/2c7ff3c8baab6aaa105e2d733a483fc07537470f))
+- Batch identity created event
+  ([#4111](https://github.com/ory/kratos/issues/4111))
+  ([340f698](https://github.com/ory/kratos/commit/340f698243bd908e217394710b475a7f686a8cf9))
+- Concurrent map update for webhook header
+  ([#4055](https://github.com/ory/kratos/issues/4055))
+  ([6ceb2f1](https://github.com/ory/kratos/commit/6ceb2f1213e1b28d3aa72380661e4aa985bfa437))
+- Do not populate `id_first` first step for account linking flows
+  ([#4074](https://github.com/ory/kratos/issues/4074))
+  ([6ab2637](https://github.com/ory/kratos/commit/6ab2637652013e0ff377f52355e2025d68c7b3d3))
+- Downgrade go-webauthn ([#4035](https://github.com/ory/kratos/issues/4035))
+  ([4d1954a](https://github.com/ory/kratos/commit/4d1954ac74dee358f9a08e619848dfe94e4934ce))
+- Emit SelfServiceMethodUsed in SettingsSucceeded event
+  ([#4056](https://github.com/ory/kratos/issues/4056))
+  ([76af303](https://github.com/ory/kratos/commit/76af303b20ae5dffb932169a73667a55be3f3f80))
+- Filter web hook headers ([#4048](https://github.com/ory/kratos/issues/4048))
+  ([ddb838e](https://github.com/ory/kratos/commit/ddb838e0e8f7d752cd1708c505e80b6c0ccc0b8a))
+- Improve OIDC account linking UI
+  ([#4036](https://github.com/ory/kratos/issues/4036))
+  ([2b4a618](https://github.com/ory/kratos/commit/2b4a618485c9d79762243f59b35f142083f5492c))
+- Include duplicate credentials in account linking message
+  ([#4079](https://github.com/ory/kratos/issues/4079))
+  ([122b63d](https://github.com/ory/kratos/commit/122b63d68a3ff2ad78107300869c5a6d2aa43354))
+- Incorrect append of code credential identifier
+  ([#4102](https://github.com/ory/kratos/issues/4102))
+  ([3215792](https://github.com/ory/kratos/commit/3215792df4cab494c05ef09e969b2fa0ed95a98b)),
+  closes [#4076](https://github.com/ory/kratos/issues/4076)
+- Jsonnet timeouts ([#3979](https://github.com/ory/kratos/issues/3979))
+  ([7c5299f](https://github.com/ory/kratos/commit/7c5299f1f832ebbe0622d0920b7a91253d26b06c))
+- Move password migration hook config
+  ([#3986](https://github.com/ory/kratos/issues/3986))
+  ([b5a66e0](https://github.com/ory/kratos/commit/b5a66e0dde3a8fa6fdeb727482481b6302589631)):
+
+  This moves the password migration hook to
+
+  ```yaml
+  selfservice:
+    methods:
+      password:
+        config:
+          migrate_hook: ...
+  ```
+
+- Normalize code credentials and deprecate via parameter
+  ([c417b4a](https://github.com/ory/kratos/commit/c417b4aa76a76d3aebb4474999d7bb072615bd9f)):
+
+  Before this, code credentials for passwordless and mfa login were incorrectly
+  stored and normalized. This could cause issues where the system would not
+  detect the user's phone number, and where SMS/email MFA would not properly
+  work with the `highest_available` setting.
+
+- Passthrough correct organization ID to CompletedLoginForWithProvider
+  ([#4124](https://github.com/ory/kratos/issues/4124))
+  ([ad1acd5](https://github.com/ory/kratos/commit/ad1acd51d8dd7582b05a3078b92f73970e1e2715))
+- Password migration hook config
+  ([#4001](https://github.com/ory/kratos/issues/4001))
+  ([50deedf](https://github.com/ory/kratos/commit/50deedfeecf7adbc948521371b181306a0c26cf1)):
+
+  This fixes the config loading for the password migration hook.
+
+- Pw migration param ([#3998](https://github.com/ory/kratos/issues/3998))
+  ([6016cc8](https://github.com/ory/kratos/commit/6016cc88a076eeea71a85d75cfb5191808b69844))
+- Refactor internal API to prevent panics
+  ([#4028](https://github.com/ory/kratos/issues/4028))
+  ([81bc152](https://github.com/ory/kratos/commit/81bc1525f09504729c666192d458cf2eaafab99f))
+- Remove flows from log messages
+  ([#3913](https://github.com/ory/kratos/issues/3913))
+  ([310a405](https://github.com/ory/kratos/commit/310a405202c6b44633b15ad30e1fdb8ebd153e4b))
+- Replace submit with continue button for recovery and verification and add
+  maxlength
+  ([04850f4](https://github.com/ory/kratos/commit/04850f45cfbdc89223366ffa3b540d579a3b44be))
+- Return credentials in FindByCredentialsIdentifier
+  ([#4068](https://github.com/ory/kratos/issues/4068))
+  ([f949173](https://github.com/ory/kratos/commit/f949173b3ed3d45167bb4af8b95440d5e4a39636)):
+
+  Instead of re-fetching the credentials later (expensive), we load them only
+  once.
+
+- Return error if invalid UUID is supplied to ids filter
+  ([#4116](https://github.com/ory/kratos/issues/4116))
+  ([98140f2](https://github.com/ory/kratos/commit/98140f2fd43ccd889e2635e4f3e7582b92fe96ab))
+- **security:** Code credential does not respect `highest_available` setting
+  ([b0111d4](https://github.com/ory/kratos/commit/b0111d4bd561d0f0e2f5883f30fac36fcf7135d5)):
+
+  This patch fixes a security vulnerability which prevents the `code` method to
+  properly report it's credentials count to the `highest_available` mechanism.
+
+  For more details on this issue please refer to the
+  [security advisory](https://github.com/ory/kratos/security/advisories/GHSA-wc43-73w7-x2f5).
+
+- Timestamp precision on mysql
+  ([9a1f171](https://github.com/ory/kratos/commit/9a1f171c1a4a8d20dc2103073bdc11ee3fdc70af))
+- Transient_payload is lost when verification flow started as part of
+  registration ([#3983](https://github.com/ory/kratos/issues/3983))
+  ([192f10f](https://github.com/ory/kratos/commit/192f10f4ad9eb44a612baaccfc71765d52c7e1ed))
+- Trigger oidc web hook on sign in after registration
+  ([#4027](https://github.com/ory/kratos/issues/4027))
+  ([ad5fb09](https://github.com/ory/kratos/commit/ad5fb09687f863e7c5d45868d0b8f5ec2d965372))
+- Typo in login link CLI error messages
+  ([#3995](https://github.com/ory/kratos/issues/3995))
+  ([8350625](https://github.com/ory/kratos/commit/835062542077b9dd8d6a30836d0455adb015265d))
+- Validate page tokens for better error codes
+  ([#4021](https://github.com/ory/kratos/issues/4021))
+  ([32737dc](https://github.com/ory/kratos/commit/32737dc708c1ecf0ec0ceaa4bbc0ac09286186fd))
+- Whoami latency ([#4070](https://github.com/ory/kratos/issues/4070))
+  ([ff6ed5b](https://github.com/ory/kratos/commit/ff6ed5b70b7f715fc38a41cedd17b5323aebd79e))
+
+### Code Generation
+
+- Pin v1.3.0 release commit
+  ([0a49fd0](https://github.com/ory/kratos/commit/0a49fd05245f179501b117163cd574786f287fe8))
+
+### Documentation
+
+- Add google to supported providers in ID Token doc strings
+  ([#4026](https://github.com/ory/kratos/issues/4026))
+  ([955bd8f](https://github.com/ory/kratos/commit/955bd8fbc1353d7a9f84d8f591c3af31781cf7b7))
+- Typo in changelog
+  ([c508980](https://github.com/ory/kratos/commit/c5089801af2a656e9c1fc371a11aeb23918ba359))
+
+### Features
+
+- Add additional messages
+  ([735fc5b](https://github.com/ory/kratos/commit/735fc5b2c5a99746d3012cc38ee2e1b7cc3a67f2))
+- Add browser return_to continue_with action
+  ([7b636d8](https://github.com/ory/kratos/commit/7b636d860c6917cb1133d6d1d7401808adb890c7))
+- Add if method to sdk
+  ([612e3bf](https://github.com/ory/kratos/commit/612e3bf09dbffd3feba08d5100bffbc39cbd240a))
+- Add redirect to continue_with for SPA flows
+  ([99c945c](https://github.com/ory/kratos/commit/99c945c92d0c2745dc8df4402d755afd53e1b9aa)):
+
+  This patch adds the new `continue_with` action `redirect_browser_to`, which
+  contains the redirect URL the app should redirect to. It is only supported for
+  SPA (not server-side browser apps, not native apps) flows at this point in
+  time.
+
+- Add social providers to credential discovery as well
+  ([5f4a2bf](https://github.com/ory/kratos/commit/5f4a2bf619d540d45e96586129c8ee1e7850e745))
+- Add support for Salesforce as identity provider
+  ([#4003](https://github.com/ory/kratos/issues/4003))
+  ([3bf1ca9](https://github.com/ory/kratos/commit/3bf1ca9030555df90ef9903c34313ae4bd1fecae))
+- Add tests for two step login
+  ([#3959](https://github.com/ory/kratos/issues/3959))
+  ([8225e40](https://github.com/ory/kratos/commit/8225e40e3d767e945006b33eebdfc47fd242ff06))
+- Allow deletion of an individual OIDC credential
+  ([#3968](https://github.com/ory/kratos/issues/3968))
+  ([a43cef2](https://github.com/ory/kratos/commit/a43cef23c177acddbf8b03afef087feeaca51981)):
+
+  This extends the existing `DELETE /admin/identities/{id}/credentials/{type}`
+  API to accept an `?identifier=foobar` query parameter for `{type}==oidc` like
+  such:
+
+  `DELETE /admin/identities/{id}/credentials/oidc?identifier=github%3A012345`
+
+  This will delete the GitHub OIDC credential with the identifier
+  `github:012345` (`012345` is the subject as returned by GitHub).
+
+  To find out which OIDC credentials exist, call
+  `GET /admin/identities/{id}?include_credential=oidc` beforehand.
+
+  This will allow you to delete individual OIDC credentials for users even if
+  they have several set up.
+
+- Allow partially failing batch inserts
+  ([#4083](https://github.com/ory/kratos/issues/4083))
+  ([4ba7033](https://github.com/ory/kratos/commit/4ba70330cf9e0eda9044b0a5a504c34493ae17ed)):
+
+  When batch-inserting multiple identities, conflicts or validation errors of a
+  subset of identities in the batch still allow the rest of the identities to be
+  inserted. The returned JSON contains the error details that lead to the
+  failure.
+
+- Better detection if credentials exist on identifier first login
+  ([#3963](https://github.com/ory/kratos/issues/3963))
+  ([42ade94](https://github.com/ory/kratos/commit/42ade94e32a9a7ad6c0bda785e86d7209c46d8bb))
+- Change `method=profile:back` to `screen=previous`
+  ([#4119](https://github.com/ory/kratos/issues/4119))
+  ([2cd8483](https://github.com/ory/kratos/commit/2cd8483e809170d0524fe6a5d13837108d29fa54))
+- Clarify session extend behavior
+  ([#3962](https://github.com/ory/kratos/issues/3962))
+  ([af5ea35](https://github.com/ory/kratos/commit/af5ea35759e74d7a1637823abcc21dc8e3e39a9d))
+- Client-side PKCE take 3 ([#4078](https://github.com/ory/kratos/issues/4078))
+  ([f7c1024](https://github.com/ory/kratos/commit/f7c102456a71b226d8353b9d59cc03fb2ba0af40)):
+
+  - feat: client-side PKCE
+
+  This change introduces a new configuration for OIDC providers: pkce with
+  values auto (default), never, force.
+
+  When auto is specified or the field is omitted, Kratos will perform
+  autodiscovery and perform PKCE when the server advertises support for it. This
+  requires the issuer_url to be set for the provider.
+
+  never completely disables PKCE support. This is only theoretically useful:
+  when a provider advertises PKCE support but doesn't actually implement it.
+
+  force always sends a PKCE challenge in the initial redirect URL, regardless of
+  what the provider advertises. This setting is useful when the provider offers
+  PKCE but doesn't advertise it in his ./well-known/openid-configuration.
+
+  Important: When setting pkce: force, you must whitelist a different return URL
+  for your OAuth2 client in the provider's configuration. Instead of
+  <base-url>/self-service/methods/oidc/callback/<provider>, you must use
+  <base-url>/self-service/methods/oidc/callback (note missing last path
+  segment). This is to enable the use of the same OAuth client ID+secret when
+  configuring several Kratos OIDC providers, without having to whitelist
+  individual redirect_uris for each Kratos provider config.
+
+  - chore: regenerate SDK, bump DB versions, cleanup tool install
+
+  - chore: get final organization ID from provider config during registration
+    and login
+
+  - chore: fixup OIDC function signatures and improve tests
+
+- Emit events in identity persister
+  ([#4107](https://github.com/ory/kratos/issues/4107))
+  ([20156f6](https://github.com/ory/kratos/commit/20156f651f2faa0a79842de8d2fb4a09ee7094c1))
+- Enable new-style OIDC state generation
+  ([#4121](https://github.com/ory/kratos/issues/4121))
+  ([eb97243](https://github.com/ory/kratos/commit/eb97243d6499e2d9f2338a2ce3f5e39579d19086))
+- Identifier first auth
+  ([1bdc19a](https://github.com/ory/kratos/commit/1bdc19ae3e1a3df38234cb892f65de4a2c95f041))
+- Identifier first login for all first factor login methods
+  ([638b274](https://github.com/ory/kratos/commit/638b27431312bcd91844ac4a00733a840976aa4f))
+- Improve session extend performance
+  ([#3948](https://github.com/ory/kratos/issues/3948))
+  ([4e3fad4](https://github.com/ory/kratos/commit/4e3fad4b4739b5cf00d658155350cb599f2cd06a)):
+
+  This patch improves the performance for extending session lifespans. Lifespan
+  extension is tricky as it is often part of the middleware of Ory Kratos
+  consumers. As such, it is prone to transaction contention when we read and
+  write to the same session row at the same time (and potentially multiple
+  times).
+
+  To address this, we:
+
+  1. Introduce a locking mechanism on the row to reduce transaction contention;
+  2. Add a new feature flag that toggles returning 204 no content instead of
+     200 + session.
+
+  Be aware that all reads on the session table will have to wait for the
+  transaction to commit before they return a value. This may cause long(er)
+  response times on `/session/whoami` for sessions that are being extended at
+  the same time.
+
+- Password migration hook ([#3978](https://github.com/ory/kratos/issues/3978))
+  ([c9d5573](https://github.com/ory/kratos/commit/c9d55730a10b71ac61bb5097f5f9c33f144f2a95)):
+
+  This adds a password migration hook to easily migrate passwords for which we
+  do not have the hash.
+
+  For each user that needs to be migrated to Ory Network, a new identity is
+  created with a credential of type password with a config of
+  {"use_password_migration_hook": true} . When a user logs in, the credential
+  identifier and password will be sent to the password_migration web hook if all
+  of these are true: The user’s identity’s password credential is
+  {"use_password_migration_hook": true} The password_migration hook is
+  configured After calling the password_migration hook, the HTTP status code
+  will be inspected: On 200, we parse the response as JSON and look for
+  {"status": "password_match"}. The password credential config will be replaced
+  with the hash of the actual password. On any other status code, we assume that
+  the password is not valid.
+
+- **sdk:** Add missing profile discriminator to update registration
+  ([0150795](https://github.com/ory/kratos/commit/0150795d902dcc7cfb2298c3b5a98da1c2541e46))
+- **sdk:** Avoid eval with javascript triggers
+  ([dd6e53d](https://github.com/ory/kratos/commit/dd6e53d62f343a317edf403218b20599539218c6)):
+
+  Using `OnLoadTrigger` and `OnClickTrigger` one can now map the trigger to the
+  corresponding JavaScript function.
+
+  For example, trigger `{"on_click_trigger":"oryWebAuthnRegistration"}` should
+  be translated to `window.oryWebAuthnRegistration()`:
+
+  ```
+  if (attrs.onClickTrigger) {
+    window[attrs.onClickTrigger]()
+  }
+  ```
+
+- Separate 2fa refresh from 1st factor refresh
+  ([#3961](https://github.com/ory/kratos/issues/3961))
+  ([89355d8](https://github.com/ory/kratos/commit/89355d86258ace19c03fcb38dd3861f88e28af59))
+- Set maxlength for totp input
+  ([51042d9](https://github.com/ory/kratos/commit/51042d99fab301f0bb44665e56c5a2364e7d8866))
+
+### Tests
+
+- Add form hydration tests for code login
+  ([37781a9](https://github.com/ory/kratos/commit/37781a93dda9b8f0127217a6b0ac2434dda1cc58))
+- Add form hydration tests for idfirst login
+  ([633b0ba](https://github.com/ory/kratos/commit/633b0ba7f724374f4c02128a5b0f748bd2e9413e))
+- Add form hydration tests for oidc login
+  ([df0cdcb](https://github.com/ory/kratos/commit/df0cdcb424cae6c49143ef2ef2d0b2c95f14fffb))
+- Add form hydration tests for passkey login
+  ([a777854](https://github.com/ory/kratos/commit/a777854e8d99336ab8f5755fdbc9d257e5edd1c0))
+- Add form hydration tests for password login
+  ([7186e7e](https://github.com/ory/kratos/commit/7186e7e060e04a4918e22e0b03fefbf4eb9f4a4b))
+- Add form hydration tests for webauthn login
+  ([8b68163](https://github.com/ory/kratos/commit/8b68163a3f293f7dceb58397f0ef555f1d8fd7c3))
+- Add tests for idfirst
+  ([5f76c15](https://github.com/ory/kratos/commit/5f76c1565e89bfb99f23c3f0f3a9beadbdfa270c))
+- Additional code credential test case
+  ([#4122](https://github.com/ory/kratos/issues/4122))
+  ([4f2c854](https://github.com/ory/kratos/commit/4f2c8542ab04b88c7112d7b564d91bcfd8f5791a))
+- Deflake and parallelize persister tests
+  ([#3953](https://github.com/ory/kratos/issues/3953))
+  ([61f87d9](https://github.com/ory/kratos/commit/61f87d90bd67e5bb1f00ee110d986e4f72fc4c91))
+- Deflake session extend config side-effect
+  ([#3950](https://github.com/ory/kratos/issues/3950))
+  ([b192c92](https://github.com/ory/kratos/commit/b192c92d6c969d470d6479bc33dbc351d327c1f9))
+- Enable server-side config from context
+  ([#3954](https://github.com/ory/kratos/issues/3954))
+  ([e0001b0](https://github.com/ory/kratos/commit/e0001b0db784457652581366bd7ead7cdf6b3898))
+- Improve stability of refresh test
+  ([#4037](https://github.com/ory/kratos/issues/4037))
+  ([68693a4](https://github.com/ory/kratos/commit/68693a43e4e1e3028f17789e72d0b79f6298d139))
+- Resolve CI failures ([#4067](https://github.com/ory/kratos/issues/4067))
+  ([dbf7274](https://github.com/ory/kratos/commit/dbf7274f7a4be56c33b06559875c42725bf4a351))
+- Resolve issues and update snapshots for all selfservice strategies
+  ([e2e81ac](https://github.com/ory/kratos/commit/e2e81ac16726b180d33c57913e3cac099daf946b))
+- Update incorrect usage of Auth0 in Salesforce tests
+  ([#4007](https://github.com/ory/kratos/issues/4007))
+  ([6ce3068](https://github.com/ory/kratos/commit/6ce306824cec81890c50dcf23c2b8a5825f20a10))
+- Verify redirect continue_with in hook executor for browser clients
+  ([7b0b94d](https://github.com/ory/kratos/commit/7b0b94d30ec9069de6978427814d55a30e62adb8))
+
+### Unclassified
+
+- Merge commit from fork
+  ([123e807](https://github.com/ory/kratos/commit/123e80782b392095631ee2e0d1bd6ec337c1fb79)):
+
+  - fix(security): code credential does not respect `highest_available` setting
+
+  This patch fixes a security vulnerability which prevents the `code` method to
+  properly report it's credentials count to the `highest_available` mechanism.
+
+  For more details on this issue please refer to the
+  [security advisory](https://github.com/ory/kratos/security/advisories/GHSA-wc43-73w7-x2f5).
+
+  - fix: normalize code credentials and deprecate via parameter
+
+  Before this, code credentials for passwordless and mfa login were incorrectly
+  stored and normalized. This could cause issues where the system would not
+  detect the user's phone number, and where SMS/email MFA would not properly
+  work with the `highest_available` setting.
+
+- Update .github/workflows/ci.yaml
+  ([2d60772](https://github.com/ory/kratos/commit/2d60772062a684c3a27f28b8836c3548f5b8cea9))
+- Update Code QL action to v2
+  ([#4008](https://github.com/ory/kratos/issues/4008))
+  ([e3f1da0](https://github.com/ory/kratos/commit/e3f1da0f4bf41a8a8733758fcd9edb9910c55cfa))
+
+# [1.2.0](https://github.com/ory/kratos/compare/v1.1.0...v1.2.0) (2024-06-05)
+
+Ory Kratos v1.2 is the most complete, scalable, and secure open-source identity
+server available. We are thrilled to announce its release!
+
+![Ory Kratos 1.2 released](https://www.ory.sh/images/newsletter/kratos-1.2.0/banner.png)
+
+This release introduces two major features: two-step registration and full
+PassKey with resident key support.
+
+Passkeys provide a secure and convenient authentication method, eliminating the
+need for passwords while ensuring strong security. With this release, we have
+added support for resident keys, enabling offline authentication. Credential
+discovery allows users to link existing passkeys to their Ory account
+seamlessly.
+
+[Watch the PassKey demo video](https://github.com/aeneasr/web-next-deprecated/assets/3372410/e676c518-c82a-42a6-821e-28aecadb270c)
+
+Two-step registration improves the user experience by dividing the registration
+process into two steps. Users first enter their identity traits, and then choose
+a credential method for authentication, resulting in a streamlined process. This
+feature is especially useful when enabling multiple authentication strategies,
+as it eliminates the need to repeat identity traits for each strategy.
+
+![Two-Step Registration](https://ik.imagekit.io/launchnotes/production/tr:w-1640,c-at_max,f-auto/ngul9dzfjdt3pe8benegjjeeagi1)
+
+The 107 commits since v1.1 include several improvements:
+
+- **Webhooks** now carry session information if available.
+- **Transient Payloads** are now available across all self-service flows.
+- **Sign in with Twitter** is now available.
+- **Sign in with LinkedIn** now includes an additional v2 provider compatible
+  with LinkedIn's new SSO API.
+- **Two-Step Registration**: An improved registration experience that separates
+  entering profile information from choosing authentication methods.
+- **User Credentials Meta-Information** can now be included on the list
+  endpoint.
+- **Social Sign-In** is now resilient to double-submit issues common with
+  Facebook and Apple mobile login.
+
+**Two-Step Registration Enabled by Default**: This is now the default setting.
+To disable, set `selfservice.flows.registration.enable_legacy_flow` to `true`.
+
+- Improved account linking and credential discovery during sign-up.
+- The `return_to` parameter is now respected in OIDC API flows.
+- Adjustments to database indices.
+- Enhanced error messages for security violations.
+- Improved SDK types.
+- The `verification` and `verification_ui` hooks are now available in the login
+  flow.
+- Webhooks now contain the correct identity state in the after-verification hook
+  chain.
+
+We are doing this survey to find out how we can support self-hosted Ory users
+better. We strive to provide you with the best product and service possible and
+your feedback will help us understand what we're doing well and where we can
+improve to better meet your needs. We truly value your opinion and thank you in
+advance for taking the time to share your thoughts with us!
+
+Fill out the
+[survey now](https://share-eu1.hsforms.com/15DiCnJpcRuijnpAdnDhxxwextgn)!
 
 ## Breaking Changes
 
@@ -362,8 +1234,13 @@ defaults to `false`.
 
 - Audit issues ([#3797](https://github.com/ory/kratos/issues/3797))
   ([7017490](https://github.com/ory/kratos/commit/7017490caa9c70e22d5c626773c0266521813ff5))
+- Change return urls in quickstarts
+  ([#3928](https://github.com/ory/kratos/issues/3928))
+  ([9730e09](https://github.com/ory/kratos/commit/9730e099a656d211389d8e993c64d8082784c929))
 - Close res body ([#3870](https://github.com/ory/kratos/issues/3870))
   ([cc39f8d](https://github.com/ory/kratos/commit/cc39f8df7c235af0df616432bc4f88681896ad85))
+- CVEs in dependencies ([#3902](https://github.com/ory/kratos/issues/3902))
+  ([e5d3b0a](https://github.com/ory/kratos/commit/e5d3b0afde3c80c6c9cf8815c56d82e291ede663))
 - Db index and duplicate credentials error
   ([#3896](https://github.com/ory/kratos/issues/3896))
   ([9f34a21](https://github.com/ory/kratos/commit/9f34a21ea2035a5d33edd96753023a3c8c6c054c)):
@@ -411,6 +1288,9 @@ defaults to `false`.
 - Missing indices and foreign keys
   ([#3800](https://github.com/ory/kratos/issues/3800))
   ([0b32ce1](https://github.com/ory/kratos/commit/0b32ce113be47aa724d3468062ced09f8f60c52a))
+- **oidc:** Grace period for continuity container on oidc callbacks
+  ([#3915](https://github.com/ory/kratos/issues/3915))
+  ([1a9a096](https://github.com/ory/kratos/commit/1a9a096d619925dd3718ad9dd9daf77387572ece))
 - Passing transient payloads
   ([#3838](https://github.com/ory/kratos/issues/3838))
   ([d01b670](https://github.com/ory/kratos/commit/d01b6705bf36efb6e0f3d71ed22d0574ab8a98a4))
@@ -473,6 +1353,17 @@ defaults to `false`.
 
   - fix: transient payload with OIDC login
 
+### Code Generation
+
+- Pin v1.2.0 release commit
+  ([1a70648](https://github.com/ory/kratos/commit/1a70648c4d5b9b8d135dd7bea3842057e67b574e))
+
+### Documentation
+
+- Remove delete reference from batch patch identity
+  ([#3906](https://github.com/ory/kratos/issues/3906))
+  ([cd01cb9](https://github.com/ory/kratos/commit/cd01cb9fb23a24e52d46538a9ea63c2144c3b145))
+
 ### Features
 
 - Add `include_credential` query param to `/admin/identities` list call
@@ -491,6 +1382,9 @@ defaults to `false`.
 - Add verification hook to login flow
   ([#3829](https://github.com/ory/kratos/issues/3829))
   ([43e4ead](https://github.com/ory/kratos/commit/43e4eadce7fa6e66bf1f9c03136d141bffd3094f))
+- Allow admin to create API code recovery flows
+  ([#3939](https://github.com/ory/kratos/issues/3939))
+  ([25d1ecd](https://github.com/ory/kratos/commit/25d1ecd90317193095e01b97ff21d92920035b02))
 - Control edge cache ttl ([#3808](https://github.com/ory/kratos/issues/3808))
   ([c9dcce5](https://github.com/ory/kratos/commit/c9dcce5a41137937df1aad7ac81170b443740f88))
 - Linkedin v2 provider ([#3804](https://github.com/ory/kratos/issues/3804))
@@ -520,6 +1414,22 @@ defaults to `false`.
 - Resolve failing test for empty tokens
   ([#3775](https://github.com/ory/kratos/issues/3775))
   ([7277368](https://github.com/ory/kratos/commit/7277368bc28df8f0badffc7e739cef20f05e9a02))
+- Resolve flaky e2e tests ([#3935](https://github.com/ory/kratos/issues/3935))
+  ([a14927d](https://github.com/ory/kratos/commit/a14927dfa5f8d0fbda7e5a831f0a09a42369e06c)):
+
+  - test: resolve flaky code registration tests
+
+  - chore: don't fail logout if cookie is not found
+
+  - chore: remove .only
+
+  - chore: reduce wait
+
+  - chore: u
+
+  - chore: u
+
+  - chore: u
 
 ### Unclassified
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b061aced1b51..9275c934a84f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -64,7 +64,7 @@ won't clash with Ory Kratos's direction. A great way to do this is via
   [a Contributors License Agreement?](https://cla-assistant.io/ory/kratos)
 
 - I would like updates about new versions of Ory Kratos.
-  [How are new releases announced?](https://ory.us10.list-manage.com/subscribe?u=ffb1a878e4ec6c0ed312a3480&id=f605a41b53)
+  [How are new releases announced?](https://www.ory.sh/l/sign-up-newsletter)
 
 ## How can I contribute?
 
diff --git a/Makefile b/Makefile
index 61e4284d3994..05c9c0de9760 100644
--- a/Makefile
+++ b/Makefile
@@ -32,9 +32,8 @@ $(call make-lint-dependency)
 	echo "deprecated usage, use docs/cli instead"
 	go build -o .bin/clidoc ./cmd/clidoc/.
 
-.PHONY: .bin/yq
-.bin/yq:
-	go build -o .bin/yq github.com/mikefarah/yq/v4
+.bin/yq: Makefile
+	GOBIN=$(PWD)/.bin go install github.com/mikefarah/yq/v4@v4.44.3
 
 .PHONY: docs/cli
 docs/cli:
@@ -49,7 +48,7 @@ docs/swagger:
 	npx @redocly/openapi-cli preview-docs spec/swagger.json
 
 .bin/golangci-lint: Makefile
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -d -b .bin v1.56.2
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -d -b .bin v1.61.0
 
 .bin/hydra: Makefile
 	bash <(curl https://raw.githubusercontent.com/ory/meta/master/install.sh) -d -b .bin hydra v2.2.0-rc.3
@@ -58,17 +57,31 @@ docs/swagger:
 	curl https://raw.githubusercontent.com/ory/meta/master/install.sh | bash -s -- -b .bin ory v0.2.2
 	touch -a -m .bin/ory
 
+.bin/buf: Makefile
+	curl -sSL \
+	"https://github.com/bufbuild/buf/releases/download/v1.39.0/buf-$(shell uname -s)-$(shell uname -m).tar.gz" | \
+	tar -xvzf - -C ".bin/" --strip-components=2 buf/bin/buf buf/bin/protoc-gen-buf-breaking buf/bin/protoc-gen-buf-lint
+	touch -a -m .bin/buf
+
 .PHONY: lint
 lint: .bin/golangci-lint
-	golangci-lint run -v --timeout 10m ./...
+	.bin/golangci-lint run -v --timeout 10m ./...
+	.bin/buf lint
 
 .PHONY: mocks
 mocks: .bin/mockgen
 	mockgen -mock_names Manager=MockLoginExecutorDependencies -package internal -destination internal/hook_login_executor_dependencies.go github.com/ory/kratos/selfservice loginExecutorDependencies
 
+.PHONY: proto
+proto: gen/oidc/v1/state.pb.go
+
+gen/oidc/v1/state.pb.go: proto/oidc/v1/state.proto buf.yaml buf.gen.yaml .bin/buf .bin/goimports
+	.bin/buf generate
+	.bin/goimports -w gen/
+
 .PHONY: install
 install:
-	GO111MODULE=on go install -tags sqlite .
+	go install -tags sqlite .
 
 .PHONY: test-resetdb
 test-resetdb:
@@ -125,7 +138,7 @@ sdk: .bin/swagger .bin/ory node_modules
 		--git-user-id ory \
 		--git-repo-id client-go \
 		--git-host github.com \
-		--api-name-suffix "Api" \
+		--api-name-suffix "API" \
 		-t .schema/openapi/templates/go \
 		-c .schema/openapi/gen.go.yml
 
@@ -139,7 +152,7 @@ sdk: .bin/swagger .bin/ory node_modules
 		--git-user-id ory \
 		--git-repo-id client-go \
 		--git-host github.com \
-		--api-name-suffix "Api" \
+		--api-name-suffix "API" \
 		-t .schema/openapi/templates/go \
 		-c .schema/openapi/gen.go.yml
 
@@ -163,11 +176,12 @@ authors:  # updates the AUTHORS file
 
 # Formats the code
 .PHONY: format
-format: .bin/goimports .bin/ory node_modules
-	.bin/ory dev headers copyright --exclude=internal/httpclient --exclude=internal/client-go --exclude test/e2e/proxy/node_modules --exclude test/e2e/node_modules --exclude node_modules
+format: .bin/goimports .bin/ory node_modules .bin/buf
+	.bin/ory dev headers copyright --exclude=gen --exclude=internal/httpclient --exclude=internal/client-go --exclude test/e2e/proxy/node_modules --exclude test/e2e/node_modules --exclude node_modules
 	goimports -w -local github.com/ory .
 	npm exec -- prettier --write 'test/e2e/**/*{.ts,.js}'
 	npm exec -- prettier --write '.github'
+	.bin/buf format --write
 
 # Build local docker image
 .PHONY: docker
@@ -193,8 +207,8 @@ migrations-sync: .bin/ory
 	ory dev pop migration sync persistence/sql/migrations/templates persistence/sql/migratest/testdata
 	script/add-down-migrations.sh
 
-.PHONY: test-update-snapshots
-test-update-snapshots:
+.PHONY: test-refresh
+test-refresh:
 	UPDATE_SNAPSHOTS=true go test -tags sqlite,json1,refresh -short ./...
 
 .PHONY: post-release
diff --git a/README.md b/README.md
index 792ae8c5de79..decd913076e0 100644
--- a/README.md
+++ b/README.md
@@ -3,11 +3,11 @@
 <h4 align="center">
     <a href="https://www.ory.sh/chat">Chat</a> |
     <a href="https://github.com/ory/kratos/discussions">Discussions</a> |
-    <a href="http://eepurl.com/di390P">Newsletter</a><br/><br/>
+    <a href="https://www.ory.sh/l/sign-up-newsletter">Newsletter</a><br/><br/>
     <a href="https://www.ory.sh/kratos/docs/">Guide</a> |
     <a href="https://www.ory.sh/kratos/docs/sdk/api">API Docs</a> |
     <a href="https://godoc.org/github.com/ory/kratos">Code Docs</a><br/><br/>
-    <a href="https://opencollective.com/ory">Support this project!</a><br/><br/>
+    <a href="https://console.ory.sh/">Support this project!</a><br/><br/>
     <a href="https://www.ory.sh/jobs/">Work in Open Source, Ory is hiring!</a>
 </h4>
 
diff --git a/SECURITY.md b/SECURITY.md
index 7a05c1cfc62e..6104514805c4 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,30 +1,56 @@
 <!-- AUTO-GENERATED, DO NOT EDIT! -->
 <!-- Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/SECURITY.md -->
 
-<!-- START doctoc generated TOC please keep comment here to allow auto update -->
-<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
-
-- [Security Policy](#security-policy)
-  - [Supported Versions](#supported-versions)
-  - [Reporting a Vulnerability](#reporting-a-vulnerability)
-
-<!-- END doctoc generated TOC please keep comment here to allow auto update -->
-
-# Security Policy
-
-## Supported Versions
-
-We release patches for security vulnerabilities. Which versions are eligible for
-receiving such patches depends on the CVSS v3.0 Rating:
-
-| CVSS v3.0 | Supported Versions                        |
-| --------- | ----------------------------------------- |
-| 9.0-10.0  | Releases within the previous three months |
-| 4.0-8.9   | Most recent release                       |
+# Ory Security Policy
+
+This policy outlines Ory's security commitments and practices for users across
+different licensing and deployment models.
+
+To learn more about Ory's security service level agreements (SLAs) and
+processes, please [contact us](https://www.ory.sh/contact/).
+
+## Ory Network Users
+
+- **Security SLA:** Ory addresses vulnerabilities in the Ory Network according
+  to the following guidelines:
+  - Critical: Typically addressed within 14 days.
+  - High: Typically addressed within 30 days.
+  - Medium: Typically addressed within 90 days.
+  - Low: Typically addressed within 180 days.
+  - Informational: Addressed as necessary.  
+    These timelines are targets and may vary based on specific circumstances.
+- **Release Schedule:** Updates are deployed to the Ory Network as
+  vulnerabilities are resolved.
+- **Version Support:** The Ory Network always runs the latest version, ensuring
+  up-to-date security fixes.
+
+## Ory Enterprise License Customers
+
+- **Security SLA:** Ory addresses vulnerabilities based on their severity:
+  - Critical: Typically addressed within 14 days.
+  - High: Typically addressed within 30 days.
+  - Medium: Typically addressed within 90 days.
+  - Low: Typically addressed within 180 days.
+  - Informational: Addressed as necessary.  
+    These timelines are targets and may vary based on specific circumstances.
+- **Release Schedule:** Updates are made available as vulnerabilities are
+  resolved. Ory works closely with enterprise customers to ensure timely updates
+  that align with their operational needs.
+- **Version Support:** Ory may provide security support for multiple versions,
+  depending on the terms of the enterprise agreement.
+
+## Apache 2.0 License Users
+
+- **Security SLA:** Ory does not provide a formal SLA for security issues under
+  the Apache 2.0 License.
+- **Release Schedule:** Releases prioritize new functionality and include fixes
+  for known security vulnerabilities at the time of release. While major
+  releases typically occur one to two times per year, Ory does not guarantee a
+  fixed release schedule.
+- **Version Support:** Security patches are only provided for the latest release
+  version.
 
 ## Reporting a Vulnerability
 
-Please report (suspected) security vulnerabilities to
-**[security@ory.sh](mailto:security@ory.sh)**. You will receive a response from
-us within 48 hours. If the issue is confirmed, we will release a patch as soon
-as possible depending on complexity but historically within a few days.
+For details on how to report security vulnerabilities, visit our
+[security policy documentation](https://www.ory.sh/docs/ecosystem/security).
diff --git a/buf.gen.yaml b/buf.gen.yaml
new file mode 100644
index 000000000000..bcc94c85856e
--- /dev/null
+++ b/buf.gen.yaml
@@ -0,0 +1,12 @@
+version: v2
+managed:
+  enabled: true
+  override:
+    - file_option: go_package_prefix
+      value: github.com/ory/kratos
+plugins:
+  - remote: buf.build/protocolbuffers/go
+    out: gen
+    opt: paths=source_relative
+inputs:
+  - directory: proto
diff --git a/buf.yaml b/buf.yaml
new file mode 100644
index 000000000000..227c4a6c6faf
--- /dev/null
+++ b/buf.yaml
@@ -0,0 +1,9 @@
+version: v2
+modules:
+  - path: proto
+lint:
+  use:
+    - DEFAULT
+breaking:
+  use:
+    - FILE
diff --git a/cipher/aes.go b/cipher/aes.go
index f4bae7e98001..7c34651d5e3f 100644
--- a/cipher/aes.go
+++ b/cipher/aes.go
@@ -12,19 +12,13 @@ import (
 	"github.com/ory/herodot"
 
 	"github.com/pkg/errors"
-
-	"github.com/ory/kratos/driver/config"
 )
 
 type AES struct {
-	c AESConfiguration
-}
-
-type AESConfiguration interface {
-	config.Provider
+	c SecretsProvider
 }
 
-func NewCryptAES(c AESConfiguration) *AES {
+func NewCryptAES(c SecretsProvider) *AES {
 	return &AES{c: c}
 }
 
@@ -36,11 +30,11 @@ func (a *AES) Encrypt(ctx context.Context, message []byte) (string, error) {
 		return "", nil
 	}
 
-	if len(a.c.Config().SecretsCipher(ctx)) == 0 {
+	if len(a.c.SecretsCipher(ctx)) == 0 {
 		return "", errors.WithStack(herodot.ErrInternalServerError.WithReason("Unable to encrypt message because no cipher secrets were configured."))
 	}
 
-	ciphertext, err := cryptopasta.Encrypt(message, &a.c.Config().SecretsCipher(ctx)[0])
+	ciphertext, err := cryptopasta.Encrypt(message, &a.c.SecretsCipher(ctx)[0])
 	return hex.EncodeToString(ciphertext), errors.WithStack(err)
 }
 
@@ -52,7 +46,7 @@ func (a *AES) Decrypt(ctx context.Context, ciphertext string) ([]byte, error) {
 		return nil, nil
 	}
 
-	secrets := a.c.Config().SecretsCipher(ctx)
+	secrets := a.c.SecretsCipher(ctx)
 	if len(secrets) == 0 {
 		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReason("Unable to decipher the encrypted message because no AES secrets were configured."))
 	}
diff --git a/cipher/chacha20.go b/cipher/chacha20.go
index 46cf1efc85d9..6ad71746c895 100644
--- a/cipher/chacha20.go
+++ b/cipher/chacha20.go
@@ -8,23 +8,19 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"io"
+	"math"
 
 	"github.com/pkg/errors"
 	"golang.org/x/crypto/chacha20poly1305"
 
 	"github.com/ory/herodot"
-	"github.com/ory/kratos/driver/config"
 )
 
-type ChaCha20Configuration interface {
-	config.Provider
-}
-
 type XChaCha20Poly1305 struct {
-	c ChaCha20Configuration
+	c SecretsProvider
 }
 
-func NewCryptChaCha20(c ChaCha20Configuration) *XChaCha20Poly1305 {
+func NewCryptChaCha20(c SecretsProvider) *XChaCha20Poly1305 {
 	return &XChaCha20Poly1305{c: c}
 }
 
@@ -34,15 +30,20 @@ func (c *XChaCha20Poly1305) Encrypt(ctx context.Context, message []byte) (string
 		return "", nil
 	}
 
-	if len(c.c.Config().SecretsCipher(ctx)) == 0 {
+	if len(c.c.SecretsCipher(ctx)) == 0 {
 		return "", errors.WithStack(herodot.ErrInternalServerError.WithReason("Unable to encrypt message because no cipher secrets were configured."))
 	}
 
-	aead, err := chacha20poly1305.NewX(c.c.Config().SecretsCipher(ctx)[0][:])
+	aead, err := chacha20poly1305.NewX(c.c.SecretsCipher(ctx)[0][:])
 	if err != nil {
 		return "", herodot.ErrInternalServerError.WithWrap(err).WithReason("Unable to generate key")
 	}
 
+	// Make sure the size calculation does not overflow.
+	if len(message) > math.MaxInt-aead.NonceSize()-aead.Overhead() {
+		return "", errors.WithStack(herodot.ErrInternalServerError.WithReason("plaintext too large"))
+	}
+
 	nonce := make([]byte, aead.NonceSize(), aead.NonceSize()+len(message)+aead.Overhead())
 	_, err = io.ReadFull(rand.Reader, nonce)
 	if err != nil {
@@ -59,7 +60,7 @@ func (c *XChaCha20Poly1305) Decrypt(ctx context.Context, ciphertext string) ([]b
 		return nil, nil
 	}
 
-	secrets := c.c.Config().SecretsCipher(ctx)
+	secrets := c.c.SecretsCipher(ctx)
 	if len(secrets) == 0 {
 		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReason("Unable to decipher the encrypted message because no cipher secrets were configured."))
 	}
diff --git a/cipher/cipher.go b/cipher/cipher.go
index 27fc316c2cfa..73c2a0b3b5c3 100644
--- a/cipher/cipher.go
+++ b/cipher/cipher.go
@@ -23,3 +23,7 @@ type Cipher interface {
 type Provider interface {
 	Cipher(ctx context.Context) Cipher
 }
+
+type SecretsProvider interface {
+	SecretsCipher(ctx context.Context) [][32]byte
+}
diff --git a/cipher/cipher_test.go b/cipher/cipher_test.go
index 90e02ff0de45..1680622517d8 100644
--- a/cipher/cipher_test.go
+++ b/cipher/cipher_test.go
@@ -29,8 +29,8 @@ func TestCipher(t *testing.T) {
 	_, reg := internal.NewFastRegistryWithMocks(t, configx.WithValue(config.ViperKeySecretsDefault, goodSecret))
 
 	ciphers := []cipher.Cipher{
-		cipher.NewCryptAES(reg),
-		cipher.NewCryptChaCha20(reg),
+		cipher.NewCryptAES(reg.Config()),
+		cipher.NewCryptChaCha20(reg.Config()),
 	}
 
 	for _, c := range ciphers {
@@ -78,7 +78,7 @@ func TestCipher(t *testing.T) {
 		})
 	}
 
-	c := cipher.NewNoop(reg)
+	c := cipher.NewNoop()
 	t.Run(fmt.Sprintf("cipher=%T", c), func(t *testing.T) {
 		t.Parallel()
 		testAllWork(ctx, t, c)
diff --git a/cipher/noop.go b/cipher/noop.go
index 2b2a353beb23..481d4c8bcba2 100644
--- a/cipher/noop.go
+++ b/cipher/noop.go
@@ -6,30 +6,21 @@ package cipher
 import (
 	"context"
 	"encoding/hex"
-
-	"github.com/ory/kratos/driver/config"
 )
 
 // Noop is default cipher implementation witch does not do encryption
+type Noop struct{}
 
-type NoopConfiguration interface {
-	config.Provider
-}
-
-type Noop struct {
-	c NoopConfiguration
-}
-
-func NewNoop(c NoopConfiguration) *Noop {
-	return &Noop{c: c}
+func NewNoop() *Noop {
+	return &Noop{}
 }
 
 // Encrypt encode message to hex
-func (c *Noop) Encrypt(_ context.Context, message []byte) (string, error) {
+func (*Noop) Encrypt(_ context.Context, message []byte) (string, error) {
 	return hex.EncodeToString(message), nil
 }
 
 // Decrypt decode the hex message
-func (c *Noop) Decrypt(_ context.Context, ciphertext string) ([]byte, error) {
+func (*Noop) Decrypt(_ context.Context, ciphertext string) ([]byte, error) {
 	return hex.DecodeString(ciphertext)
 }
diff --git a/cmd/cliclient/migrate.go b/cmd/cliclient/migrate.go
index e22dcf2ed73c..ef22fbd4b0b7 100644
--- a/cmd/cliclient/migrate.go
+++ b/cmd/cliclient/migrate.go
@@ -4,12 +4,9 @@
 package cliclient
 
 import (
-	"bufio"
-	"bytes"
 	"fmt"
-	"os"
-	"strings"
 
+	"github.com/ory/x/popx"
 	"github.com/ory/x/servicelocatorx"
 
 	"github.com/pkg/errors"
@@ -32,10 +29,7 @@ func NewMigrateHandler() *MigrateHandler {
 	return &MigrateHandler{}
 }
 
-func (h *MigrateHandler) MigrateSQL(cmd *cobra.Command, args []string, opts ...driver.RegistryOption) error {
-	var d driver.Registry
-	var err error
-
+func (h *MigrateHandler) getPersister(cmd *cobra.Command, args []string, opts []driver.RegistryOption) (d driver.Registry, err error) {
 	if flagx.MustGetBool(cmd, "read-from-env") {
 		d, err = driver.NewWithoutInit(
 			cmd.Context(),
@@ -47,21 +41,18 @@ func (h *MigrateHandler) MigrateSQL(cmd *cobra.Command, args []string, opts ...d
 				configx.SkipValidation(),
 			})
 		if err != nil {
-			return err
+			return nil, err
 		}
 		if len(d.Config().DSN(cmd.Context())) == 0 {
 			fmt.Println(cmd.UsageString())
 			fmt.Println("")
 			fmt.Println("When using flag -e, environment variable DSN must be set")
-			return cmdx.FailSilently(cmd)
-		}
-		if err != nil {
-			return err
+			return nil, cmdx.FailSilently(cmd)
 		}
 	} else {
 		if len(args) != 1 {
 			fmt.Println(cmd.UsageString())
-			return cmdx.FailSilently(cmd)
+			return nil, cmdx.FailSilently(cmd)
 		}
 		d, err = driver.NewWithoutInit(
 			cmd.Context(),
@@ -74,54 +65,38 @@ func (h *MigrateHandler) MigrateSQL(cmd *cobra.Command, args []string, opts ...d
 				configx.WithValue(config.ViperKeyDSN, args[0]),
 			})
 		if err != nil {
-			return err
+			return nil, err
 		}
 	}
 
 	err = d.Init(cmd.Context(), &contextx.Default{}, append(opts, driver.SkipNetworkInit)...)
 	if err != nil {
-		return errors.Wrap(err, "an error occurred initializing migrations")
+		return nil, errors.Wrap(err, "an error occurred initializing migrations")
 	}
 
-	var plan bytes.Buffer
-	_, err = d.Persister().MigrationStatus(cmd.Context())
-	if err != nil {
-		return errors.Wrap(err, "an error occurred planning migrations:")
-	}
+	return d, nil
+}
 
-	if !flagx.MustGetBool(cmd, "yes") {
-		fmt.Println("The following migration is planned:")
-		fmt.Println("")
-		fmt.Printf("%s", plan.String())
-		fmt.Println("")
-		fmt.Println("To skip the next question use flag --yes (at your own risk).")
-		if !askForConfirmation("Do you wish to execute this migration plan?") {
-			fmt.Println("Migration aborted.")
-			return cmdx.FailSilently(cmd)
-		}
+func (h *MigrateHandler) MigrateSQLDown(cmd *cobra.Command, args []string, opts ...driver.RegistryOption) error {
+	p, err := h.getPersister(cmd, args, opts)
+	if err != nil {
+		return err
 	}
+	return popx.MigrateSQLDown(cmd, p.Persister())
+}
 
-	if err = d.Persister().MigrateUp(cmd.Context()); err != nil {
+func (h *MigrateHandler) MigrateSQLStatus(cmd *cobra.Command, args []string, opts ...driver.RegistryOption) error {
+	p, err := h.getPersister(cmd, args, opts)
+	if err != nil {
 		return err
 	}
-	fmt.Println("Successfully applied SQL migrations!")
-	return nil
+	return popx.MigrateStatus(cmd, p.Persister())
 }
 
-func askForConfirmation(s string) bool {
-	reader := bufio.NewReader(os.Stdin)
-
-	for {
-		fmt.Printf("%s [y/n]: ", s)
-
-		response, err := reader.ReadString('\n')
-		cmdx.Must(err, "%s", err)
-
-		response = strings.ToLower(strings.TrimSpace(response))
-		if response == "y" || response == "yes" {
-			return true
-		} else if response == "n" || response == "no" {
-			return false
-		}
+func (h *MigrateHandler) MigrateSQLUp(cmd *cobra.Command, args []string, opts ...driver.RegistryOption) error {
+	p, err := h.getPersister(cmd, args, opts)
+	if err != nil {
+		return err
 	}
+	return popx.MigrateSQLUp(cmd, p.Persister())
 }
diff --git a/cmd/clidoc/main.go b/cmd/clidoc/main.go
index 6ed8df8d1748..c0bcda5d320e 100644
--- a/cmd/clidoc/main.go
+++ b/cmd/clidoc/main.go
@@ -121,11 +121,11 @@ func init() {
 		"NewInfoLoginLookupLabel":                                 text.NewInfoLoginLookupLabel(),
 		"NewInfoLogin":                                            text.NewInfoLogin(),
 		"NewInfoLoginAndLink":                                     text.NewInfoLoginAndLink(),
-		"NewInfoLoginLinkMessage":                                 text.NewInfoLoginLinkMessage("{duplicteIdentifier}", "{provider}", "{newLoginUrl}"),
+		"NewInfoLoginLinkMessage":                                 text.NewInfoLoginLinkMessage("{duplicateIdentifier}", "{provider}", "{newLoginUrl}", []string{"{available_credential_types_list}"}, []string{"{available_oidc_providers_list}"}),
 		"NewInfoLoginTOTP":                                        text.NewInfoLoginTOTP(),
 		"NewInfoLoginLookup":                                      text.NewInfoLoginLookup(),
 		"NewInfoLoginVerify":                                      text.NewInfoLoginVerify(),
-		"NewInfoLoginWith":                                        text.NewInfoLoginWith("{provider}"),
+		"NewInfoLoginWith":                                        text.NewInfoLoginWith("{provider}", "{providerID}"),
 		"NewInfoLoginWithAndLink":                                 text.NewInfoLoginWithAndLink("{provider}"),
 		"NewErrorValidationLoginFlowExpired":                      text.NewErrorValidationLoginFlowExpired(aSecondAgo),
 		"NewErrorValidationLoginNoStrategyFound":                  text.NewErrorValidationLoginNoStrategyFound(),
@@ -135,7 +135,7 @@ func init() {
 		"NewErrorValidationVerificationNoStrategyFound":           text.NewErrorValidationVerificationNoStrategyFound(),
 		"NewInfoSelfServiceLoginWebAuthn":                         text.NewInfoSelfServiceLoginWebAuthn(),
 		"NewInfoRegistration":                                     text.NewInfoRegistration(),
-		"NewInfoRegistrationWith":                                 text.NewInfoRegistrationWith("{provider}"),
+		"NewInfoRegistrationWith":                                 text.NewInfoRegistrationWith("{provider}", "{providerID}"),
 		"NewInfoRegistrationContinue":                             text.NewInfoRegistrationContinue(),
 		"NewInfoRegistrationBack":                                 text.NewInfoRegistrationBack(),
 		"NewInfoSelfServiceChooseCredentials":                     text.NewInfoSelfServiceChooseCredentials(),
@@ -162,7 +162,7 @@ func init() {
 		"NewInfoSelfServiceLoginContinue":                         text.NewInfoSelfServiceLoginContinue(),
 		"NewErrorValidationSuchNoWebAuthnUser":                    text.NewErrorValidationSuchNoWebAuthnUser(),
 		"NewRegistrationEmailWithCodeSent":                        text.NewRegistrationEmailWithCodeSent(),
-		"NewLoginEmailWithCodeSent":                               text.NewLoginEmailWithCodeSent(),
+		"NewLoginCodeSent":                                        text.NewLoginCodeSent(),
 		"NewErrorValidationRegistrationCodeInvalidOrAlreadyUsed":  text.NewErrorValidationRegistrationCodeInvalidOrAlreadyUsed(),
 		"NewErrorValidationLoginCodeInvalidOrAlreadyUsed":         text.NewErrorValidationLoginCodeInvalidOrAlreadyUsed(),
 		"NewErrorValidationNoCodeUser":                            text.NewErrorValidationNoCodeUser(),
@@ -176,7 +176,11 @@ func init() {
 		"NewErrorValidationLoginLinkedCredentialsDoNotMatch":      text.NewErrorValidationLoginLinkedCredentialsDoNotMatch(),
 		"NewErrorValidationAddressUnknown":                        text.NewErrorValidationAddressUnknown(),
 		"NewInfoSelfServiceLoginCodeMFA":                          text.NewInfoSelfServiceLoginCodeMFA(),
-		"NewInfoSelfServiceLoginCodeMFAHint":                      text.NewInfoSelfServiceLoginCodeMFAHint("{maskedIdentifier}"),
+		"NewInfoLoginPassword":                                    text.NewInfoLoginPassword(),
+		"NewErrorValidationAccountNotFound":                       text.NewErrorValidationAccountNotFound(),
+		"NewInfoSelfServiceLoginAAL2CodeAddress":                  text.NewInfoSelfServiceLoginAAL2CodeAddress("{channel}", "{address}"),
+		"NewErrorCaptchaFailed":                                   text.NewErrorCaptchaFailed(),
+		"NewCaptchaContainerMessage":                              text.NewCaptchaContainerMessage(),
 	}
 }
 
@@ -305,6 +309,8 @@ func validateAllMessages(path string) error {
 	info := &types.Info{
 		Defs: make(map[*ast.Ident]types.Object),
 	}
+
+	//nolint:staticcheck
 	var pack *ast.Package
 	for _, p := range packs {
 		if p.Name == "text" {
diff --git a/cmd/hashers/argon2/calibrate.go b/cmd/hashers/argon2/calibrate.go
index 6f888735bbd5..8b4364a764f3 100644
--- a/cmd/hashers/argon2/calibrate.go
+++ b/cmd/hashers/argon2/calibrate.go
@@ -246,6 +246,7 @@ Please note that the values depend on the machine you run the hashing on. If you
 				case res.MaxMem > conf.localConfig.DedicatedMemory:
 					_, _ = progressPrinter.Printf("The required memory was %s more than the maximum allowed of %s.\n", res.MaxMem-maxMemory, conf.localConfig.DedicatedMemory)
 
+					//nolint:gosec // disable G115
 					conf.localConfig.Memory -= (res.MaxMem - conf.localConfig.DedicatedMemory) / bytesize.ByteSize(reqPerMin)
 					_, _ = progressPrinter.Printf("Decreasing memory to %s\n", conf.localConfig.Memory)
 				// too slow
diff --git a/cmd/identities/delete.go b/cmd/identities/delete.go
index 9a1029b7a244..e1433bca87be 100644
--- a/cmd/identities/delete.go
+++ b/cmd/identities/delete.go
@@ -47,7 +47,7 @@ func NewDeleteIdentityCmd() *cobra.Command {
 			)
 
 			for _, a := range args {
-				_, err := c.IdentityApi.DeleteIdentity(cmd.Context(), a).Execute()
+				_, err := c.IdentityAPI.DeleteIdentity(cmd.Context(), a).Execute()
 				if err != nil {
 					failed[a] = cmdx.PrintOpenAPIError(cmd, err)
 					continue
diff --git a/cmd/identities/get.go b/cmd/identities/get.go
index 677ac3bc9121..8203454b2af0 100644
--- a/cmd/identities/get.go
+++ b/cmd/identities/get.go
@@ -66,7 +66,7 @@ func NewGetIdentityCmd() *cobra.Command {
 			identities := make([]kratos.Identity, 0, len(args))
 			failed := make(map[string]error)
 			for _, id := range args {
-				identity, _, err := c.IdentityApi.
+				identity, _, err := c.IdentityAPI.
 					GetIdentity(cmd.Context(), id).
 					IncludeCredential(includeCreds).
 					Execute()
diff --git a/cmd/identities/get_test.go b/cmd/identities/get_test.go
index 03a1291d5872..5cbaad0e9cb8 100644
--- a/cmd/identities/get_test.go
+++ b/cmd/identities/get_test.go
@@ -5,7 +5,6 @@ package identities_test
 
 import (
 	"context"
-	"encoding/hex"
 	"encoding/json"
 	"testing"
 
@@ -63,10 +62,12 @@ func TestGetCmd(t *testing.T) {
 				return out
 			}
 			transform := func(token string) string {
-				if !encrypt {
-					return token
+				if encrypt {
+					s, err := reg.Cipher(context.Background()).Encrypt(context.Background(), []byte(token))
+					require.NoError(t, err)
+					return s
 				}
-				return hex.EncodeToString([]byte(token))
+				return token
 			}
 			return identity.Credentials{
 				Type:        identity.CredentialsTypeOIDC,
diff --git a/cmd/identities/helpers_test.go b/cmd/identities/helpers_test.go
index 5997b32c7623..a6571e813abc 100644
--- a/cmd/identities/helpers_test.go
+++ b/cmd/identities/helpers_test.go
@@ -21,7 +21,7 @@ import (
 	"github.com/ory/kratos/internal/testhelpers"
 )
 
-func setup(t *testing.T, newCmd func() *cobra.Command) (driver.Registry, *cmdx.CommandExecuter) {
+func setup(t *testing.T, newCmd func() *cobra.Command) (*driver.RegistryDefault, *cmdx.CommandExecuter) {
 	conf, reg := internal.NewFastRegistryWithMocks(t)
 	_, admin := testhelpers.NewKratosServerWithCSRF(t, reg)
 	testhelpers.SetDefaultIdentitySchema(conf, "file://./stubs/identity.schema.json")
diff --git a/cmd/identities/import.go b/cmd/identities/import.go
index 1de8a22de385..8eac43afed05 100644
--- a/cmd/identities/import.go
+++ b/cmd/identities/import.go
@@ -73,7 +73,7 @@ Files can contain only a single or an array of identities. The validity of files
 					return cmdx.FailSilently(cmd)
 				}
 
-				ident, _, err := c.IdentityApi.CreateIdentity(cmd.Context()).CreateIdentityBody(params).Execute()
+				ident, _, err := c.IdentityAPI.CreateIdentity(cmd.Context()).CreateIdentityBody(params).Execute()
 				if err != nil {
 					failed[src] = cmdx.PrintOpenAPIError(cmd, err)
 				} else {
diff --git a/cmd/identities/list.go b/cmd/identities/list.go
index 0fd4f13d20bf..24e38fafad0b 100644
--- a/cmd/identities/list.go
+++ b/cmd/identities/list.go
@@ -43,7 +43,7 @@ Eventual consistency means that the list operation will return faster and might
 			}
 
 			consistency := flagx.MustGetString(cmd, "consistency")
-			req := c.IdentityApi.ListIdentities(cmd.Context()).Consistency(consistency)
+			req := c.IdentityAPI.ListIdentities(cmd.Context()).Consistency(consistency)
 			page, perPage, err := cmdx.ParseTokenPaginationArgs(cmd)
 			if err != nil {
 				return err
diff --git a/cmd/identities/validate.go b/cmd/identities/validate.go
index 2454d896225b..322e8e15c99a 100644
--- a/cmd/identities/validate.go
+++ b/cmd/identities/validate.go
@@ -56,7 +56,7 @@ Identities can be supplied via STD_IN or JSON files containing a single or an ar
 
 			for src, i := range is {
 				err = ValidateIdentity(cmd, src, i, func(ctx context.Context, id string) (map[string]interface{}, *http.Response, error) {
-					return c.IdentityApi.GetIdentitySchema(ctx, id).Execute()
+					return c.IdentityAPI.GetIdentitySchema(ctx, id).Execute()
 				})
 				if err != nil {
 					return err
diff --git a/cmd/migrate/root.go b/cmd/migrate/root.go
index ccac053b6ad2..38cd83ed950e 100644
--- a/cmd/migrate/root.go
+++ b/cmd/migrate/root.go
@@ -5,6 +5,11 @@ package migrate
 
 import (
 	"github.com/spf13/cobra"
+
+	"github.com/ory/kratos/cmd/cliclient"
+	"github.com/ory/kratos/driver"
+	"github.com/ory/x/configx"
+	"github.com/ory/x/popx"
 )
 
 func NewMigrateCmd() *cobra.Command {
@@ -16,6 +21,27 @@ func NewMigrateCmd() *cobra.Command {
 
 func RegisterCommandRecursive(parent *cobra.Command) {
 	c := NewMigrateCmd()
-	parent.AddCommand(c)
+
+	configx.RegisterFlags(c.PersistentFlags())
 	c.AddCommand(NewMigrateSQLCmd())
+
+	parent.AddCommand(c)
+}
+
+func NewMigrateSQLDownCmd(opts ...driver.RegistryOption) *cobra.Command {
+	return popx.NewMigrateSQLDownCmd("kratos", func(cmd *cobra.Command, args []string) error {
+		return cliclient.NewMigrateHandler().MigrateSQLDown(cmd, args, opts...)
+	})
+}
+
+func NewMigrateSQLUpCmd(opts ...driver.RegistryOption) *cobra.Command {
+	return popx.NewMigrateSQLUpCmd("kratos", func(cmd *cobra.Command, args []string) error {
+		return cliclient.NewMigrateHandler().MigrateSQLUp(cmd, args, opts...)
+	})
+}
+
+func NewMigrateSQLStatusCmd(opts ...driver.RegistryOption) *cobra.Command {
+	return popx.NewMigrateSQLStatusCmd("kratos", func(cmd *cobra.Command, args []string) error {
+		return cliclient.NewMigrateHandler().MigrateSQLStatus(cmd, args, opts...)
+	})
 }
diff --git a/cmd/migrate/sql.go b/cmd/migrate/sql.go
index a1e940235304..148d33b12c5f 100644
--- a/cmd/migrate/sql.go
+++ b/cmd/migrate/sql.go
@@ -14,8 +14,9 @@ import (
 // migrateSqlCmd represents the sql command
 func NewMigrateSQLCmd(opts ...driver.RegistryOption) *cobra.Command {
 	c := &cobra.Command{
-		Use:   "sql <database-url>",
-		Short: "Create SQL schemas and apply migration plans",
+		Use:        "sql <database-url>",
+		Deprecated: "Please use `hydra migrate sql` instead.",
+		Short:      "Create SQL schemas and apply migration plans",
 		Long: `Run this command on a fresh SQL installation and when you upgrade Ory Kratos to a new minor version.
 
 It is recommended to run this command close to the SQL instance (e.g. same subnet) instead of over the public internet.
@@ -30,12 +31,17 @@ You can read in the database URL using the -e flag, for example:
 Before running this command on an existing database, create a back up!
 `,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return cliclient.NewMigrateHandler().MigrateSQL(cmd, args, opts...)
+			return cliclient.NewMigrateHandler().MigrateSQLUp(cmd, args, opts...)
 		},
 	}
 
 	configx.RegisterFlags(c.PersistentFlags())
-	c.Flags().BoolP("read-from-env", "e", false, "If set, reads the database connection string from the environment variable DSN or config file key dsn.")
+	c.PersistentFlags().BoolP("read-from-env", "e", false, "If set, reads the database connection string from the environment variable DSN or config file key dsn.")
 	c.Flags().BoolP("yes", "y", false, "If set all confirmation requests are accepted without user interaction.")
+
+	c.AddCommand(NewMigrateSQLStatusCmd(opts...))
+	c.AddCommand(NewMigrateSQLUpCmd(opts...))
+	c.AddCommand(NewMigrateSQLDownCmd(opts...))
+
 	return c
 }
diff --git a/cmd/remote/status.go b/cmd/remote/status.go
index e61ef0b068b2..7421eef7e659 100644
--- a/cmd/remote/status.go
+++ b/cmd/remote/status.go
@@ -51,14 +51,14 @@ var statusCmd = &cobra.Command{
 		state := &statusState{}
 		defer cmdx.PrintRow(cmd, state)
 
-		alive, _, err := c.MetadataApi.IsAlive(cmd.Context()).Execute()
+		alive, _, err := c.MetadataAPI.IsAlive(cmd.Context()).Execute()
 		if err != nil {
 			return err
 		}
 
 		state.Alive = alive.Status == "ok"
 
-		ready, _, err := c.MetadataApi.IsReady(cmd.Context()).Execute()
+		ready, _, err := c.MetadataAPI.IsReady(cmd.Context()).Execute()
 		if err != nil {
 			return err
 		}
diff --git a/cmd/remote/version.go b/cmd/remote/version.go
index 18c33388ac36..23bf102f344f 100644
--- a/cmd/remote/version.go
+++ b/cmd/remote/version.go
@@ -36,7 +36,7 @@ var versionCmd = &cobra.Command{
 			return err
 		}
 
-		resp, _, err := c.MetadataApi.GetVersion(cmd.Context()).Execute()
+		resp, _, err := c.MetadataAPI.GetVersion(cmd.Context()).Execute()
 		if err != nil {
 			return err
 		}
diff --git a/codecov.yml b/codecov.yml
index 920fd382283f..620228c31857 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -2,10 +2,9 @@ coverage:
   status:
     project:
       default:
-        target: 70%
-        threshold: 5%
+        target: 65%
+        threshold: 10%
         only_pulls: true
-        base: auto
 ignore:
   - "test"
   - "internal"
diff --git a/corpx/faker.go b/corpx/faker.go
index e8fc4b0e388f..ec54a252ab6b 100644
--- a/corpx/faker.go
+++ b/corpx/faker.go
@@ -17,8 +17,8 @@ import (
 	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/ui/node"
 	"github.com/ory/kratos/x"
+	"github.com/ory/x/pointerx"
 	"github.com/ory/x/randx"
-	"github.com/ory/x/stringsx"
 )
 
 var setup sync.Once
@@ -31,13 +31,13 @@ func registerFakes() {
 	_ = faker.SetRandomMapAndSliceSize(4)
 
 	if err := faker.AddProvider("ptr_geo_location", func(v reflect.Value) (interface{}, error) {
-		return stringsx.GetPointer("Munich, Germany"), nil
+		return pointerx.Ptr("Munich, Germany"), nil
 	}); err != nil {
 		panic(err)
 	}
 
 	if err := faker.AddProvider("ptr_ipv4", func(v reflect.Value) (interface{}, error) {
-		return stringsx.GetPointer(faker.IPv4()), nil
+		return pointerx.Ptr(faker.IPv4()), nil
 	}); err != nil {
 		panic(err)
 	}
diff --git a/courier/courier.go b/courier/courier.go
index 231b4007060f..cb5acede6aee 100644
--- a/courier/courier.go
+++ b/courier/courier.go
@@ -47,10 +47,10 @@ type (
 	}
 
 	courier struct {
-		courierChannels     map[string]Channel
-		deps                Dependencies
-		failOnDispatchError bool
-		backoff             backoff.BackOff
+		deps                        Dependencies
+		failOnDispatchError         bool
+		backoff                     backoff.BackOff
+		newEmailTemplateFromMessage func(d template.Dependencies, msg Message) (EmailTemplate, error)
 	}
 )
 
@@ -58,31 +58,11 @@ func NewCourier(ctx context.Context, deps Dependencies) (Courier, error) {
 	return NewCourierWithCustomTemplates(ctx, deps, NewEmailTemplateFromMessage)
 }
 
-func NewCourierWithCustomTemplates(ctx context.Context, deps Dependencies, newEmailTemplateFromMessage func(d template.Dependencies, msg Message) (EmailTemplate, error)) (Courier, error) {
-	cs, err := deps.CourierConfig().CourierChannels(ctx)
-	if err != nil {
-		return nil, err
-	}
-	channels := make(map[string]Channel, len(cs))
-	for _, c := range cs {
-		switch c.Type {
-		case "smtp":
-			ch, err := NewSMTPChannelWithCustomTemplates(deps, c.SMTPConfig, newEmailTemplateFromMessage)
-			if err != nil {
-				return nil, err
-			}
-			channels[ch.ID()] = ch
-		case "http":
-			channels[c.ID] = newHttpChannel(c.ID, c.RequestConfig, deps)
-		default:
-			return nil, errors.Errorf("unknown courier channel type: %s", c.Type)
-		}
-	}
-
+func NewCourierWithCustomTemplates(_ context.Context, deps Dependencies, newEmailTemplateFromMessage func(d template.Dependencies, msg Message) (EmailTemplate, error)) (Courier, error) {
 	return &courier{
-		deps:            deps,
-		backoff:         backoff.NewExponentialBackOff(),
-		courierChannels: channels,
+		deps:                        deps,
+		backoff:                     backoff.NewExponentialBackOff(),
+		newEmailTemplateFromMessage: newEmailTemplateFromMessage,
 	}, nil
 }
 
diff --git a/courier/courier_dispatcher.go b/courier/courier_dispatcher.go
index 47399369c3c3..8d7a5773c5ab 100644
--- a/courier/courier_dispatcher.go
+++ b/courier/courier_dispatcher.go
@@ -7,9 +7,49 @@ import (
 	"context"
 
 	"github.com/pkg/errors"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/ory/x/otelx"
 )
 
-func (c *courier) DispatchMessage(ctx context.Context, msg Message) error {
+func (c *courier) channels(ctx context.Context, id string) (Channel, error) {
+	cs, err := c.deps.CourierConfig().CourierChannels(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, channel := range cs {
+		if channel.ID != id {
+			continue
+		}
+		switch channel.Type {
+		case "smtp":
+			courierChannel, err := NewSMTPChannelWithCustomTemplates(c.deps, channel.SMTPConfig, c.newEmailTemplateFromMessage)
+			if err != nil {
+				return nil, err
+			}
+			return courierChannel, nil
+		case "http":
+			return newHttpChannel(channel.ID, channel.RequestConfig, c.deps), nil
+		default:
+			return nil, errors.Errorf("unknown courier channel type: %s", channel.Type)
+		}
+	}
+
+	return nil, errors.Errorf("no courier channels configured")
+}
+
+func (c *courier) DispatchMessage(ctx context.Context, msg Message) (err error) {
+	ctx, span := c.deps.Tracer(ctx).Tracer().Start(ctx, "courier.DispatchMessage", trace.WithAttributes(
+		attribute.Stringer("message.id", msg.ID),
+		attribute.Stringer("message.nid", msg.NID),
+		attribute.Stringer("message.type", msg.Type),
+		attribute.String("message.template_type", string(msg.TemplateType)),
+		attribute.Int("message.send_count", msg.SendCount),
+	))
+	defer otelx.End(span, &err)
+
 	logger := c.deps.Logger().
 		WithField("message_id", msg.ID).
 		WithField("message_nid", msg.NID).
@@ -24,11 +64,12 @@ func (c *courier) DispatchMessage(ctx context.Context, msg Message) error {
 		return err
 	}
 
-	channel, ok := c.courierChannels[msg.Channel.String()]
-	if !ok {
-		return errors.Errorf("message %s has unknown channel %q", msg.ID.String(), msg.Channel)
+	channel, err := c.channels(ctx, msg.Channel.String())
+	if err != nil {
+		return err
 	}
 
+	span.SetAttributes(attribute.String("channel.id", channel.ID()))
 	logger = logger.
 		WithField("channel", channel.ID())
 
@@ -52,6 +93,7 @@ func (c *courier) DispatchQueue(ctx context.Context) error {
 	maxRetries := c.deps.CourierConfig().CourierMessageRetries(ctx)
 	pullCount := c.deps.CourierConfig().CourierWorkerPullCount(ctx)
 
+	//nolint:gosec // disable G115
 	messages, err := c.deps.CourierPersister().NextMessages(ctx, uint8(pullCount))
 	if err != nil {
 		if errors.Is(err, ErrQueueEmpty) {
@@ -80,6 +122,9 @@ func (c *courier) DispatchQueue(ctx context.Context) error {
 			logger.
 				Warnf(`Message was abandoned because it did not deliver after %d attempts`, msg.SendCount)
 		} else if err := c.DispatchMessage(ctx, msg); err != nil {
+			logger.
+				WithError(err).
+				Warn(`Unable to dispatch message.`)
 			if err := c.deps.CourierPersister().RecordDispatch(ctx, msg.ID, CourierMessageDispatchStatusFailed, err); err != nil {
 				logger.
 					WithError(err).
diff --git a/courier/handler_test.go b/courier/handler_test.go
index 28a7ec55d8b2..f4ca48ba30d6 100644
--- a/courier/handler_test.go
+++ b/courier/handler_test.go
@@ -57,7 +57,7 @@ func TestHandler(t *testing.T) {
 	conf.MustSet(ctx, config.ViperKeyAdminBaseURL, adminTS.URL)
 	conf.MustSet(ctx, config.ViperKeyPublicBaseURL, mockServerURL.String())
 
-	var get = func(t *testing.T, base *httptest.Server, href string, expectCode int) gjson.Result {
+	get := func(t *testing.T, base *httptest.Server, href string, expectCode int) gjson.Result {
 		t.Helper()
 		res, err := base.Client().Get(base.URL + href)
 		require.NoError(t, err)
@@ -69,7 +69,7 @@ func TestHandler(t *testing.T) {
 		return gjson.ParseBytes(body)
 	}
 
-	var getList = func(t *testing.T, tsName string, qs string) gjson.Result {
+	getList := func(t *testing.T, tsName string, qs string) gjson.Result {
 		t.Helper()
 		href := courier.AdminRouteListMessages + qs
 		ts := adminTS
@@ -109,12 +109,12 @@ func TestHandler(t *testing.T) {
 			}
 			require.NoError(t, reg.CourierPersister().AddMessage(context.Background(), &messages[i]))
 		}
-		for i := 0; i < procCount; i++ {
+		for i := range procCount {
 			require.NoError(t, reg.CourierPersister().SetMessageStatus(context.Background(), messages[i].ID, courier.MessageStatusProcessing))
 		}
 
 		t.Run("paging", func(t *testing.T) {
-			t.Run("case=should return half of the messages", func(t *testing.T) {
+			t.Run("case=should return first half of the messages", func(t *testing.T) {
 				qs := fmt.Sprintf("?page_token=%s&page_size=%d", defaultPageToken, msgCount/2)
 
 				for _, tc := range tss {
@@ -124,7 +124,7 @@ func TestHandler(t *testing.T) {
 					})
 				}
 			})
-			t.Run("case=should return no message", func(t *testing.T) {
+			t.Run("case=should error with random page token", func(t *testing.T) {
 				token := keysetpagination.MapPageToken{
 					"id":         "1232",
 					"created_at": time.Now().Add(time.Duration(-10) * time.Hour).Format("2006-01-02 15:04:05.99999-07:00"),
@@ -133,8 +133,13 @@ func TestHandler(t *testing.T) {
 
 				for _, tc := range tss {
 					t.Run("endpoint="+tc.name, func(t *testing.T) {
-						parsed := getList(t, tc.name, qs)
-						assert.Len(t, parsed.Array(), 0)
+						path := courier.AdminRouteListMessages + qs
+						if tc.name == "public" {
+							path = x.AdminPrefix + path
+						}
+						resp, err := tc.s.Client().Get(tc.s.URL + path)
+						require.NoError(t, err)
+						assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
 					})
 				}
 			})
diff --git a/courier/http_channel.go b/courier/http_channel.go
index 2e405fb22abe..97df749e48ae 100644
--- a/courier/http_channel.go
+++ b/courier/http_channel.go
@@ -61,7 +61,7 @@ func (c *httpChannel) Dispatch(ctx context.Context, msg Message) (err error) {
 	ctx, span := c.d.Tracer(ctx).Tracer().Start(ctx, "courier.httpChannel.Dispatch")
 	defer otelx.End(span, &err)
 
-	builder, err := request.NewBuilder(ctx, c.requestConfig, c.d, nil)
+	builder, err := request.NewBuilder(ctx, c.requestConfig, c.d)
 	if err != nil {
 		return errors.WithStack(err)
 	}
diff --git a/courier/sms_templates.go b/courier/sms_templates.go
index b560542d53c9..12c55ceed751 100644
--- a/courier/sms_templates.go
+++ b/courier/sms_templates.go
@@ -40,6 +40,12 @@ func NewSMSTemplateFromMessage(d template.Dependencies, m Message) (SMSTemplate,
 			return nil, err
 		}
 		return sms.NewLoginCodeValid(d, &t), nil
+	case template.TypeRegistrationCodeValid:
+		var t sms.RegistrationCodeValidModel
+		if err := json.Unmarshal(m.TemplateData, &t); err != nil {
+			return nil, err
+		}
+		return sms.NewRegistrationCodeValid(d, &t), nil
 
 	default:
 		return nil, errors.Errorf("received unexpected message template type: %s", m.TemplateType)
diff --git a/courier/sms_test.go b/courier/sms_test.go
index a93a7974bf71..5dc727048be6 100644
--- a/courier/sms_test.go
+++ b/courier/sms_test.go
@@ -63,6 +63,7 @@ func TestQueueSMS(t *testing.T) {
 			Body: body.Body,
 		})
 	}))
+	t.Cleanup(srv.Close)
 
 	requestConfig := fmt.Sprintf(`{
 		"url": "%s",
@@ -112,8 +113,6 @@ func TestQueueSMS(t *testing.T) {
 		assert.Equal(t, expected.To, message.To)
 		assert.Equal(t, fmt.Sprintf("stub sms body %s\n", expected.Body), message.Body)
 	}
-
-	srv.Close()
 }
 
 func TestDisallowedInternalNetwork(t *testing.T) {
diff --git a/courier/smtp_channel.go b/courier/smtp_channel.go
index 9ed9335f8e7f..3527b2b7d680 100644
--- a/courier/smtp_channel.go
+++ b/courier/smtp_channel.go
@@ -5,15 +5,19 @@ package courier
 
 import (
 	"context"
-	"fmt"
+	"net"
 	"net/textproto"
+	"strconv"
 
 	"github.com/pkg/errors"
+	semconv "go.opentelemetry.io/otel/semconv/v1.20.0"
+	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/herodot"
 	"github.com/ory/kratos/courier/template"
 	"github.com/ory/kratos/driver/config"
 	"github.com/ory/mail/v3"
+	"github.com/ory/x/otelx"
 )
 
 type (
@@ -47,7 +51,10 @@ func (c *SMTPChannel) ID() string {
 	return "email"
 }
 
-func (c *SMTPChannel) Dispatch(ctx context.Context, msg Message) error {
+func (c *SMTPChannel) Dispatch(ctx context.Context, msg Message) (err error) {
+	ctx, span := c.d.Tracer(ctx).Tracer().Start(ctx, "courier.SMTPChannel.Dispatch")
+	defer otelx.End(span, &err)
+
 	if c.smtpClient.Host == "" {
 		return errors.WithStack(herodot.ErrInternalServerError.WithErrorf("Courier tried to deliver an email but %s is not set!", config.ViperKeyCourierSMTPURL))
 	}
@@ -87,7 +94,7 @@ func (c *SMTPChannel) Dispatch(ctx context.Context, msg Message) error {
 	gm.SetBody("text/plain", msg.Body)
 
 	logger := c.d.Logger().
-		WithField("smtp_server", fmt.Sprintf("%s:%d", c.smtpClient.Host, c.smtpClient.Port)).
+		WithField("smtp_server", net.JoinHostPort(c.smtpClient.Host, strconv.Itoa(c.smtpClient.Port))).
 		WithField("smtp_ssl_enabled", c.smtpClient.SSL).
 		WithField("message_from", cfg.FromAddress).
 		WithField("message_id", msg.ID).
@@ -107,8 +114,29 @@ func (c *SMTPChannel) Dispatch(ctx context.Context, msg Message) error {
 		gm.AddAlternative("text/html", htmlBody)
 	}
 
-	if err := c.smtpClient.DialAndSend(ctx, gm); err != nil {
-		c.d.Logger().
+	dialCtx, dialSpan := c.d.Tracer(ctx).Tracer().Start(ctx, "courier.SMTPChannel.Dispatch.Dial", trace.WithAttributes(
+		semconv.NetPeerName(c.smtpClient.Host),
+		semconv.NetPeerPort(c.smtpClient.Port),
+		semconv.NetProtocolName("smtp"),
+	))
+	snd, err := c.smtpClient.Dial(dialCtx)
+	otelx.End(dialSpan, &err)
+
+	if err != nil {
+		logger.
+			WithError(err).
+			Error("Unable to dial SMTP connection.")
+		return errors.WithStack(herodot.ErrInternalServerError.
+			WithError(err.Error()).WithReason("failed to send email via smtp"))
+	}
+	defer snd.Close()
+
+	sendCtx, sendSpan := c.d.Tracer(ctx).Tracer().Start(ctx, "courier.SMTPChannel.Dispatch.Send")
+	err = mail.Send(sendCtx, snd, gm)
+	otelx.End(sendSpan, &err)
+
+	if err != nil {
+		logger.
 			WithError(err).
 			Error("Unable to send email using SMTP connection.")
 
diff --git a/courier/template/courier/builtin/templates/login_code/valid/email.body.gotmpl b/courier/template/courier/builtin/templates/login_code/valid/email.body.gotmpl
index 505684b9849b..0b1b3abd30b8 100644
--- a/courier/template/courier/builtin/templates/login_code/valid/email.body.gotmpl
+++ b/courier/template/courier/builtin/templates/login_code/valid/email.body.gotmpl
@@ -1,5 +1,5 @@
-Hi,
-
-please login to your account by entering the following code:
+Login to your account with the following code:
 
 {{ .LoginCode }}
+
+It expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/login_code/valid/email.body.plaintext.gotmpl b/courier/template/courier/builtin/templates/login_code/valid/email.body.plaintext.gotmpl
index 505684b9849b..0b1b3abd30b8 100644
--- a/courier/template/courier/builtin/templates/login_code/valid/email.body.plaintext.gotmpl
+++ b/courier/template/courier/builtin/templates/login_code/valid/email.body.plaintext.gotmpl
@@ -1,5 +1,5 @@
-Hi,
-
-please login to your account by entering the following code:
+Login to your account with the following code:
 
 {{ .LoginCode }}
+
+It expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/login_code/valid/email.subject.gotmpl b/courier/template/courier/builtin/templates/login_code/valid/email.subject.gotmpl
index 19d7bfd57d49..0015e66086c9 100644
--- a/courier/template/courier/builtin/templates/login_code/valid/email.subject.gotmpl
+++ b/courier/template/courier/builtin/templates/login_code/valid/email.subject.gotmpl
@@ -1 +1 @@
-Login to your account
+Use code {{ .LoginCode }} to log in
diff --git a/courier/template/courier/builtin/templates/login_code/valid/sms.body.gotmpl b/courier/template/courier/builtin/templates/login_code/valid/sms.body.gotmpl
index 5b88dde9a382..ca6d35ca9eac 100644
--- a/courier/template/courier/builtin/templates/login_code/valid/sms.body.gotmpl
+++ b/courier/template/courier/builtin/templates/login_code/valid/sms.body.gotmpl
@@ -1 +1,3 @@
 Your login code is: {{ .LoginCode }}
+
+It expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/recovery/valid/email.body.gotmpl b/courier/template/courier/builtin/templates/recovery/valid/email.body.gotmpl
index 2dbc8d53550b..c4ac7a1d6404 100644
--- a/courier/template/courier/builtin/templates/recovery/valid/email.body.gotmpl
+++ b/courier/template/courier/builtin/templates/recovery/valid/email.body.gotmpl
@@ -1,5 +1,5 @@
-Hi,
-
-please recover access to your account by clicking the following link:
+Recover access to your account by clicking the following link:
 
 <a href="{{ .RecoveryURL }}">{{ .RecoveryURL }}</a>
+
+If this was not you, do nothing. This link expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/recovery/valid/email.body.plaintext.gotmpl b/courier/template/courier/builtin/templates/recovery/valid/email.body.plaintext.gotmpl
index d41e8963cc50..7bea438ffffa 100644
--- a/courier/template/courier/builtin/templates/recovery/valid/email.body.plaintext.gotmpl
+++ b/courier/template/courier/builtin/templates/recovery/valid/email.body.plaintext.gotmpl
@@ -1,5 +1,6 @@
-Hi,
-
-please recover access to your account by clicking the following link:
+Recover access to your account by clicking the following link:
 
 {{ .RecoveryURL }}
+
+If this was not you, do nothing. This link expires in {{ .ExpiresInMinutes }} minutes.
+
diff --git a/courier/template/courier/builtin/templates/recovery_code/valid/email.body.gotmpl b/courier/template/courier/builtin/templates/recovery_code/valid/email.body.gotmpl
index 5037d753998e..8427467b81c8 100644
--- a/courier/template/courier/builtin/templates/recovery_code/valid/email.body.gotmpl
+++ b/courier/template/courier/builtin/templates/recovery_code/valid/email.body.gotmpl
@@ -1,5 +1,5 @@
-Hi,
-
-please recover access to your account by entering the following code:
+Recover access to your account by entering the following code:
 
 {{ .RecoveryCode }}
+
+If this was not you, do nothing. This code expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/recovery_code/valid/email.body.plaintext.gotmpl b/courier/template/courier/builtin/templates/recovery_code/valid/email.body.plaintext.gotmpl
index 5037d753998e..8427467b81c8 100644
--- a/courier/template/courier/builtin/templates/recovery_code/valid/email.body.plaintext.gotmpl
+++ b/courier/template/courier/builtin/templates/recovery_code/valid/email.body.plaintext.gotmpl
@@ -1,5 +1,5 @@
-Hi,
-
-please recover access to your account by entering the following code:
+Recover access to your account by entering the following code:
 
 {{ .RecoveryCode }}
+
+If this was not you, do nothing. This code expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/recovery_code/valid/email.subject.gotmpl b/courier/template/courier/builtin/templates/recovery_code/valid/email.subject.gotmpl
index 9a47d5f5814a..0890daa9df87 100644
--- a/courier/template/courier/builtin/templates/recovery_code/valid/email.subject.gotmpl
+++ b/courier/template/courier/builtin/templates/recovery_code/valid/email.subject.gotmpl
@@ -1 +1 @@
-Recover access to your account
+Use code {{ .RecoveryCode }} to recover access to your account
diff --git a/courier/template/courier/builtin/templates/registration_code/valid/email.body.gotmpl b/courier/template/courier/builtin/templates/registration_code/valid/email.body.gotmpl
index 6b9c31799995..b839053d8afb 100644
--- a/courier/template/courier/builtin/templates/registration_code/valid/email.body.gotmpl
+++ b/courier/template/courier/builtin/templates/registration_code/valid/email.body.gotmpl
@@ -1,5 +1,5 @@
-Hi,
-
-please complete your account registration by entering the following code:
+Complete your account registration with the following code:
 
 {{ .RegistrationCode }}
+
+This code expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/registration_code/valid/email.body.plaintext.gotmpl b/courier/template/courier/builtin/templates/registration_code/valid/email.body.plaintext.gotmpl
index 6b9c31799995..b839053d8afb 100644
--- a/courier/template/courier/builtin/templates/registration_code/valid/email.body.plaintext.gotmpl
+++ b/courier/template/courier/builtin/templates/registration_code/valid/email.body.plaintext.gotmpl
@@ -1,5 +1,5 @@
-Hi,
-
-please complete your account registration by entering the following code:
+Complete your account registration with the following code:
 
 {{ .RegistrationCode }}
+
+This code expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/registration_code/valid/email.subject.gotmpl b/courier/template/courier/builtin/templates/registration_code/valid/email.subject.gotmpl
index 0f36292619ef..fd48d99a2b19 100644
--- a/courier/template/courier/builtin/templates/registration_code/valid/email.subject.gotmpl
+++ b/courier/template/courier/builtin/templates/registration_code/valid/email.subject.gotmpl
@@ -1 +1 @@
-Complete your account registration
+Use code {{ .RegistrationCode }} to complete your account registration
diff --git a/courier/template/courier/builtin/templates/registration_code/valid/sms.body.gotmpl b/courier/template/courier/builtin/templates/registration_code/valid/sms.body.gotmpl
new file mode 100644
index 000000000000..24b79fff0f8a
--- /dev/null
+++ b/courier/template/courier/builtin/templates/registration_code/valid/sms.body.gotmpl
@@ -0,0 +1,3 @@
+Your registration code is: {{ .RegistrationCode }}
+
+It expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/verification/invalid/email.body.gotmpl b/courier/template/courier/builtin/templates/verification/invalid/email.body.gotmpl
index bb3d3c1b3d90..18565a8de01d 100644
--- a/courier/template/courier/builtin/templates/verification/invalid/email.body.gotmpl
+++ b/courier/template/courier/builtin/templates/verification/invalid/email.body.gotmpl
@@ -1,6 +1,4 @@
-Hi,
-
-someone asked to verify this email address, but we were unable to find an account for this address.
+Someone asked to verify this email address, but we were unable to find an account for this address.
 
 If this was you, check if you signed up using a different address.
 
diff --git a/courier/template/courier/builtin/templates/verification/invalid/email.body.plaintext.gotmpl b/courier/template/courier/builtin/templates/verification/invalid/email.body.plaintext.gotmpl
index bb3d3c1b3d90..18565a8de01d 100644
--- a/courier/template/courier/builtin/templates/verification/invalid/email.body.plaintext.gotmpl
+++ b/courier/template/courier/builtin/templates/verification/invalid/email.body.plaintext.gotmpl
@@ -1,6 +1,4 @@
-Hi,
-
-someone asked to verify this email address, but we were unable to find an account for this address.
+Someone asked to verify this email address, but we were unable to find an account for this address.
 
 If this was you, check if you signed up using a different address.
 
diff --git a/courier/template/courier/builtin/templates/verification/valid/email.body.gotmpl b/courier/template/courier/builtin/templates/verification/valid/email.body.gotmpl
index d8e3168e5a78..d111cc47dd32 100644
--- a/courier/template/courier/builtin/templates/verification/valid/email.body.gotmpl
+++ b/courier/template/courier/builtin/templates/verification/valid/email.body.gotmpl
@@ -1,3 +1,5 @@
-Hi, please verify your account by clicking the following link:
+Verify your account by opening the following link:
 
 <a href="{{ .VerificationURL }}">{{ .VerificationURL }}</a>
+
+If this was not you, do nothing. This link expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/verification/valid/email.body.plaintext.gotmpl b/courier/template/courier/builtin/templates/verification/valid/email.body.plaintext.gotmpl
index 4d915646c61e..ac28e51a4878 100644
--- a/courier/template/courier/builtin/templates/verification/valid/email.body.plaintext.gotmpl
+++ b/courier/template/courier/builtin/templates/verification/valid/email.body.plaintext.gotmpl
@@ -1,4 +1,5 @@
-Hi, please verify your account by clicking the following link:
+Verify your account by opening the following link:
 
 {{ .VerificationURL }}
 
+If this was not you, do nothing. This link expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/verification_code/valid/email.body.gotmpl b/courier/template/courier/builtin/templates/verification_code/valid/email.body.gotmpl
index f564f53378af..fc8d55ab5c0a 100644
--- a/courier/template/courier/builtin/templates/verification_code/valid/email.body.gotmpl
+++ b/courier/template/courier/builtin/templates/verification_code/valid/email.body.gotmpl
@@ -1,9 +1,9 @@
-Hi,
-
-please verify your account by entering the following code:
+Verify your account with the following code:
 
 {{ .VerificationCode }}
 
 or clicking the following link:
 
 <a href="{{ .VerificationURL }}">{{ .VerificationURL }}</a>
+
+If this was not you, do nothing. This code / link expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/verification_code/valid/email.body.plaintext.gotmpl b/courier/template/courier/builtin/templates/verification_code/valid/email.body.plaintext.gotmpl
index 58a5f39d4410..b6dde063b3c1 100644
--- a/courier/template/courier/builtin/templates/verification_code/valid/email.body.plaintext.gotmpl
+++ b/courier/template/courier/builtin/templates/verification_code/valid/email.body.plaintext.gotmpl
@@ -1,9 +1,9 @@
-Hi,
-
-please verify your account by entering the following code:
+Verify your account with the following code:
 
 {{ .VerificationCode }}
 
 or clicking the following link:
 
 {{ .VerificationURL }}
+
+If this was not you, do nothing. This code / link expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/courier/builtin/templates/verification_code/valid/email.subject.gotmpl b/courier/template/courier/builtin/templates/verification_code/valid/email.subject.gotmpl
index 3f0aceec1a72..b71c78404bde 100644
--- a/courier/template/courier/builtin/templates/verification_code/valid/email.subject.gotmpl
+++ b/courier/template/courier/builtin/templates/verification_code/valid/email.subject.gotmpl
@@ -1 +1 @@
-Please verify your email address
+Use code {{ .VerificationCode }} to verify your account
diff --git a/courier/template/courier/builtin/templates/verification_code/valid/sms.body.gotmpl b/courier/template/courier/builtin/templates/verification_code/valid/sms.body.gotmpl
index 0469598d2d58..60474c5eb57b 100644
--- a/courier/template/courier/builtin/templates/verification_code/valid/sms.body.gotmpl
+++ b/courier/template/courier/builtin/templates/verification_code/valid/sms.body.gotmpl
@@ -1 +1,3 @@
 Your verification code is: {{ .VerificationCode }}
+
+If this was not you, do nothing. It expires in {{ .ExpiresInMinutes }} minutes.
diff --git a/courier/template/email/login_code_valid.go b/courier/template/email/login_code_valid.go
index b09f70f8625e..1863ea39fbe6 100644
--- a/courier/template/email/login_code_valid.go
+++ b/courier/template/email/login_code_valid.go
@@ -23,6 +23,7 @@ type (
 		Identity         map[string]interface{} `json:"identity"`
 		RequestURL       string                 `json:"request_url"`
 		TransientPayload map[string]interface{} `json:"transient_payload"`
+		ExpiresInMinutes int                    `json:"expires_in_minutes"`
 	}
 )
 
diff --git a/courier/template/email/recovery_code_valid.go b/courier/template/email/recovery_code_valid.go
index 4e8992da3d1d..313613ab714d 100644
--- a/courier/template/email/recovery_code_valid.go
+++ b/courier/template/email/recovery_code_valid.go
@@ -23,6 +23,7 @@ type (
 		Identity         map[string]interface{} `json:"identity"`
 		RequestURL       string                 `json:"request_url"`
 		TransientPayload map[string]interface{} `json:"transient_payload"`
+		ExpiresInMinutes int                    `json:"expires_in_minutes"`
 	}
 )
 
diff --git a/courier/template/email/recovery_valid.go b/courier/template/email/recovery_valid.go
index f82a40b4f919..ae681b7c875b 100644
--- a/courier/template/email/recovery_valid.go
+++ b/courier/template/email/recovery_valid.go
@@ -23,6 +23,7 @@ type (
 		Identity         map[string]interface{} `json:"identity"`
 		RequestURL       string                 `json:"request_url"`
 		TransientPayload map[string]interface{} `json:"transient_payload"`
+		ExpiresInMinutes int                    `json:"expires_in_minutes"`
 	}
 )
 
diff --git a/courier/template/email/registration_code_valid.go b/courier/template/email/registration_code_valid.go
index ec52362a8990..7994c1484afc 100644
--- a/courier/template/email/registration_code_valid.go
+++ b/courier/template/email/registration_code_valid.go
@@ -23,6 +23,7 @@ type (
 		RegistrationCode string                 `json:"registration_code"`
 		RequestURL       string                 `json:"request_url"`
 		TransientPayload map[string]interface{} `json:"transient_payload"`
+		ExpiresInMinutes int                    `json:"expires_in_minutes"`
 	}
 )
 
diff --git a/courier/template/email/verification_code_valid.go b/courier/template/email/verification_code_valid.go
index bd2045a03d25..d9b527901519 100644
--- a/courier/template/email/verification_code_valid.go
+++ b/courier/template/email/verification_code_valid.go
@@ -24,6 +24,7 @@ type (
 		Identity         map[string]interface{} `json:"identity"`
 		RequestURL       string                 `json:"request_url"`
 		TransientPayload map[string]interface{} `json:"transient_payload"`
+		ExpiresInMinutes int                    `json:"expires_in_minutes"`
 	}
 )
 
diff --git a/courier/template/email/verification_valid.go b/courier/template/email/verification_valid.go
index eb9578261d83..c8d24c4372ac 100644
--- a/courier/template/email/verification_valid.go
+++ b/courier/template/email/verification_valid.go
@@ -23,6 +23,7 @@ type (
 		Identity         map[string]interface{} `json:"identity"`
 		RequestURL       string                 `json:"request_url"`
 		TransientPayload map[string]interface{} `json:"transient_payload"`
+		ExpiresInMinutes int                    `json:"expires_in_minutes"`
 	}
 )
 
diff --git a/courier/template/load_template.go b/courier/template/load_template.go
index a34427949e95..db7ff61aea25 100644
--- a/courier/template/load_template.go
+++ b/courier/template/load_template.go
@@ -17,14 +17,14 @@ import (
 	"github.com/ory/x/fetcher"
 
 	"github.com/Masterminds/sprig/v3"
-	lru "github.com/hashicorp/golang-lru"
+	lru "github.com/hashicorp/golang-lru/v2"
 	"github.com/pkg/errors"
 )
 
 //go:embed courier/builtin/templates/*
 var templates embed.FS
 
-var Cache, _ = lru.New(16)
+var Cache, _ = lru.New[string, Template](16)
 
 type Template interface {
 	Execute(wr io.Writer, data interface{}) error
@@ -36,7 +36,7 @@ type templateDependencies interface {
 
 func loadBuiltInTemplate(filesystem fs.FS, name string, html bool) (Template, error) {
 	if t, found := Cache.Get(name); found {
-		return t.(Template), nil
+		return t, nil
 	}
 
 	file, err := filesystem.Open(name)
@@ -77,18 +77,16 @@ func loadBuiltInTemplate(filesystem fs.FS, name string, html bool) (Template, er
 }
 
 func loadRemoteTemplate(ctx context.Context, d templateDependencies, url string, html bool) (t Template, err error) {
-	var b []byte
 	if t, found := Cache.Get(url); found {
-		b = t.([]byte)
-	} else {
-		f := fetcher.NewFetcher(fetcher.WithClient(d.HTTPClient(ctx)))
-		bb, err := f.FetchContext(ctx, url)
-		if err != nil {
-			return nil, errors.WithStack(err)
-		}
-		b = bb.Bytes()
-		_ = Cache.Add(url, b)
+		return t, nil
+	}
+
+	f := fetcher.NewFetcher(fetcher.WithClient(d.HTTPClient(ctx)))
+	bb, err := f.FetchContext(ctx, url)
+	if err != nil {
+		return nil, errors.WithStack(err)
 	}
+	b := bb.Bytes()
 
 	if html {
 		t, err = htemplate.New(url).Funcs(sprig.HermeticHtmlFuncMap()).Parse(string(b))
@@ -101,13 +99,14 @@ func loadRemoteTemplate(ctx context.Context, d templateDependencies, url string,
 			return nil, errors.WithStack(err)
 		}
 	}
+	Cache.Add(url, t)
 
 	return t, nil
 }
 
 func loadTemplate(filesystem fs.FS, name, pattern string, html bool) (Template, error) {
 	if t, found := Cache.Get(name); found {
-		return t.(Template), nil
+		return t, nil
 	}
 
 	matches, _ := fs.Glob(filesystem, name)
diff --git a/courier/template/load_template_test.go b/courier/template/load_template_test.go
index 1fd245497ca9..986745726952 100644
--- a/courier/template/load_template_test.go
+++ b/courier/template/load_template_test.go
@@ -21,7 +21,7 @@ import (
 	"github.com/ory/kratos/internal"
 	"github.com/ory/x/fetcher"
 
-	lru "github.com/hashicorp/golang-lru"
+	lru "github.com/hashicorp/golang-lru/v2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -51,20 +51,20 @@ func TestLoadTextTemplate(t *testing.T) {
 	})
 
 	t.Run("method=fallback to bundled", func(t *testing.T) {
-		template.Cache, _ = lru.New(16) // prevent Cache hit
+		template.Cache, _ = lru.New[string, template.Template](16) // prevent Cache hit
 		actual := executeTextTemplate(t, "some/inexistent/dir", "test_stub/email.body.gotmpl", "", nil)
 		assert.Contains(t, actual, "stub email")
 	})
 
 	t.Run("method=with Sprig functions", func(t *testing.T) {
-		template.Cache, _ = lru.New(16)                     // prevent Cache hit
-		m := map[string]interface{}{"input": "hello world"} // create a simple model
+		template.Cache, _ = lru.New[string, template.Template](16) // prevent Cache hit
+		m := map[string]interface{}{"input": "hello world"}        // create a simple model
 		actual := executeTextTemplate(t, "courier/builtin/templates/test_stub", "email.body.sprig.gotmpl", "", m)
 		assert.Contains(t, actual, "HelloWorld,HELLOWORLD")
 	})
 
 	t.Run("method=sprig should not support non-hermetic", func(t *testing.T) {
-		template.Cache, _ = lru.New(16)
+		template.Cache, _ = lru.New[string, template.Template](16)
 		ctx := context.Background()
 		_, reg := internal.NewFastRegistryWithMocks(t)
 
@@ -80,8 +80,8 @@ func TestLoadTextTemplate(t *testing.T) {
 	})
 
 	t.Run("method=html with nested templates", func(t *testing.T) {
-		template.Cache, _ = lru.New(16)              // prevent Cache hit
-		m := map[string]interface{}{"lang": "en_US"} // create a simple model
+		template.Cache, _ = lru.New[string, template.Template](16) // prevent Cache hit
+		m := map[string]interface{}{"lang": "en_US"}               // create a simple model
 		actual := executeHTMLTemplate(t, "courier/builtin/templates/test_stub", "email.body.html.gotmpl", "email.body.html*", m)
 		assert.Contains(t, actual, "lang=en_US")
 	})
diff --git a/courier/template/sms/login_code_valid.go b/courier/template/sms/login_code_valid.go
index f365a6ba2800..f19e6e567771 100644
--- a/courier/template/sms/login_code_valid.go
+++ b/courier/template/sms/login_code_valid.go
@@ -22,6 +22,7 @@ type (
 		Identity         map[string]interface{} `json:"identity"`
 		RequestURL       string                 `json:"request_url"`
 		TransientPayload map[string]interface{} `json:"transient_payload"`
+		ExpiresInMinutes int                    `json:"expires_in_minutes"`
 	}
 )
 
diff --git a/courier/template/sms/login_code_valid_test.go b/courier/template/sms/login_code_valid_test.go
index a2915c750c89..48e24475c8d7 100644
--- a/courier/template/sms/login_code_valid_test.go
+++ b/courier/template/sms/login_code_valid_test.go
@@ -25,7 +25,7 @@ func TestNewLoginCodeValid(t *testing.T) {
 
 	tpl := sms.NewLoginCodeValid(reg, &sms.LoginCodeValidModel{To: expectedPhone, LoginCode: otp})
 
-	expectedBody := fmt.Sprintf("Your login code is: %s\n", otp)
+	expectedBody := fmt.Sprintf("Your login code is: %s\n\nIt expires in 0 minutes.\n", otp)
 
 	actualBody, err := tpl.SMSBody(context.Background())
 	require.NoError(t, err)
diff --git a/courier/template/sms/registration_code_valid.go b/courier/template/sms/registration_code_valid.go
new file mode 100644
index 000000000000..7413f75a94de
--- /dev/null
+++ b/courier/template/sms/registration_code_valid.go
@@ -0,0 +1,55 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package sms
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+
+	"github.com/ory/kratos/courier/template"
+)
+
+type (
+	RegistrationCodeValid struct {
+		deps  template.Dependencies
+		model *RegistrationCodeValidModel
+	}
+	RegistrationCodeValidModel struct {
+		To               string                 `json:"to"`
+		RegistrationCode string                 `json:"registration_code"`
+		Identity         map[string]interface{} `json:"identity"`
+		RequestURL       string                 `json:"request_url"`
+		TransientPayload map[string]interface{} `json:"transient_payload"`
+		ExpiresInMinutes int                    `json:"expires_in_minutes"`
+	}
+)
+
+func NewRegistrationCodeValid(d template.Dependencies, m *RegistrationCodeValidModel) *RegistrationCodeValid {
+	return &RegistrationCodeValid{deps: d, model: m}
+}
+
+func (t *RegistrationCodeValid) PhoneNumber() (string, error) {
+	return t.model.To, nil
+}
+
+func (t *RegistrationCodeValid) SMSBody(ctx context.Context) (string, error) {
+	return template.LoadText(
+		ctx,
+		t.deps,
+		os.DirFS(t.deps.CourierConfig().CourierTemplatesRoot(ctx)),
+		"registration_code/valid/sms.body.gotmpl",
+		"registration_code/valid/sms.body*",
+		t.model,
+		t.deps.CourierConfig().CourierSMSTemplatesRegistrationCodeValid(ctx).Body.PlainText,
+	)
+}
+
+func (t *RegistrationCodeValid) MarshalJSON() ([]byte, error) {
+	return json.Marshal(t.model)
+}
+
+func (t *RegistrationCodeValid) TemplateType() template.TemplateType {
+	return template.TypeRegistrationCodeValid
+}
diff --git a/courier/template/sms/registration_code_valid_test.go b/courier/template/sms/registration_code_valid_test.go
new file mode 100644
index 000000000000..1299c113f331
--- /dev/null
+++ b/courier/template/sms/registration_code_valid_test.go
@@ -0,0 +1,37 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package sms_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/courier/template/sms"
+	"github.com/ory/kratos/internal"
+)
+
+func TestNewRegistrationCodeValid(t *testing.T) {
+	_, reg := internal.NewFastRegistryWithMocks(t)
+
+	const (
+		expectedPhone = "+12345678901"
+		otp           = "012345"
+	)
+
+	tpl := sms.NewRegistrationCodeValid(reg, &sms.RegistrationCodeValidModel{To: expectedPhone, RegistrationCode: otp})
+
+	expectedBody := fmt.Sprintf("Your registration code is: %s\n\nIt expires in 0 minutes.\n", otp)
+
+	actualBody, err := tpl.SMSBody(context.Background())
+	require.NoError(t, err)
+	assert.Equal(t, expectedBody, actualBody)
+
+	actualPhone, err := tpl.PhoneNumber()
+	require.NoError(t, err)
+	assert.Equal(t, expectedPhone, actualPhone)
+}
diff --git a/courier/template/sms/verification_code.go b/courier/template/sms/verification_code.go
index 4204df0ac4c8..13c24be534cd 100644
--- a/courier/template/sms/verification_code.go
+++ b/courier/template/sms/verification_code.go
@@ -23,6 +23,7 @@ type (
 		Identity         map[string]interface{} `json:"identity"`
 		RequestURL       string                 `json:"request_url"`
 		TransientPayload map[string]interface{} `json:"transient_payload"`
+		ExpiresInMinutes int                    `json:"expires_in_minutes"`
 	}
 )
 
diff --git a/courier/template/sms/verification_code_test.go b/courier/template/sms/verification_code_test.go
index fc2bb892e6b2..4a31ae7f6ce3 100644
--- a/courier/template/sms/verification_code_test.go
+++ b/courier/template/sms/verification_code_test.go
@@ -25,7 +25,7 @@ func TestNewOTPMessage(t *testing.T) {
 
 	tpl := sms.NewVerificationCodeValid(reg, &sms.VerificationCodeValidModel{To: expectedPhone, VerificationCode: otp})
 
-	expectedBody := fmt.Sprintf("Your verification code is: %s\n", otp)
+	expectedBody := fmt.Sprintf("Your verification code is: %s\n\nIf this was not you, do nothing. It expires in 0 minutes.\n", otp)
 
 	actualBody, err := tpl.SMSBody(context.Background())
 	require.NoError(t, err)
diff --git a/driver/config/config.go b/driver/config/config.go
index 9f3c1b38938b..366f9e37150d 100644
--- a/driver/config/config.go
+++ b/driver/config/config.go
@@ -69,6 +69,7 @@ const (
 	ViperKeyCourierTemplatesVerificationCodeValidEmail       = "courier.templates.verification_code.valid.email"
 	ViperKeyCourierTemplatesVerificationCodeValidSMS         = "courier.templates.verification_code.valid.sms"
 	ViperKeyCourierTemplatesLoginCodeValidSMS                = "courier.templates.login_code.valid.sms"
+	ViperKeyCourierTemplatesRegistrationCodeValidSMS         = "courier.templates.registration_code.valid.sms"
 	ViperKeyCourierDeliveryStrategy                          = "courier.delivery_strategy"
 	ViperKeyCourierHTTPRequestConfig                         = "courier.http.request_config"
 	ViperKeyCourierTemplatesLoginCodeValidEmail              = "courier.templates.login_code.valid.email"
@@ -109,6 +110,7 @@ const (
 	ViperKeyAdminTLSKeyPath                                  = "serve.admin.tls.key.path"
 	ViperKeySessionLifespan                                  = "session.lifespan"
 	ViperKeySessionSameSite                                  = "session.cookie.same_site"
+	ViperKeySessionSecure                                    = "session.cookie.secure"
 	ViperKeySessionDomain                                    = "session.cookie.domain"
 	ViperKeySessionName                                      = "session.cookie.name"
 	ViperKeySessionPath                                      = "session.cookie.path"
@@ -123,6 +125,7 @@ const (
 	ViperKeyCookieSameSite                                   = "cookies.same_site"
 	ViperKeyCookieDomain                                     = "cookies.domain"
 	ViperKeyCookiePath                                       = "cookies.path"
+	ViperKeyCookieSecure                                     = "cookies.secure"
 	ViperKeySelfServiceStrategyConfig                        = "selfservice.methods"
 	ViperKeySelfServiceBrowserDefaultReturnTo                = "selfservice." + DefaultBrowserReturnURL
 	ViperKeyURLsAllowedReturnToDomains                       = "selfservice.allowed_return_urls"
@@ -134,6 +137,8 @@ const (
 	ViperKeySelfServiceRegistrationAfter                     = "selfservice.flows.registration.after"
 	ViperKeySelfServiceRegistrationBeforeHooks               = "selfservice.flows.registration.before.hooks"
 	ViperKeySelfServiceLoginUI                               = "selfservice.flows.login.ui_url"
+	ViperKeySelfServiceLoginFlowStyle                        = "selfservice.flows.login.style"
+	ViperKeySecurityAccountEnumerationMitigate               = "security.account_enumeration.mitigate"
 	ViperKeySelfServiceLoginRequestLifespan                  = "selfservice.flows.login.lifespan"
 	ViperKeySelfServiceLoginAfter                            = "selfservice.flows.login.after"
 	ViperKeySelfServiceLoginBeforeHooks                      = "selfservice.flows.login.before.hooks"
@@ -179,6 +184,7 @@ const (
 	ViperKeyLinkLifespan                                     = "selfservice.methods.link.config.lifespan"
 	ViperKeyLinkBaseURL                                      = "selfservice.methods.link.config.base_url"
 	ViperKeyCodeLifespan                                     = "selfservice.methods.code.config.lifespan"
+	ViperKeyCodeConfigMissingCredentialFallbackEnabled       = "selfservice.methods.code.config.missing_credential_fallback_enabled"
 	ViperKeyPasswordHaveIBeenPwnedHost                       = "selfservice.methods.password.config.haveibeenpwned_host"
 	ViperKeyPasswordHaveIBeenPwnedEnabled                    = "selfservice.methods.password.config.haveibeenpwned_enabled"
 	ViperKeyPasswordMaxBreaches                              = "selfservice.methods.password.config.max_breaches"
@@ -187,6 +193,7 @@ const (
 	ViperKeyIgnoreNetworkErrors                              = "selfservice.methods.password.config.ignore_network_errors"
 	ViperKeyTOTPIssuer                                       = "selfservice.methods.totp.config.issuer"
 	ViperKeyOIDCBaseRedirectURL                              = "selfservice.methods.oidc.config.base_redirect_uri"
+	ViperKeySAMLBaseRedirectURL                              = "selfservice.methods.saml.config.base_redirect_uri"
 	ViperKeyWebAuthnRPDisplayName                            = "selfservice.methods.webauthn.config.rp.display_name"
 	ViperKeyWebAuthnRPID                                     = "selfservice.methods.webauthn.config.rp.id"
 	ViperKeyWebAuthnRPOrigin                                 = "selfservice.methods.webauthn.config.rp.origin"
@@ -203,6 +210,7 @@ const (
 	ViperKeyClientHTTPPrivateIPExceptionURLs                 = "clients.http.private_ip_exception_urls"
 	ViperKeyPreviewDefaultReadConsistencyLevel               = "preview.default_read_consistency_level"
 	ViperKeyVersion                                          = "version"
+	ViperKeyPasswordMigrationHook                            = "selfservice.methods.password.config.migrate_hook"
 )
 
 const (
@@ -290,6 +298,10 @@ type (
 		Headers        map[string]string `json:"headers" koanf:"headers"`
 		LocalName      string            `json:"local_name" koanf:"local_name"`
 	}
+	PasswordMigrationHook struct {
+		Enabled bool            `json:"enabled" koanf:"enabled"`
+		Config  json.RawMessage `json:"config" koanf:"config"`
+	}
 	Config struct {
 		l                  *logrusx.Logger
 		p                  *configx.Provider
@@ -314,6 +326,7 @@ type (
 		CourierTemplatesRegistrationCodeValid(ctx context.Context) *CourierEmailTemplate
 		CourierSMSTemplatesVerificationCodeValid(ctx context.Context) *CourierSMSTemplate
 		CourierSMSTemplatesLoginCodeValid(ctx context.Context) *CourierSMSTemplate
+		CourierSMSTemplatesRegistrationCodeValid(ctx context.Context) *CourierSMSTemplate
 		CourierMessageRetries(ctx context.Context) int
 		CourierWorkerPullCount(ctx context.Context) int
 		CourierWorkerPullWait(ctx context.Context) time.Duration
@@ -518,13 +531,13 @@ func (p *Config) cors(ctx context.Context, prefix string) (cors.Options, bool) {
 	})
 }
 
-// Deprecatd: use context-based WithConfigValue instead
-func (p *Config) Set(ctx context.Context, key string, value interface{}) error {
+// Deprecated: use context-based WithConfigValue instead
+func (p *Config) Set(_ context.Context, key string, value interface{}) error {
 	return p.p.Set(key, value)
 }
 
 // Deprecated: use context-based WithConfigValue instead
-func (p *Config) MustSet(ctx context.Context, key string, value interface{}) {
+func (p *Config) MustSet(_ context.Context, key string, value interface{}) {
 	if err := p.p.Set(key, value); err != nil {
 		p.l.WithError(err).Fatalf("Unable to set \"%s\" to \"%s\".", key, value)
 	}
@@ -538,10 +551,14 @@ func (p *Config) HasherArgon2(ctx context.Context) *Argon2 {
 	// warn about usage of default values and point to the docs
 	// warning will require https://github.com/ory/viper/issues/19
 	return &Argon2{
-		Memory:            p.GetProvider(ctx).ByteSizeF(ViperKeyHasherArgon2ConfigMemory, Argon2DefaultMemory),
-		Iterations:        uint32(p.GetProvider(ctx).IntF(ViperKeyHasherArgon2ConfigIterations, int(Argon2DefaultIterations))),
-		Parallelism:       uint8(p.GetProvider(ctx).IntF(ViperKeyHasherArgon2ConfigParallelism, int(Argon2DefaultParallelism))),
-		SaltLength:        uint32(p.GetProvider(ctx).IntF(ViperKeyHasherArgon2ConfigSaltLength, int(Argon2DefaultSaltLength))),
+		Memory: p.GetProvider(ctx).ByteSizeF(ViperKeyHasherArgon2ConfigMemory, Argon2DefaultMemory),
+		//nolint:gosec // disable G115
+		Iterations: uint32(p.GetProvider(ctx).IntF(ViperKeyHasherArgon2ConfigIterations, int(Argon2DefaultIterations))),
+		//nolint:gosec // disable G115
+		Parallelism: uint8(p.GetProvider(ctx).IntF(ViperKeyHasherArgon2ConfigParallelism, int(Argon2DefaultParallelism))),
+		//nolint:gosec // disable G115
+		SaltLength: uint32(p.GetProvider(ctx).IntF(ViperKeyHasherArgon2ConfigSaltLength, int(Argon2DefaultSaltLength))),
+		//nolint:gosec // disable G115
 		KeyLength:         uint32(p.GetProvider(ctx).IntF(ViperKeyHasherArgon2ConfigKeyLength, int(Argon2DefaultKeyLength))),
 		ExpectedDuration:  p.GetProvider(ctx).DurationF(ViperKeyHasherArgon2ConfigExpectedDuration, Argon2DefaultDuration),
 		ExpectedDeviation: p.GetProvider(ctx).DurationF(ViperKeyHasherArgon2ConfigExpectedDeviation, Argon2DefaultDeviation),
@@ -600,6 +617,10 @@ func (p *Config) OIDCRedirectURIBase(ctx context.Context) *url.URL {
 	return p.GetProvider(ctx).URIF(ViperKeyOIDCBaseRedirectURL, p.SelfPublicURL(ctx))
 }
 
+func (p *Config) SAMLRedirectURIBase(ctx context.Context) *url.URL {
+	return p.GetProvider(ctx).URIF(ViperKeySAMLBaseRedirectURL, p.SelfPublicURL(ctx))
+}
+
 func (p *Config) IdentityTraitsSchemas(ctx context.Context) (ss Schemas, err error) {
 	if err = p.GetProvider(ctx).Koanf.Unmarshal(ViperKeyIdentitySchemas, &ss); err != nil {
 		return ss, nil
@@ -769,7 +790,7 @@ func (p *Config) SelfServiceStrategy(ctx context.Context, strategy string) *Self
 	var err error
 	config, err = json.Marshal(pp.GetF(basePath+".config", config))
 	if err != nil {
-		p.l.WithError(err).Warn("Unable to marshal self service strategy configuration.")
+		p.l.WithError(err).Warn("Unable to marshal self-service strategy configuration.")
 		config = json.RawMessage("{}")
 	}
 
@@ -777,6 +798,8 @@ func (p *Config) SelfServiceStrategy(ctx context.Context, strategy string) *Self
 	// we need to forcibly set these values here:
 	defaultEnabled := false
 	switch strategy {
+	case "identifier_first":
+		defaultEnabled = p.SelfServiceLoginFlowIdentifierFirstEnabled(ctx)
 	case "code", "password", "profile":
 		defaultEnabled = true
 	}
@@ -849,6 +872,10 @@ func (p *Config) SecretsSession(ctx context.Context) [][]byte {
 
 func (p *Config) SecretsCipher(ctx context.Context) [][32]byte {
 	secrets := p.GetProvider(ctx).Strings(ViperKeySecretsCipher)
+	return ToCipherSecrets(secrets)
+}
+
+func ToCipherSecrets(secrets []string) [][32]byte {
 	var cleanSecrets []string
 	for k := range secrets {
 		if len(secrets[k]) == 32 {
@@ -1150,6 +1177,10 @@ func (p *Config) CourierSMSTemplatesLoginCodeValid(ctx context.Context) *Courier
 	return p.CourierSMSTemplatesHelper(ctx, ViperKeyCourierTemplatesLoginCodeValidSMS)
 }
 
+func (p *Config) CourierSMSTemplatesRegistrationCodeValid(ctx context.Context) *CourierSMSTemplate {
+	return p.CourierSMSTemplatesHelper(ctx, ViperKeyCourierTemplatesRegistrationCodeValidSMS)
+}
+
 func (p *Config) CourierTemplatesLoginCodeValid(ctx context.Context) *CourierEmailTemplate {
 	return p.CourierEmailTemplatesHelper(ctx, ViperKeyCourierTemplatesLoginCodeValidEmail)
 }
@@ -1321,6 +1352,10 @@ func (p *Config) SelfServiceCodeMethodLifespan(ctx context.Context) time.Duratio
 	return p.GetProvider(ctx).DurationF(ViperKeyCodeLifespan, time.Hour)
 }
 
+func (p *Config) SelfServiceCodeMethodMissingCredentialFallbackEnabled(ctx context.Context) bool {
+	return p.GetProvider(ctx).Bool(ViperKeyCodeConfigMissingCredentialFallbackEnabled)
+}
+
 func (p *Config) DatabaseCleanupSleepTables(ctx context.Context) time.Duration {
 	return p.GetProvider(ctx).Duration(ViperKeyDatabaseCleanupSleepTables)
 }
@@ -1360,6 +1395,13 @@ func (p *Config) SessionDomain(ctx context.Context) string {
 	return p.GetProvider(ctx).String(ViperKeySessionDomain)
 }
 
+func (p *Config) SessionCookieSecure(ctx context.Context) bool {
+	if !p.GetProvider(ctx).Exists(ViperKeySessionSecure) {
+		return !p.IsInsecureDevMode(ctx)
+	}
+	return p.GetProvider(ctx).Bool(ViperKeySessionSecure)
+}
+
 func (p *Config) CookieDomain(ctx context.Context) string {
 	return p.GetProvider(ctx).String(ViperKeyCookieDomain)
 }
@@ -1415,6 +1457,13 @@ func (p *Config) CookiePath(ctx context.Context) string {
 	return p.GetProvider(ctx).String(ViperKeyCookiePath)
 }
 
+func (p *Config) CookieSecure(ctx context.Context) bool {
+	if !p.GetProvider(ctx).Exists(ViperKeyCookieSecure) {
+		return !p.IsInsecureDevMode(ctx)
+	}
+	return p.GetProvider(ctx).Bool(ViperKeyCookieSecure)
+}
+
 func (p *Config) SelfServiceFlowLoginReturnTo(ctx context.Context, strategy string) *url.URL {
 	return p.selfServiceReturnTo(ctx, ViperKeySelfServiceLoginAfter, strategy)
 }
@@ -1487,6 +1536,7 @@ func (p *Config) PasskeyConfig(ctx context.Context) *webauthn.Config {
 		AuthenticatorSelection: protocol.AuthenticatorSelection{
 			AuthenticatorAttachment: "platform",
 			RequireResidentKey:      pointerx.Ptr(true),
+			ResidentKey:             protocol.ResidentKeyRequirementRequired,
 			UserVerification:        protocol.VerificationPreferred,
 		},
 		EncodeUserIDAsString: false,
@@ -1599,3 +1649,29 @@ func (p *Config) TokenizeTemplate(ctx context.Context, key string) (_ *SessionTo
 func (p *Config) DefaultConsistencyLevel(ctx context.Context) crdbx.ConsistencyLevel {
 	return crdbx.ConsistencyLevelFromString(p.GetProvider(ctx).String(ViperKeyPreviewDefaultReadConsistencyLevel))
 }
+
+func (p *Config) PasswordMigrationHook(ctx context.Context) *PasswordMigrationHook {
+	hook := &PasswordMigrationHook{
+		Enabled: p.GetProvider(ctx).BoolF(ViperKeyPasswordMigrationHook+".enabled", false),
+	}
+	if !hook.Enabled {
+		return hook
+	}
+
+	hook.Config, _ = json.Marshal(p.GetProvider(ctx).Get(ViperKeyPasswordMigrationHook + ".config"))
+
+	return hook
+}
+
+func (p *Config) SelfServiceLoginFlowIdentifierFirstEnabled(ctx context.Context) bool {
+	switch p.GetProvider(ctx).String(ViperKeySelfServiceLoginFlowStyle) {
+	case "identifier_first":
+		return true
+	default:
+		return false
+	}
+}
+
+func (p *Config) SecurityAccountEnumerationMitigate(ctx context.Context) bool {
+	return p.GetProvider(ctx).Bool(ViperKeySecurityAccountEnumerationMitigate)
+}
diff --git a/driver/config/config_test.go b/driver/config/config_test.go
index dc276eb3a171..0b65f6c1417c 100644
--- a/driver/config/config_test.go
+++ b/driver/config/config_test.go
@@ -218,7 +218,7 @@ func TestViperProvider(t *testing.T) {
 				config  string
 				enabled bool
 			}{
-				{id: "password", enabled: true, config: `{"haveibeenpwned_host":"api.pwnedpasswords.com","haveibeenpwned_enabled":true,"ignore_network_errors":true,"max_breaches":0,"min_password_length":8,"identifier_similarity_check_enabled":true}`},
+				{id: "password", enabled: true, config: `{"haveibeenpwned_host":"api.pwnedpasswords.com","haveibeenpwned_enabled":true,"ignore_network_errors":true,"max_breaches":0,"migrate_hook":{"config":{"emit_analytics_event":true,"method":"POST"},"enabled":false},"min_password_length":8,"identifier_similarity_check_enabled":true}`},
 				{id: "oidc", enabled: true, config: `{"providers":[{"client_id":"a","client_secret":"b","id":"github","provider":"github","mapper_url":"http://test.kratos.ory.sh/default-identity.schema.json"}]}`},
 				{id: "totp", enabled: true, config: `{"issuer":"issuer.ory.sh"}`},
 			} {
@@ -993,7 +993,6 @@ func TestIdentitySchemaValidation(t *testing.T) {
 	}
 
 	t.Run("case=skip invalid schema validation", func(t *testing.T) {
-		ctx := ctx
 		_, err := config.New(ctx, logrusx.New("", ""), os.Stderr, &contextx.Default{},
 			configx.WithConfigFiles("stub/.kratos.invalid.identities.yaml"),
 			configx.SkipValidation())
@@ -1001,7 +1000,6 @@ func TestIdentitySchemaValidation(t *testing.T) {
 	})
 
 	t.Run("case=invalid schema should throw error", func(t *testing.T) {
-		ctx := ctx
 		var stdErr bytes.Buffer
 		_, err := config.New(ctx, logrusx.New("", ""), &stdErr, &contextx.Default{},
 			configx.WithConfigFiles("stub/.kratos.invalid.identities.yaml"))
@@ -1011,15 +1009,13 @@ func TestIdentitySchemaValidation(t *testing.T) {
 	})
 
 	t.Run("case=must fail on loading unreachable schemas", func(t *testing.T) {
-		ctx = config.SetValidateIdentitySchemaResilientClientOptions(ctx, []httpx.ResilientOptions{
+		// we make sure that the test runs into DNS issues instead of the context being canceled
+		ctx := config.SetValidateIdentitySchemaResilientClientOptions(ctx, []httpx.ResilientOptions{
 			httpx.ResilientClientWithMaxRetry(0),
-			httpx.ResilientClientWithConnectionTimeout(time.Nanosecond),
+			httpx.ResilientClientWithConnectionTimeout(5 * time.Second),
 		})
 
-		ctx, cancel := context.WithTimeout(ctx, time.Second*30)
-		t.Cleanup(cancel)
-
-		err := make(chan error, 1)
+		err := make(chan error)
 		go func(err chan error) {
 			_, e := config.New(ctx, logrusx.New("", ""), os.Stderr, &contextx.Default{},
 				configx.WithConfigFiles("stub/.kratos.mock.identities.yaml"))
@@ -1027,11 +1023,10 @@ func TestIdentitySchemaValidation(t *testing.T) {
 		}(err)
 
 		select {
-		case <-ctx.Done():
-			panic("the test could not complete as the context timed out before the identity schema loader timed out")
+		case <-time.After(5 * time.Second):
+			t.Fatal("the test could not complete as the context timed out before the identity schema loader timed out")
 		case e := <-err:
-			assert.Error(t, e)
-			assert.Contains(t, e.Error(), "Client.Timeout")
+			assert.ErrorContains(t, e, "no such host")
 		}
 	})
 
diff --git a/driver/config/testhelpers/config.go b/driver/config/testhelpers/config.go
index 6d0e4ba0b910..bf68772d9a3f 100644
--- a/driver/config/testhelpers/config.go
+++ b/driver/config/testhelpers/config.go
@@ -33,7 +33,9 @@ func (t *TestConfigProvider) Config(ctx context.Context, config *configx.Provide
 	if !ok {
 		return config
 	}
+
 	opts := make([]configx.OptionModifier, 0, len(values))
+	opts = append(opts, configx.WithValues(config.All()))
 	for _, v := range values {
 		opts = append(opts, configx.WithValues(v))
 	}
diff --git a/driver/factory_test.go b/driver/factory_test.go
index d5c646550a87..f5b622520deb 100644
--- a/driver/factory_test.go
+++ b/driver/factory_test.go
@@ -7,6 +7,7 @@ import (
 	"context"
 	"os"
 	"testing"
+	"time"
 
 	"github.com/ory/x/servicelocatorx"
 
@@ -35,7 +36,9 @@ func TestDriverNew(t *testing.T) {
 	require.NoError(t, err)
 
 	assert.EqualValues(t, config.DefaultSQLiteMemoryDSN, r.Config().DSN(ctx))
-	require.NoError(t, r.Persister().Ping())
+	pingCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	t.Cleanup(cancel)
+	require.NoError(t, r.Persister().Ping(pingCtx))
 
 	assert.NotEqual(t, uuid.Nil.String(), r.Persister().NetworkID(context.Background()).String())
 
diff --git a/driver/registry.go b/driver/registry.go
index dc31f7305633..e284d6f6a6dd 100644
--- a/driver/registry.go
+++ b/driver/registry.go
@@ -7,45 +7,39 @@ import (
 	"context"
 	"io/fs"
 
-	"github.com/ory/kratos/selfservice/sessiontokenexchange"
-	"github.com/ory/x/contextx"
-	"github.com/ory/x/jsonnetsecure"
-	"github.com/ory/x/otelx"
-	prometheus "github.com/ory/x/prometheusx"
-
 	"github.com/gorilla/sessions"
 	"github.com/pkg/errors"
 
-	"github.com/ory/nosurf"
-
-	"github.com/ory/x/logrusx"
-
+	"github.com/ory/kratos/cipher"
 	"github.com/ory/kratos/continuity"
 	"github.com/ory/kratos/courier"
+	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/hash"
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/persistence"
 	"github.com/ory/kratos/schema"
+	"github.com/ory/kratos/selfservice/errorx"
+	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/selfservice/flow/logout"
 	"github.com/ory/kratos/selfservice/flow/recovery"
+	"github.com/ory/kratos/selfservice/flow/registration"
 	"github.com/ory/kratos/selfservice/flow/settings"
 	"github.com/ory/kratos/selfservice/flow/verification"
+	"github.com/ory/kratos/selfservice/sessiontokenexchange"
 	"github.com/ory/kratos/selfservice/strategy/code"
 	"github.com/ory/kratos/selfservice/strategy/link"
-
-	"github.com/ory/x/healthx"
-
-	"github.com/ory/kratos/persistence"
-	"github.com/ory/kratos/selfservice/flow/login"
-	"github.com/ory/kratos/selfservice/flow/logout"
-	"github.com/ory/kratos/selfservice/flow/registration"
-
-	"github.com/ory/kratos/x"
-
-	"github.com/ory/x/dbal"
-
-	"github.com/ory/kratos/driver/config"
-	"github.com/ory/kratos/identity"
-	"github.com/ory/kratos/selfservice/errorx"
 	password2 "github.com/ory/kratos/selfservice/strategy/password"
 	"github.com/ory/kratos/session"
+	"github.com/ory/kratos/x"
+	"github.com/ory/nosurf"
+	"github.com/ory/x/contextx"
+	"github.com/ory/x/dbal"
+	"github.com/ory/x/healthx"
+	"github.com/ory/x/jsonnetsecure"
+	"github.com/ory/x/logrusx"
+	"github.com/ory/x/otelx"
+	"github.com/ory/x/popx"
+	prometheus "github.com/ory/x/prometheusx"
 )
 
 type Registry interface {
@@ -85,6 +79,8 @@ type Registry interface {
 	continuity.ManagementProvider
 	continuity.PersistenceProvider
 
+	cipher.Provider
+
 	courier.Provider
 
 	persistence.Provider
@@ -186,6 +182,7 @@ type options struct {
 	replaceIdentitySchemaProvider func(Registry) schema.IdentitySchemaProvider
 	inspect                       func(Registry) error
 	extraMigrations               []fs.FS
+	extraGoMigrations             popx.Migrations
 	replacementStrategies         []NewStrategy
 	extraHooks                    map[string]func(config.SelfServiceHook) any
 	disableMigrationLogging       bool
@@ -251,6 +248,12 @@ func WithExtraMigrations(m ...fs.FS) RegistryOption {
 	}
 }
 
+func WithExtraGoMigrations(m ...popx.Migration) RegistryOption {
+	return func(o *options) {
+		o.extraGoMigrations = append(o.extraGoMigrations, m...)
+	}
+}
+
 func WithDisabledMigrationLogging() RegistryOption {
 	return func(o *options) {
 		o.disableMigrationLogging = true
diff --git a/driver/registry_default.go b/driver/registry_default.go
index eab63a120981..464f7881f626 100644
--- a/driver/registry_default.go
+++ b/driver/registry_default.go
@@ -12,6 +12,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/lestrrat-go/jwx/jwk"
+
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+
 	"github.com/cenkalti/backoff"
 	"github.com/dgraph-io/ristretto"
 	"github.com/gobuffalo/pop/v6"
@@ -249,8 +253,8 @@ func (m *RegistryDefault) HealthHandler(_ context.Context) *healthx.Handler {
 	if m.healthxHandler == nil {
 		m.healthxHandler = healthx.NewHandler(m.Writer(), config.Version,
 			healthx.ReadyCheckers{
-				"database": func(_ *http.Request) error {
-					return m.Ping()
+				"database": func(r *http.Request) error {
+					return m.PingContext(r.Context())
 				},
 				"migrations": func(r *http.Request) error {
 					if m.migrationStatus != nil && !m.migrationStatus.HasPending() {
@@ -324,6 +328,7 @@ func (m *RegistryDefault) selfServiceStrategies() []any {
 				passkey.NewStrategy(m),
 				webauthn.NewStrategy(m),
 				lookup.NewStrategy(m),
+				idfirst.NewStrategy(m),
 			}
 		}
 	}
@@ -379,6 +384,7 @@ nextStrategy:
 					continue nextStrategy
 				}
 			}
+
 			if m.strategyLoginEnabled(ctx, s.ID().String()) {
 				loginStrategies = append(loginStrategies, s)
 			}
@@ -475,11 +481,11 @@ func (m *RegistryDefault) Cipher(ctx context.Context) cipher.Cipher {
 	if m.crypter == nil {
 		switch m.c.CipherAlgorithm(ctx) {
 		case "xchacha20-poly1305":
-			m.crypter = cipher.NewCryptChaCha20(m)
+			m.crypter = cipher.NewCryptChaCha20(m.Config())
 		case "aes":
-			m.crypter = cipher.NewCryptAES(m)
+			m.crypter = cipher.NewCryptAES(m.Config())
 		default:
-			m.crypter = cipher.NewNoop(m)
+			m.crypter = cipher.NewNoop()
 			m.l.Logger.Warning("No encryption configuration found. The default algorithm (noop) will be used, resulting in sensitive data being stored in plaintext")
 		}
 	}
@@ -523,7 +529,7 @@ func (m *RegistryDefault) CookieManager(ctx context.Context) sessions.StoreExact
 	}
 
 	cs := sessions.NewCookieStore(keys...)
-	cs.Options.Secure = !m.Config().IsInsecureDevMode(ctx)
+	cs.Options.Secure = m.Config().SessionCookieSecure(ctx)
 	cs.Options.HttpOnly = true
 
 	if domain := m.Config().SessionDomain(ctx); domain != "" {
@@ -549,7 +555,7 @@ func (m *RegistryDefault) CookieManager(ctx context.Context) sessions.StoreExact
 func (m *RegistryDefault) ContinuityCookieManager(ctx context.Context) sessions.StoreExact {
 	// To support hot reloading, this can not be instantiated only once.
 	cs := sessions.NewCookieStore(m.Config().SecretsSession(ctx)...)
-	cs.Options.Secure = !m.Config().IsInsecureDevMode(ctx)
+	cs.Options.Secure = m.Config().CookieSecure(ctx)
 	cs.Options.HttpOnly = true
 	cs.Options.SameSite = http.SameSiteLaxMode
 	return cs
@@ -668,13 +674,18 @@ func (m *RegistryDefault) Init(ctx context.Context, ctxer contextx.Contextualize
 			m.Logger().WithError(err).Warnf("Unable to open database, retrying.")
 			return errors.WithStack(err)
 		}
-		p, err := sql.NewPersister(ctx, m, c, sql.WithExtraMigrations(o.extraMigrations...), sql.WithDisabledLogging(o.disableMigrationLogging))
+		p, err := sql.NewPersister(ctx, m, c,
+			sql.WithExtraMigrations(o.extraMigrations...),
+			sql.WithExtraGoMigrations(o.extraGoMigrations...),
+			sql.WithDisabledLogging(o.disableMigrationLogging))
 		if err != nil {
 			m.Logger().WithError(err).Warnf("Unable to initialize persister, retrying.")
 			return err
 		}
 
-		if err := p.Ping(); err != nil {
+		ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+		defer cancel()
+		if err := c.Store.SQLDB().PingContext(ctx); err != nil {
 			m.Logger().WithError(err).Warnf("Unable to ping database, retrying.")
 			return err
 		}
@@ -793,12 +804,20 @@ func (m *RegistryDefault) LoginCodePersister() code.LoginCodePersister {
 	return m.Persister()
 }
 
+func (m *RegistryDefault) TransactionalPersisterProvider() x.TransactionalPersister {
+	return m.Persister()
+}
+
 func (m *RegistryDefault) Persister() persistence.Persister {
 	return m.persister
 }
 
+func (m *RegistryDefault) PingContext(ctx context.Context) error {
+	return m.persister.Ping(ctx)
+}
+
 func (m *RegistryDefault) Ping() error {
-	return m.persister.Ping()
+	return m.persister.Ping(context.Background())
 }
 
 func (m *RegistryDefault) WithCSRFTokenGenerator(cg x.CSRFToken) {
@@ -863,13 +882,13 @@ func (m *RegistryDefault) Contextualizer() contextx.Contextualizer {
 func (m *RegistryDefault) JWKSFetcher() *jwksx.FetcherNext {
 	if m.jwkFetcher == nil {
 		maxItems := int64(10000000)
-		cache, _ := ristretto.NewCache(&ristretto.Config{
+		cache, _ := ristretto.NewCache(&ristretto.Config[[]byte, jwk.Set]{
 			NumCounters:        maxItems * 10,
 			MaxCost:            maxItems,
 			BufferItems:        64,
 			Metrics:            true,
 			IgnoreInternalCost: true,
-			Cost: func(value interface{}) int64 {
+			Cost: func(value jwk.Set) int64 {
 				return 1
 			},
 		})
diff --git a/driver/registry_default_test.go b/driver/registry_default_test.go
index fa3e7772c62a..a52b4fc6072c 100644
--- a/driver/registry_default_test.go
+++ b/driver/registry_default_test.go
@@ -872,7 +872,7 @@ func TestDefaultRegistry_AllStrategies(t *testing.T) {
 	_, reg := internal.NewVeryFastRegistryWithoutDB(t)
 
 	t.Run("case=all login strategies", func(t *testing.T) {
-		expects := []string{"password", "oidc", "code", "totp", "passkey", "webauthn", "lookup_secret"}
+		expects := []string{"password", "oidc", "code", "totp", "passkey", "webauthn", "lookup_secret", "identifier_first"}
 		s := reg.AllLoginStrategies()
 		require.Len(t, s, len(expects))
 		for k, e := range expects {
diff --git a/embedx/config.schema.json b/embedx/config.schema.json
index 4ccb5d8ba0ab..5dd64348dda3 100644
--- a/embedx/config.schema.json
+++ b/embedx/config.schema.json
@@ -43,10 +43,7 @@
       "description": "Ory Kratos redirects to this URL per default on completion of self-service flows and other browser interaction. Read this [article for more information on browser redirects](https://www.ory.sh/kratos/docs/concepts/browser-redirect-flow-completion).",
       "type": "string",
       "format": "uri-reference",
-      "examples": [
-        "https://my-app.com/dashboard",
-        "/dashboard"
-      ]
+      "examples": ["https://my-app.com/dashboard", "/dashboard"]
     },
     "selfServiceSessionRevokerHook": {
       "type": "object",
@@ -56,9 +53,7 @@
         }
       },
       "additionalProperties": false,
-      "required": [
-        "hook"
-      ]
+      "required": ["hook"]
     },
     "selfServiceSessionIssuerHook": {
       "type": "object",
@@ -68,9 +63,7 @@
         }
       },
       "additionalProperties": false,
-      "required": [
-        "hook"
-      ]
+      "required": ["hook"]
     },
     "selfServiceRequireVerifiedAddressHook": {
       "type": "object",
@@ -80,9 +73,7 @@
         }
       },
       "additionalProperties": false,
-      "required": [
-        "hook"
-      ]
+      "required": ["hook"]
     },
     "selfServiceVerificationHook": {
       "type": "object",
@@ -92,9 +83,7 @@
         }
       },
       "additionalProperties": false,
-      "required": [
-        "hook"
-      ]
+      "required": ["hook"]
     },
     "selfServiceShowVerificationUIHook": {
       "type": "object",
@@ -104,9 +93,7 @@
         }
       },
       "additionalProperties": false,
-      "required": [
-        "hook"
-      ]
+      "required": ["hook"]
     },
     "b2bSSOHook": {
       "type": "object",
@@ -120,10 +107,7 @@
         }
       },
       "additionalProperties": false,
-      "required": [
-        "hook",
-        "config"
-      ]
+      "required": ["hook", "config"]
     },
     "webHookAuthBasicAuthProperties": {
       "properties": {
@@ -143,17 +127,11 @@
             }
           },
           "additionalProperties": false,
-          "required": [
-            "user",
-            "password"
-          ]
+          "required": ["user", "password"]
         }
       },
       "additionalProperties": false,
-      "required": [
-        "type",
-        "config"
-      ]
+      "required": ["type", "config"]
     },
     "httpRequestConfig": {
       "type": "object",
@@ -161,9 +139,7 @@
         "url": {
           "title": "HTTP address of API endpoint",
           "description": "This URL will be used to send the emails to.",
-          "examples": [
-            "https://example.com/api/v1/email"
-          ],
+          "examples": ["https://example.com/api/v1/email"],
           "type": "string",
           "pattern": "^https?://"
         },
@@ -228,25 +204,15 @@
             "in": {
               "type": "string",
               "description": "How the api key should be transferred",
-              "enum": [
-                "header",
-                "cookie"
-              ]
+              "enum": ["header", "cookie"]
             }
           },
           "additionalProperties": false,
-          "required": [
-            "name",
-            "value",
-            "in"
-          ]
+          "required": ["name", "value", "in"]
         }
       },
       "additionalProperties": false,
-      "required": [
-        "type",
-        "config"
-      ]
+      "required": ["type", "config"]
     },
     "selfServiceWebHook": {
       "type": "object",
@@ -259,6 +225,10 @@
           "title": "Web-Hook Configuration",
           "description": "Define what the hook should do",
           "properties": {
+            "id": {
+              "type": "string",
+              "description": "The ID of the hook. Used to identify the hook in logs and errors. For debugging purposes only."
+            },
             "response": {
               "title": "Response Handling",
               "description": "How the web hook should handle the response",
@@ -285,10 +255,7 @@
                     "const": true
                   }
                 },
-                "required": [
-                  "ignore",
-                  "parse"
-                ]
+                "required": ["ignore", "parse"]
               }
             },
             "url": {
@@ -361,46 +328,30 @@
                   "response": {
                     "properties": {
                       "ignore": {
-                        "enum": [
-                          true
-                        ]
+                        "enum": [true]
                       }
                     },
-                    "required": [
-                      "ignore"
-                    ]
+                    "required": ["ignore"]
                   }
                 },
-                "required": [
-                  "response"
-                ]
+                "required": ["response"]
               }
             },
             {
               "properties": {
                 "can_interrupt": {
-                  "enum": [
-                    false
-                  ]
+                  "enum": [false]
                 }
               },
-              "require": [
-                "can_interrupt"
-              ]
+              "require": ["can_interrupt"]
             }
           ],
           "additionalProperties": false,
-          "required": [
-            "url",
-            "method"
-          ]
+          "required": ["url", "method"]
         }
       },
       "additionalProperties": false,
-      "required": [
-        "hook",
-        "config"
-      ]
+      "required": ["hook", "config"]
     },
     "OIDCClaims": {
       "title": "OpenID Connect claims",
@@ -433,9 +384,7 @@
               "essential": true
             },
             "acr": {
-              "values": [
-                "urn:mace:incommon:iap:silver"
-              ]
+              "values": ["urn:mace:incommon:iap:silver"]
             }
           }
         }
@@ -483,13 +432,11 @@
       "properties": {
         "id": {
           "type": "string",
-          "examples": [
-            "google"
-          ]
+          "examples": ["google"]
         },
         "provider": {
           "title": "Provider",
-          "description": "Can be one of github, github-app, gitlab, generic, google, microsoft, discord, slack, facebook, auth0, vk, yandex, apple, spotify, netid, dingtalk, patreon.",
+          "description": "Can be one of github, github-app, gitlab, generic, google, microsoft, discord, salesforce, slack, facebook, auth0, vk, yandex, apple, spotify, netid, dingtalk, patreon.",
           "type": "string",
           "enum": [
             "github",
@@ -499,6 +446,7 @@
             "google",
             "microsoft",
             "discord",
+            "salesforce",
             "slack",
             "facebook",
             "auth0",
@@ -514,9 +462,7 @@
             "lark",
             "x"
           ],
-          "examples": [
-            "google"
-          ]
+          "examples": ["google"]
         },
         "label": {
           "title": "Optional string which will be used when generating labels for UI buttons.",
@@ -531,9 +477,7 @@
         "issuer_url": {
           "type": "string",
           "format": "uri",
-          "examples": [
-            "https://accounts.google.com"
-          ]
+          "examples": ["https://accounts.google.com"]
         },
         "require_nonce": {
           "type": "boolean"
@@ -541,16 +485,12 @@
         "auth_url": {
           "type": "string",
           "format": "uri",
-          "examples": [
-            "https://accounts.google.com/o/oauth2/v2/auth"
-          ]
+          "examples": ["https://accounts.google.com/o/oauth2/v2/auth"]
         },
         "token_url": {
           "type": "string",
           "format": "uri",
-          "examples": [
-            "https://www.googleapis.com/oauth2/v4/token"
-          ]
+          "examples": ["https://www.googleapis.com/oauth2/v4/token"]
         },
         "mapper_url": {
           "title": "Jsonnet Mapper URL",
@@ -567,10 +507,7 @@
           "type": "array",
           "items": {
             "type": "string",
-            "examples": [
-              "offline_access",
-              "profile"
-            ]
+            "examples": ["offline_access", "profile"]
           }
         },
         "microsoft_tenant": {
@@ -589,30 +526,21 @@
           "title": "Microsoft subject source",
           "description": "Controls which source the subject identifier is taken from by microsoft provider. If set to `userinfo` (the default) then the identifier is taken from the `sub` field of OIDC ID token or data received from `/userinfo` standard OIDC endpoint. If set to `me` then the `id` field of data structure received from `https://graph.microsoft.com/v1.0/me` is taken as an identifier.",
           "type": "string",
-          "enum": [
-            "userinfo",
-            "me"
-          ],
+          "enum": ["userinfo", "me", "oid"],
           "default": "userinfo",
-          "examples": [
-            "userinfo"
-          ]
+          "examples": ["userinfo"]
         },
         "apple_team_id": {
           "title": "Apple Developer Team ID",
           "description": "Apple Developer Team ID needed for generating a JWT token for client secret",
           "type": "string",
-          "examples": [
-            "KP76DQS54M"
-          ]
+          "examples": ["KP76DQS54M"]
         },
         "apple_private_key_id": {
           "title": "Apple Private Key Identifier",
           "description": "Sign In with Apple Private Key Identifier needed for generating a JWT token for client secret",
           "type": "string",
-          "examples": [
-            "UX56C66723"
-          ]
+          "examples": ["UX56C66723"]
         },
         "apple_private_key": {
           "title": "Apple Private Key",
@@ -629,42 +557,34 @@
           "title": "Organization ID",
           "description": "The ID of the organization that this provider belongs to. Only effective in the Ory Network.",
           "type": "string",
-          "examples": [
-            "12345678-1234-1234-1234-123456789012"
-          ]
+          "examples": ["12345678-1234-1234-1234-123456789012"]
         },
         "additional_id_token_audiences": {
           "title": "Additional client ids allowed when using ID token submission",
           "type": "array",
           "items": {
             "type": "string",
-            "examples": [
-              "12345678-1234-1234-1234-123456789012"
-            ]
+            "examples": ["12345678-1234-1234-1234-123456789012"]
           }
         },
         "claims_source": {
           "title": "Claims source",
           "description": "Can be either `userinfo` (calls the userinfo endpoint to get the claims) or `id_token` (takes the claims from the id token). It defaults to `id_token`",
           "type": "string",
-          "enum": [
-            "id_token",
-            "userinfo"
-          ],
+          "enum": ["id_token", "userinfo"],
           "default": "id_token",
-          "examples": [
-            "id_token",
-            "userinfo"
-          ]
+          "examples": ["id_token", "userinfo"]
+        },
+        "pkce": {
+          "title": "Proof Key for Code Exchange",
+          "description": "PKCE controls if the OpenID Connect OAuth2 flow should use PKCE (Proof Key for Code Exchange). IMPORTANT: If you set this to `force`, you must whitelist a different return URL for your OAuth2 client in the provider's configuration. Instead of <base-url>/self-service/methods/oidc/callback/<provider>, you must use <base-url>/self-service/methods/oidc/callback",
+          "type": "string",
+          "enum": ["auto", "never", "force"],
+          "default": "auto"
         }
       },
       "additionalProperties": false,
-      "required": [
-        "id",
-        "provider",
-        "client_id",
-        "mapper_url"
-      ],
+      "required": ["id", "provider", "client_id", "mapper_url"],
       "allOf": [
         {
           "if": {
@@ -673,23 +593,17 @@
                 "const": "microsoft"
               }
             },
-            "required": [
-              "provider"
-            ]
+            "required": ["provider"]
           },
           "then": {
-            "required": [
-              "microsoft_tenant"
-            ]
+            "required": ["microsoft_tenant"]
           },
           "else": {
             "not": {
               "properties": {
                 "microsoft_tenant": {}
               },
-              "required": [
-                "microsoft_tenant"
-              ]
+              "required": ["microsoft_tenant"]
             }
           }
         },
@@ -700,9 +614,7 @@
                 "const": "apple"
               }
             },
-            "required": [
-              "provider"
-            ]
+            "required": ["provider"]
           },
           "then": {
             "not": {
@@ -712,9 +624,7 @@
                   "minLength": 1
                 }
               },
-              "required": [
-                "client_secret"
-              ]
+              "required": ["client_secret"]
             },
             "required": [
               "apple_private_key_id",
@@ -723,9 +633,7 @@
             ]
           },
           "else": {
-            "required": [
-              "client_secret"
-            ],
+            "required": ["client_secret"],
             "allOf": [
               {
                 "not": {
@@ -735,9 +643,7 @@
                       "minLength": 1
                     }
                   },
-                  "required": [
-                    "apple_team_id"
-                  ]
+                  "required": ["apple_team_id"]
                 }
               },
               {
@@ -748,9 +654,7 @@
                       "minLength": 1
                     }
                   },
-                  "required": [
-                    "apple_private_key_id"
-                  ]
+                  "required": ["apple_private_key_id"]
                 }
               },
               {
@@ -761,9 +665,7 @@
                       "minLength": 1
                     }
                   },
-                  "required": [
-                    "apple_private_key"
-                  ]
+                  "required": ["apple_private_key"]
                 }
               }
             ]
@@ -814,6 +716,9 @@
             "anyOf": [
               {
                 "$ref": "#/definitions/selfServiceWebHook"
+              },
+              {
+                "$ref": "#/definitions/b2bSSOHook"
               }
             ]
           },
@@ -871,6 +776,9 @@
               },
               {
                 "$ref": "#/definitions/selfServiceShowVerificationUIHook"
+              },
+              {
+                "$ref": "#/definitions/b2bSSOHook"
               }
             ]
           },
@@ -943,10 +851,7 @@
       "title": "Required Authenticator Assurance Level",
       "description": "Sets what Authenticator Assurance Level (used for 2FA) is required to access this feature. If set to `highest_available` then this endpoint requires the highest AAL the identity has set up. If set to `aal1` then the identity can access this feature without 2FA.",
       "type": "string",
-      "enum": [
-        "aal1",
-        "highest_available"
-      ],
+      "enum": ["aal1", "highest_available"],
       "default": "highest_available"
     },
     "selfServiceAfterSettings": {
@@ -1142,9 +1047,7 @@
         "path": {
           "title": "Path to PEM-encoded Fle",
           "type": "string",
-          "examples": [
-            "path/to/file.pem"
-          ]
+          "examples": ["path/to/file.pem"]
         },
         "base64": {
           "title": "Base64 Encoded Inline",
@@ -1192,9 +1095,7 @@
               "$ref": "#/definitions/emailCourierTemplate"
             }
           },
-          "required": [
-            "email"
-          ]
+          "required": ["email"]
         },
         "valid": {
           "additionalProperties": false,
@@ -1207,9 +1108,7 @@
               "$ref": "#/definitions/smsCourierTemplate"
             }
           },
-          "required": [
-            "email"
-          ]
+          "required": ["email"]
         }
       }
     },
@@ -1280,9 +1179,7 @@
     "selfservice": {
       "type": "object",
       "additionalProperties": false,
-      "required": [
-        "default_browser_return_url"
-      ],
+      "required": ["default_browser_return_url"],
       "properties": {
         "default_browser_return_url": {
           "$ref": "#/definitions/defaultReturnTo"
@@ -1317,30 +1214,20 @@
                   "description": "URL where the Settings UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                   "type": "string",
                   "format": "uri-reference",
-                  "examples": [
-                    "https://my-app.com/user/settings"
-                  ],
+                  "examples": ["https://my-app.com/user/settings"],
                   "default": "https://www.ory.sh/kratos/docs/fallback/settings"
                 },
                 "lifespan": {
                   "type": "string",
                   "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
                   "default": "1h",
-                  "examples": [
-                    "1h",
-                    "1m",
-                    "1s"
-                  ]
+                  "examples": ["1h", "1m", "1s"]
                 },
                 "privileged_session_max_age": {
                   "type": "string",
                   "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
                   "default": "1h",
-                  "examples": [
-                    "1h",
-                    "1m",
-                    "1s"
-                  ]
+                  "examples": ["1h", "1m", "1s"]
                 },
                 "required_aal": {
                   "$ref": "#/definitions/featureRequiredAal"
@@ -1389,20 +1276,14 @@
                   "description": "URL where the Registration UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                   "type": "string",
                   "format": "uri-reference",
-                  "examples": [
-                    "https://my-app.com/signup"
-                  ],
+                  "examples": ["https://my-app.com/signup"],
                   "default": "https://www.ory.sh/kratos/docs/fallback/registration"
                 },
                 "lifespan": {
                   "type": "string",
                   "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
                   "default": "1h",
-                  "examples": [
-                    "1h",
-                    "1m",
-                    "1s"
-                  ]
+                  "examples": ["1h", "1m", "1s"]
                 },
                 "before": {
                   "$ref": "#/definitions/selfServiceBeforeRegistration"
@@ -1427,30 +1308,21 @@
                   "description": "URL where the Login UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                   "type": "string",
                   "format": "uri-reference",
-                  "examples": [
-                    "https://my-app.com/login"
-                  ],
+                  "examples": ["https://my-app.com/login"],
                   "default": "https://www.ory.sh/kratos/docs/fallback/login"
                 },
                 "lifespan": {
                   "type": "string",
                   "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
                   "default": "1h",
-                  "examples": [
-                    "1h",
-                    "1m",
-                    "1s"
-                  ]
+                  "examples": ["1h", "1m", "1s"]
                 },
                 "style": {
                   "title": "Login Flow Style",
-                  "description": "The style of the login flow. If set to `one_step` the login flow will be a one-step process. If set to `identifier_first` (experimental!) the login flow will first ask for the identifier and then the credentials.",
+                  "description": "The style of the login flow. If set to `unified` the login flow will be a one-step process. If set to `identifier_first` (experimental!) the login flow will first ask for the identifier and then the credentials.",
                   "type": "string",
-                  "enum": [
-                    "one_step",
-                    "identifier_first"
-                  ],
-                  "default": "one_step"
+                  "enum": ["unified", "identifier_first"],
+                  "default": "unified"
                 },
                 "before": {
                   "$ref": "#/definitions/selfServiceBeforeLogin"
@@ -1476,9 +1348,7 @@
                   "description": "URL where the Ory Verify UI is hosted. This is the page where users activate and / or verify their email or telephone number. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                   "type": "string",
                   "format": "uri-reference",
-                  "examples": [
-                    "https://my-app.com/verify"
-                  ],
+                  "examples": ["https://my-app.com/verify"],
                   "default": "https://www.ory.sh/kratos/docs/fallback/verification"
                 },
                 "after": {
@@ -1490,11 +1360,7 @@
                   "type": "string",
                   "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
                   "default": "1h",
-                  "examples": [
-                    "1h",
-                    "1m",
-                    "1s"
-                  ]
+                  "examples": ["1h", "1m", "1s"]
                 },
                 "before": {
                   "$ref": "#/definitions/selfServiceBeforeVerification"
@@ -1503,10 +1369,7 @@
                   "title": "Verification Strategy",
                   "description": "The strategy to use for verification requests",
                   "type": "string",
-                  "enum": [
-                    "link",
-                    "code"
-                  ],
+                  "enum": ["link", "code"],
                   "default": "code"
                 },
                 "notify_unknown_recipients": {
@@ -1533,9 +1396,7 @@
                   "description": "URL where the Ory Recovery UI is hosted. This is the page where users request and complete account recovery. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                   "type": "string",
                   "format": "uri-reference",
-                  "examples": [
-                    "https://my-app.com/verify"
-                  ],
+                  "examples": ["https://my-app.com/verify"],
                   "default": "https://www.ory.sh/kratos/docs/fallback/recovery"
                 },
                 "after": {
@@ -1547,11 +1408,7 @@
                   "type": "string",
                   "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
                   "default": "1h",
-                  "examples": [
-                    "1h",
-                    "1m",
-                    "1s"
-                  ]
+                  "examples": ["1h", "1m", "1s"]
                 },
                 "before": {
                   "$ref": "#/definitions/selfServiceBeforeRecovery"
@@ -1560,10 +1417,7 @@
                   "title": "Recovery Strategy",
                   "description": "The strategy to use for recovery requests",
                   "type": "string",
-                  "enum": [
-                    "link",
-                    "code"
-                  ],
+                  "enum": ["link", "code"],
                   "default": "code"
                 },
                 "notify_unknown_recipients": {
@@ -1583,9 +1437,7 @@
                   "description": "URL where the Ory Kratos Error UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                   "type": "string",
                   "format": "uri-reference",
-                  "examples": [
-                    "https://my-app.com/kratos-error"
-                  ],
+                  "examples": ["https://my-app.com/kratos-error"],
                   "default": "https://www.ory.sh/kratos/docs/fallback/error"
                 }
               }
@@ -1614,25 +1466,19 @@
                             "type": "string",
                             "description": "The ID of the organization.",
                             "format": "uuid",
-                            "examples": [
-                              "00000000-0000-0000-0000-000000000000"
-                            ]
+                            "examples": ["00000000-0000-0000-0000-000000000000"]
                           },
                           "label": {
                             "type": "string",
                             "description": "The label of the organization.",
-                            "examples": [
-                              "ACME SSO"
-                            ]
+                            "examples": ["ACME SSO"]
                           },
                           "domains": {
                             "type": "array",
                             "items": {
                               "type": "string",
                               "format": "hostname",
-                              "examples": [
-                                "my-app.com"
-                              ],
+                              "examples": ["my-app.com"],
                               "description": "If this domain matches the email's domain, this provider is shown."
                             }
                           }
@@ -1672,20 +1518,14 @@
                     "base_url": {
                       "title": "Override the base URL which should be used as the base for recovery and verification links.",
                       "type": "string",
-                      "examples": [
-                        "https://my-app.com"
-                      ]
+                      "examples": ["https://my-app.com"]
                     },
                     "lifespan": {
                       "title": "How long a link is valid for",
                       "type": "string",
                       "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
                       "default": "1h",
-                      "examples": [
-                        "1h",
-                        "1m",
-                        "1s"
-                      ]
+                      "examples": ["1h", "1m", "1s"]
                     }
                   }
                 }
@@ -1738,12 +1578,6 @@
                   "title": "Enables login flows code method to fulfil MFA requests",
                   "default": false
                 },
-                "passwordless_login_fallback_enabled": {
-                  "type": "boolean",
-                  "title": "Passwordless Login Fallback Enabled",
-                  "description": "This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.",
-                  "default": false
-                },
                 "enabled": {
                   "type": "boolean",
                   "title": "Enables Code Method",
@@ -1759,11 +1593,14 @@
                       "type": "string",
                       "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
                       "default": "1h",
-                      "examples": [
-                        "1h",
-                        "1m",
-                        "1s"
-                      ]
+                      "examples": ["1h", "1m", "1s"]
+                    },
+                    "missing_credential_fallback_enabled": {
+                      "type": "boolean",
+                      "title": "Enable Code OTP as a Fallback",
+                      "description": "Enabling this allows users to sign in with the code method, even if their identity schema or their credentials are not set up to use the code method. If enabled, a verified address (such as an email) will be used to send the code to the user. Use with caution and only if actually needed.",
+
+                      "default": false
                     }
                   }
                 }
@@ -1821,6 +1658,61 @@
                       "description": "If set to false the password validation does not check for similarity between the password and the user identifier.",
                       "type": "boolean",
                       "default": true
+                    },
+                    "migrate_hook": {
+                      "type": "object",
+                      "additionalProperties": false,
+                      "properties": {
+                        "enabled": {
+                          "type": "boolean",
+                          "title": "Enable Password Migration",
+                          "description": "If set to true will enable password migration.",
+                          "default": false
+                        },
+                        "config": {
+                          "type": "object",
+                          "additionalProperties": false,
+                          "properties": {
+                            "url": {
+                              "type": "string",
+                              "description": "The URL the password migration hook should call",
+                              "format": "uri"
+                            },
+                            "method": {
+                              "type": "string",
+                              "description": "The HTTP method to use (GET, POST, etc).",
+                              "const": "POST",
+                              "default": "POST"
+                            },
+                            "headers": {
+                              "type": "object",
+                              "description": "The HTTP headers that must be applied to the password migration hook.",
+                              "additionalProperties": {
+                                "type": "string"
+                              }
+                            },
+                            "emit_analytics_event": {
+                              "type": "boolean",
+                              "default": true,
+                              "description": "Emit tracing events for this hook on delivery or error"
+                            },
+                            "auth": {
+                              "type": "object",
+                              "title": "Auth mechanisms",
+                              "description": "Define which auth mechanism the Web-Hook should use",
+                              "oneOf": [
+                                {
+                                  "$ref": "#/definitions/webHookAuthApiKeyProperties"
+                                },
+                                {
+                                  "$ref": "#/definitions/webHookAuthBasicAuthProperties"
+                                }
+                              ]
+                            },
+                            "additionalProperties": false
+                          }
+                        }
+                      }
                     }
                   },
                   "additionalProperties": false
@@ -1886,17 +1778,13 @@
                           "type": "string",
                           "title": "Relying Party Display Name",
                           "description": "An name to help the user identify this RP.",
-                          "examples": [
-                            "Ory Foundation"
-                          ]
+                          "examples": ["Ory Foundation"]
                         },
                         "id": {
                           "type": "string",
                           "title": "Relying Party Identifier",
                           "description": "The id must be a subset of the domain currently in the browser.",
-                          "examples": [
-                            "ory.sh"
-                          ]
+                          "examples": ["ory.sh"]
                         },
                         "origin": {
                           "type": "string",
@@ -1904,9 +1792,7 @@
                           "description": "An explicit RP origin. If left empty, this defaults to `id`, prepended with the current protocol schema (HTTP or HTTPS).",
                           "format": "uri",
                           "deprecationMessage": "This field is deprecated. Use `origins` instead.",
-                          "examples": [
-                            "https://www.ory.sh"
-                          ]
+                          "examples": ["https://www.ory.sh"]
                         },
                         "origins": {
                           "type": "array",
@@ -1927,18 +1813,13 @@
                           "description": "An icon to help the user identify this RP.",
                           "format": "uri",
                           "deprecationMessage": "This field is deprecated and ignored due to security considerations.",
-                          "examples": [
-                            "https://www.ory.sh/an-icon.png"
-                          ]
+                          "examples": ["https://www.ory.sh/an-icon.png"]
                         }
                       },
                       "type": "object",
                       "oneOf": [
                         {
-                          "required": [
-                            "id",
-                            "display_name"
-                          ],
+                          "required": ["id", "display_name"],
                           "properties": {
                             "origin": {
                               "not": {}
@@ -1949,11 +1830,7 @@
                           }
                         },
                         {
-                          "required": [
-                            "id",
-                            "display_name",
-                            "origin"
-                          ],
+                          "required": ["id", "display_name", "origin"],
                           "properties": {
                             "origin": {
                               "type": "string"
@@ -1964,11 +1841,7 @@
                           }
                         },
                         {
-                          "required": [
-                            "id",
-                            "display_name",
-                            "origins"
-                          ],
+                          "required": ["id", "display_name", "origins"],
                           "properties": {
                             "origin": {
                               "not": {}
@@ -1993,14 +1866,10 @@
                     "const": true
                   }
                 },
-                "required": [
-                  "enabled"
-                ]
+                "required": ["enabled"]
               },
               "then": {
-                "required": [
-                  "config"
-                ]
+                "required": ["config"]
               }
             },
             "passkey": {
@@ -2023,17 +1892,13 @@
                           "type": "string",
                           "title": "Relying Party Display Name",
                           "description": "A name to help the user identify this RP.",
-                          "examples": [
-                            "Ory Foundation"
-                          ]
+                          "examples": ["Ory Foundation"]
                         },
                         "id": {
                           "type": "string",
                           "title": "Relying Party Identifier",
                           "description": "The id must be a subset of the domain currently in the browser.",
-                          "examples": [
-                            "ory.sh"
-                          ]
+                          "examples": ["ory.sh"]
                         },
                         "origins": {
                           "type": "array",
@@ -2041,7 +1906,6 @@
                           "description": "A list of explicit RP origins. If left empty, this defaults to either `origin` or `id`, prepended with the current protocol schema (HTTP or HTTPS).",
                           "items": {
                             "type": "string",
-                            "format": "uri",
                             "examples": [
                               "https://www.ory.sh",
                               "https://auth.ory.sh"
@@ -2050,10 +1914,7 @@
                         }
                       },
                       "type": "object",
-                      "required": [
-                        "display_name",
-                        "id"
-                      ]
+                      "required": ["display_name", "id"]
                     }
                   },
                   "additionalProperties": false
@@ -2065,14 +1926,10 @@
                     "const": true
                   }
                 },
-                "required": [
-                  "enabled"
-                ]
+                "required": ["enabled"]
               },
               "then": {
-                "required": [
-                  "config"
-                ]
+                "required": ["config"]
               }
             },
             "oidc": {
@@ -2095,9 +1952,7 @@
                       "title": "Base URL for OAuth2 Redirect URIs",
                       "description": "Can be used to modify the base URL for OAuth2 Redirect URLs. If unset, the Public Base URL will be used.",
                       "format": "uri",
-                      "examples": [
-                        "https://auth.myexample.org/"
-                      ]
+                      "examples": ["https://auth.myexample.org/"]
                     },
                     "providers": {
                       "title": "OpenID Connect and OAuth2 Providers",
@@ -2200,11 +2055,12 @@
                   "properties": {
                     "email": {
                       "$ref": "#/definitions/emailCourierTemplate"
+                    },
+                    "sms": {
+                      "$ref": "#/definitions/smsCourierTemplate"
                     }
                   },
-                  "required": [
-                    "email"
-                  ]
+                  "required": ["email"]
                 }
               }
             },
@@ -2223,9 +2079,7 @@
                       "$ref": "#/definitions/smsCourierTemplate"
                     }
                   },
-                  "required": [
-                    "email"
-                  ]
+                  "required": ["email"]
                 }
               }
             }
@@ -2235,18 +2089,13 @@
           "type": "string",
           "title": "Override message templates",
           "description": "You can override certain or all message templates by pointing this key to the path where the templates are located.",
-          "examples": [
-            "/conf/courier-templates"
-          ]
+          "examples": ["/conf/courier-templates"]
         },
         "message_retries": {
           "description": "Defines the maximum number of times the sending of a message is retried after it failed before it is marked as abandoned",
           "type": "integer",
           "default": 5,
-          "examples": [
-            10,
-            60
-          ]
+          "examples": [10, 60]
         },
         "worker": {
           "description": "Configures the dispatch worker.",
@@ -2269,10 +2118,7 @@
           "title": "Delivery Strategy",
           "description": "Defines how emails will be sent, either through SMTP (default) or HTTP.",
           "type": "string",
-          "enum": [
-            "smtp",
-            "http"
-          ],
+          "enum": ["smtp", "http"],
           "default": "smtp"
         },
         "http": {
@@ -2304,7 +2150,7 @@
                 "smtps://subdomain.my-mailserver:1234/?server_name=my-mailserver (allows TLS to work if the server is hosted on a sudomain that uses a non-wildcard domain certificate)"
               ],
               "type": "string",
-              "pattern": "^smtps?:\\/\\/.*"
+              "pattern": "^smtps?://.*"
             },
             "client_cert_path": {
               "title": "SMTP Client certificate path",
@@ -2329,9 +2175,7 @@
               "title": "SMTP Sender Name",
               "description": "The recipient of an email will see this as the sender name.",
               "type": "string",
-              "examples": [
-                "Bob"
-              ]
+              "examples": ["Bob"]
             },
             "headers": {
               "title": "SMTP Headers",
@@ -2357,81 +2201,6 @@
           },
           "additionalProperties": false
         },
-        "sms": {
-          "title": "SMS sender configuration",
-          "description": "Configures outgoing sms messages using HTTP protocol with generic SMS provider",
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "description": "Determines if SMS functionality is enabled",
-              "type": "boolean",
-              "default": false
-            },
-            "from": {
-              "title": "SMS Sender Address",
-              "description": "The recipient of a sms will see this as the sender address.",
-              "type": "string",
-              "default": "Ory Kratos"
-            },
-            "request_config": {
-              "type": "object",
-              "properties": {
-                "url": {
-                  "title": "HTTP address of API endpoint",
-                  "description": "This URL will be used to connect to the SMS provider.",
-                  "examples": [
-                    "https://api.twillio.com/sms/send"
-                  ],
-                  "type": "string",
-                  "pattern": "^https?:\\/\\/.*"
-                },
-                "method": {
-                  "type": "string",
-                  "description": "The HTTP method to use (GET, POST, etc)."
-                },
-                "headers": {
-                  "type": "object",
-                  "description": "The HTTP headers that must be applied to request",
-                  "additionalProperties": {
-                    "type": "string"
-                  }
-                },
-                "body": {
-                  "type": "string",
-                  "format": "uri",
-                  "pattern": "^(http|https|file|base64)://",
-                  "description": "URI pointing to the jsonnet template used for payload generation. Only used for those HTTP methods, which support HTTP body payloads",
-                  "examples": [
-                    "file:///path/to/body.jsonnet",
-                    "file://./body.jsonnet",
-                    "base64://ZnVuY3Rpb24oY3R4KSB7CiAgaWRlbnRpdHlfaWQ6IGlmIGN0eFsiaWRlbnRpdHkiXSAhPSBudWxsIHRoZW4gY3R4LmlkZW50aXR5LmlkLAp9=",
-                    "https://oryapis.com/default_body.jsonnet"
-                  ]
-                },
-                "auth": {
-                  "type": "object",
-                  "title": "Auth mechanisms",
-                  "description": "Define which auth mechanism to use for auth with the SMS provider",
-                  "oneOf": [
-                    {
-                      "$ref": "#/definitions/webHookAuthApiKeyProperties"
-                    },
-                    {
-                      "$ref": "#/definitions/webHookAuthBasicAuthProperties"
-                    }
-                  ]
-                },
-                "additionalProperties": false
-              },
-              "required": [
-                "url",
-                "method"
-              ],
-              "additionalProperties": false
-            }
-          },
-          "additionalProperties": false
-        },
         "channels": {
           "type": "array",
           "items": {
@@ -2441,28 +2210,21 @@
               "id": {
                 "type": "string",
                 "title": "Channel id",
-                "description": "The channel id. Corresponds to the .via property of the identity schema for recovery, verification, etc. Currently only phone is supported.",
+                "description": "The channel id. Corresponds to the .via property of the identity schema for recovery, verification, etc. Currently only sms is supported.",
                 "maxLength": 32,
-                "enum": [
-                  "sms"
-                ]
+                "enum": ["sms"]
               },
               "type": {
                 "type": "string",
                 "title": "Channel type",
                 "description": "The channel type. Currently only http is supported.",
-                "enum": [
-                  "http"
-                ]
+                "enum": ["http"]
               },
               "request_config": {
                 "$ref": "#/definitions/httpRequestConfig"
               }
             },
-            "required": [
-              "id",
-              "request_config"
-            ],
+            "required": ["id", "request_config"],
             "additionalProperties": false
           }
         }
@@ -2513,10 +2275,7 @@
           "type": "string",
           "title": "Default Read Consistency Level",
           "description": "The default consistency level to use when reading from the database. Defaults to `strong` to not break existing API contracts. Only set this to `eventual` if you can accept that other read APIs will suddenly return eventually consistent results. It is only effective in Ory Network.",
-          "enum": [
-            "strong",
-            "eventual"
-          ],
+          "enum": ["strong", "eventual"],
           "default": "strong"
         }
       }
@@ -2544,9 +2303,7 @@
               "description": "The URL where the admin endpoint is exposed at.",
               "type": "string",
               "format": "uri",
-              "examples": [
-                "https://kratos.private-network:4434/"
-              ]
+              "examples": ["https://kratos.private-network:4434/"]
             },
             "host": {
               "title": "Admin Host",
@@ -2560,9 +2317,7 @@
               "type": "integer",
               "minimum": 1,
               "maximum": 65535,
-              "examples": [
-                4434
-              ],
+              "examples": [4434],
               "default": 4434
             },
             "socket": {
@@ -2621,9 +2376,7 @@
                     ]
                   },
                   "uniqueItems": true,
-                  "default": [
-                    "*"
-                  ],
+                  "default": ["*"],
                   "examples": [
                     [
                       "https://example.com",
@@ -2635,13 +2388,7 @@
                 "allowed_methods": {
                   "type": "array",
                   "description": "A list of HTTP methods the user agent is allowed to use with cross-domain requests.",
-                  "default": [
-                    "POST",
-                    "GET",
-                    "PUT",
-                    "PATCH",
-                    "DELETE"
-                  ],
+                  "default": ["POST", "GET", "PUT", "PATCH", "DELETE"],
                   "items": {
                     "type": "string",
                     "enum": [
@@ -2675,9 +2422,7 @@
                 "exposed_headers": {
                   "type": "array",
                   "description": "Sets which headers are safe to expose to the API of a CORS API specification.",
-                  "default": [
-                    "Content-Type"
-                  ],
+                  "default": ["Content-Type"],
                   "items": {
                     "type": "string"
                   }
@@ -2720,9 +2465,7 @@
               "type": "integer",
               "minimum": 1,
               "maximum": 65535,
-              "examples": [
-                4433
-              ],
+              "examples": [4433],
               "default": 4433
             },
             "socket": {
@@ -2772,10 +2515,7 @@
         "format": {
           "description": "The log format can either be text or JSON.",
           "type": "string",
-          "enum": [
-            "json",
-            "text"
-          ]
+          "enum": ["json", "text"]
         }
       },
       "additionalProperties": false
@@ -2816,9 +2556,7 @@
               "id": {
                 "title": "The schema's ID.",
                 "type": "string",
-                "examples": [
-                  "employee"
-                ]
+                "examples": ["employee"]
               },
               "url": {
                 "type": "string",
@@ -2832,16 +2570,11 @@
                 ]
               }
             },
-            "required": [
-              "id",
-              "url"
-            ]
+            "required": ["id", "url"]
           }
         }
       },
-      "required": [
-        "schemas"
-      ],
+      "required": ["schemas"],
       "additionalProperties": false
     },
     "secrets": {
@@ -2890,10 +2623,7 @@
           "description": "One of the values: argon2, bcrypt.\nAny other hashes will be migrated to the set algorithm once an identity authenticates using their password.",
           "type": "string",
           "default": "bcrypt",
-          "enum": [
-            "argon2",
-            "bcrypt"
-          ]
+          "enum": ["argon2", "bcrypt"]
         },
         "argon2": {
           "title": "Configuration for the Argon2id hasher.",
@@ -2949,9 +2679,7 @@
           "title": "Configuration for the Bcrypt hasher. Minimum is 4 when --dev flag is used and 12 otherwise.",
           "type": "object",
           "additionalProperties": false,
-          "required": [
-            "cost"
-          ],
+          "required": ["cost"],
           "properties": {
             "cost": {
               "type": "integer",
@@ -2973,11 +2701,7 @@
           "description": "One of the values: noop, aes, xchacha20-poly1305",
           "type": "string",
           "default": "noop",
-          "enum": [
-            "noop",
-            "aes",
-            "xchacha20-poly1305"
-          ]
+          "enum": ["noop", "aes", "xchacha20-poly1305"]
         }
       }
     },
@@ -2997,15 +2721,16 @@
           "type": "string",
           "default": "/"
         },
+        "secure": {
+          "title": "Session Cookie Secure Flag",
+          "description": "Sets the session secure flag. If unset, defaults to !dev mode.",
+          "type": "string"
+        },
         "same_site": {
           "title": "HTTP Cookie Same Site Configuration",
           "description": "Sets the session and CSRF cookie SameSite.",
           "type": "string",
-          "enum": [
-            "Strict",
-            "Lax",
-            "None"
-          ],
+          "enum": ["Strict", "Lax", "None"],
           "default": "Lax"
         }
       },
@@ -3035,9 +2760,7 @@
                   "patternProperties": {
                     "[a-zA-Z0-9-_.]+": {
                       "type": "object",
-                      "required": [
-                        "jwks_url"
-                      ],
+                      "required": ["jwks_url"],
                       "properties": {
                         "ttl": {
                           "type": "string",
@@ -3070,11 +2793,7 @@
           "type": "string",
           "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
           "default": "24h",
-          "examples": [
-            "1h",
-            "1m",
-            "1s"
-          ]
+          "examples": ["1h", "1m", "1s"]
         },
         "cookie": {
           "type": "object",
@@ -3101,15 +2820,16 @@
               "description": "Sets the session cookie path. Use with care! Overrides `cookies.path`.",
               "type": "string"
             },
+            "secure": {
+              "title": "Session Cookie Secure Flag",
+              "description": "Sets the session secure flag. If unset, defaults to !dev mode.",
+              "type": "string"
+            },
             "same_site": {
               "title": "Session Cookie SameSite Configuration",
               "description": "Sets the session cookie SameSite. Overrides `cookies.same_site`.",
               "type": "string",
-              "enum": [
-                "Strict",
-                "Lax",
-                "None"
-              ]
+              "enum": ["Strict", "Lax", "None"]
             }
           },
           "additionalProperties": false
@@ -3119,11 +2839,22 @@
           "description": "Sets when a session can be extended. Settings this value to `24h` will prevent the session from being extended before until 24 hours before it expires. This setting prevents excessive writes to the database. We highly recommend setting this value.",
           "type": "string",
           "pattern": "^([0-9]+(ns|us|ms|s|m|h))+$",
-          "examples": [
-            "1h",
-            "1m",
-            "1s"
-          ]
+          "examples": ["1h", "1m", "1s"]
+        }
+      }
+    },
+    "security": {
+      "type": "object",
+      "properties": {
+        "account_enumeration": {
+          "type": "object",
+          "properties": {
+            "mitigate": {
+              "type": "boolean",
+              "default": false,
+              "description": "Mitigate account enumeration by making it harder to figure out if an identifier (email, phone number) exists or not. Enabling this setting degrades user experience. This setting does not mitigate all possible attack vectors yet."
+            }
+          }
         }
       }
     },
@@ -3132,9 +2863,7 @@
       "description": "SemVer according to https://semver.org/ prefixed with `v` as in our releases.",
       "type": "string",
       "pattern": "^(v(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)|$",
-      "examples": [
-        "v0.5.0-alpha.1"
-      ]
+      "examples": ["v0.5.0-alpha.1"]
     },
     "dev": {
       "type": "boolean"
@@ -3158,9 +2887,7 @@
       "type": "integer",
       "minimum": 0,
       "maximum": 65535,
-      "examples": [
-        4434
-      ],
+      "examples": [4434],
       "default": 0
     },
     "config": {
@@ -3266,14 +2993,10 @@
                             "const": true
                           }
                         },
-                        "required": [
-                          "enabled"
-                        ]
+                        "required": ["enabled"]
                       }
                     },
-                    "required": [
-                      "verification"
-                    ]
+                    "required": ["verification"]
                   },
                   {
                     "properties": {
@@ -3283,31 +3006,21 @@
                             "const": true
                           }
                         },
-                        "required": [
-                          "enabled"
-                        ]
+                        "required": ["enabled"]
                       }
                     },
-                    "required": [
-                      "recovery"
-                    ]
+                    "required": ["recovery"]
                   }
                 ]
               }
             },
-            "required": [
-              "flows"
-            ]
+            "required": ["flows"]
           }
         },
-        "required": [
-          "selfservice"
-        ]
+        "required": ["selfservice"]
       },
       "then": {
-        "required": [
-          "courier"
-        ]
+        "required": ["courier"]
       }
     },
     {
@@ -3326,33 +3039,21 @@
                 ]
               }
             },
-            "required": [
-              "algorithm"
-            ]
+            "required": ["algorithm"]
           }
         },
-        "required": [
-          "ciphers"
-        ]
+        "required": ["ciphers"]
       },
       "then": {
-        "required": [
-          "secrets"
-        ],
+        "required": ["secrets"],
         "properties": {
           "secrets": {
-            "required": [
-              "cipher"
-            ]
+            "required": ["cipher"]
           }
         }
       }
     }
   ],
-  "required": [
-    "identity",
-    "dsn",
-    "selfservice"
-  ],
+  "required": ["identity", "dsn", "selfservice"],
   "additionalProperties": false
 }
diff --git a/embedx/embedx.go b/embedx/embedx.go
index b91d86b8f692..5212337f4ea2 100644
--- a/embedx/embedx.go
+++ b/embedx/embedx.go
@@ -5,15 +5,13 @@ package embedx
 
 import (
 	"bytes"
+	_ "embed"
 	"io"
 
 	"github.com/pkg/errors"
-
-	"github.com/ory/x/otelx"
-
 	"github.com/tidwall/gjson"
 
-	_ "embed"
+	"github.com/ory/x/otelx"
 )
 
 //go:embed config.schema.json
diff --git a/examples/go/identity/create/main.go b/examples/go/identity/create/main.go
index 92f95769d054..be515e997131 100644
--- a/examples/go/identity/create/main.go
+++ b/examples/go/identity/create/main.go
@@ -19,7 +19,7 @@ var client = pkg.NewSDK("playground")
 func createIdentity() *ory.Identity {
 	ctx := context.Background()
 
-	identity, res, err := client.IdentityApi.CreateIdentity(ctx).
+	identity, res, err := client.IdentityAPI.CreateIdentity(ctx).
 		CreateIdentityBody(ory.CreateIdentityBody{
 			SchemaId: "default",
 			Traits: map[string]interface{}{
diff --git a/examples/go/identity/delete/main.go b/examples/go/identity/delete/main.go
index 999bc004dfa8..6857c2a3f6c5 100644
--- a/examples/go/identity/delete/main.go
+++ b/examples/go/identity/delete/main.go
@@ -20,7 +20,7 @@ func deleteIdentity() {
 
 	identity := pkg.CreateIdentity(client)
 
-	res, err := client.IdentityApi.DeleteIdentity(ctx, identity.Id).Execute()
+	res, err := client.IdentityAPI.DeleteIdentity(ctx, identity.Id).Execute()
 	pkg.SDKExitOnError(err, res)
 }
 
diff --git a/examples/go/identity/get/main.go b/examples/go/identity/get/main.go
index 865c72c3a1e7..dcd5cefc814d 100644
--- a/examples/go/identity/get/main.go
+++ b/examples/go/identity/get/main.go
@@ -19,7 +19,7 @@ func getIdentity() *ory.Identity {
 	ctx := context.Background()
 	created := pkg.CreateIdentity(client)
 
-	identity, res, err := client.IdentityApi.GetIdentity(ctx, created.Id).IncludeCredential([]string{"password"}).Execute()
+	identity, res, err := client.IdentityAPI.GetIdentity(ctx, created.Id).IncludeCredential([]string{"password"}).Execute()
 	pkg.SDKExitOnError(err, res)
 
 	return identity
diff --git a/examples/go/identity/update/main.go b/examples/go/identity/update/main.go
index a1d9062ad821..46b868f84b10 100644
--- a/examples/go/identity/update/main.go
+++ b/examples/go/identity/update/main.go
@@ -20,7 +20,7 @@ func updateIdentity() *ory.Identity {
 	ctx := context.Background()
 	toUpdate := pkg.CreateIdentity(client)
 
-	identity, res, err := client.IdentityApi.UpdateIdentity(ctx, toUpdate.Id).UpdateIdentityBody(ory.UpdateIdentityBody{
+	identity, res, err := client.IdentityAPI.UpdateIdentity(ctx, toUpdate.Id).UpdateIdentityBody(ory.UpdateIdentityBody{
 		Traits: map[string]interface{}{
 			"email": "dev+not-" + x.NewUUID().String() + "@ory.sh",
 		},
diff --git a/examples/go/pkg/common.go b/examples/go/pkg/common.go
index edb8c17e2e19..f39725103e33 100644
--- a/examples/go/pkg/common.go
+++ b/examples/go/pkg/common.go
@@ -11,11 +11,9 @@ import (
 	"os"
 	"testing"
 
-	"github.com/ory/kratos/x"
-
-	"github.com/ory/kratos/internal/testhelpers"
-
 	ory "github.com/ory/client-go"
+	"github.com/ory/kratos/internal/testhelpers"
+	"github.com/ory/kratos/x"
 )
 
 func PrintJSONPretty(v interface{}) {
diff --git a/examples/go/pkg/resources.go b/examples/go/pkg/resources.go
index b931ef0fdda9..a6cd4326faed 100644
--- a/examples/go/pkg/resources.go
+++ b/examples/go/pkg/resources.go
@@ -32,11 +32,11 @@ func CreateIdentityWithSession(c *ory.APIClient, email, password string) (*ory.S
 	}
 
 	// Initialize a registration flow
-	flow, _, err := c.FrontendApi.CreateNativeRegistrationFlow(ctx).Execute()
+	flow, _, err := c.FrontendAPI.CreateNativeRegistrationFlow(ctx).Execute()
 	ExitOnError(err)
 
 	// Submit the registration flow
-	result, res, err := c.FrontendApi.UpdateRegistrationFlow(ctx).Flow(flow.Id).UpdateRegistrationFlowBody(
+	result, res, err := c.FrontendAPI.UpdateRegistrationFlow(ctx).Flow(flow.Id).UpdateRegistrationFlowBody(
 		ory.UpdateRegistrationFlowWithPasswordMethodAsUpdateRegistrationFlowBody(&ory.UpdateRegistrationFlowWithPasswordMethod{
 			Method:   "password",
 			Password: password,
@@ -56,7 +56,7 @@ func CreateIdentity(c *ory.APIClient) *ory.Identity {
 	ctx := context.Background()
 
 	email, _ := RandomCredentials()
-	identity, _, err := c.IdentityApi.CreateIdentity(ctx).CreateIdentityBody(ory.CreateIdentityBody{
+	identity, _, err := c.IdentityAPI.CreateIdentity(ctx).CreateIdentityBody(ory.CreateIdentityBody{
 		SchemaId: "default",
 		Traits: map[string]interface{}{
 			"email": email,
diff --git a/examples/go/selfservice/error/main.go b/examples/go/selfservice/error/main.go
index cdd31eec40aa..ca9eda53c86c 100644
--- a/examples/go/selfservice/error/main.go
+++ b/examples/go/selfservice/error/main.go
@@ -17,7 +17,7 @@ import (
 var client = pkg.NewSDK("playground")
 
 func getError() *ory.FlowError {
-	e, res, err := client.FrontendApi.GetFlowError(context.Background()).Id("stub:500").Execute()
+	e, res, err := client.FrontendAPI.GetFlowError(context.Background()).Id("stub:500").Execute()
 	pkg.SDKExitOnError(err, res)
 	return e
 }
diff --git a/examples/go/selfservice/login/main.go b/examples/go/selfservice/login/main.go
index 23360c6e144b..c94f67e55bef 100644
--- a/examples/go/selfservice/login/main.go
+++ b/examples/go/selfservice/login/main.go
@@ -24,7 +24,7 @@ func performLogin() *ory.SuccessfulNativeLogin {
 	_, _ = pkg.CreateIdentityWithSession(client, email, password)
 
 	// Initialize the flow
-	flow, res, err := client.FrontendApi.CreateNativeLoginFlow(ctx).Execute()
+	flow, res, err := client.FrontendAPI.CreateNativeLoginFlow(ctx).Execute()
 	pkg.SDKExitOnError(err, res)
 
 	// If you want, print the flow here:
@@ -32,7 +32,7 @@ func performLogin() *ory.SuccessfulNativeLogin {
 	//	pkg.PrintJSONPretty(flow)
 
 	// Submit the form
-	result, res, err := client.FrontendApi.UpdateLoginFlow(ctx).Flow(flow.Id).UpdateLoginFlowBody(
+	result, res, err := client.FrontendAPI.UpdateLoginFlow(ctx).Flow(flow.Id).UpdateLoginFlowBody(
 		ory.UpdateLoginFlowWithPasswordMethodAsUpdateLoginFlowBody(&ory.UpdateLoginFlowWithPasswordMethod{
 			Method:             "password",
 			Password:           password,
diff --git a/examples/go/selfservice/logout/main.go b/examples/go/selfservice/logout/main.go
index 0ecb6eedd096..9d2bd02c2be2 100644
--- a/examples/go/selfservice/logout/main.go
+++ b/examples/go/selfservice/logout/main.go
@@ -23,7 +23,7 @@ func performLogout() {
 	_, sessionToken := pkg.CreateIdentityWithSession(client, email, password)
 
 	// Log out using session token
-	res, err := client.FrontendApi.PerformNativeLogout(context.Background()).
+	res, err := client.FrontendAPI.PerformNativeLogout(context.Background()).
 		PerformNativeLogoutBody(ory.PerformNativeLogoutBody{SessionToken: sessionToken}).Execute()
 	pkg.SDKExitOnError(err, res)
 }
diff --git a/examples/go/selfservice/recovery/main.go b/examples/go/selfservice/recovery/main.go
index 41011b9236a0..790d5dc91ee2 100644
--- a/examples/go/selfservice/recovery/main.go
+++ b/examples/go/selfservice/recovery/main.go
@@ -20,7 +20,7 @@ func performRecovery(email string) *ory.RecoveryFlow {
 	ctx := context.Background()
 
 	// Initialize the flow
-	flow, res, err := client.FrontendApi.CreateNativeRecoveryFlow(ctx).Execute()
+	flow, res, err := client.FrontendAPI.CreateNativeRecoveryFlow(ctx).Execute()
 	pkg.SDKExitOnError(err, res)
 
 	// If you want, print the flow here:
@@ -28,7 +28,7 @@ func performRecovery(email string) *ory.RecoveryFlow {
 	//	pkg.PrintJSONPretty(flow)
 
 	// Submit the form
-	afterSubmit, res, err := client.FrontendApi.UpdateRecoveryFlow(ctx).Flow(flow.Id).
+	afterSubmit, res, err := client.FrontendAPI.UpdateRecoveryFlow(ctx).Flow(flow.Id).
 		UpdateRecoveryFlowBody(ory.UpdateRecoveryFlowWithLinkMethodAsUpdateRecoveryFlowBody(&ory.UpdateRecoveryFlowWithLinkMethod{
 			Email:  email,
 			Method: "link",
diff --git a/examples/go/selfservice/registration/main.go b/examples/go/selfservice/registration/main.go
index a038320ffa76..a51e0e210c62 100644
--- a/examples/go/selfservice/registration/main.go
+++ b/examples/go/selfservice/registration/main.go
@@ -20,7 +20,7 @@ func initRegistration() *ory.SuccessfulNativeRegistration {
 	ctx := context.Background()
 
 	// Initialize the flow
-	flow, res, err := client.FrontendApi.CreateNativeRegistrationFlow(ctx).Execute()
+	flow, res, err := client.FrontendAPI.CreateNativeRegistrationFlow(ctx).Execute()
 	pkg.SDKExitOnError(err, res)
 
 	// If you want, print the flow here:
@@ -30,7 +30,7 @@ func initRegistration() *ory.SuccessfulNativeRegistration {
 	email, password := pkg.RandomCredentials()
 
 	// Submit the registration flow
-	result, res, err := client.FrontendApi.UpdateRegistrationFlow(ctx).Flow(flow.Id).UpdateRegistrationFlowBody(
+	result, res, err := client.FrontendAPI.UpdateRegistrationFlow(ctx).Flow(flow.Id).UpdateRegistrationFlowBody(
 		ory.UpdateRegistrationFlowWithPasswordMethodAsUpdateRegistrationFlowBody(&ory.UpdateRegistrationFlowWithPasswordMethod{
 			Method:   "password",
 			Password: password,
diff --git a/examples/go/selfservice/settings/main.go b/examples/go/selfservice/settings/main.go
index 7311465a245a..725b3d8f836d 100644
--- a/examples/go/selfservice/settings/main.go
+++ b/examples/go/selfservice/settings/main.go
@@ -22,7 +22,7 @@ func initFlow(email, password string) (string, *ory.SettingsFlow) {
 	// Create a temporary user
 	_, sessionToken := pkg.CreateIdentityWithSession(client, email, password)
 
-	flow, res, err := client.FrontendApi.CreateNativeSettingsFlow(context.Background()).XSessionToken(sessionToken).Execute()
+	flow, res, err := client.FrontendAPI.CreateNativeSettingsFlow(context.Background()).XSessionToken(sessionToken).Execute()
 	pkg.SDKExitOnError(err, res)
 
 	// If you want, print the flow here:
@@ -36,7 +36,7 @@ func changePassword(email, password string) *ory.SettingsFlow {
 	sessionToken, flow := initFlow(email, password)
 
 	// Submit the form
-	result, res, err := client.FrontendApi.UpdateSettingsFlow(ctx).Flow(flow.Id).XSessionToken(sessionToken).UpdateSettingsFlowBody(
+	result, res, err := client.FrontendAPI.UpdateSettingsFlow(ctx).Flow(flow.Id).XSessionToken(sessionToken).UpdateSettingsFlowBody(
 		ory.UpdateSettingsFlowWithPasswordMethodAsUpdateSettingsFlowBody(&ory.UpdateSettingsFlowWithPasswordMethod{
 			Method:   "password",
 			Password: "not-" + password,
@@ -51,7 +51,7 @@ func changeTraits(email, password string) *ory.SettingsFlow {
 	sessionToken, flow := initFlow(email, password)
 
 	// Submit the form
-	result, res, err := client.FrontendApi.UpdateSettingsFlow(ctx).Flow(flow.Id).XSessionToken(sessionToken).UpdateSettingsFlowBody(
+	result, res, err := client.FrontendAPI.UpdateSettingsFlow(ctx).Flow(flow.Id).XSessionToken(sessionToken).UpdateSettingsFlowBody(
 		ory.UpdateSettingsFlowWithProfileMethodAsUpdateSettingsFlowBody(&ory.UpdateSettingsFlowWithProfileMethod{
 			Method: "profile",
 			Traits: map[string]interface{}{
diff --git a/examples/go/selfservice/verification/main.go b/examples/go/selfservice/verification/main.go
index cd587f5a8c31..86feb5bfccc9 100644
--- a/examples/go/selfservice/verification/main.go
+++ b/examples/go/selfservice/verification/main.go
@@ -20,7 +20,7 @@ func performVerification(email string) *ory.VerificationFlow {
 	ctx := context.Background()
 
 	// Initialize the flow
-	flow, res, err := client.FrontendApi.CreateNativeVerificationFlow(ctx).Execute()
+	flow, res, err := client.FrontendAPI.CreateNativeVerificationFlow(ctx).Execute()
 	pkg.SDKExitOnError(err, res)
 
 	// If you want, print the flow here:
@@ -28,7 +28,7 @@ func performVerification(email string) *ory.VerificationFlow {
 	//	pkg.PrintJSONPretty(flow)
 
 	// Submit the form
-	afterSubmit, res, err := client.FrontendApi.UpdateVerificationFlow(ctx).Flow(flow.Id).
+	afterSubmit, res, err := client.FrontendAPI.UpdateVerificationFlow(ctx).Flow(flow.Id).
 		UpdateVerificationFlowBody(ory.UpdateVerificationFlowWithLinkMethodAsUpdateVerificationFlowBody(&ory.UpdateVerificationFlowWithLinkMethod{
 			Email:  email,
 			Method: "link",
diff --git a/examples/go/session/tosession/main.go b/examples/go/session/tosession/main.go
index ec8c30e847b2..05cbd6040bcf 100644
--- a/examples/go/session/tosession/main.go
+++ b/examples/go/session/tosession/main.go
@@ -19,7 +19,7 @@ func toSession() *ory.Session {
 	email, password := pkg.RandomCredentials()
 	_, sessionToken := pkg.CreateIdentityWithSession(client, email, password)
 
-	session, res, err := client.FrontendApi.ToSessionExecute(ory.FrontendApiApiToSessionRequest{}.
+	session, res, err := client.FrontendAPI.ToSessionExecute(ory.FrontendAPIApiToSessionRequest{}.
 		XSessionToken(sessionToken))
 	pkg.SDKExitOnError(err, res)
 	return session
diff --git a/gen/oidc/v1/state.pb.go b/gen/oidc/v1/state.pb.go
new file mode 100644
index 000000000000..ce3ab14d52b1
--- /dev/null
+++ b/gen/oidc/v1/state.pb.go
@@ -0,0 +1,183 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        (unknown)
+// source: oidc/v1/state.proto
+
+package oidcv1
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type State struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	FlowId                         []byte `protobuf:"bytes,1,opt,name=flow_id,json=flowId,proto3" json:"flow_id,omitempty"`
+	SessionTokenExchangeCodeSha512 []byte `protobuf:"bytes,2,opt,name=session_token_exchange_code_sha512,json=sessionTokenExchangeCodeSha512,proto3" json:"session_token_exchange_code_sha512,omitempty"`
+	ProviderId                     string `protobuf:"bytes,3,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"`
+	PkceVerifier                   string `protobuf:"bytes,4,opt,name=pkce_verifier,json=pkceVerifier,proto3" json:"pkce_verifier,omitempty"`
+}
+
+func (x *State) Reset() {
+	*x = State{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_oidc_v1_state_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *State) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*State) ProtoMessage() {}
+
+func (x *State) ProtoReflect() protoreflect.Message {
+	mi := &file_oidc_v1_state_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use State.ProtoReflect.Descriptor instead.
+func (*State) Descriptor() ([]byte, []int) {
+	return file_oidc_v1_state_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *State) GetFlowId() []byte {
+	if x != nil {
+		return x.FlowId
+	}
+	return nil
+}
+
+func (x *State) GetSessionTokenExchangeCodeSha512() []byte {
+	if x != nil {
+		return x.SessionTokenExchangeCodeSha512
+	}
+	return nil
+}
+
+func (x *State) GetProviderId() string {
+	if x != nil {
+		return x.ProviderId
+	}
+	return ""
+}
+
+func (x *State) GetPkceVerifier() string {
+	if x != nil {
+		return x.PkceVerifier
+	}
+	return ""
+}
+
+var File_oidc_v1_state_proto protoreflect.FileDescriptor
+
+var file_oidc_v1_state_proto_rawDesc = []byte{
+	0x0a, 0x13, 0x6f, 0x69, 0x64, 0x63, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x6f, 0x69, 0x64, 0x63, 0x2e, 0x76, 0x31, 0x22, 0xb2,
+	0x01, 0x0a, 0x05, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x66, 0x6c, 0x6f, 0x77,
+	0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x66, 0x6c, 0x6f, 0x77, 0x49,
+	0x64, 0x12, 0x4a, 0x0a, 0x22, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x5f, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x5f, 0x63, 0x6f, 0x64, 0x65,
+	0x5f, 0x73, 0x68, 0x61, 0x35, 0x31, 0x32, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x1e, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x78, 0x63, 0x68, 0x61,
+	0x6e, 0x67, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x53, 0x68, 0x61, 0x35, 0x31, 0x32, 0x12, 0x1f, 0x0a,
+	0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x49, 0x64, 0x12, 0x23,
+	0x0a, 0x0d, 0x70, 0x6b, 0x63, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x6b, 0x63, 0x65, 0x56, 0x65, 0x72, 0x69, 0x66,
+	0x69, 0x65, 0x72, 0x42, 0x7c, 0x0a, 0x0b, 0x63, 0x6f, 0x6d, 0x2e, 0x6f, 0x69, 0x64, 0x63, 0x2e,
+	0x76, 0x31, 0x42, 0x0a, 0x53, 0x74, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
+	0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x72, 0x79,
+	0x2f, 0x6b, 0x72, 0x61, 0x74, 0x6f, 0x73, 0x2f, 0x6f, 0x69, 0x64, 0x63, 0x2f, 0x76, 0x31, 0x3b,
+	0x6f, 0x69, 0x64, 0x63, 0x76, 0x31, 0xa2, 0x02, 0x03, 0x4f, 0x58, 0x58, 0xaa, 0x02, 0x07, 0x4f,
+	0x69, 0x64, 0x63, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x07, 0x4f, 0x69, 0x64, 0x63, 0x5c, 0x56, 0x31,
+	0xe2, 0x02, 0x13, 0x4f, 0x69, 0x64, 0x63, 0x5c, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x08, 0x4f, 0x69, 0x64, 0x63, 0x3a, 0x3a, 0x56,
+	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_oidc_v1_state_proto_rawDescOnce sync.Once
+	file_oidc_v1_state_proto_rawDescData = file_oidc_v1_state_proto_rawDesc
+)
+
+func file_oidc_v1_state_proto_rawDescGZIP() []byte {
+	file_oidc_v1_state_proto_rawDescOnce.Do(func() {
+		file_oidc_v1_state_proto_rawDescData = protoimpl.X.CompressGZIP(file_oidc_v1_state_proto_rawDescData)
+	})
+	return file_oidc_v1_state_proto_rawDescData
+}
+
+var file_oidc_v1_state_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_oidc_v1_state_proto_goTypes = []any{
+	(*State)(nil), // 0: oidc.v1.State
+}
+var file_oidc_v1_state_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_oidc_v1_state_proto_init() }
+func file_oidc_v1_state_proto_init() {
+	if File_oidc_v1_state_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_oidc_v1_state_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*State); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_oidc_v1_state_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_oidc_v1_state_proto_goTypes,
+		DependencyIndexes: file_oidc_v1_state_proto_depIdxs,
+		MessageInfos:      file_oidc_v1_state_proto_msgTypes,
+	}.Build()
+	File_oidc_v1_state_proto = out.File
+	file_oidc_v1_state_proto_rawDesc = nil
+	file_oidc_v1_state_proto_goTypes = nil
+	file_oidc_v1_state_proto_depIdxs = nil
+}
diff --git a/go.mod b/go.mod
index 67e7a524c134..b73ec1fd3e4b 100644
--- a/go.mod
+++ b/go.mod
@@ -1,15 +1,19 @@
 module github.com/ory/kratos
 
-go 1.22
+go 1.23
+
+toolchain go1.23.2
 
 replace (
-	github.com/go-sql-driver/mysql => github.com/go-sql-driver/mysql v1.7.2-0.20231005084435-37980127edfb
+	github.com/coreos/go-oidc/v3 => github.com/ory/go-oidc/v3 v3.0.0-20241127113405-e5362711266b
 
+	github.com/go-swagger/go-swagger => github.com/aeneasr/go-swagger v0.19.1-0.20241013070044-bccef3a12e26 // See https://github.com/go-swagger/go-swagger/issues/3131
+	// github.com/go-swagger/go-swagger => ../../go-swagger/go-swagger
 	// https://github.com/gobuffalo/pop/pull/833
-	github.com/gobuffalo/pop/v6 => github.com/alnr/pop/v6 v6.1.2-0.20240220141536-653aad67c0c2
+	github.com/gobuffalo/pop/v6 => github.com/ory/pop/v6 v6.2.1-0.20241121111754-e5dfc0f3344b
 
 	github.com/gorilla/sessions => github.com/ory/sessions v1.2.2-0.20220110165800-b09c17334dc2
-	github.com/mattn/go-sqlite3 => github.com/mattn/go-sqlite3 v1.14.16
+	github.com/mattn/go-sqlite3 => github.com/mattn/go-sqlite3 v1.14.22
 
 	// Use the internal httpclient which can be generated in this codebase but mark it as the
 	// official SDK, allowing for the Ory CLI to consume Ory Kratos' CLI commands.
@@ -17,207 +21,206 @@ replace (
 )
 
 require (
-	code.dny.dev/ssrf v0.2.0 // indirect
+	dario.cat/mergo v1.0.0
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0
 	github.com/avast/retry-go/v3 v3.1.1
 	github.com/bradleyjkemp/cupaloy/v2 v2.8.0
-	github.com/bwmarrin/discordgo v0.23.0
+	github.com/bwmarrin/discordgo v0.28.1
 	github.com/cenkalti/backoff v2.2.1+incompatible
-	github.com/cortesi/modd v0.0.0-20210323234521-b35eddab86cc
-	github.com/davecgh/go-spew v1.1.1
-	github.com/davidrjonas/semver-cli v0.0.0-20190116233701-ee19a9a0dda6
-	github.com/dgraph-io/ristretto v0.1.1
-	github.com/fatih/color v1.13.0
+	github.com/coreos/go-oidc/v3 v3.11.0
+	github.com/cortesi/modd v0.8.1
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
+	github.com/dghubble/oauth1 v0.7.3
+	github.com/dgraph-io/ristretto v1.0.0
+	github.com/fatih/color v1.17.0
 	github.com/ghodss/yaml v1.0.0
-	github.com/go-crypt/crypt v0.2.9
-	github.com/go-faker/faker/v4 v4.2.0
-	github.com/go-openapi/strfmt v0.21.7
-	github.com/go-playground/validator/v10 v10.4.1
-	github.com/go-swagger/go-swagger v0.30.5
-	github.com/go-webauthn/webauthn v0.8.4
-	github.com/gobuffalo/fizz v1.14.4
+	github.com/go-crypt/crypt v0.2.25
+	github.com/go-faker/faker/v4 v4.4.2
+	github.com/go-openapi/strfmt v0.23.0
+	github.com/go-playground/validator/v10 v10.22.0
+	github.com/go-swagger/go-swagger v0.31.0
+	github.com/go-webauthn/webauthn v0.11.2
 	github.com/gobuffalo/httptest v1.5.2
 	github.com/gobuffalo/pop/v6 v6.1.2-0.20230318123913-c85387acc9a0
-	github.com/gofrs/uuid v4.3.1+incompatible
-	github.com/golang-jwt/jwt/v4 v4.5.0
-	github.com/golang-jwt/jwt/v5 v5.0.0
+	github.com/gofrs/uuid v4.4.0+incompatible
+	github.com/golang-jwt/jwt/v4 v4.5.1
+	github.com/golang-jwt/jwt/v5 v5.2.1
 	github.com/golang/gddo v0.0.0-20190904175337-72a348e765d2
 	github.com/golang/mock v1.6.0
-	github.com/google/go-github/v27 v27.0.1
 	github.com/google/go-github/v38 v38.1.0
 	github.com/google/go-jsonnet v0.20.0
-	github.com/gorilla/sessions v1.2.1
+	github.com/gorilla/sessions v1.3.0
 	github.com/gtank/cryptopasta v0.0.0-20170601214702-1f550f6f2f69
-	github.com/hashicorp/consul/api v1.20.0
-	github.com/hashicorp/go-retryablehttp v0.7.2
-	github.com/hashicorp/golang-lru v0.5.4
-	github.com/imdario/mergo v0.3.13
+	github.com/hashicorp/go-retryablehttp v0.7.7
+	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf
-	github.com/jarcoal/httpmock v1.0.5
-	github.com/jmoiron/sqlx v1.3.5
-	github.com/jteeuwen/go-bindata v3.0.7+incompatible
+	github.com/jarcoal/httpmock v1.3.1
+	github.com/jmoiron/sqlx v1.4.0
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/knadh/koanf/parsers/json v0.1.0
-	github.com/laher/mergefs v0.1.2-0.20230223191438-d16611b2f4e7
-	github.com/lestrrat-go/jwx v1.2.29 // indirect
+	github.com/laher/mergefs v0.1.2-0.20230223191438-d16611b2f4e7 // indirect
+	github.com/lestrrat-go/jwx/v2 v2.1.1
 	github.com/luna-duclos/instrumentedsql v1.1.3
 	github.com/mailhog/MailHog v1.0.1
-	github.com/mattn/goveralls v0.0.7
-	github.com/mikefarah/yq/v4 v4.19.1
+	github.com/mattn/goveralls v0.0.12
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
 	github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe
 	github.com/ory/analytics-go/v5 v5.0.1
-	github.com/ory/client-go v0.2.0-alpha.60
-	github.com/ory/dockertest/v3 v3.9.1
+	github.com/ory/client-go v1.14.3
+	github.com/ory/dockertest/v3 v3.11.0
 	github.com/ory/go-acc v0.2.9-0.20230103102148-6b1c9a70dbbe
 	github.com/ory/graceful v0.1.4-0.20230301144740-e222150c51d0
 	github.com/ory/herodot v0.10.3-0.20230626083119-d7e5192f0d88
-	github.com/ory/hydra-client-go/v2 v2.2.0-rc.3.0.20240202131107-1c7b57df3bb0
+	github.com/ory/hydra-client-go/v2 v2.2.1
 	github.com/ory/jsonschema/v3 v3.0.8
 	github.com/ory/mail/v3 v3.0.0
 	github.com/ory/nosurf v1.2.7
-	github.com/ory/x v0.0.623
+	github.com/ory/x v0.0.675
 	github.com/peterhellberg/link v1.2.0
-	github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2
+	github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5
 	github.com/pkg/errors v0.9.1
 	github.com/pquerna/otp v1.4.0
 	github.com/rakutentech/jwk-go v1.1.3
-	github.com/rs/cors v1.8.2
-	github.com/samber/lo v1.37.0
-	github.com/sirupsen/logrus v1.9.0
-	github.com/slack-go/slack v0.7.4
-	github.com/spf13/cobra v1.7.0
+	github.com/rs/cors v1.11.0
+	github.com/samber/lo v1.46.0
+	github.com/sirupsen/logrus v1.9.3
+	github.com/slack-go/slack v0.13.1
+	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
-	github.com/sqs/goreturns v0.0.0-20181028201513-538ac6014518
 	github.com/stretchr/testify v1.9.0
-	github.com/tidwall/gjson v1.14.3
+	github.com/tidwall/gjson v1.17.3
 	github.com/tidwall/sjson v1.2.5
 	github.com/urfave/negroni v1.0.0
-	github.com/zmb3/spotify/v2 v2.4.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0
-	go.opentelemetry.io/otel v1.22.0
-	go.opentelemetry.io/otel/sdk v1.21.0
-	go.opentelemetry.io/otel/trace v1.22.0
-	golang.org/x/crypto v0.22.0
-	golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611
-	golang.org/x/net v0.24.0
-	golang.org/x/oauth2 v0.16.0
-	golang.org/x/sync v0.5.0
-	golang.org/x/text v0.14.0
-	golang.org/x/tools/cmd/cover v0.1.0-deprecated
-	google.golang.org/grpc v1.59.0
+	github.com/zmb3/spotify/v2 v2.4.2
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0
+	go.opentelemetry.io/otel v1.32.0
+	go.opentelemetry.io/otel/sdk v1.32.0
+	go.opentelemetry.io/otel/trace v1.32.0
+	golang.org/x/crypto v0.31.0
+	golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 // indirect
+	golang.org/x/net v0.33.0
+	golang.org/x/oauth2 v0.24.0
+	golang.org/x/sync v0.10.0
+	golang.org/x/text v0.21.0
+	google.golang.org/grpc v1.67.1
+)
+
+require github.com/wI2L/jsondiff v0.6.0
+
+require (
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
+	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
+	github.com/bmatcuk/doublestar v1.3.4 // indirect
+	github.com/cortesi/moddwatch v0.1.0 // indirect
+	github.com/cortesi/termlog v0.0.0-20210222042314-a1eec763abec // indirect
+	github.com/dgraph-io/ristretto/v2 v2.0.0 // indirect
+	github.com/jackc/pgx/v5 v5.7.2 // indirect
+	github.com/rjeczalik/notify v0.9.3 // indirect
+	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/time v0.8.0 // indirect
+	gopkg.in/alecthomas/kingpin.v2 v2.2.6 // indirect
+	mvdan.cc/sh/v3 v3.6.0 // indirect
 )
 
 require (
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	code.dny.dev/ssrf v0.2.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver v1.5.0 // indirect
-	github.com/Masterminds/semver/v3 v3.2.0 // indirect
-	github.com/Microsoft/go-winio v0.6.0 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
-	github.com/a8m/envsubst v1.3.0 // indirect
-	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
-	github.com/alecthomas/units v0.0.0-20210208195552-ff826a37aa15 // indirect
-	github.com/armon/go-metrics v0.4.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/avast/retry-go/v4 v4.3.0 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bmatcuk/doublestar v1.3.4 // indirect
 	github.com/boombuler/barcode v1.0.1 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cockroachdb/cockroach-go/v2 v2.3.5
-	github.com/containerd/continuity v0.3.0 // indirect
-	github.com/cortesi/moddwatch v0.0.0-20210222043437-a6aaad86a36e // indirect
-	github.com/cortesi/termlog v0.0.0-20210222042314-a1eec763abec // indirect
-	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
-	github.com/docker/cli v20.10.21+incompatible // indirect
-	github.com/docker/distribution v2.8.2+incompatible // indirect
-	github.com/docker/docker v20.10.27+incompatible // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/containerd/continuity v0.4.3 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/cli v26.1.4+incompatible // indirect
+	github.com/docker/docker v27.1.1+incompatible // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/dustin/go-humanize v1.0.0 // indirect
-	github.com/elliotchance/orderedmap v1.4.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
 	github.com/felixge/fgprof v0.9.3 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fsnotify/fsnotify v1.6.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.4.0 // indirect
-	github.com/go-crypt/x v0.2.1 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
+	github.com/go-crypt/x v0.2.18 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.4 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.21.4 // indirect
-	github.com/go-openapi/errors v0.20.4 // indirect
-	github.com/go-openapi/inflect v0.19.0 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/loads v0.21.2 // indirect
-	github.com/go-openapi/runtime v0.26.0 // indirect
-	github.com/go-openapi/spec v0.20.9 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/go-openapi/validate v0.22.1 // indirect
-	github.com/go-playground/locales v0.13.0 // indirect
-	github.com/go-playground/universal-translator v0.17.0 // indirect
-	github.com/go-sql-driver/mysql v1.7.0 // indirect
-	github.com/go-webauthn/x v0.1.4 // indirect
+	github.com/go-openapi/analysis v0.23.0 // indirect
+	github.com/go-openapi/errors v0.22.0 // indirect
+	github.com/go-openapi/inflect v0.21.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/loads v0.22.0 // indirect
+	github.com/go-openapi/runtime v0.28.0 // indirect
+	github.com/go-openapi/spec v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/validate v0.24.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-sql-driver/mysql v1.8.1 // indirect
+	github.com/go-webauthn/x v0.1.14 // indirect
 	github.com/gobuffalo/envy v1.10.2 // indirect
-	github.com/gobuffalo/flect v1.0.0 // indirect
-	github.com/gobuffalo/github_flavored_markdown v1.1.3 // indirect
+	github.com/gobuffalo/fizz v1.14.4 // indirect
+	github.com/gobuffalo/flect v1.0.2 // indirect
+	github.com/gobuffalo/github_flavored_markdown v1.1.4 // indirect
 	github.com/gobuffalo/helpers v0.6.7 // indirect
 	github.com/gobuffalo/nulls v0.4.2 // indirect
-	github.com/gobuffalo/plush/v4 v4.1.18 // indirect
+	github.com/gobuffalo/plush/v4 v4.1.21 // indirect
 	github.com/gobuffalo/tags/v3 v3.1.4 // indirect
 	github.com/gobuffalo/validate/v3 v3.3.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
-	github.com/goccy/go-json v0.10.2 // indirect
-	github.com/goccy/go-yaml v1.9.6 // indirect
+	github.com/goccy/go-json v0.10.3 // indirect
+	github.com/goccy/go-yaml v1.11.3 // indirect
 	github.com/gofrs/flock v0.8.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/glog v1.1.2 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/btree v1.0.1 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-querystring v1.0.0 // indirect
-	github.com/google/go-tpm v0.9.0 // indirect
+	github.com/google/go-tpm v0.9.1 // indirect
 	github.com/google/pprof v0.0.0-20221010195024-131d412537ea // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/google/uuid v1.3.1 // indirect
-	github.com/gorilla/context v1.1.1 // indirect
-	github.com/gorilla/css v1.0.0 // indirect
-	github.com/gorilla/handlers v1.5.1 // indirect
-	github.com/gorilla/mux v1.7.3 // indirect
-	github.com/gorilla/pat v1.0.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/context v1.1.2 // indirect
+	github.com/gorilla/css v1.0.1 // indirect
+	github.com/gorilla/handlers v1.5.2 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/gorilla/pat v1.0.2 // indirect
 	github.com/gorilla/securecookie v1.1.1 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-hclog v1.2.0 // indirect
-	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
-	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/serf v0.10.1 // indirect
-	github.com/huandu/xstrings v1.3.3 // indirect
+	github.com/huandu/xstrings v1.4.0 // indirect
 	github.com/ian-kent/envconf v0.0.0-20141026121121-c19809918c02 // indirect
 	github.com/ian-kent/go-log v0.0.0-20160113211217-5731446c36ab // indirect
 	github.com/ian-kent/goose v0.0.0-20141221090059-c3541ea826ad // indirect
 	github.com/ian-kent/linkio v0.0.0-20170807205755-97566b872887 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
 	github.com/jackc/pgconn v1.14.3 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
-	github.com/jackc/pgtype v1.14.0 // indirect
-	github.com/jackc/pgx/v4 v4.18.2 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jandelgado/gcov2lcov v1.0.5 // indirect
 	github.com/jessevdk/go-flags v1.5.0 // indirect
-	github.com/jinzhu/copier v0.3.5 // indirect
-	github.com/joho/godotenv v1.4.0 // indirect
+	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/knadh/koanf/maps v0.1.1 // indirect
@@ -227,13 +230,15 @@ require (
 	github.com/knadh/koanf/v2 v2.0.1 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/leodido/go-urn v1.2.0 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/lestrrat-go/backoff/v2 v2.0.8 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.2 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
+	github.com/lestrrat-go/httprc v1.0.6 // indirect
 	github.com/lestrrat-go/iter v1.0.2 // indirect
+	github.com/lestrrat-go/jwx v1.2.29
 	github.com/lestrrat-go/option v1.0.1 // indirect
-	github.com/lib/pq v1.10.7 // indirect
+	github.com/lib/pq v1.10.9 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mailhog/MailHog-Server v1.0.1 // indirect
 	github.com/mailhog/MailHog-UI v1.0.1 // indirect
@@ -244,99 +249,81 @@ require (
 	github.com/mailhog/storage v1.0.1 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.16 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/microcosm-cc/bluemonday v1.0.21 // indirect
+	github.com/microcosm-cc/bluemonday v1.0.26 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae // indirect
-	github.com/nyaruka/phonenumbers v1.3.6 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/term v0.5.0 // indirect
+	github.com/nyaruka/phonenumbers v1.4.1
 	github.com/ogier/pflag v0.0.1 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
-	github.com/opencontainers/runc v1.1.12 // indirect
-	github.com/openzipkin/zipkin-go v0.4.2 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/opencontainers/runc v1.1.14 // indirect
+	github.com/openzipkin/zipkin-go v0.4.3 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
-	github.com/philhofer/fwd v1.1.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986 // indirect
 	github.com/pkg/profile v1.7.0 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.13.0 // indirect
 	github.com/prometheus/client_model v0.3.0 // indirect
 	github.com/prometheus/common v0.37.0 // indirect
 	github.com/prometheus/procfs v0.8.0 // indirect
-	github.com/rjeczalik/notify v0.0.0-20181126183243-629144ba06a1 // indirect
-	github.com/rogpeppe/go-internal v1.10.0 // indirect
+	github.com/rogpeppe/go-internal v1.13.1 // indirect
+	github.com/sagikazarmark/locafero v0.4.0 // indirect
+	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
 	github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761 // indirect
+	github.com/segmentio/asm v1.2.0 // indirect
 	github.com/segmentio/backo-go v1.0.1 // indirect
-	github.com/sergi/go-diff v1.2.0 // indirect
+	github.com/sergi/go-diff v1.3.1 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
 	github.com/smartystreets/assertions v1.0.0 // indirect
 	github.com/smartystreets/goconvey v1.6.4 // indirect
 	github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e // indirect
-	github.com/spf13/afero v1.9.5 // indirect
-	github.com/spf13/cast v1.5.1 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/viper v1.16.0 // indirect
-	github.com/subosito/gotenv v1.4.2 // indirect
+	github.com/spf13/afero v1.11.0 // indirect
+	github.com/spf13/cast v1.6.0 // indirect
+	github.com/spf13/viper v1.18.2 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/t-k/fluent-logger-golang v1.0.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
-	github.com/timtadh/data-structures v0.5.3 // indirect
-	github.com/timtadh/lexmachine v0.2.2 // indirect
-	github.com/tinylib/msgp v1.1.8 // indirect
+	github.com/tinylib/msgp v1.2.0 // indirect
 	github.com/toqueteos/webbrowser v1.2.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xtgo/uuid v0.0.0-20140804021211-a0b114877d4c // indirect
-	go.mongodb.org/mongo-driver v1.11.3 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.47.0 // indirect
-	go.opentelemetry.io/contrib/propagators/b3 v1.21.0 // indirect
-	go.opentelemetry.io/contrib/propagators/jaeger v1.21.1 // indirect
-	go.opentelemetry.io/contrib/samplers/jaegerremote v0.15.1 // indirect
+	go.mongodb.org/mongo-driver v1.14.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.57.0 // indirect
+	go.opentelemetry.io/contrib/propagators/b3 v1.32.0 // indirect
+	go.opentelemetry.io/contrib/propagators/jaeger v1.32.0 // indirect
+	go.opentelemetry.io/contrib/samplers/jaegerremote v0.26.0 // indirect
 	go.opentelemetry.io/otel/exporters/jaeger v1.17.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect; / indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 // indirect; / indirect
-	go.opentelemetry.io/otel/exporters/zipkin v1.21.0 // indirect; / indirect
-	go.opentelemetry.io/otel/metric v1.22.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
-	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/sys v0.19.0 // indirect
-	golang.org/x/term v0.19.0 // indirect
-	golang.org/x/tools v0.16.0 // indirect
-	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
-	gopkg.in/alecthomas/kingpin.v2 v2.2.6 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 // indirect; / indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0 // indirect; / indirect
+	go.opentelemetry.io/otel/exporters/zipkin v1.32.0 // indirect; / indirect
+	go.opentelemetry.io/otel/metric v1.32.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/mod v0.22.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/tools v0.28.0 // indirect
+	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 // indirect
+	google.golang.org/protobuf v1.35.1
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22 // indirect
-	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	mvdan.cc/sh/v3 v3.3.0-0.dev.0.20210224101809-fb5052e7a010 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
-
-require (
-	github.com/coreos/go-oidc/v3 v3.9.0
-	github.com/dghubble/oauth1 v0.7.2
-	github.com/lestrrat-go/jwx/v2 v2.0.21
-)
-
-require (
-	github.com/jackc/puddle/v2 v2.1.2 // indirect
-	github.com/lestrrat-go/httprc v1.0.5 // indirect
-	github.com/segmentio/asm v1.2.0 // indirect
-	go.uber.org/atomic v1.10.0 // indirect
-)
diff --git a/go.sum b/go.sum
index 85e85e83626c..194a67fb0bb7 100644
--- a/go.sum
+++ b/go.sum
@@ -3,7 +3,6 @@ cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMT
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
 cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
 cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
 cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
 cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
 cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
@@ -14,9 +13,6 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
-cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
@@ -34,51 +30,41 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
 code.dny.dev/ssrf v0.2.0 h1:wCBP990rQQ1CYfRpW+YK1+8xhwUjv189AQ3WMo1jQaI=
 code.dny.dev/ssrf v0.2.0/go.mod h1:B+91l25OnyaLIeCx0WRJN5qfJ/4/ZTZxRXgm0lj/2w8=
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
+dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
-github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
-github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
-github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
-github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
-github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/a8m/envsubst v1.3.0 h1:GmXKmVssap0YtlU3E230W98RWtWCyIZzjtf1apWWyAg=
-github.com/a8m/envsubst v1.3.0/go.mod h1:MVUTQNGQ3tsjOOtKCNd+fl8RzhsXcDvvAEzkhGtlsbY=
+github.com/aeneasr/go-swagger v0.19.1-0.20241013070044-bccef3a12e26 h1:rwCKVbnpzxQ0F/AhO9FkXnrKqRmqej4epjhe1CpNkB0=
+github.com/aeneasr/go-swagger v0.19.1-0.20241013070044-bccef3a12e26/go.mod h1:WSigRRWEig8zV6t6Sm8Y+EmUjlzA/HoaZJ5edupq7po=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
-github.com/alecthomas/units v0.0.0-20210208195552-ff826a37aa15 h1:AUNCr9CiJuwrRYS3XieqF+Z9B9gNxo/eANAJCF2eiN4=
-github.com/alecthomas/units v0.0.0-20210208195552-ff826a37aa15/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
-github.com/alnr/pop/v6 v6.1.2-0.20240220141536-653aad67c0c2 h1:GcIj2UDicQcj5xPwdpyYzqFP3GITJFzuoRyvqZTHz1c=
-github.com/alnr/pop/v6 v6.1.2-0.20240220141536-653aad67c0c2/go.mod h1:1n7jAmI1i7fxuXPZjZb0VBPQDbksRtCoFnrDV5IsvaI=
+github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
+github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
-github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
-github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
-github.com/armon/go-metrics v0.4.0 h1:yCQqn7dwca4ITXb+CbubHmedzaQYHhNhrEXLYUeEe8Q=
-github.com/armon/go-metrics v0.4.0/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/avast/retry-go/v3 v3.1.1 h1:49Scxf4v8PmiQ/nY0aY3p0hDueqSmc7++cBbtiDGu2g=
@@ -91,7 +77,6 @@ github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bmatcuk/doublestar v1.3.4 h1:gPypJ5xD31uhX6Tf54sDPUOBXTqKH4c9aPY66CyQrS0=
 github.com/bmatcuk/doublestar v1.3.4/go.mod h1:wiQtGV+rzVYxB7WIlirSN++5HPtPlXEo9MEoZQC/PmE=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
@@ -101,115 +86,107 @@ github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyX
 github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
-github.com/bwmarrin/discordgo v0.23.0 h1://ARp8qUrRZvDGMkfAjtcC20WOvsMtTgi+KrdKnl6eY=
-github.com/bwmarrin/discordgo v0.23.0/go.mod h1:c1WtWUGN6nREDmzIpyTp/iD3VYt4Fpx+bVyfBG7JE+M=
+github.com/bwmarrin/discordgo v0.28.1 h1:gXsuo2GBO7NbR6uqmrrBDplPUx2T3nzu775q/Rd1aG4=
+github.com/bwmarrin/discordgo v0.28.1/go.mod h1:NJZpH+1AfhIcyQsPeuBKsUtYrRnjkyu0kIVMCHkZtRY=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
-github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
-github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
 github.com/cockroachdb/cockroach-go/v2 v2.3.5 h1:Khtm8K6fTTz/ZCWPzU9Ne3aOW9VyAnj4qIPCJgKtwK0=
 github.com/cockroachdb/cockroach-go/v2 v2.3.5/go.mod h1:1wNJ45eSXW9AnOc3skntW9ZUZz6gxrQK3cOj3rK+BC8=
-github.com/containerd/continuity v0.3.0 h1:nisirsYROK15TAMVukJOUyGJjz4BNQJBVsNvAXZJ/eg=
-github.com/containerd/continuity v0.3.0/go.mod h1:wJEAIwKOm/pBZuBd0JmeTvnLquTB1Ag8espWhkykbPM=
-github.com/coreos/go-oidc/v3 v3.9.0 h1:0J/ogVOd4y8P0f0xUh8l9t07xRP/d8tccvjHl2dcsSo=
-github.com/coreos/go-oidc/v3 v3.9.0/go.mod h1:rTKz2PYwftcrtoCzV5g5kvfJoWcm0Mk8AF8y1iAQro4=
-github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/cortesi/modd v0.0.0-20210323234521-b35eddab86cc h1:JPkUs3TdeYIbBy9GTDdez9rBbbl6E9BNRa9jlfEDjnE=
-github.com/cortesi/modd v0.0.0-20210323234521-b35eddab86cc/go.mod h1:h20oNPW+cbtizAJwm90svrR7HlV7XvSNT5di+GP7SbA=
-github.com/cortesi/moddwatch v0.0.0-20210222043437-a6aaad86a36e h1:vNbhR09qtq9ELJgvhAWng4zl/4CVTPBPVev3R8MlUYc=
-github.com/cortesi/moddwatch v0.0.0-20210222043437-a6aaad86a36e/go.mod h1:MUkYRZrwFTHATqCI5tDJRPqmBt9xf3q4+Avfut7kCCE=
+github.com/containerd/continuity v0.4.3 h1:6HVkalIp+2u1ZLH1J/pYX2oBVXlJZvh1X1A7bEZ9Su8=
+github.com/containerd/continuity v0.4.3/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/cortesi/modd v0.8.1 h1:0s8e10CJ6pxc6NQHYFrmUZOLP0X6v63ry+3na6Gq2Ow=
+github.com/cortesi/modd v0.8.1/go.mod h1:GDJFkhHnnW+SD1C+wHBlKe5Yh2IqiOb6Lu5t2/fjnS4=
+github.com/cortesi/moddwatch v0.1.0 h1:+TSMuplhKlKEPKsdUXNHd67aCqew+et15dJvRCxMd1M=
+github.com/cortesi/moddwatch v0.1.0/go.mod h1:PFkhcmmwsRMQ76IMjKbaIIMcGQt7BSMtFOp+pA0B2eo=
 github.com/cortesi/termlog v0.0.0-20210222042314-a1eec763abec h1:v7D8uHsIKsyjfyhhNdY4qivqN558Ejiq+CDXiUljZ+4=
 github.com/cortesi/termlog v0.0.0-20210222042314-a1eec763abec/go.mod h1:10Fm2kasJmcKf1FSMQGSWb976sfR29hejNtfS9AydB4=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw=
-github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
+github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davidrjonas/semver-cli v0.0.0-20190116233701-ee19a9a0dda6 h1:VzPvKOw28XJ77PYwOq5gAqvFB4gk6gst0HxxiW8kfZQ=
-github.com/davidrjonas/semver-cli v0.0.0-20190116233701-ee19a9a0dda6/go.mod h1:+6FzxsSbK4oEuvdN06Jco8zKB2mQqIB6UduZdd0Zesk=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decred/dcrd/crypto/blake256 v1.0.1/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
-github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etlyjdBU4sfcs2WYQMs=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
-github.com/dghubble/oauth1 v0.7.2 h1:pwcinOZy8z6XkNxvPmUDY52M7RDPxt0Xw1zgZ6Cl5JA=
-github.com/dghubble/oauth1 v0.7.2/go.mod h1:9erQdIhqhOHG/7K9s/tgh9Ks/AfoyrO5mW/43Lu2+kE=
-github.com/dgraph-io/ristretto v0.1.1 h1:6CWw5tJNgpegArSHpNHJKldNeq03FQCwYvfMVWajOK8=
-github.com/dgraph-io/ristretto v0.1.1/go.mod h1:S1GPSBCYCIhmVNfcth17y2zZtQT6wzkzgwUve0VDWWA=
-github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2 h1:tdlZCpZ/P9DhczCTSixgIKmwPv6+wP5DGjqLYw5SUiA=
-github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
-github.com/docker/cli v20.10.21+incompatible h1:qVkgyYUnOLQ98LtXBrwd/duVqPT2X4SHndOuGsfwyhU=
-github.com/docker/cli v20.10.21+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
-github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v20.10.27+incompatible h1:Id/ZooynV4ZlD6xX20RCd3SR0Ikn7r4QZDa2ECK2TgA=
-github.com/docker/docker v20.10.27+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
-github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 h1:rpfIENRNNilwHwZeG5+P150SMrnNEcHYvcCuK6dPZSg=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
+github.com/dghubble/oauth1 v0.7.3 h1:EkEM/zMDMp3zOsX2DC/ZQ2vnEX3ELK0/l9kb+vs4ptE=
+github.com/dghubble/oauth1 v0.7.3/go.mod h1:oxTe+az9NSMIucDPDCCtzJGsPhciJV33xocHfcR2sVY=
+github.com/dgraph-io/ristretto v1.0.0 h1:SYG07bONKMlFDUYu5pEu3DGAh8c2OFNzKm6G9J4Si84=
+github.com/dgraph-io/ristretto v1.0.0/go.mod h1:jTi2FiYEhQ1NsMmA7DeBykizjOuY88NhKBkepyu1jPc=
+github.com/dgraph-io/ristretto/v2 v2.0.0 h1:l0yiSOtlJvc0otkqyMaDNysg8E9/F/TYZwMbxscNOAQ=
+github.com/dgraph-io/ristretto/v2 v2.0.0/go.mod h1:FVFokF2dRqXyPyeMnK1YDy8Fc6aTe0IKgbcd03CYeEk=
+github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 h1:fAjc9m62+UWV/WAFKLNi6ZS0675eEUC9y3AlwSbQu1Y=
+github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/cli v26.1.4+incompatible h1:I8PHdc0MtxEADqYJZvhBrW9bo8gawKwwenxRM7/rLu8=
+github.com/docker/cli v26.1.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v27.1.1+incompatible h1:hO/M4MtV36kzKldqnA37IWhebRA+LnqqcqDja6kVaKY=
+github.com/docker/docker v27.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/elliotchance/orderedmap v1.4.0 h1:wZtfeEONCbx6in1CZyE6bELEt/vFayMvsxqI5SgsR+A=
-github.com/elliotchance/orderedmap v1.4.0/go.mod h1:wsDwEaX5jEoyhbs7x93zk2H/qv0zwuhg4inXhDkYqys=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww=
 github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
-github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4=
+github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
 github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
-github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
 github.com/frankban/quicktest v1.14.4/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
-github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
-github.com/fxamacker/cbor/v2 v2.4.0 h1:ri0ArlOR+5XunOP8CRUowT0pSJOwhW098ZCUyskZD88=
-github.com/fxamacker/cbor/v2 v2.4.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
+github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
+github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-crypt/crypt v0.2.9 h1:5gWWTId2Qyqs9ROIsegt5pnqo9wUSRLbhpkR6JSftjg=
-github.com/go-crypt/crypt v0.2.9/go.mod h1:JjzdTYE2mArb6nBoIvvpF7o46/rK/1pfmlArCRMTFUk=
-github.com/go-crypt/x v0.2.1 h1:OGw78Bswme9lffCOX6tyuC280ouU5391glsvThMtM5U=
-github.com/go-crypt/x v0.2.1/go.mod h1:Q/y9rms7yw4/1CavBlNGn0Itg4HqwNpe1N9FX0TxXrc=
-github.com/go-faker/faker/v4 v4.2.0 h1:dGebOupKwssrODV51E0zbMrv5e2gO9VWSLNC1WDCpWg=
-github.com/go-faker/faker/v4 v4.2.0/go.mod h1:F/bBy8GH9NxOxMInug5Gx4WYeG6fHJZ8Ol/dhcpRub4=
+github.com/go-crypt/crypt v0.2.25 h1:uW/3n4/9zYSOOgY0Md9dMxGSqrjaMyLo1/IFrm2L5yw=
+github.com/go-crypt/crypt v0.2.25/go.mod h1:ny8BOunn+/kr99iq2LYSKA0MAsxNaxZUmKKL42vV1io=
+github.com/go-crypt/x v0.2.18 h1:KdUGj4D/PdzcIkOQhK36QHzH2YD5GWrsVQ7JgO73Q8Y=
+github.com/go-crypt/x v0.2.18/go.mod h1:z48dMLdgMGPPjrzni9ETtg2foPez3EytjCL43Ak4QZ8=
+github.com/go-faker/faker/v4 v4.4.2 h1:96WeU9QKEqRUVYdjHquY2/5bAqmVM0IfGKHV5mbfqmQ=
+github.com/go-faker/faker/v4 v4.4.2/go.mod h1:4K3v4AbKXYNHMQNaREMc9/kRB9j5JJzpFo6KHRvrcIw=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
 github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
+github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
+github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -219,147 +196,95 @@ github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-openapi/analysis v0.21.2/go.mod h1:HZwRk4RRisyG8vx2Oe6aqeSQcoxRp47Xkp3+K6q+LdY=
-github.com/go-openapi/analysis v0.21.4 h1:ZDFLvSNxpDaomuCueM0BlSXxpANBlFYiBvr+GXrvIHc=
-github.com/go-openapi/analysis v0.21.4/go.mod h1:4zQ35W4neeZTqh3ol0rv/O8JBbka9QyAgQRPp9y3pfo=
-github.com/go-openapi/errors v0.19.8/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
-github.com/go-openapi/errors v0.19.9/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
-github.com/go-openapi/errors v0.20.2/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
-github.com/go-openapi/errors v0.20.4 h1:unTcVm6PispJsMECE3zWgvG4xTiKda1LIR5rCRWLG6M=
-github.com/go-openapi/errors v0.20.4/go.mod h1:Z3FlZ4I8jEGxjUK+bugx3on2mIAk4txuAOhlsB1FSgk=
-github.com/go-openapi/inflect v0.19.0 h1:9jCH9scKIbHeV9m12SmPilScz6krDxKRasNNSNPXu/4=
-github.com/go-openapi/inflect v0.19.0/go.mod h1:lHpZVlpIQqLyKwJ4N+YSc9hchQy/i12fJykb83CRBH4=
-github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
-github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
-github.com/go-openapi/jsonreference v0.19.6/go.mod h1:diGHMEHg2IqXZGKxqyvWdfWU/aim5Dprw5bqpKkTvns=
-github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo=
-github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
-github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/loads v0.21.1/go.mod h1:/DtAMXXneXFjbQMGEtbamCZb+4x7eGwkvZCvBmwUG+g=
-github.com/go-openapi/loads v0.21.2 h1:r2a/xFIYeZ4Qd2TnGpWDIQNcP80dIaZgf704za8enro=
-github.com/go-openapi/loads v0.21.2/go.mod h1:Jq58Os6SSGz0rzh62ptiu8Z31I+OTHqmULx5e/gJbNw=
-github.com/go-openapi/runtime v0.26.0 h1:HYOFtG00FM1UvqrcxbEJg/SwvDRvYLQKGhw2zaQjTcc=
-github.com/go-openapi/runtime v0.26.0/go.mod h1:QgRGeZwrUcSHdeh4Ka9Glvo0ug1LC5WyE+EV88plZrQ=
-github.com/go-openapi/spec v0.20.4/go.mod h1:faYFR1CvsJZ0mNsmsphTMSoRrNV3TEDoAM7FOEWeq8I=
-github.com/go-openapi/spec v0.20.6/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
-github.com/go-openapi/spec v0.20.9 h1:xnlYNQAwKd2VQRRfwTEI0DcK+2cbuvI/0c7jx3gA8/8=
-github.com/go-openapi/spec v0.20.9/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
-github.com/go-openapi/strfmt v0.21.0/go.mod h1:ZRQ409bWMj+SOgXofQAGTIo2Ebu72Gs+WaRADcS5iNg=
-github.com/go-openapi/strfmt v0.21.1/go.mod h1:I/XVKeLc5+MM5oPNN7P6urMOpuLXEcNrCX/rPGuWb0k=
-github.com/go-openapi/strfmt v0.21.3/go.mod h1:k+RzNO0Da+k3FrrynSNN8F7n/peCmQQqbbXjtDfvmGg=
-github.com/go-openapi/strfmt v0.21.7 h1:rspiXgNWgeUzhjo1YU01do6qsahtJNByjLVbPLNHb8k=
-github.com/go-openapi/strfmt v0.21.7/go.mod h1:adeGTkxE44sPyLk0JV235VQAO/ZXUr8KAzYjclFs3ew=
-github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.21.1/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/validate v0.22.1 h1:G+c2ub6q47kfX1sOBLwIQwzBVt8qmOAARyo/9Fqs9NU=
-github.com/go-openapi/validate v0.22.1/go.mod h1:rjnrwK57VJ7A8xqfpAOEKRH8yQSGUriMu5/zuPSQ1hg=
-github.com/go-playground/assert/v2 v2.0.1 h1:MsBgLAaY856+nPRTKrp3/OZK38U/wa0CcBYNjji3q3A=
-github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
-github.com/go-playground/locales v0.13.0 h1:HyWk6mgj5qFqCT5fjGBuRArbVDfE4hi8+e8ceBS/t7Q=
-github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
-github.com/go-playground/universal-translator v0.17.0 h1:icxd5fm+REJzpZx7ZfpaD876Lmtgy7VtROAbHHXk8no=
-github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
-github.com/go-playground/validator/v10 v10.4.1 h1:pH2c5ADXtd66mxoE0Zm9SUhxE20r7aM3F26W0hOn+GE=
-github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn9GlaMV7XkbRSipzJ0Ii4=
-github.com/go-sql-driver/mysql v1.7.2-0.20231005084435-37980127edfb h1:R5sscofA9Cyd0h2DNMbR8BHYVKj1ZTOgUah1PoU4OVU=
-github.com/go-sql-driver/mysql v1.7.2-0.20231005084435-37980127edfb/go.mod h1:6gYm/zDt3ahdnMVTPeT/LfoBFsws1qZm5yI6FmVjB14=
+github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
+github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
+github.com/go-openapi/errors v0.22.0 h1:c4xY/OLxUBSTiepAg3j/MHuAv5mJhnf53LLMWFB+u/w=
+github.com/go-openapi/errors v0.22.0/go.mod h1:J3DmZScxCDufmIMsdOuDHxJbdOGC0xtUynjIx092vXE=
+github.com/go-openapi/inflect v0.21.0 h1:FoBjBTQEcbg2cJUWX6uwL9OyIW8eqc9k4KhN4lfbeYk=
+github.com/go-openapi/inflect v0.21.0/go.mod h1:INezMuUu7SJQc2AyR3WO0DqqYUJSj8Kb4hBd7WtjlAw=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/loads v0.22.0 h1:ECPGd4jX1U6NApCGG1We+uEozOAvXvJSF4nnwHZ8Aco=
+github.com/go-openapi/loads v0.22.0/go.mod h1:yLsaTCS92mnSAZX5WWoxszLj0u+Ojl+Zs5Stn1oF+rs=
+github.com/go-openapi/runtime v0.28.0 h1:gpPPmWSNGo214l6n8hzdXYhPuJcGtziTOgUpvsFWGIQ=
+github.com/go-openapi/runtime v0.28.0/go.mod h1:QN7OzcS+XuYmkQLw05akXk0jRH/eZ3kb18+1KwW9gyc=
+github.com/go-openapi/spec v0.21.0 h1:LTVzPc3p/RzRnkQqLRndbAzjY0d0BCL72A6j3CdL9ZY=
+github.com/go-openapi/spec v0.21.0/go.mod h1:78u6VdPw81XU44qEWGhtr982gJ5BWg2c0I5XwVMotYk=
+github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMgO/c=
+github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
+github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.22.0 h1:k6HsTZ0sTnROkhS//R0O+55JgM8C4Bx7ia+JlgcnOao=
+github.com/go-playground/validator/v10 v10.22.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-swagger/go-swagger v0.30.5 h1:SQ2+xSonWjjoEMOV5tcOnZJVlfyUfCBhGQGArS1b9+U=
-github.com/go-swagger/go-swagger v0.30.5/go.mod h1:cWUhSyCNqV7J1wkkxfr5QmbcnCewetCdvEXqgPvbc/Q=
-github.com/go-swagger/scan-repo-boundary v0.0.0-20180623220736-973b3573c013 h1:l9rI6sNaZgNC0LnF3MiE+qTmyBA/tZAg1rtyrGbUMK0=
-github.com/go-swagger/scan-repo-boundary v0.0.0-20180623220736-973b3573c013/go.mod h1:b65mBPzqzZWxOZGxSWrqs4GInLIn+u99Q9q7p+GKni0=
 github.com/go-test/deep v1.0.4 h1:u2CU3YKy9I2pmu9pX0eq50wCgjfGIt539SqR7FbHiho=
 github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/go-webauthn/webauthn v0.8.4 h1:/emQ9b9Rj4flWO94Fo8KJeYvZ6VzPywXsmqyDA/WicY=
-github.com/go-webauthn/webauthn v0.8.4/go.mod h1:ZqEa9OnSCdQf6CJvTWTDCsUcPRi8F3h7XCIDINwbBgI=
-github.com/go-webauthn/x v0.1.4 h1:sGmIFhcY70l6k7JIDfnjVBiAAFEssga5lXIUXe0GtAs=
-github.com/go-webauthn/x v0.1.4/go.mod h1:75Ug0oK6KYpANh5hDOanfDI+dvPWHk788naJVG/37H8=
-github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
-github.com/gobuffalo/attrs v1.0.3/go.mod h1:KvDJCE0avbufqS0Bw3UV7RQynESY0jjod+572ctX4t8=
-github.com/gobuffalo/depgen v0.0.0-20190329151759-d478694a28d3/go.mod h1:3STtPUQYuzV0gBVOY3vy6CfMm/ljR4pABfrTeHNLHUY=
-github.com/gobuffalo/depgen v0.1.0/go.mod h1:+ifsuy7fhi15RWncXQQKjWS9JPkdah5sZvtHc2RXGlg=
-github.com/gobuffalo/envy v1.6.15/go.mod h1:n7DRkBerg/aorDM8kbduw5dN3oXGswK5liaSCx4T5NI=
-github.com/gobuffalo/envy v1.7.0/go.mod h1:n7DRkBerg/aorDM8kbduw5dN3oXGswK5liaSCx4T5NI=
+github.com/go-webauthn/webauthn v0.11.2 h1:Fgx0/wlmkClTKlnOsdOQ+K5HcHDsDcYIvtYmfhEOSUc=
+github.com/go-webauthn/webauthn v0.11.2/go.mod h1:aOtudaF94pM71g3jRwTYYwQTG1KyTILTcZqN1srkmD0=
+github.com/go-webauthn/x v0.1.14 h1:1wrB8jzXAofojJPAaRxnZhRgagvLGnLjhCAwg3kTpT0=
+github.com/go-webauthn/x v0.1.14/go.mod h1:UuVvFZ8/NbOnkDz3y1NaxtUN87pmtpC1PQ+/5BBQRdc=
 github.com/gobuffalo/envy v1.10.2 h1:EIi03p9c3yeuRCFPOKcSfajzkLb3hrRjEpHGI8I2Wo4=
 github.com/gobuffalo/envy v1.10.2/go.mod h1:qGAGwdvDsaEtPhfBzb3o0SfDea8ByGn9j8bKmVft9z8=
 github.com/gobuffalo/fizz v1.14.4 h1:8uume7joF6niTNWN582IQ2jhGTUoa9g1fiV/tIoGdBs=
 github.com/gobuffalo/fizz v1.14.4/go.mod h1:9/2fGNXNeIFOXEEgTPJwiK63e44RjG+Nc4hfMm1ArGM=
-github.com/gobuffalo/flect v0.1.0/go.mod h1:d2ehjJqGOH/Kjqcoz+F7jHTBbmDb38yXA598Hb50EGs=
-github.com/gobuffalo/flect v0.1.1/go.mod h1:8JCgGVbRjJhVgD6399mQr4fx5rRfGKVzFjbj6RE/9UI=
-github.com/gobuffalo/flect v0.1.3/go.mod h1:8JCgGVbRjJhVgD6399mQr4fx5rRfGKVzFjbj6RE/9UI=
 github.com/gobuffalo/flect v0.3.0/go.mod h1:5pf3aGnsvqvCj50AVni7mJJF8ICxGZ8HomberC3pXLE=
-github.com/gobuffalo/flect v1.0.0 h1:eBFmskjXZgAOagiTXJH25Nt5sdFwNRcb8DKZsIsAUQI=
-github.com/gobuffalo/flect v1.0.0/go.mod h1:l9V6xSb4BlXwsxEMj3FVEub2nkdQjWhPvD8XTTlHPQc=
-github.com/gobuffalo/genny v0.0.0-20190329151137-27723ad26ef9/go.mod h1:rWs4Z12d1Zbf19rlsn0nurr75KqhYp52EAGGxTbBhNk=
-github.com/gobuffalo/genny v0.0.0-20190403191548-3ca520ef0d9e/go.mod h1:80lIj3kVJWwOrXWWMRzzdhW3DsrdjILVil/SFKBzF28=
-github.com/gobuffalo/genny v0.1.0/go.mod h1:XidbUqzak3lHdS//TPu2OgiFB+51Ur5f7CSnXZ/JDvo=
-github.com/gobuffalo/genny v0.1.1/go.mod h1:5TExbEyY48pfunL4QSXxlDOmdsD44RRq4mVZ0Ex28Xk=
-github.com/gobuffalo/genny/v2 v2.1.0/go.mod h1:4yoTNk4bYuP3BMM6uQKYPvtP6WsXFGm2w2EFYZdRls8=
-github.com/gobuffalo/gitgen v0.0.0-20190315122116-cc086187d211/go.mod h1:vEHJk/E9DmhejeLeNt7UVvlSGv3ziL+djtTr3yyzcOw=
-github.com/gobuffalo/github_flavored_markdown v1.1.3 h1:rSMPtx9ePkFB22vJ+dH+m/EUBS8doQ3S8LeEXcdwZHk=
+github.com/gobuffalo/flect v1.0.2 h1:eqjPGSo2WmjgY2XlpGwo2NXgL3RucAKo4k4qQMNA5sA=
+github.com/gobuffalo/flect v1.0.2/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs=
 github.com/gobuffalo/github_flavored_markdown v1.1.3/go.mod h1:IzgO5xS6hqkDmUh91BW/+Qxo/qYnvfzoz3A7uLkg77I=
-github.com/gobuffalo/gogen v0.0.0-20190315121717-8f38393713f5/go.mod h1:V9QVDIxsgKNZs6L2IYiGR8datgMhB577vzTDqypH360=
-github.com/gobuffalo/gogen v0.1.0/go.mod h1:8NTelM5qd8RZ15VjQTFkAW6qOMx5wBbW4dSCS3BY8gg=
-github.com/gobuffalo/gogen v0.1.1/go.mod h1:y8iBtmHmGc4qa3urIyo1shvOD8JftTtfcKi+71xfDNE=
+github.com/gobuffalo/github_flavored_markdown v1.1.4 h1:WacrEGPXUDX+BpU1GM/Y0ADgMzESKNWls9hOTG1MHVs=
+github.com/gobuffalo/github_flavored_markdown v1.1.4/go.mod h1:Vl9686qrVVQou4GrHRK/KOG3jCZOKLUqV8MMOAYtlso=
 github.com/gobuffalo/helpers v0.6.7 h1:C9CedoRSfgWg2ZoIkVXgjI5kgmSpL34Z3qdnzpfNVd8=
 github.com/gobuffalo/helpers v0.6.7/go.mod h1:j0u1iC1VqlCaJEEVkZN8Ia3TEzfj/zoXANqyJExTMTA=
-github.com/gobuffalo/here v0.6.7 h1:hpfhh+kt2y9JLDfhYUxxCRxQol540jsVfKUZzjlbp8o=
-github.com/gobuffalo/here v0.6.7/go.mod h1:vuCfanjqckTuRlqAitJz6QC4ABNnS27wLb816UhsPcc=
 github.com/gobuffalo/httptest v1.5.2 h1:GpGy520SfY1QEmyPvaqmznTpG4gEQqQ82HtHqyNEreM=
 github.com/gobuffalo/httptest v1.5.2/go.mod h1:FA23yjsWLGj92mVV74Qtc8eqluc11VqcWr8/C1vxt4g=
-github.com/gobuffalo/logger v0.0.0-20190315122211-86e12af44bc2/go.mod h1:QdxcLw541hSGtBnhUc4gaNIXRjiDppFGaDqzbrBd3v8=
-github.com/gobuffalo/logger v1.0.7/go.mod h1:u40u6Bq3VVvaMcy5sRBclD8SXhBYPS0Qk95ubt+1xJM=
-github.com/gobuffalo/mapi v1.0.1/go.mod h1:4VAGh89y6rVOvm5A8fKFxYG+wIW6LO1FMTG9hnKStFc=
-github.com/gobuffalo/mapi v1.0.2/go.mod h1:4VAGh89y6rVOvm5A8fKFxYG+wIW6LO1FMTG9hnKStFc=
 github.com/gobuffalo/nulls v0.4.2 h1:GAqBR29R3oPY+WCC7JL9KKk9erchaNuV6unsOSZGQkw=
 github.com/gobuffalo/nulls v0.4.2/go.mod h1:EElw2zmBYafU2R9W4Ii1ByIj177wA/pc0JdjtD0EsH8=
-github.com/gobuffalo/packd v0.0.0-20190315124812-a385830c7fc0/go.mod h1:M2Juc+hhDXf/PnmBANFCqx4DM3wRbgDvnVWeG2RIxq4=
-github.com/gobuffalo/packd v0.1.0/go.mod h1:M2Juc+hhDXf/PnmBANFCqx4DM3wRbgDvnVWeG2RIxq4=
-github.com/gobuffalo/packd v1.0.2/go.mod h1:sUc61tDqGMXON80zpKGp92lDb86Km28jfvX7IAyxFT8=
-github.com/gobuffalo/packr/v2 v2.0.9/go.mod h1:emmyGweYTm6Kdper+iywB6YK5YzuKchGtJQZ0Odn4pQ=
-github.com/gobuffalo/packr/v2 v2.2.0/go.mod h1:CaAwI0GPIAv+5wKLtv8Afwl+Cm78K/I/VCm/3ptBN+0=
 github.com/gobuffalo/plush/v4 v4.1.16/go.mod h1:6t7swVsarJ8qSLw1qyAH/KbrcSTwdun2ASEQkOznakg=
-github.com/gobuffalo/plush/v4 v4.1.18 h1:bnPjdMTEUQHqj9TNX2Ck3mxEXYZa+0nrFMNM07kpX9g=
-github.com/gobuffalo/plush/v4 v4.1.18/go.mod h1:xi2tJIhFI4UdzIL8sxZtzGYOd2xbBpcFbLZlIPGGZhU=
-github.com/gobuffalo/syncx v0.0.0-20190224160051-33c29581e754/go.mod h1:HhnNqWY95UYwwW3uSASeV7vtgYkT2t16hJgV3AEPUpw=
+github.com/gobuffalo/plush/v4 v4.1.21 h1:YVfauGshxyQ+beh4jHR6Ct3NEXohn+1EboMjzdUDo30=
+github.com/gobuffalo/plush/v4 v4.1.21/go.mod h1:WiKHJx3qBvfaDVlrv8zT7NCd3dEMaVR/fVxW4wqV17M=
 github.com/gobuffalo/tags/v3 v3.1.4 h1:X/ydLLPhgXV4h04Hp2xlbI2oc5MDaa7eub6zw8oHjsM=
 github.com/gobuffalo/tags/v3 v3.1.4/go.mod h1:ArRNo3ErlHO8BtdA0REaZxijuWnWzF6PUXngmMXd2I0=
 github.com/gobuffalo/validate/v3 v3.3.3 h1:o7wkIGSvZBYBd6ChQoLxkz2y1pfmhbI4jNJYh6PuNJ4=
 github.com/gobuffalo/validate/v3 v3.3.3/go.mod h1:YC7FsbJ/9hW/VjQdmXPvFqvRis4vrRYFxr69WiNZw6g=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
-github.com/goccy/go-yaml v1.9.6 h1:KhAu1zf9JXnm3vbG49aDE0E5uEBUsM4uwD31/58ZWyI=
-github.com/goccy/go-yaml v1.9.6/go.mod h1:JubOolP3gh0HpiBc4BLRD4YmjEjHAmIIB2aaXKkTfoE=
+github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
+github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.11.3 h1:B3W9IdWbvrUu2OYQGwvU1nZtvMQJPBKgBUuweJjLj6I=
+github.com/goccy/go-yaml v1.11.3/go.mod h1:wKnAMd44+9JAAnGQpWVEgBzGt3YuTaQ4uXoHvE4m7WU=
 github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
 github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
-github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gofrs/uuid v4.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/gofrs/uuid v4.3.1+incompatible h1:0/KbAdpx3UXAx1kEOWHJeOkpbgRFGHVgv+CFIY7dBJI=
-github.com/gofrs/uuid v4.3.1+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
+github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
-github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.0.0 h1:1n1XNM9hk7O9mnQoNBGolZvzebBQ7p93ULHRc28XJUE=
-github.com/golang-jwt/jwt/v5 v5.0.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v4 v4.5.1 h1:JdqV9zKUdtaa9gdPlywC3aeoEsR681PlKC+4F5gQgeo=
+github.com/golang-jwt/jwt/v4 v4.5.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/gddo v0.0.0-20190904175337-72a348e765d2 h1:xisWqjiKEff2B0KfFYGpCqc3M3zdTz+OHQHRc09FeYk=
 github.com/golang/gddo v0.0.0-20190904175337-72a348e765d2/go.mod h1:xEhNfoBDX1hzLm2Nf80qUvZ2sVwoMZ8d6IE2SrsQfh4=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
-github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -388,13 +313,10 @@ github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.1 h1:gK4Kx5IaGY9CD5sPJ36FHiBJ6ZXl0kilRiiCj+jdYp4=
-github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -402,27 +324,24 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-github/v27 v27.0.1 h1:sSMFSShNn4VnqCqs+qhab6TS3uQc+uVR6TD1bW6MavM=
-github.com/google/go-github/v27 v27.0.1/go.mod h1:/0Gr8pJ55COkmv+S/yPKCczSkUPIM/LnFyubufRNIS0=
 github.com/google/go-github/v38 v38.1.0 h1:C6h1FkaITcBFK7gAmq4eFzt6gbhEhk7L5z6R3Uva+po=
 github.com/google/go-github/v38 v38.1.0/go.mod h1:cStvrz/7nFr0FoENgG6GLbp53WaelXucT+BBz/3VKx4=
 github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
 github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
 github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
-github.com/google/go-tpm v0.9.0 h1:sQF6YqWMi+SCXpsmS3fd21oPy/vSddwZry4JnmltHVk=
-github.com/google/go-tpm v0.9.0/go.mod h1:FkNVkc6C+IsvDI9Jw1OveJmxGZUUaKxtrpOS47QWKfU=
+github.com/google/go-tpm v0.9.1 h1:0pGc4X//bAlmZzMKf8iz6IsDo1nYTbYJ6FZN/rg4zdM=
+github.com/google/go-tpm v0.9.1/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -430,99 +349,59 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
 github.com/google/pprof v0.0.0-20221010195024-131d412537ea h1:R3VfsTXMMK4JCWZDdxScmnTzu9n9YRsDvguLis0U/b8=
 github.com/google/pprof v0.0.0-20221010195024-131d412537ea/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
-github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
-github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
-github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY=
+github.com/gorilla/context v1.1.2 h1:WRkNAv2uoa03QNIc1A6u4O7DAGMUVoopZhkiXWA2V1o=
+github.com/gorilla/context v1.1.2/go.mod h1:KDPwT9i/MeWHiLl90fuTgrt4/wPcv75vFAZLaOOcbxM=
 github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
-github.com/gorilla/handlers v1.5.1 h1:9lRY6j8DEeeBT10CvO9hGW0gmky0BprnvDI5vfhUHH4=
-github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q=
-github.com/gorilla/mux v1.7.3 h1:gnP5JzjVOuiZD07fKKToCAOjS0yOpj/qPETTXCCS6hw=
-github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/pat v1.0.1 h1:OeSoj6sffw4/majibAY2BAUsXjNP7fEE+w30KickaL4=
-github.com/gorilla/pat v1.0.1/go.mod h1:YeAe0gNeiNT5hoiZRI4yiOky6jVdNvfO2N6Kav/HmxY=
+github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
+github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
+github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
+github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/gorilla/pat v1.0.2 h1:TDh/RulbnPxMQACcwbgMF5Bf00jaGoeYBNu+XUFuwtE=
+github.com/gorilla/pat v1.0.2/go.mod h1:ioQ7dFQ2KXmOmWLJs6vZAfRikcm2D2JyuLrL9b5wVCg=
 github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
 github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
-github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
 github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1 h1:6UKoz5ujsI55KNpsJH3UwCq3T8kKbZwNZBNPuTTje8U=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1/go.mod h1:YvJ2f6MplWDhfxiUC3KpyTy76kYUZA4W3pTv/wdKQ9Y=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0 h1:ad0vkEBuk23VJzZR9nkLVG0YAoN9coASF1GusYX6AlU=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0/go.mod h1:igFoXX2ELCW06bol23DWPB5BEWfZISOzSP5K2sbLea0=
 github.com/gtank/cryptopasta v0.0.0-20170601214702-1f550f6f2f69 h1:7xsUJsB2NrdcttQPa7JLEaGzvdbk7KvfrjgHZXOQRo0=
 github.com/gtank/cryptopasta v0.0.0-20170601214702-1f550f6f2f69/go.mod h1:YLEMZOtU+AZ7dhN9T/IpGhXVGly2bvkJQ+zxj3WeVQo=
-github.com/hashicorp/consul/api v1.20.0 h1:9IHTjNVSZ7MIwjlW3N3a7iGiykCMDpxZu8jsxFJh0yc=
-github.com/hashicorp/consul/api v1.20.0/go.mod h1:nR64eD44KQ59Of/ECwt2vUmIK2DKsDzAwTmwmLl8Wpo=
-github.com/hashicorp/consul/sdk v0.13.1 h1:EygWVWWMczTzXGpO93awkHFzfUka6hLYJ0qhETd+6lY=
-github.com/hashicorp/consul/sdk v0.13.1/go.mod h1:SW/mM4LbKfqmMvcFu8v+eiQQ7oitXEFeiBe9StxERb0=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
-github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v1.2.0 h1:La19f8d7WIlm4ogzNHB0JGqs5AUDAZ2UfCY4sJXcJdM=
-github.com/hashicorp/go-hclog v1.2.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
-github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-msgpack v0.5.3 h1:zKjpN5BK/P5lMYrLmBHdBULWbJ0XpYR+7NGzqkZzoD4=
-github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
-github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
-github.com/hashicorp/go-retryablehttp v0.7.2 h1:AcYqCvkpalPnPF2pn0KamgwamS42TqUDDYFRKq/RAd0=
-github.com/hashicorp/go-retryablehttp v0.7.2/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
-github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
-github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
-github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
-github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.2.1 h1:zEfKbn2+PDgroKdiOzqiE8rsmLqU2uwi5PB5pBJ3TkI=
-github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
+github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/mdns v1.0.4/go.mod h1:mtBihi+LeNXGtG8L9dX59gAEa12BDtBQSp4v/YAJqrc=
-github.com/hashicorp/memberlist v0.5.0 h1:EtYPN8DpAURiapus508I4n9CzHs2W+8NZGbmmR/prTM=
-github.com/hashicorp/memberlist v0.5.0/go.mod h1:yvyXLpo0QaGE59Y7hDTsTzDD25JYBZ4mHgHUZ8lrOI0=
-github.com/hashicorp/serf v0.10.1 h1:Z1H2J60yRKvfDYAOZLd2MU0ND4AH/WDz7xYHDWQsIPY=
-github.com/hashicorp/serf v0.10.1/go.mod h1:yL2t6BqATOLGc5HF7qbFkTfXoPIY0WZdWHfEvMqbG+4=
 github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4=
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
+github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/ian-kent/envconf v0.0.0-20141026121121-c19809918c02 h1:dU8zq210pt1b71X8xh9GOxC7uBHNtQ9BYC+Lb6SA/mA=
 github.com/ian-kent/envconf v0.0.0-20141026121121-c19809918c02/go.mod h1:1m5fo3aKG2moYtGHC4I2nFkXmG97+vCeaEIWC+mXTSI=
 github.com/ian-kent/go-log v0.0.0-20160113211217-5731446c36ab h1:OgrFrYWlVzY7Tc8rq7Y4ErlKo28igc70gbfJGTVWTJk=
@@ -532,109 +411,72 @@ github.com/ian-kent/goose v0.0.0-20141221090059-c3541ea826ad/go.mod h1:VHyJj0/IJ
 github.com/ian-kent/linkio v0.0.0-20170807205755-97566b872887 h1:LPaZmcRJS13h+igi07S26uKy0qxCa76u1+pArD+JGrY=
 github.com/ian-kent/linkio v0.0.0-20170807205755-97566b872887/go.mod h1:aE63iKqF9rMrshaEiYZroUYFZLaYoTuA7pBMsg3lJoY=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20210905161508-09a460cdf81d/go.mod h1:aYm2/VgdVmcIU8iMfdMvDMsRAQjcfZSKFby6HOFvi/w=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
-github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
+github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf h1:FtEj8sfIcaaBfAKrE1Cwb61YDtYq9JxChK1c7AKce7s=
 github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf/go.mod h1:yrqSXGoD/4EKfF26AOGzscPOgTTJcyAwM2rpixWT+t4=
-github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
 github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
 github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
 github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
-github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
-github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
-github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
-github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
-github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
-github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
-github.com/jackc/pgconn v1.13.0/go.mod h1:AnowpAqO4CMIIJNZl2VJp+KrkAZciAkhEl0W0JIobpI=
 github.com/jackc/pgconn v1.14.3 h1:bVoTr12EGANZz66nZPkMInAV/KHD2TxH9npjXXgiB3w=
 github.com/jackc/pgconn v1.14.3/go.mod h1:RZbme4uasqzybK2RK5c65VsHxoyaml09lx3tXOcO/VM=
 github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
 github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
-github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
-github.com/jackc/pgmock v0.0.0-20201204152224-4fe30f7445fd/go.mod h1:hrBW0Enj2AZTNpt/7Y5rr2xe/9Mn757Wtb2xeBzPv2c=
 github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65 h1:DadwsjnMwFjfWc9y5Wi/+Zz7xoE5ALHsRQlOctkOiHc=
 github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65/go.mod h1:5R2h2EEX+qri8jOWMbJCtaPWkrrNc7OHwsp2TCqp7ak=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
-github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
-github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
-github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
-github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
-github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.3.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.3.3 h1:1HLSx5H+tXR9pW3in3zaztoEwQYRC9SQaYUHjTSUOag=
 github.com/jackc/pgproto3/v2 v2.3.3/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
-github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
-github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
-github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
-github.com/jackc/pgtype v1.12.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
 github.com/jackc/pgtype v1.14.0 h1:y+xUdabmyMkJLyApYuPj38mW+aAIqCe5uuBB51rH3Vw=
 github.com/jackc/pgtype v1.14.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
-github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
-github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
-github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
-github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
-github.com/jackc/pgx/v4 v4.17.2/go.mod h1:lcxIZN44yMIrWI78a5CpucdD14hX0SBDbNRvjDBItsw=
 github.com/jackc/pgx/v4 v4.18.2 h1:xVpYkNR5pk5bMCZGfClbO962UIqVABcAGt7ha1s/FeU=
 github.com/jackc/pgx/v4 v4.18.2/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
-github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle/v2 v2.1.2 h1:0f7vaaXINONKTsxYDn4otOAiJanX/BMeAtY//BXqzlg=
-github.com/jackc/puddle/v2 v2.1.2/go.mod h1:2lpufsF5mRHO6SuZkm0fNYxM6SWHfvyFj62KwNzgels=
+github.com/jackc/pgx/v5 v5.6.0 h1:SWJzexBzPL5jb0GEsrPMLIsi/3jOo7RHlzTjcAeDrPY=
+github.com/jackc/pgx/v5 v5.6.0/go.mod h1:DNZ/vlrUnhWCoFGxHAG8U2ljioxukquj7utPDgtQdTw=
+github.com/jackc/pgx/v5 v5.7.2 h1:mLoDLV6sonKlvjIEsV56SkWNCnuNv531l94GaIzO+XI=
+github.com/jackc/pgx/v5 v5.7.2/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
+github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
+github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jandelgado/gcov2lcov v1.0.5 h1:rkBt40h0CVK4oCb8Dps950gvfd1rYvQ8+cWa346lVU0=
 github.com/jandelgado/gcov2lcov v1.0.5/go.mod h1:NnSxK6TMlg1oGDBfGelGbjgorT5/L3cchlbtgFYZSss=
-github.com/jarcoal/httpmock v1.0.5 h1:cHtVEcTxRSX4J0je7mWPfc9BpDpqzXSJ5HbymZmyHck=
-github.com/jarcoal/httpmock v1.0.5/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
+github.com/jarcoal/httpmock v1.3.1 h1:iUx3whfZWVf3jT01hQTO/Eo5sAYtB2/rqaUuOtpInww=
+github.com/jarcoal/httpmock v1.3.1/go.mod h1:3yb8rc4BI7TCBhFY8ng0gjuLKJNquuDNiPaZjnENuYg=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jessevdk/go-flags v1.5.0 h1:1jKYvbxEjfUl0fmqTCOfonvskHHXMjBySTLW4y9LFvc=
 github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
-github.com/jinzhu/copier v0.3.5 h1:GlvfUwHk62RokgqVNvYsku0TATCF7bAHVwEXoBh3iJg=
-github.com/jinzhu/copier v0.3.5/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
-github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
 github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
-github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
-github.com/joho/godotenv v1.4.0 h1:3l4+N6zfMWnkbPEXKng2o2/MR5mSwTrBih4ZEkkz1lg=
+github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
+github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
 github.com/joho/godotenv v1.4.0/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
+github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/jteeuwen/go-bindata v3.0.7+incompatible h1:91Uy4d9SYVr1kyTJ15wJsog+esAZZl7JmEfTkwmhJts=
-github.com/jteeuwen/go-bindata v3.0.7+incompatible/go.mod h1:JVvhzYOiGBnFSYRyV00iY8q7/0PThjIYav1p9h5dmKs=
 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
-github.com/karrick/godirwalk v1.8.0/go.mod h1:H5KPZjojv4lE+QYImBI8xVtrBRgYrIVsaRPx4tDPEn4=
-github.com/karrick/godirwalk v1.10.3/go.mod h1:RoGL9dQei4vP9ilrpETWE8CLOZ1kiN0LhBygSwrAsHA=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
 github.com/knadh/koanf/maps v0.1.1 h1:G5TjmUh2D7G2YWf5SQQqSiHRJEjaicvU0KpypqB3NIs=
 github.com/knadh/koanf/maps v0.1.1/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
 github.com/knadh/koanf/parsers/json v0.1.0 h1:dzSZl5pf5bBcW0Acnu20Djleto19T0CfHcvZ14NJ6fU=
@@ -650,9 +492,7 @@ github.com/knadh/koanf/providers/rawbytes v0.1.0/go.mod h1:mMTB1/IcJ/yE++A2iEZbY
 github.com/knadh/koanf/v2 v2.0.1 h1:1dYGITt1I23x8cfx8ZnldtezdyaZtfAuRtIFOiRzK7g=
 github.com/knadh/koanf/v2 v2.0.1/go.mod h1:ZeiIlIDXTE7w1lMT6UVcNiRAS2/rCeLn/GdLNvY1Dus=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
@@ -660,37 +500,33 @@ github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NB
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/laher/mergefs v0.1.2-0.20230223191438-d16611b2f4e7 h1:PDeBswTUsSIT4QSrzLvlqKlGrANYa7TrXUwdBN9myU8=
 github.com/laher/mergefs v0.1.2-0.20230223191438-d16611b2f4e7/go.mod h1:FSY1hYy94on4Tz60waRMGdO1awwS23BacqJlqf9lJ9Q=
-github.com/leodido/go-urn v1.2.0 h1:hpXL4XnriNwQ/ABnpepYM/1vCLWNDfUNts8dX3xTG6Y=
-github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/lestrrat-go/backoff/v2 v2.0.8 h1:oNb5E5isby2kiro9AgdHLv5N5tint1AnDVVf2E2un5A=
 github.com/lestrrat-go/backoff/v2 v2.0.8/go.mod h1:rHP/q/r9aT27n24JQLa7JhSQZCKBBOiM/uP402WwN8Y=
 github.com/lestrrat-go/blackmagic v1.0.2 h1:Cg2gVSc9h7sz9NOByczrbUvLopQmXrfFx//N+AkAr5k=
 github.com/lestrrat-go/blackmagic v1.0.2/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
 github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
 github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
-github.com/lestrrat-go/httprc v1.0.5 h1:bsTfiH8xaKOJPrg1R+E3iE/AWZr/x0Phj9PBTG/OLUk=
-github.com/lestrrat-go/httprc v1.0.5/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
+github.com/lestrrat-go/httprc v1.0.6 h1:qgmgIRhpvBqexMJjA/PmwSvhNk679oqD1RbovdCGW8k=
+github.com/lestrrat-go/httprc v1.0.6/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
 github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
 github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
 github.com/lestrrat-go/jwx v1.2.29 h1:QT0utmUJ4/12rmsVQrJ3u55bycPkKqGYuGT4tyRhxSQ=
 github.com/lestrrat-go/jwx v1.2.29/go.mod h1:hU8k2l6WF0ncx20uQdOmik/Gjg6E3/wIRtXSNFeZuB8=
-github.com/lestrrat-go/jwx/v2 v2.0.21 h1:jAPKupy4uHgrHFEdjVjNkUgoBKtVDgrQPB/h55FHrR0=
-github.com/lestrrat-go/jwx/v2 v2.0.21/go.mod h1:09mLW8zto6bWL9GbwnqAli+ArLf+5M33QLQPDggkUWM=
+github.com/lestrrat-go/jwx/v2 v2.1.1 h1:Y2ltVl8J6izLYFs54BVcpXLv5msSW4o8eXwnzZLI32E=
+github.com/lestrrat-go/jwx/v2 v2.1.1/go.mod h1:4LvZg7oxu6Q5VJwn7Mk/UwooNRnTHUpXBj2C4j3HNx0=
 github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
 github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
 github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
-github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw=
-github.com/lib/pq v1.10.7/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/luna-duclos/instrumentedsql v1.1.3 h1:t7mvC0z1jUt5A0UQ6I/0H31ryymuQRnJcWCiqV3lSAA=
 github.com/luna-duclos/instrumentedsql v1.1.3/go.mod h1:9J1njvFds+zN7y85EDhN9XNQLANWwZt2ULeIC8yMNYs=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
@@ -711,66 +547,44 @@ github.com/mailhog/smtp v1.0.1 h1:igL3N/L+pWuGCqUaje21HX3VIVnqHoVlqWO0t+wJEYE=
 github.com/mailhog/smtp v1.0.1/go.mod h1:GMrAdv1hXro38xj5dsWPAk5ZiXJHFx9t7W9Yqsk0XUM=
 github.com/mailhog/storage v1.0.1 h1:uut2nlG5hIxbsl6f8DGznPAHwQLf3/7Na2t4gmrIais=
 github.com/mailhog/storage v1.0.1/go.mod h1:4EAUf5xaEVd7c/OhvSxOOwQ66jT6q2er+BDBQ0EVrew=
-github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
-github.com/markbates/pkger v0.17.1 h1:/MKEtWqtc0mZvu9OinB9UzVN9iYCwLWuyUv4Bw+PCno=
-github.com/markbates/pkger v0.17.1/go.mod h1:0JoVlrol20BSywW79rN3kdFFsE5xYM+rSCQDXbLhiuI=
-github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
-github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
 github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-sqlite3 v1.14.16 h1:yOQRA0RpS5PFz/oikGwBEqvAWhWg5ufRz4ETLjwpU1Y=
-github.com/mattn/go-sqlite3 v1.14.16/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
-github.com/mattn/goveralls v0.0.7 h1:vzy0i4a2iDzEFMdXIxcanRadkr0FBvSBKUmj0P8SPlQ=
-github.com/mattn/goveralls v0.0.7/go.mod h1:h8b4ow6FxSPMQHF6o2ve3qsclnffZjYTNEKmLesRwqw=
+github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/goveralls v0.0.12 h1:PEEeF0k1SsTjOBQ8FOmrOAoCu4ytuMaWCnWe94zxbCg=
+github.com/mattn/goveralls v0.0.12/go.mod h1:44ImGEUfmqH8bBtaMrYKsM65LXfNLWmwaxFGjZwgMSQ=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
 github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/maxatome/go-testdeep v1.12.0 h1:Ql7Go8Tg0C1D/uMMX59LAoYK7LffeJQ6X2T04nTH68g=
+github.com/maxatome/go-testdeep v1.12.0/go.mod h1:lPZc/HAcJMP92l7yI6TRz1aZN5URwUBUAfUNvrclaNM=
 github.com/microcosm-cc/bluemonday v1.0.20/go.mod h1:yfBmMi8mxvaZut3Yytv+jTXRY8mxyjJ0/kQBTElld50=
-github.com/microcosm-cc/bluemonday v1.0.21 h1:dNH3e4PSyE4vNX+KlRGHT5KrSvjeUkoNPwEORjffHJg=
-github.com/microcosm-cc/bluemonday v1.0.21/go.mod h1:ytNkv4RrDrLJ2pqlsSI46O6IVXmZOBBD4SaJyDwwTkM=
-github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
-github.com/miekg/dns v1.1.41 h1:WMszZWJG0XmzbK9FEmzH2TVcqYzFesusSIB41b8KHxY=
-github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/mikefarah/yq/v4 v4.19.1 h1:QrZCqjOBZ918aOZIfl/IwnHBv104SPfarhgO5MGd2W4=
-github.com/mikefarah/yq/v4 v4.19.1/go.mod h1:krTElh9V1fv3Cw7+21S8El/W/vn3f2buOOcJ4VyjsFY=
-github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
+github.com/microcosm-cc/bluemonday v1.0.22/go.mod h1:ytNkv4RrDrLJ2pqlsSI46O6IVXmZOBBD4SaJyDwwTkM=
+github.com/microcosm-cc/bluemonday v1.0.26 h1:xbqSvqzQMeEHCqMi64VAs4d8uy6Mequs3rQ0k/Khz58=
+github.com/microcosm-cc/bluemonday v1.0.26/go.mod h1:JyzOCs9gkyQyjs+6h10UEVSe02CGwkhd72Xdqh78TWs=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
-github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae h1:O4SWKdcHVCvYqyDV+9CJA1fcDN2L11Bule0iFy3YlAI=
-github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
@@ -784,9 +598,8 @@ github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/nyaruka/phonenumbers v1.3.6 h1:33owXWp4d1U+Tyaj9fpci6PbvaQZcXBUO2FybeKeLwQ=
-github.com/nyaruka/phonenumbers v1.3.6/go.mod h1:Ut+eFwikULbmCenH6InMKL9csUNLyxHuBLyfkpum11s=
+github.com/nyaruka/phonenumbers v1.4.1 h1:dNsiYGirahC2lMRz3p2dxmmyLbzD3arCgmj/hPEVRPY=
+github.com/nyaruka/phonenumbers v1.4.1/go.mod h1:gv+CtldaFz+G3vHHnasBSirAi3O2XLqZzVWz4V1pl2E=
 github.com/ogier/pflag v0.0.1 h1:RW6JSWSu/RkSatfcLtogGfFgpim5p7ARQ10ECk5O750=
 github.com/ogier/pflag v0.0.1/go.mod h1:zkFki7tvTa0tafRvTBIZTvzYyAu6kQhPZFnshFFPE+g=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
@@ -800,24 +613,26 @@ github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
 github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc2 h1:2zx/Stx4Wc5pIPDvIxHXvXtQFW/7XWJGmnM7r3wg034=
-github.com/opencontainers/image-spec v1.1.0-rc2/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
-github.com/opencontainers/runc v1.1.12 h1:BOIssBaW1La0/qbNZHXOOa71dZfZEQOzW7dqQf3phss=
-github.com/opencontainers/runc v1.1.12/go.mod h1:S+lQwSfncpBha7XTy/5lBwWgm5+y5Ma/O44Ekby9FK8=
-github.com/openzipkin/zipkin-go v0.4.2 h1:zjqfqHjUpPmB3c1GlCvvgsM1G4LkvqQbBDueDOCg/jA=
-github.com/openzipkin/zipkin-go v0.4.2/go.mod h1:ZeVkFjuuBiSy13y8vpSDCjMi9GoI3hPpCJSBx/EYFhY=
+github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
+github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/runc v1.1.14 h1:rgSuzbmgz5DUJjeSnw337TxDbRuqjs6iqQck/2weR6w=
+github.com/opencontainers/runc v1.1.14/go.mod h1:E4C2z+7BxR7GHXp0hAY53mek+x49X1LjPNeMTfRGvOA=
+github.com/openzipkin/zipkin-go v0.4.3 h1:9EGwpqkgnwdEIJ+Od7QVSEIH+ocmm5nPat0G7sjsSdg=
+github.com/openzipkin/zipkin-go v0.4.3/go.mod h1:M9wCJZFWCo2RiY+o1eBCEMe0Dp2S5LDHcMZmk3RmK7c=
 github.com/ory/analytics-go/v5 v5.0.1 h1:LX8T5B9FN8KZXOtxgN+R3I4THRRVB6+28IKgKBpXmAM=
 github.com/ory/analytics-go/v5 v5.0.1/go.mod h1:lWCiCjAaJkKfgR/BN5DCLMol8BjKS1x+4jxBxff/FF0=
-github.com/ory/dockertest/v3 v3.9.1 h1:v4dkG+dlu76goxMiTT2j8zV7s4oPPEppKT8K8p2f1kY=
-github.com/ory/dockertest/v3 v3.9.1/go.mod h1:42Ir9hmvaAPm0Mgibk6mBPi7SFvTXxEcnztDYOJ//uM=
+github.com/ory/dockertest/v3 v3.11.0 h1:OiHcxKAvSDUwsEVh2BjxQQc/5EHz9n0va9awCtNGuyA=
+github.com/ory/dockertest/v3 v3.11.0/go.mod h1:VIPxS1gwT9NpPOrfD3rACs8Y9Z7yhzO4SB194iUDnUI=
 github.com/ory/go-acc v0.2.9-0.20230103102148-6b1c9a70dbbe h1:rvu4obdvqR0fkSIJ8IfgzKOWwZ5kOT2UNfLq81Qk7rc=
 github.com/ory/go-acc v0.2.9-0.20230103102148-6b1c9a70dbbe/go.mod h1:z4n3u6as84LbV4YmgjHhnwtccQqzf4cZlSk9f1FhygI=
+github.com/ory/go-oidc/v3 v3.0.0-20241127113405-e5362711266b h1:PHfiybEhBiabSpPAD5Vq8BotzBrvCUgZN3OrAy3w5u8=
+github.com/ory/go-oidc/v3 v3.0.0-20241127113405-e5362711266b/go.mod h1:Jxfv2TPRvdJuLfmkvokss8dkguhMmer2UvARU6SWy0Y=
 github.com/ory/graceful v0.1.4-0.20230301144740-e222150c51d0 h1:VMUeLRfQD14fOMvhpYZIIT4vtAqxYh+f3KnSqCeJ13o=
 github.com/ory/graceful v0.1.4-0.20230301144740-e222150c51d0/go.mod h1:hg2iCy+LCWOXahBZ+NQa4dk8J2govyQD79rrqrgMyY8=
 github.com/ory/herodot v0.10.3-0.20230626083119-d7e5192f0d88 h1:J0CIFKdpUeqKbVMw7pQ1qLtUnflRM1JWAcOEq7Hp4yg=
 github.com/ory/herodot v0.10.3-0.20230626083119-d7e5192f0d88/go.mod h1:MMNmY6MG1uB6fnXYFaHoqdV23DTWctlPsmRCeq/2+wc=
-github.com/ory/hydra-client-go/v2 v2.2.0-rc.3.0.20240202131107-1c7b57df3bb0 h1:D5w0EQBqZU5UcdW0iLTxqbBiEAhOwT2cWHWE6vjxJ3o=
-github.com/ory/hydra-client-go/v2 v2.2.0-rc.3.0.20240202131107-1c7b57df3bb0/go.mod h1:JwnnsLd402LPTmIA+EDMsu5Nwr6IRl777pE0QvOq66c=
+github.com/ory/hydra-client-go/v2 v2.2.1 h1:m1821pIX6ybG/3oSAn2wtrbBKNwe9q5A8fLljYuLpBk=
+github.com/ory/hydra-client-go/v2 v2.2.1/go.mod h1:K83R+iK40+5uF2uQ34yRUrf9izRvFsza9pG2Se5qMmk=
 github.com/ory/jsonschema/v3 v3.0.8 h1:Ssdb3eJ4lDZ/+XnGkvQS/te0p+EkolqwTsDOCxr/FmU=
 github.com/ory/jsonschema/v3 v3.0.8/go.mod h1:ZPzqjDkwd3QTnb2Z6PAS+OTvBE2x5i6m25wCGx54W/0=
 github.com/ory/mail v2.3.1+incompatible/go.mod h1:87D9/1gB6ewElQoN0lXJ0ayfqcj3cW3qCTXh+5E9mfU=
@@ -825,26 +640,22 @@ github.com/ory/mail/v3 v3.0.0 h1:8LFMRj473vGahFD/ntiotWEd4S80FKYFtiZTDfOQ+sM=
 github.com/ory/mail/v3 v3.0.0/go.mod h1:JGAVeZF8YAlxbaFDUHqRZAKBCSeW2w1vuxf28hFbZAw=
 github.com/ory/nosurf v1.2.7 h1:YrHrbSensQyU6r6HT/V5+HPdVEgrOTMJiLoJABSBOp4=
 github.com/ory/nosurf v1.2.7/go.mod h1:d4L3ZBa7Amv55bqxCBtCs63wSlyaiCkWVl4vKf3OUxA=
+github.com/ory/pop/v6 v6.2.1-0.20241121111754-e5dfc0f3344b h1:BIzoOe2/wynZBQak1po0tzgvARseIKsR2bF6b+SZoKE=
+github.com/ory/pop/v6 v6.2.1-0.20241121111754-e5dfc0f3344b/go.mod h1:okVAYKGtgunD/wbW3NGhZTndJCS+6FqO+cA89rQ4doc=
 github.com/ory/sessions v1.2.2-0.20220110165800-b09c17334dc2 h1:zm6sDvHy/U9XrGpixwHiuAwpp0Ock6khSVHkrv6lQQU=
 github.com/ory/sessions v1.2.2-0.20220110165800-b09c17334dc2/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
-github.com/ory/x v0.0.623 h1:sFJiw2i/itTkBRJbhGXtrso9NcdscnjFlHBFitCzf8A=
-github.com/ory/x v0.0.623/go.mod h1:CUw8/O3X8lUMheyV0iH+6LQ0tePrH+FBsW39MccCHgw=
-github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
-github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pelletier/go-toml v1.7.0/go.mod h1:vwGMzjaWMwyfHwgIBhI2YUM4fB6nL6lVAvS1LBMMhTE=
+github.com/ory/x v0.0.675 h1:K6GpVo99BXBFv2UiwMjySNNNqCFKGswynrt7vWQJFU8=
+github.com/ory/x v0.0.675/go.mod h1:zJmnDtKje2FCP4EeFvRsKk94XXiqKCSGJMZcirAfhUs=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.0.8 h1:0ctb6s9mE31h0/lhu+J6OPmVeDxJn+kYnJc2jZR9tGQ=
-github.com/pelletier/go-toml/v2 v2.0.8/go.mod h1:vuYfssBdrU2XDZ9bYydBu6t+6a6PYNcZljzZR9VXg+4=
+github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
+github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
 github.com/peterhellberg/link v1.2.0 h1:UA5pg3Gp/E0F2WdX7GERiNrPQrM1K6CVJUUWfHa4t6c=
 github.com/peterhellberg/link v1.2.0/go.mod h1:gYfAh+oJgQu2SrZHg5hROVRQe1ICoK0/HHJTcE0edxc=
-github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2 h1:JhzVVoYvbOACxoUmOs6V/G4D5nPVUW73rKvXxP4XUJc=
-github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
-github.com/philhofer/fwd v1.1.2 h1:bnDivRJ1EWPjUIRXV5KfORO897HTbpFAQddBdE8t7Gw=
-github.com/philhofer/fwd v1.1.2/go.mod h1:qkPdfjR2SIEbspLqpe1tO4n5yICnr2DY7mqEx2tUTP0=
-github.com/pkg/diff v0.0.0-20200914180035-5b29258ca4f7/go.mod h1:zO8QMzTeZd5cpnIkz/Gn6iK0jDfGicM1nynOkkPIl28=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgcC4zIxODThtZNPirFr42+A=
+github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 h1:Ii+DKncOVM8Cu1Hc+ETb5K+23HdAMvESYE3ZJ5b5cMI=
+github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
+github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986 h1:jYi87L8j62qkXzaYHAQAhEapgukhenIMZRBKTNRLHJ4=
+github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -852,16 +663,13 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
 github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
-github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
 github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
@@ -874,7 +682,6 @@ github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6T
 github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
 github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
 github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
@@ -882,7 +689,6 @@ github.com/prometheus/common v0.37.0 h1:ccBbHCgIiT9uSoFY0vX8H3zsNR5eLt17/RQLUvn8
 github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
@@ -890,28 +696,22 @@ github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5
 github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
 github.com/rakutentech/jwk-go v1.1.3 h1:PiLwepKyUaW+QFG3ki78DIO2+b4IVK3nMhlxM70zrQ4=
 github.com/rakutentech/jwk-go v1.1.3/go.mod h1:LtzSv4/+Iti1nnNeVQiP6l5cI74GBStbhyXCYvgPZFk=
-github.com/rjeczalik/notify v0.0.0-20181126183243-629144ba06a1 h1:FLWDC+iIP9BWgYKvWKKtOUZux35LIQNAuIzp/63RQJU=
-github.com/rjeczalik/notify v0.0.0-20181126183243-629144ba06a1/go.mod h1:aErll2f0sUX9PXZnVNyeiObbmTlk5jnMoCa4QEjJeqM=
-github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.2.2/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rjeczalik/notify v0.9.3 h1:6rJAzHTGKXGj76sbRgDiDcYj/HniypXmSJo1SWakZeY=
+github.com/rjeczalik/notify v0.9.3/go.mod h1:gF3zSOrafR9DQEWSE8TjfI9NkooDxbyT4UgRGKZA0lc=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
-github.com/rs/cors v1.8.2 h1:KCooALfAYGs415Cwu5ABvv9n9509fSiG5SQJn/AQo4U=
-github.com/rs/cors v1.8.2/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
-github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
-github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
-github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/rs/cors v1.11.0 h1:0B9GE/r9Bc2UxRMMtymBkHTenPkHDv0CW4Y98GBY+po=
+github.com/rs/cors v1.11.0/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/samber/lo v1.37.0 h1:XjVcB8g6tgUp8rsPsJ2CvhClfImrpL04YpQHXeHPhRw=
-github.com/samber/lo v1.37.0/go.mod h1:9vaz2O4o8oOnK23pd2TrXufcbdbJIa3b6cstBWKpopA=
-github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
-github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
+github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
+github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
+github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
+github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
+github.com/samber/lo v1.46.0 h1:w8G+oaCPgz1PoCJztqymCFaKwXt+5cCXn51uPxExFfQ=
+github.com/samber/lo v1.46.0/go.mod h1:RmDH9Ct32Qy3gduHQuKJ3gW1fMHAnE/fAzQuf6He5cU=
 github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761 h1:0b8DF5kR0PhRoRXDiEEdzrgBc8UqVY4JWLkQJCRsLME=
 github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761/go.mod h1:/THDZYi7F/BsVEcYzYPqdcWFQ+1C2InkawTKfLOAnzg=
 github.com/segmentio/analytics-go v3.1.0+incompatible/go.mod h1:C7CYBtQWk4vRk2RyLu0qOcbHJ18E3F1HV2C/8JvKN48=
@@ -923,22 +723,19 @@ github.com/segmentio/backo-go v1.0.1/go.mod h1:9/Rh6yILuLysoQnZ2oNooD2g7aBnvM7r/
 github.com/segmentio/conf v1.2.0/go.mod h1:Y3B9O/PqqWqjyxyWWseyj/quPEtMu1zDp/kVbSWWaB0=
 github.com/segmentio/go-snakecase v1.1.0/go.mod h1:jk1miR5MS7Na32PZUykG89Arm+1BUSYhuGR6b7+hJto=
 github.com/segmentio/objconv v1.0.1/go.mod h1:auayaH5k3137Cl4SoXTgrzQcuQDmvuVtZgS0fb1Ahys=
-github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
 github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.4.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/slack-go/slack v0.7.4 h1:Z+7CmUDV+ym4lYLA4NNLFIpr3+nDgViHrx8xsuXgrYs=
-github.com/slack-go/slack v0.7.4/go.mod h1:FGqNzJBmxIsZURAxh2a8D21AnOVvvXZvGligs4npPUM=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/slack-go/slack v0.13.1 h1:6UkM3U1OnbhPsYeb1IMkQ6HSNOSikWluwOncJt4Tz/o=
+github.com/slack-go/slack v0.13.1/go.mod h1:hlGi5oXA+Gt+yWTPP0plCdRKmjsDxecdHxYQdlMQKOw=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.0.0 h1:UVQPSSmc3qtTi+zPPkCXvZX9VvW/xT/NsRvKfwY81a8=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
@@ -946,29 +743,23 @@ github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIK
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d h1:yKm7XZV6j9Ev6lojP2XaIshpT4ymkqhMeSghO5Ps00E=
 github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d/go.mod h1:UdhH50NIW0fCiwBSr0co2m7BnFLdv4fQTgdqdJTHFeE=
+github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
+github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e h1:qpG93cPwA5f7s/ZPBJnGOYQNK/vKsaDaseuKT5Asee8=
 github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e/go.mod h1:HuIsMU8RRBOtsCgI77wP899iHVBQpCmg4ErYMZB+2IA=
-github.com/spf13/afero v1.9.5 h1:stMpOSZFs//0Lv29HduCmli3GUfpFoF3Y1Q/aXj/wVM=
-github.com/spf13/afero v1.9.5/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
+github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
+github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
-github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN48=
-github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
-github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
-github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
-github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
-github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
-github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
+github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.16.0 h1:rGGH0XDZhdUOryiDWjmIvUSWpbNqisK8Wk0Vyefw8hc=
-github.com/spf13/viper v1.16.0/go.mod h1:yg78JgCJcbrQOvV9YLXgkLaZqUidkY9K+Dd1FofRzQg=
-github.com/sqs/goreturns v0.0.0-20181028201513-538ac6014518 h1:iD+PFTQwKEmbwSdwfvP5ld2WEI/g7qbdhmHJ2ASfYGs=
-github.com/sqs/goreturns v0.0.0-20181028201513-538ac6014518/go.mod h1:CKI4AZ4XmGV240rTHfO0hfE83S6/a3/Q1siZJ/vXf7A=
+github.com/spf13/viper v1.18.2 h1:LUXCnvUvSM6FXAsj6nnfc8Q2tp1dIgUfY9Kc8GsSOiQ=
+github.com/spf13/viper v1.18.2/go.mod h1:EKmWIqdnk5lOcmR72yw6hS+8OPYcwD0jteitLMVB+yk=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
@@ -982,43 +773,33 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
-github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/t-k/fluent-logger-golang v1.0.0 h1:4IQzY+/l66Zkkhk9eB3LwF9vPkgKHJ1rpYdrRiap0EI=
 github.com/t-k/fluent-logger-golang v1.0.0/go.mod h1:6vC3Vzp9Kva0l5J9+YDY5/ROePwkAqwLK+KneCjSm4w=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.14.3 h1:9jvXn7olKEHU1S9vwoMGliaT8jq1vJ7IH/n9zD9Dnlw=
-github.com/tidwall/gjson v1.14.3/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.17.3 h1:bwWLZU7icoKRG+C+0PNwIKC6FCJO/Q3p2pZvuP0jN94=
+github.com/tidwall/gjson v1.17.3/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
-github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
 github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
-github.com/timtadh/data-structures v0.5.3 h1:F2tEjoG9qWIyUjbvXVgJqEOGJPMIiYn7U5W5mE+i/vQ=
-github.com/timtadh/data-structures v0.5.3/go.mod h1:9R4XODhJ8JdWFEI8P/HJKqxuJctfBQw6fDibMQny2oU=
-github.com/timtadh/lexmachine v0.2.2 h1:g55RnjdYazm5wnKv59pwFcBJHOyvTPfDEoz21s4PHmY=
-github.com/timtadh/lexmachine v0.2.2/go.mod h1:GBJvD5OAfRn/gnp92zb9KTgHLB7akKyxmVivoYCcjQI=
-github.com/tinylib/msgp v1.1.8 h1:FCXC1xanKO4I8plpHGH2P7koL/RzZs12l/+r7vakfm0=
-github.com/tinylib/msgp v1.1.8/go.mod h1:qkpG+2ldGg4xRFmx+jfTvZPxfGFhi64BcnL9vkCm/Tw=
+github.com/tinylib/msgp v1.2.0 h1:0uKB/662twsVBpYUPbokj4sTSKhWFKB7LopO2kWK8lY=
+github.com/tinylib/msgp v1.2.0/go.mod h1:2vIGs3lcUo8izAATNobrCHevYZC/LMsJtw4JPiYPHro=
 github.com/toqueteos/webbrowser v1.2.0 h1:tVP/gpK69Fx+qMJKsLE7TD8LuGWPnEV71wBN9rrstGQ=
 github.com/toqueteos/webbrowser v1.2.0/go.mod h1:XWoZq4cyp9WeUeak7w7LXRUQf1F1ATJMir8RTqb4ayM=
-github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/urfave/negroni v1.0.0 h1:kIimOitoypq34K7TG7DUaJ9kq/N4Ofuwi1sjz0KipXc=
 github.com/urfave/negroni v1.0.0/go.mod h1:Meg73S6kFm/4PpbYdq35yYWoCZ9mS/YSx+lKnmiohz4=
+github.com/wI2L/jsondiff v0.6.0 h1:zrsH3FbfVa3JO9llxrcDy/XLkYPLgoMX6Mz3T2PP2AI=
+github.com/wI2L/jsondiff v0.6.0/go.mod h1:D6aQ5gKgPF9g17j+E9N7aasmU1O+XvfmWm1y8UMmNpw=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
-github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
-github.com/xdg-go/scram v1.1.1/go.mod h1:RaEWvsqvNKKvBPvcKeFjrG2cJqOkHTiyTpzz23ni57g=
-github.com/xdg-go/stringprep v1.0.2/go.mod h1:8F9zXuvzgwmyT5DUm4GUfZGDdT3W+LCvS6+da4O5kxM=
-github.com/xdg-go/stringprep v1.0.3/go.mod h1:W3f5j4i+9rC0kuIEJL0ky1VpHXQU3ocBgklLGvcBnW8=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
@@ -1028,97 +809,69 @@ github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xtgo/uuid v0.0.0-20140804021211-a0b114877d4c h1:3lbZUMbMiGUW/LMkfsEABsc5zNT9+b1CvsJx47JzJ8g=
 github.com/xtgo/uuid v0.0.0-20140804021211-a0b114877d4c/go.mod h1:UrdRz5enIKZ63MEE3IF9l2/ebyx59GyGgPi+tICQdmM=
-github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
-github.com/zmb3/spotify/v2 v2.4.0 h1:ZHdhBx/Qyn7rtVDP+onk/oSvtL5uVyJtb+VBLrNDC7Y=
-github.com/zmb3/spotify/v2 v2.4.0/go.mod h1:m6c3mHgZSt1rTF76UfSfdn1Gb2Kx/B/ClCcr+2V1Scw=
-go.mongodb.org/mongo-driver v1.7.3/go.mod h1:NqaYOwnXWr5Pm7AOpO5QFxKJ503nbMse/R79oO62zWg=
-go.mongodb.org/mongo-driver v1.7.5/go.mod h1:VXEWRZ6URJIkUq2SCAyapmhH0ZLRBP+FT4xhp5Zvxng=
-go.mongodb.org/mongo-driver v1.10.0/go.mod h1:wsihk0Kdgv8Kqu1Anit4sfK+22vSFbUrAVEYRhCXrA8=
-go.mongodb.org/mongo-driver v1.11.3 h1:Ql6K6qYHEzB6xvu4+AU0BoRoqf9vFPcc4o7MUIdPW8Y=
-go.mongodb.org/mongo-driver v1.11.3/go.mod h1:PTSz5yu21bkT/wXpkS7WR5f0ddqw5quethTUn9WM+2g=
+github.com/zmb3/spotify/v2 v2.4.2 h1:j3yNN5lKVEMZQItJF4MHCSZbfNWmXO+KaC+3RFaLlLc=
+github.com/zmb3/spotify/v2 v2.4.2/go.mod h1:XOV7BrThayFYB9AAfB+L0Q0wyxBuLCARk4fI/ZXCBW8=
+go.mongodb.org/mongo-driver v1.14.0 h1:P98w8egYRjYe3XDjxhYJagTokP/H6HzlsnojRgZRd80=
+go.mongodb.org/mongo-driver v1.14.0/go.mod h1:Vzb0Mk/pa7e6cWw85R4F/endUC3u0U9jGcNU603k65c=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.47.0 h1:rw+yB4sMhufNzbVHGG9SDMSrw1CKSnRqfjJnMpAH4dE=
-go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.47.0/go.mod h1:2NonlJyJNVbDK/hCwiLsu5gsD2bVtmIzQ/tGzWq58us=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 h1:sv9kVfal0MK0wBMCOGr+HeJm9v803BkJxGrk2au7j08=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
-go.opentelemetry.io/contrib/propagators/b3 v1.21.0 h1:uGdgDPNzwQWRwCXJgw/7h29JaRqcq9B87Iv4hJDKAZw=
-go.opentelemetry.io/contrib/propagators/b3 v1.21.0/go.mod h1:D9GQXvVGT2pzyTfp1QBOnD1rzKEWzKjjwu5q2mslCUI=
-go.opentelemetry.io/contrib/propagators/jaeger v1.21.1 h1:f4beMGDKiVzg9IcX7/VuWVy+oGdjx3dNJ72YehmtY5k=
-go.opentelemetry.io/contrib/propagators/jaeger v1.21.1/go.mod h1:U9jhkEl8d1LL+QXY7q3kneJWJugiN3kZJV2OWz3hkBY=
-go.opentelemetry.io/contrib/samplers/jaegerremote v0.15.1 h1:Qb+5A+JbIjXwO7l4HkRUhgIn4Bzz0GNS2q+qdmSx+0c=
-go.opentelemetry.io/contrib/samplers/jaegerremote v0.15.1/go.mod h1:G4vNCm7fRk0kjZ6pGNLo5SpLxAUvOfSrcaegnT8TPck=
-go.opentelemetry.io/otel v1.22.0 h1:xS7Ku+7yTFvDfDraDIJVpw7XPyuHlB9MCiqqX5mcJ6Y=
-go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.57.0 h1:7F3XCD6WYzDkwbi8I8N+oYJWquPVScnRosKGgqjsR8c=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.57.0/go.mod h1:Dk3C0BfIlZDZ5c6eVS7TYiH2vssuyUU3vUsgbrR+5V4=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0 h1:DheMAlT6POBP+gh8RUH19EOTnQIor5QE0uSRPtzCpSw=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0/go.mod h1:wZcGmeVO9nzP67aYSLDqXNWK87EZWhi7JWj1v7ZXf94=
+go.opentelemetry.io/contrib/propagators/b3 v1.32.0 h1:MazJBz2Zf6HTN/nK/s3Ru1qme+VhWU5hm83QxEP+dvw=
+go.opentelemetry.io/contrib/propagators/b3 v1.32.0/go.mod h1:B0s70QHYPrJwPOwD1o3V/R8vETNOG9N3qZf4LDYvA30=
+go.opentelemetry.io/contrib/propagators/jaeger v1.32.0 h1:K/fOyTMD6GELKTIJBaJ9k3ppF2Njt8MeUGBOwfaWXXA=
+go.opentelemetry.io/contrib/propagators/jaeger v1.32.0/go.mod h1:ISE6hda//MTWvtngG7p4et3OCngsrTVfl7c6DjN17f8=
+go.opentelemetry.io/contrib/samplers/jaegerremote v0.26.0 h1:/SKXyZLAnuj981HVc8G5ZylYK3qD2W6AYR6cJx5kIHw=
+go.opentelemetry.io/contrib/samplers/jaegerremote v0.26.0/go.mod h1:cOEzME0M2OKeHB45lJiOKfvUCdg/r75mf7YS5w0tbmE=
+go.opentelemetry.io/otel v1.32.0 h1:WnBN+Xjcteh0zdk01SVqV55d/m62NJLJdIyb4y/WO5U=
+go.opentelemetry.io/otel v1.32.0/go.mod h1:00DCVSB0RQcnzlwyTfqtxSm+DRr9hpYrHjNGiBHVQIg=
 go.opentelemetry.io/otel/exporters/jaeger v1.17.0 h1:D7UpUy2Xc2wsi1Ras6V40q806WM07rqoCWzXu7Sqy+4=
 go.opentelemetry.io/otel/exporters/jaeger v1.17.0/go.mod h1:nPCqOnEH9rNLKqH/+rrUjiMzHJdV1BlpKcTwRTyKkKI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 h1:digkEZCJWobwBqMwC0cwCq8/wkkRy/OowZg5OArWZrM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0/go.mod h1:/OpE/y70qVkndM0TrxT4KBoN3RsFZP0QaofcfYrj76I=
-go.opentelemetry.io/otel/exporters/zipkin v1.21.0 h1:D+Gv6lSfrFBWmQYyxKjDd0Zuld9SRXpIrEsKZvE4DO4=
-go.opentelemetry.io/otel/exporters/zipkin v1.21.0/go.mod h1:83oMKR6DzmHisFOW3I+yIMGZUTjxiWaiBI8M8+TU5zE=
-go.opentelemetry.io/otel/metric v1.22.0 h1:lypMQnGyJYeuYPhOM/bgjbFM6WE44W1/T45er4d8Hhg=
-go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
-go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
-go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
-go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
-go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
-go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
-go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
-go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
-go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
-go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
-go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 h1:IJFEoHiytixx8cMiVAO+GmHR6Frwu+u5Ur8njpFO6Ac=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0/go.mod h1:3rHrKNtLIoS0oZwkY2vxi+oJcwFRWdtUyRII+so45p8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0 h1:cMyu9O88joYEaI47CnQkxO1XZdpoTF9fEnW2duIddhw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0/go.mod h1:6Am3rn7P9TVVeXYG+wtcGE7IE1tsQ+bP3AuWcKt/gOI=
+go.opentelemetry.io/otel/exporters/zipkin v1.32.0 h1:6O8HgLHPXtXE9QEKEWkBImL9mEKCGEl+m+OncVO53go=
+go.opentelemetry.io/otel/exporters/zipkin v1.32.0/go.mod h1:+MFvorlowjy0iWnsKaNxC1kzczSxe71mw85h4p8yEvg=
+go.opentelemetry.io/otel/metric v1.32.0 h1:xV2umtmNcThh2/a/aCP+h64Xx5wsj8qqnkYZktzNa0M=
+go.opentelemetry.io/otel/metric v1.32.0/go.mod h1:jH7CIbbK6SH2V2wE16W05BHCtIDzauciCRLoc/SyMv8=
+go.opentelemetry.io/otel/sdk v1.32.0 h1:RNxepc9vK59A8XsgZQouW8ue8Gkb4jpWtJm9ge5lEG4=
+go.opentelemetry.io/otel/sdk v1.32.0/go.mod h1:LqgegDBjKMmb2GC6/PrTnteJG39I8/vJCAP9LlJXEjU=
+go.opentelemetry.io/otel/trace v1.32.0 h1:WIC9mYrXf8TmY/EXuULKc8hR17vE+Hjv2cssQDe03fM=
+go.opentelemetry.io/otel/trace v1.32.0/go.mod h1:+i4rkvCraA+tG6AzwloGaCtkx53Fa+L+V8e9a7YvhT8=
+go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
+go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
 go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
-go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
-go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
-go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
-go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
-go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181030102418-4d3f4d9ffa16/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
-golang.org/x/crypto v0.0.0-20190422162423-af44ce270edf/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.4.0/go.mod h1:3quD/ATkf6oY+rnes5c3ExXTbLc8mueNue5/DoinL80=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
-golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
-golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1129,8 +882,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611 h1:qCEDpW1G+vcj3Y7Fy52pEM1AWm3abj8WimGYejI3SC4=
-golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
+golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 h1:1UoZQm6f0P/ZO0w1Ri+f+ifG/gXhegadRdwBIXEFWDo=
+golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1143,7 +896,6 @@ golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
 golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
@@ -1152,14 +904,12 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB
 golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
-golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1175,8 +925,6 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -1192,17 +940,10 @@ golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210220033124-5f55cee0dc0d/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210323141857-08027d57d8cf/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
-golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
@@ -1210,31 +951,29 @@ golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfS
 golang.org/x/net v0.0.0-20221002022538-bcab6841153b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
+golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
-golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210810183815-faf39c7919d5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
-golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
+golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
+golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190412183630-56d357773e84/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1245,32 +984,24 @@ golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180926160741-c2ed4eda69e7/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190419153524-e8e3143a4f4a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190531175056-4c3a928424d2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1292,23 +1023,13 @@ golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201029080932-201ba4db2418/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210420072515-93ed5bcd2bfe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1317,58 +1038,53 @@ golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220406163625-3f8b81556e12/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
-golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20191110171634-ad39bd3f0407/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210317153231-de623e64d2a6/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.0.0-20220722155259-a9ba230a4035/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
-golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q=
-golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.4.0 h1:Z81tqI5ddIoXDPvVQ7/7CC9TnLM7ubaFG2qXYd5BbYY=
-golang.org/x/time v0.4.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
+golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1376,25 +1092,15 @@ golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3
 golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190329151228-23e29df326fe/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190416151739-9c9e1878f421/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190420181800-aa740d480789/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190531172133-b3315ee88b7d/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -1402,7 +1108,6 @@ golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
@@ -1417,36 +1122,24 @@ golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWc
 golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200522201501-cb1345f3a375/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.16.0 h1:GO788SKMRunPIBCXiQyo2AaexLstOrVhuAL5YwsckQM=
-golang.org/x/tools v0.16.0/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
-golang.org/x/tools/cmd/cover v0.1.0-deprecated h1:Rwy+mWYz6loAF+LnG1jHG/JWMHRMMC2/1XX3Ejkx9lA=
-golang.org/x/tools/cmd/cover v0.1.0-deprecated/go.mod h1:hMDiIvlpN1NoVgmjLjUJE9tMHyxHjFX7RuQ+rW12mSA=
-golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
+golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
+golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
-golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY=
+golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
@@ -1463,9 +1156,6 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
-google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1473,8 +1163,6 @@ google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
-google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -1504,19 +1192,10 @@ google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7Fc
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ=
-google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:J7XzRzVy1+IPwWHZUzoD0IccYZIrXILAQpc+Qy9CMhY=
-google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 h1:JpwMPBpFN3uKhdaekDpiNlImDdkUAyiJ6ez/uxGaUSo=
-google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17 h1:Jyp0Hsi0bmHXG6k9eATXoYtjd6e2UzZ1SCn/wIupY14=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:oQ5rr10WTTMvP4A36n8JpR1OrO1BEiV4f78CneXZxkA=
+google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 h1:M0KvPgPmDZHPlbRbaNU1APr28TvwvvdUPlSv7PUvy8g=
+google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28/go.mod h1:dguCy7UOdZhTvLzDyt15+rOrawrpM4q7DD9dQ1P11P4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 h1:XVhgTWWV3kGQlwJHR3upFWZeTsei6Oks1apkZSeonIE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1529,12 +1208,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
-google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
-google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
+google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
 google.golang.org/grpc/examples v0.0.0-20210304020650-930c79186c99 h1:qA8rMbz1wQ4DOFfM2ouD29DG9aHWBm6ZOy9BGxiUMmY=
 google.golang.org/grpc/examples v0.0.0-20210304020650-930c79186c99/go.mod h1:Ly7ZA/ARzg8fnPU9TyZIxoz33sEUuWX7txiqs8lPTgE=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
@@ -1549,9 +1224,9 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
+google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
@@ -1559,7 +1234,6 @@ gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
@@ -1567,14 +1241,11 @@ gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
 gopkg.in/go-playground/mold.v2 v2.2.0/go.mod h1:XMyyRsGtakkDPbxXbrA5VODo6bUXyvoDjLd5l3T0XoA=
-gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/mail.v2 v2.3.1/go.mod h1:htwXN1Qh09vZJ1NVKxQqHPBaCBbzKhp5GzuJEA4VJWw=
 gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22 h1:VpOs+IwYnYBaFnrNAeB8UUWtL3vEUnzSCL1nVjPhqrw=
 gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
-gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473 h1:6D+BvnJ/j6e222UW8s2qTSe3wGBtvo0MbVQG/c5k8RE=
-gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473/go.mod h1:N1eN2tsCx0Ydtgjl4cqmbRCsY4/+z4cYDeqwZTk6zog=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/validator.v2 v2.0.0-20180514200540-135c24b11c19/go.mod h1:o4V0GXN9/CAmCsvJ0oXYZvrZOe7syiDZSN1GWGZTGzc=
@@ -1582,20 +1253,14 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
-gotest.tools/v3 v3.2.0 h1:I0DwBVMGAx26dttAj1BtJLAkVGncrkkUXfJLC4Flt/I=
-gotest.tools/v3 v3.2.0/go.mod h1:Mcr9QNxkg0uMvy/YElmo4SpXgJKWgQvYrT7Kw5RzJ1A=
+gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
+gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -1603,9 +1268,9 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-mvdan.cc/editorconfig v0.1.1-0.20200121172147-e40951bde157/go.mod h1:Ge4atmRUYqueGppvJ7JNrtqpqokoJEFxYbP0Z+WeKS8=
-mvdan.cc/sh/v3 v3.3.0-0.dev.0.20210224101809-fb5052e7a010 h1:0xJA1YM0Ppa63jEfcdPsjRHo1qxklwXWhIPr9tAQ2J4=
-mvdan.cc/sh/v3 v3.3.0-0.dev.0.20210224101809-fb5052e7a010/go.mod h1:fPQmabBpREM/XQ9YXSU5ZFZ/Sm+PmKP9/vkFHgYKJEI=
+mvdan.cc/editorconfig v0.2.0/go.mod h1:lvnnD3BNdBYkhq+B4uBuFFKatfp02eB6HixDvEz91C0=
+mvdan.cc/sh/v3 v3.6.0 h1:gtva4EXJ0dFNvl5bHjcUEvws+KRcDslT8VKheTYkbGU=
+mvdan.cc/sh/v3 v3.6.0/go.mod h1:U4mhtBLZ32iWhif5/lD+ygy1zrgaQhUu+XFy7C8+TTA=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/go_mod_indirect_pins.go b/go_mod_indirect_pins.go
index c01015abe0a2..15d9aecaf52f 100644
--- a/go_mod_indirect_pins.go
+++ b/go_mod_indirect_pins.go
@@ -7,22 +7,10 @@
 package main
 
 import (
+	_ "github.com/cortesi/modd/cmd/modd"
 	_ "github.com/go-swagger/go-swagger/cmd/swagger"
+	_ "github.com/mailhog/MailHog"
 	_ "github.com/mattn/goveralls"
-	_ "github.com/sqs/goreturns"
-	_ "golang.org/x/tools/cmd/cover"
-
-	_ "github.com/gobuffalo/fizz"
 
 	_ "github.com/ory/go-acc"
-
-	_ "github.com/jteeuwen/go-bindata"
-
-	_ "github.com/davidrjonas/semver-cli"
-
-	_ "github.com/cortesi/modd/cmd/modd"
-	_ "github.com/hashicorp/consul/api"
-
-	_ "github.com/mailhog/MailHog"
-	_ "github.com/mikefarah/yq/v4"
 )
diff --git a/hash/hash_comparator.go b/hash/hash_comparator.go
index 524eb9bfba14..4c6007ec94ff 100644
--- a/hash/hash_comparator.go
+++ b/hash/hash_comparator.go
@@ -9,8 +9,8 @@ import (
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/hmac"
-	"crypto/md5"  //#nosec G501 -- compatibility for imported passwords
-	"crypto/sha1" //#nosec G505 -- compatibility for imported passwords
+	"crypto/md5"  //nolint:all // System compatibility for imported passwords
+	"crypto/sha1" //nolint:all // System compatibility for imported passwords
 	"crypto/sha256"
 	"crypto/sha512"
 	"crypto/subtle"
@@ -21,6 +21,9 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/go-crypt/crypt"
+	"github.com/go-crypt/crypt/algorithm/md5crypt"
+	"github.com/go-crypt/crypt/algorithm/shacrypt"
 	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
@@ -29,14 +32,10 @@ import (
 
 	//nolint:staticcheck
 	//lint:ignore SA1019 compatibility for imported passwords
-	"golang.org/x/crypto/md4" //#nosec G501 -- compatibility for imported passwords
+	"golang.org/x/crypto/md4" //nolint:gosec // disable G115 G501 -- compatibility for imported passwords
 	"golang.org/x/crypto/pbkdf2"
 	"golang.org/x/crypto/scrypt"
 
-	"github.com/go-crypt/crypt"
-	"github.com/go-crypt/crypt/algorithm/md5crypt"
-	"github.com/go-crypt/crypt/algorithm/shacrypt"
-
 	"github.com/ory/kratos/driver/config"
 )
 
@@ -60,54 +59,97 @@ func NewCryptDecoder() *crypt.Decoder {
 
 var CryptDecoder = NewCryptDecoder()
 
+type SupportedHasher struct {
+	Comparator func(ctx context.Context, password []byte, hash []byte) error
+	Name       string
+	Is         func(hash []byte) bool
+}
+
+func AddSupportedHasher(s SupportedHasher) {
+	supportedHashers = append(supportedHashers, s)
+}
+
+var supportedHashers = []SupportedHasher{
+	{
+		Comparator: CompareMD5Crypt,
+		Name:       "md5crypt",
+		Is:         IsMD5CryptHash,
+	},
+	{
+		Comparator: CompareBcrypt,
+		Name:       "bcrypt",
+		Is:         IsBcryptHash,
+	},
+	{
+		Comparator: CompareSHA256Crypt,
+		Name:       "sha256crypt",
+		Is:         IsSHA256CryptHash,
+	},
+	{
+		Comparator: CompareSHA512Crypt,
+		Name:       "sha512crypt",
+		Is:         IsSHA512CryptHash,
+	},
+	{
+		Comparator: CompareArgon2id,
+		Name:       "argon2id",
+		Is:         IsArgon2idHash,
+	},
+	{
+		Comparator: CompareArgon2i,
+		Name:       "argon2i",
+		Is:         IsArgon2iHash,
+	},
+	{
+		Comparator: ComparePbkdf2,
+		Name:       "pbkdf2",
+		Is:         IsPbkdf2Hash,
+	},
+	{
+		Comparator: CompareScrypt,
+		Name:       "scrypt",
+		Is:         IsScryptHash,
+	},
+	{
+		Comparator: CompareSSHA,
+		Name:       "ssha",
+		Is:         IsSSHAHash,
+	},
+	{
+		Comparator: CompareSHA,
+		Name:       "sha",
+		Is:         IsSHAHash,
+	},
+	{
+		Comparator: CompareFirebaseScrypt,
+		Name:       "firebasescrypt",
+		Is:         IsFirebaseScryptHash,
+	},
+	{
+		Comparator: CompareMD5,
+		Name:       "md5",
+		Is:         IsMD5Hash,
+	},
+	{
+		Comparator: CompareHMAC,
+		Name:       "hmac",
+		Is:         IsHMACHash,
+	},
+}
+
 func Compare(ctx context.Context, password []byte, hash []byte) error {
 	ctx, span := otel.GetTracerProvider().Tracer(tracingComponent).Start(ctx, "hash.Compare")
 	defer span.End()
 
-	switch {
-	case IsMD5CryptHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "md5crypt"))
-		return CompareMD5Crypt(ctx, password, hash)
-	case IsBcryptHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "bcrypt"))
-		return CompareBcrypt(ctx, password, hash)
-	case IsSHA256CryptHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "sha256"))
-		return CompareSHA256Crypt(ctx, password, hash)
-	case IsSHA512CryptHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "sha512"))
-		return CompareSHA512Crypt(ctx, password, hash)
-	case IsArgon2idHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "argon2id"))
-		return CompareArgon2id(ctx, password, hash)
-	case IsArgon2iHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "argon2i"))
-		return CompareArgon2i(ctx, password, hash)
-	case IsPbkdf2Hash(hash):
-		span.SetAttributes(attribute.String("hash.type", "pbkdf2"))
-		return ComparePbkdf2(ctx, password, hash)
-	case IsScryptHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "scrypt"))
-		return CompareScrypt(ctx, password, hash)
-	case IsSSHAHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "ssha"))
-		return CompareSSHA(ctx, password, hash)
-	case IsSHAHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "sha"))
-		return CompareSHA(ctx, password, hash)
-	case IsFirebaseScryptHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "firebasescrypt"))
-		return CompareFirebaseScrypt(ctx, password, hash)
-	case IsMD5Hash(hash):
-		span.SetAttributes(attribute.String("hash.type", "md5"))
-		return CompareMD5(ctx, password, hash)
-	case IsHMACHash(hash):
-		span.SetAttributes(attribute.String("hash.type", "hmac"))
-		return CompareHMAC(ctx, password, hash)
-	default:
-		span.SetAttributes(attribute.String("hash.type", "unknown"))
-		return errors.WithStack(ErrUnknownHashAlgorithm)
+	for _, h := range supportedHashers {
+		if h.Is(hash) {
+			span.SetAttributes(attribute.String("hash.type", h.Name))
+			return h.Comparator(ctx, password, hash)
+		}
 	}
+
+	span.SetAttributes(attribute.String("hash.type", "unknown"))
+	return errors.WithStack(ErrUnknownHashAlgorithm)
 }
 
 func CompareMD5Crypt(_ context.Context, password []byte, hash []byte) error {
@@ -159,6 +201,7 @@ func CompareArgon2id(_ context.Context, password []byte, hash []byte) error {
 	}
 
 	// Derive the key from the other password using the same parameters.
+	//nolint:gosec // disable G115
 	otherHash := argon2.IDKey(password, salt, p.Iterations, uint32(p.Memory), p.Parallelism, p.KeyLength)
 
 	return comparePasswordHashConstantTime(hash, otherHash)
@@ -217,7 +260,7 @@ func CompareSSHA(_ context.Context, password []byte, hash []byte) error {
 
 	raw := append(password[:], salt[:]...)
 
-	return compareSHAHelper(hasher, raw, hash)
+	return CompareSHAHelper(hasher, raw, hash)
 }
 
 func CompareSHA(_ context.Context, password []byte, hash []byte) error {
@@ -229,7 +272,7 @@ func CompareSHA(_ context.Context, password []byte, hash []byte) error {
 	r := strings.NewReplacer("{SALT}", string(salt), "{PASSWORD}", string(password))
 	raw := []byte(r.Replace(string(pf)))
 
-	return compareSHAHelper(hasher, raw, hash)
+	return CompareSHAHelper(hasher, raw, hash)
 }
 
 func CompareFirebaseScrypt(_ context.Context, password []byte, hash []byte) error {
@@ -327,23 +370,13 @@ func IsMD5Hash(hash []byte) bool            { return isMD5Hash.Match(hash) }
 func IsHMACHash(hash []byte) bool           { return isHMACHash.Match(hash) }
 
 func IsValidHashFormat(hash []byte) bool {
-	if IsMD5CryptHash(hash) ||
-		IsBcryptHash(hash) ||
-		IsSHA256CryptHash(hash) ||
-		IsSHA512CryptHash(hash) ||
-		IsArgon2idHash(hash) ||
-		IsArgon2iHash(hash) ||
-		IsPbkdf2Hash(hash) ||
-		IsScryptHash(hash) ||
-		IsSSHAHash(hash) ||
-		IsSHAHash(hash) ||
-		IsFirebaseScryptHash(hash) ||
-		IsMD5Hash(hash) ||
-		IsHMACHash(hash) {
-		return true
-	} else {
-		return false
+	for _, h := range supportedHashers {
+		if h.Is(hash) {
+			return true
+		}
 	}
+
+	return false
 }
 
 func decodeArgon2idHash(encodedHash string) (p *config.Argon2, salt, hash []byte, err error) {
@@ -481,8 +514,8 @@ func decodeSHAHash(encodedHash string) (hasher string, pf, salt, hash []byte, er
 	return hasher, pf, salt, hash, nil
 }
 
-// used for CompareSHA and CompareSSHA
-func compareSHAHelper(hasher string, raw []byte, hash []byte) error {
+// CompareSHAHelper compares the raw password with the hash using the given hasher.
+func CompareSHAHelper(hasher string, raw []byte, hash []byte) error {
 	var sha []byte
 
 	switch hasher {
@@ -518,10 +551,11 @@ func compareCryptHelper(password []byte, hash string) error {
 	return errors.WithStack(ErrMismatchedHashAndPassword)
 }
 
+var regexSSHA = regexp.MustCompile(`\{([^}]*)\}`)
+
 // decodeSSHAHash decodes SSHA[1|256|512] encoded password hash in usual {SSHA...} format.
 func decodeSSHAHash(encodedHash string) (hasher string, salt, hash []byte, err error) {
-	re := regexp.MustCompile(`\{([^}]*)\}`)
-	match := re.FindStringSubmatch(string(encodedHash))
+	match := regexSSHA.FindStringSubmatch(string(encodedHash))
 
 	var index_of_salt_begin int
 	var index_of_hash_begin int
diff --git a/hash/hasher_argon2.go b/hash/hasher_argon2.go
index 6775641bb36e..0a6dd32debc2 100644
--- a/hash/hasher_argon2.go
+++ b/hash/hasher_argon2.go
@@ -41,6 +41,7 @@ func NewHasherArgon2(c Argon2Configuration) *Argon2 {
 }
 
 func toKB(mem bytesize.ByteSize) uint32 {
+	//nolint:gosec // disable G115
 	return uint32(mem / bytesize.KB)
 }
 
diff --git a/hydra/hydra.go b/hydra/hydra.go
index a4466307ec9d..3332fb120157 100644
--- a/hydra/hydra.go
+++ b/hydra/hydra.go
@@ -72,7 +72,7 @@ func (h *DefaultHydra) getAdminURL(ctx context.Context) (string, error) {
 	return u.String(), nil
 }
 
-func (h *DefaultHydra) getAdminAPIClient(ctx context.Context) (*hydraclientgo.OAuth2ApiService, error) {
+func (h *DefaultHydra) getAdminAPIClient(ctx context.Context) (hydraclientgo.OAuth2API, error) {
 	url, err := h.getAdminURL(ctx)
 	if err != nil {
 		return nil, err
@@ -87,7 +87,7 @@ func (h *DefaultHydra) getAdminAPIClient(ctx context.Context) (*hydraclientgo.OA
 	}
 
 	configuration.HTTPClient = client
-	return hydraclientgo.NewAPIClient(configuration).OAuth2Api, nil
+	return hydraclientgo.NewAPIClient(configuration).OAuth2API, nil
 }
 
 func (h *DefaultHydra) AcceptLoginRequest(ctx context.Context, params AcceptLoginRequestParams) (string, error) {
diff --git a/identity/.snapshots/TestHandler-case=should_be_able_to_import_users-with_password_migration_hook_enabled.json b/identity/.snapshots/TestHandler-case=should_be_able_to_import_users-with_password_migration_hook_enabled.json
new file mode 100644
index 000000000000..e89fc60f2d8b
--- /dev/null
+++ b/identity/.snapshots/TestHandler-case=should_be_able_to_import_users-with_password_migration_hook_enabled.json
@@ -0,0 +1,22 @@
+{
+  "credentials": {
+    "password": {
+      "type": "password",
+      "identifiers": [
+        "pw-migration-hook@ory.sh"
+      ],
+      "config": {
+        "use_password_migration_hook": true
+      },
+      "version": 0
+    }
+  },
+  "schema_id": "default",
+  "state": "active",
+  "traits": {
+    "email": "pw-migration-hook@ory.sh"
+  },
+  "metadata_public": null,
+  "metadata_admin": null,
+  "organization_id": null
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=0.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=0.json
new file mode 100644
index 000000000000..9d4512a908be
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=0.json
@@ -0,0 +1,6 @@
+{
+  "type": "password",
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=1.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=1.json
new file mode 100644
index 000000000000..9d4512a908be
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=1.json
@@ -0,0 +1,6 @@
+{
+  "type": "password",
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=10.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=10.json
new file mode 100644
index 000000000000..b189c3022df0
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=10.json
@@ -0,0 +1,18 @@
+{
+  "type": "code",
+  "config": {
+    "addresses": [
+      {
+        "channel": "sms",
+        "address": "+4917667111638"
+      },
+      {
+        "channel": "email",
+        "address": "foo@ory.sh"
+      }
+    ]
+  },
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=11.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=11.json
new file mode 100644
index 000000000000..b189c3022df0
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=11.json
@@ -0,0 +1,18 @@
+{
+  "type": "code",
+  "config": {
+    "addresses": [
+      {
+        "channel": "sms",
+        "address": "+4917667111638"
+      },
+      {
+        "channel": "email",
+        "address": "foo@ory.sh"
+      }
+    ]
+  },
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=12.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=12.json
new file mode 100644
index 000000000000..968d3fa35bdd
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=12.json
@@ -0,0 +1,22 @@
+{
+  "type": "code",
+  "config": {
+    "addresses": [
+      {
+        "channel": "sms",
+        "address": "+4917667111638"
+      },
+      {
+        "channel": "email",
+        "address": "bar@ory.sh"
+      },
+      {
+        "channel": "email",
+        "address": "foo@ory.sh"
+      }
+    ]
+  },
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=13.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=13.json
new file mode 100644
index 000000000000..0a7e7320cbaa
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=13.json
@@ -0,0 +1,14 @@
+{
+  "type": "code",
+  "config": {
+    "addresses": [
+      {
+        "channel": "email",
+        "address": "bar@ory.sh"
+      }
+    ]
+  },
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=2.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=2.json
new file mode 100644
index 000000000000..5a19603d9a00
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=2.json
@@ -0,0 +1,6 @@
+{
+  "type": "webauthn",
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=3.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=3.json
new file mode 100644
index 000000000000..9d4512a908be
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=3.json
@@ -0,0 +1,6 @@
+{
+  "type": "password",
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=4.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=4.json
new file mode 100644
index 000000000000..5a19603d9a00
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=4.json
@@ -0,0 +1,6 @@
+{
+  "type": "webauthn",
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=5.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=5.json
new file mode 100644
index 000000000000..5a19603d9a00
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=5.json
@@ -0,0 +1,6 @@
+{
+  "type": "webauthn",
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=6.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=6.json
new file mode 100644
index 000000000000..2663d5b1297a
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=6.json
@@ -0,0 +1,14 @@
+{
+  "type": "code",
+  "config": {
+    "addresses": [
+      {
+        "channel": "email",
+        "address": "foo@ory.sh"
+      }
+    ]
+  },
+  "version": 1,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=7.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=7.json
new file mode 100644
index 000000000000..6b8c682b5077
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=7.json
@@ -0,0 +1,14 @@
+{
+  "type": "code",
+  "config": {
+    "addresses": [
+      {
+        "channel": "email",
+        "address": "foo@ory.sh"
+      }
+    ]
+  },
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=8.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=8.json
new file mode 100644
index 000000000000..6b8c682b5077
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=8.json
@@ -0,0 +1,14 @@
+{
+  "type": "code",
+  "config": {
+    "addresses": [
+      {
+        "channel": "email",
+        "address": "foo@ory.sh"
+      }
+    ]
+  },
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestSchemaExtensionCredentials-case=9.json b/identity/.snapshots/TestSchemaExtensionCredentials-case=9.json
new file mode 100644
index 000000000000..b189c3022df0
--- /dev/null
+++ b/identity/.snapshots/TestSchemaExtensionCredentials-case=9.json
@@ -0,0 +1,18 @@
+{
+  "type": "code",
+  "config": {
+    "addresses": [
+      {
+        "channel": "sms",
+        "address": "+4917667111638"
+      },
+      {
+        "channel": "email",
+        "address": "foo@ory.sh"
+      }
+    ]
+  },
+  "version": 0,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z"
+}
diff --git a/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_correct_value.json b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_correct_value.json
new file mode 100644
index 000000000000..3673c6943f03
--- /dev/null
+++ b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_correct_value.json
@@ -0,0 +1,30 @@
+{
+  "id": "4d64fa08-20fc-450d-bebd-ebd7c7b6e249",
+  "credentials": {
+    "code": {
+      "type": "code",
+      "identifiers": [
+        "hi@example.org"
+      ],
+      "config": {
+        "addresses": [
+          {
+            "channel": "email",
+            "address": "hi@example.org"
+          }
+        ]
+      },
+      "version": 1,
+      "created_at": "0001-01-01T00:00:00Z",
+      "updated_at": "0001-01-01T00:00:00Z"
+    }
+  },
+  "schema_id": "",
+  "schema_url": "",
+  "state": "",
+  "traits": null,
+  "metadata_public": null,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z",
+  "organization_id": null
+}
diff --git a/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_email_empty_space_value-with_one_identifier.json b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_email_empty_space_value-with_one_identifier.json
new file mode 100644
index 000000000000..3673c6943f03
--- /dev/null
+++ b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_email_empty_space_value-with_one_identifier.json
@@ -0,0 +1,30 @@
+{
+  "id": "4d64fa08-20fc-450d-bebd-ebd7c7b6e249",
+  "credentials": {
+    "code": {
+      "type": "code",
+      "identifiers": [
+        "hi@example.org"
+      ],
+      "config": {
+        "addresses": [
+          {
+            "channel": "email",
+            "address": "hi@example.org"
+          }
+        ]
+      },
+      "version": 1,
+      "created_at": "0001-01-01T00:00:00Z",
+      "updated_at": "0001-01-01T00:00:00Z"
+    }
+  },
+  "schema_id": "",
+  "schema_url": "",
+  "state": "",
+  "traits": null,
+  "metadata_public": null,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z",
+  "organization_id": null
+}
diff --git a/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_email_empty_space_value-with_two_identifiers.json b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_email_empty_space_value-with_two_identifiers.json
new file mode 100644
index 000000000000..9163f3c3886b
--- /dev/null
+++ b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_email_empty_space_value-with_two_identifiers.json
@@ -0,0 +1,35 @@
+{
+  "id": "4d64fa08-20fc-450d-bebd-ebd7c7b6e249",
+  "credentials": {
+    "code": {
+      "type": "code",
+      "identifiers": [
+        "foo@example.org",
+        "bar@example.org"
+      ],
+      "config": {
+        "addresses": [
+          {
+            "channel": "email",
+            "address": "foo@example.org"
+          },
+          {
+            "channel": "email",
+            "address": "bar@example.org"
+          }
+        ]
+      },
+      "version": 1,
+      "created_at": "0001-01-01T00:00:00Z",
+      "updated_at": "0001-01-01T00:00:00Z"
+    }
+  },
+  "schema_id": "",
+  "schema_url": "",
+  "state": "",
+  "traits": null,
+  "metadata_public": null,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z",
+  "organization_id": null
+}
diff --git a/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_empty_value.json b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_empty_value.json
new file mode 100644
index 000000000000..3673c6943f03
--- /dev/null
+++ b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_empty_value.json
@@ -0,0 +1,30 @@
+{
+  "id": "4d64fa08-20fc-450d-bebd-ebd7c7b6e249",
+  "credentials": {
+    "code": {
+      "type": "code",
+      "identifiers": [
+        "hi@example.org"
+      ],
+      "config": {
+        "addresses": [
+          {
+            "channel": "email",
+            "address": "hi@example.org"
+          }
+        ]
+      },
+      "version": 1,
+      "created_at": "0001-01-01T00:00:00Z",
+      "updated_at": "0001-01-01T00:00:00Z"
+    }
+  },
+  "schema_id": "",
+  "schema_url": "",
+  "state": "",
+  "traits": null,
+  "metadata_public": null,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z",
+  "organization_id": null
+}
diff --git a/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_unknown_value.json b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_unknown_value.json
new file mode 100644
index 000000000000..3673c6943f03
--- /dev/null
+++ b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v0_with_unknown_value.json
@@ -0,0 +1,30 @@
+{
+  "id": "4d64fa08-20fc-450d-bebd-ebd7c7b6e249",
+  "credentials": {
+    "code": {
+      "type": "code",
+      "identifiers": [
+        "hi@example.org"
+      ],
+      "config": {
+        "addresses": [
+          {
+            "channel": "email",
+            "address": "hi@example.org"
+          }
+        ]
+      },
+      "version": 1,
+      "created_at": "0001-01-01T00:00:00Z",
+      "updated_at": "0001-01-01T00:00:00Z"
+    }
+  },
+  "schema_id": "",
+  "schema_url": "",
+  "state": "",
+  "traits": null,
+  "metadata_public": null,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z",
+  "organization_id": null
+}
diff --git a/identity/.snapshots/TestUpgradeCredentials-type=code-from=v2_with_empty_value.json b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v2_with_empty_value.json
new file mode 100644
index 000000000000..a52b01ffd526
--- /dev/null
+++ b/identity/.snapshots/TestUpgradeCredentials-type=code-from=v2_with_empty_value.json
@@ -0,0 +1,35 @@
+{
+  "id": "4d64fa08-20fc-450d-bebd-ebd7c7b6e249",
+  "credentials": {
+    "code": {
+      "type": "code",
+      "identifiers": [
+        "foo@example.org",
+        "+12341234"
+      ],
+      "config": {
+        "addresses": [
+          {
+            "address": "foo@example.org",
+            "channel": "email"
+          },
+          {
+            "address": "+12341234",
+            "channel": "sms"
+          }
+        ]
+      },
+      "version": 1,
+      "created_at": "0001-01-01T00:00:00Z",
+      "updated_at": "0001-01-01T00:00:00Z"
+    }
+  },
+  "schema_id": "",
+  "schema_url": "",
+  "state": "",
+  "traits": null,
+  "metadata_public": null,
+  "created_at": "0001-01-01T00:00:00Z",
+  "updated_at": "0001-01-01T00:00:00Z",
+  "organization_id": null
+}
diff --git a/identity/.snapshots/TestUpgradeCredentials-type=webauthn-from=v1.json b/identity/.snapshots/TestUpgradeCredentials-type=webauthn-from=v1.json
index 60038539418a..4931ed3f972d 100644
--- a/identity/.snapshots/TestUpgradeCredentials-type=webauthn-from=v1.json
+++ b/identity/.snapshots/TestUpgradeCredentials-type=webauthn-from=v1.json
@@ -3,7 +3,7 @@
   "credentials": {
     "webauthn": {
       "type": "webauthn",
-      "identifiers": null,
+      "identifiers": [],
       "config": {
         "credentials": [
           {
diff --git a/identity/address.go b/identity/address.go
index 2e9175642e84..ae7ab83e38e7 100644
--- a/identity/address.go
+++ b/identity/address.go
@@ -5,4 +5,5 @@ package identity
 
 const (
 	AddressTypeEmail = "email"
+	AddressTypeSMS   = "sms"
 )
diff --git a/identity/credentials.go b/identity/credentials.go
index 3cc910c5a74e..9f3865006f96 100644
--- a/identity/credentials.go
+++ b/identity/credentials.go
@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/gofrs/uuid"
+	"github.com/wI2L/jsondiff"
 
 	"github.com/ory/kratos/ui/node"
 	"github.com/ory/x/sqlxx"
@@ -88,6 +89,7 @@ const (
 	CredentialsTypeCodeAuth CredentialsType = "code"
 	CredentialsTypePasskey  CredentialsType = "passkey"
 	CredentialsTypeProfile  CredentialsType = "profile"
+	CredentialsTypeSAML     CredentialsType = "saml"
 )
 
 func (c CredentialsType) String() string {
@@ -98,7 +100,7 @@ func (c CredentialsType) ToUiNodeGroup() node.UiNodeGroup {
 	switch c {
 	case CredentialsTypePassword:
 		return node.PasswordGroup
-	case CredentialsTypeOIDC:
+	case CredentialsTypeOIDC, CredentialsTypeSAML:
 		return node.OpenIDConnectGroup
 	case CredentialsTypeTOTP:
 		return node.TOTPGroup
@@ -137,6 +139,7 @@ func ParseCredentialsType(in string) (CredentialsType, bool) {
 	for _, t := range []CredentialsType{
 		CredentialsTypePassword,
 		CredentialsTypeOIDC,
+		CredentialsTypeSAML,
 		CredentialsTypeTOTP,
 		CredentialsTypeLookup,
 		CredentialsTypeWebAuthn,
@@ -215,8 +218,8 @@ type (
 	// swagger:ignore
 	ActiveCredentialsCounter interface {
 		ID() CredentialsType
-		CountActiveFirstFactorCredentials(cc map[CredentialsType]Credentials) (int, error)
-		CountActiveMultiFactorCredentials(cc map[CredentialsType]Credentials) (int, error)
+		CountActiveFirstFactorCredentials(context.Context, map[CredentialsType]Credentials) (int, error)
+		CountActiveMultiFactorCredentials(context.Context, map[CredentialsType]Credentials) (int, error)
 	}
 
 	// swagger:ignore
@@ -248,7 +251,13 @@ func CredentialsEqual(a, b map[CredentialsType]Credentials) bool {
 			return false
 		}
 
-		if string(expect.Config) != string(actual.Config) {
+		// Try to normalize configs (remove spaces etc).
+		patch, err := jsondiff.CompareJSON(actual.Config, expect.Config)
+		if err != nil {
+			return false
+		}
+
+		if len(patch) > 0 {
 			return false
 		}
 
diff --git a/identity/credentials_code.go b/identity/credentials_code.go
index b7f828ae09a1..e3e5f174f84c 100644
--- a/identity/credentials_code.go
+++ b/identity/credentials_code.go
@@ -4,22 +4,63 @@
 package identity
 
 import (
-	"database/sql"
+	"encoding/json"
+
+	"github.com/ory/herodot"
+
+	"github.com/pkg/errors"
+
+	"github.com/ory/x/stringsx"
 )
 
-type CodeAddressType = string
+type CodeChannel string
 
 const (
-	CodeAddressTypeEmail CodeAddressType = AddressTypeEmail
+	CodeChannelEmail CodeChannel = AddressTypeEmail
+	CodeChannelSMS   CodeChannel = AddressTypeSMS
 )
 
+func NewCodeChannel(value string) (CodeChannel, error) {
+	switch f := stringsx.SwitchExact(value); {
+	case f.AddCase(string(CodeChannelEmail)):
+		return CodeChannelEmail, nil
+	case f.AddCase(string(CodeChannelSMS)):
+		return CodeChannelSMS, nil
+	default:
+		return "", errors.Wrap(ErrInvalidCodeAddressType, f.ToUnknownCaseErr().Error())
+	}
+}
+
 // CredentialsCode represents a one time login/registration code
 //
 // swagger:model identityCredentialsCode
 type CredentialsCode struct {
+	Addresses []CredentialsCodeAddress `json:"addresses"`
+}
+
+// swagger:model identityCredentialsCodeAddress
+type CredentialsCodeAddress struct {
 	// The type of the address for this code
-	AddressType CodeAddressType `json:"address_type"`
+	Channel CodeChannel `json:"channel"`
+
+	// The address for this code
+	Address string `json:"address"`
+}
+
+var ErrInvalidCodeAddressType = herodot.ErrInternalServerError.WithReasonf("The address type for sending OTP codes is not supported.")
+
+func (c *CredentialsCodeAddress) UnmarshalJSON(data []byte) (err error) {
+	type alias CredentialsCodeAddress
+	var ac alias
+	if err := json.Unmarshal(data, &ac); err != nil {
+		return err
+	}
+
+	ac.Channel, err = NewCodeChannel(string(ac.Channel))
+	if err != nil {
+		return err
+	}
 
-	// UsedAt indicates whether and when a recovery code was used.
-	UsedAt sql.NullTime `json:"used_at,omitempty"`
+	*c = CredentialsCodeAddress(ac)
+	return nil
 }
diff --git a/identity/credentials_code_test.go b/identity/credentials_code_test.go
new file mode 100644
index 000000000000..475885024faa
--- /dev/null
+++ b/identity/credentials_code_test.go
@@ -0,0 +1,110 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package identity
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCredentialsCodeAddressUnmarshalJSON(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    CredentialsCodeAddress
+		wantErr bool
+	}{
+		{
+			name:  "valid email address",
+			input: `{"channel": "email", "address": "user@example.com"}`,
+			want: CredentialsCodeAddress{
+				Channel: CodeChannelEmail,
+				Address: "user@example.com",
+			},
+			wantErr: false,
+		},
+		{
+			name:  "valid SMS address",
+			input: `{"channel": "sms", "address": "+1234567890"}`,
+			want: CredentialsCodeAddress{
+				Channel: CodeChannelSMS,
+				Address: "+1234567890",
+			},
+			wantErr: false,
+		},
+		{
+			name:    "invalid address type",
+			input:   `{"channel": "invalid", "address": "user@example.com"}`,
+			want:    CredentialsCodeAddress{},
+			wantErr: true,
+		},
+		{
+			name:    "missing channel field",
+			input:   `{"address": "user@example.com"}`,
+			want:    CredentialsCodeAddress{},
+			wantErr: true,
+		},
+		{
+			name:    "invalid JSON structure",
+			input:   `{"channel": "email", "address": "user@example.com"`,
+			want:    CredentialsCodeAddress{},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var got CredentialsCodeAddress
+			err := json.Unmarshal([]byte(tt.input), &got)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tt.want, got)
+			}
+		})
+	}
+}
+
+func TestNewCodeAddressType(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    CodeChannel
+		wantErr bool
+	}{
+		{
+			name:    "valid email address type",
+			input:   "email",
+			want:    CodeChannelEmail,
+			wantErr: false,
+		},
+		{
+			name:    "valid SMS address type",
+			input:   "sms",
+			want:    CodeChannelSMS,
+			wantErr: false,
+		},
+		{
+			name:    "invalid address type",
+			input:   "invalid",
+			want:    "",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := NewCodeChannel(tt.input)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tt.want, got)
+			}
+		})
+	}
+}
diff --git a/identity/credentials_migrate.go b/identity/credentials_migrate.go
index f856be135a29..dea1a8a44b8d 100644
--- a/identity/credentials_migrate.go
+++ b/identity/credentials_migrate.go
@@ -6,6 +6,7 @@ package identity
 import (
 	"encoding/json"
 	"fmt"
+	"strings"
 
 	"github.com/tidwall/gjson"
 	"github.com/tidwall/sjson"
@@ -60,7 +61,61 @@ func UpgradeCredentials(i *Identity) error {
 		if err := UpgradeWebAuthnCredentials(i, &c); err != nil {
 			return errors.WithStack(err)
 		}
+		if err := UpgradeCodeCredentials(&c); err != nil {
+			return errors.WithStack(err)
+		}
 		i.Credentials[k] = c
 	}
 	return nil
 }
+
+func UpgradeCodeCredentials(c *Credentials) (err error) {
+	if c.Type != CredentialsTypeCodeAuth {
+		return nil
+	}
+
+	version := c.Version
+	if version == 0 {
+		addressType := strings.ToLower(strings.TrimSpace(gjson.GetBytes(c.Config, "address_type").String()))
+
+		channel, err := NewCodeChannel(addressType)
+		if err != nil {
+			// We know that in some cases the address type can be empty. In this case, we default to email
+			// as sms is a new addition to the address_type introduced in this PR.
+			channel = CodeChannelEmail
+		}
+
+		c.Config, err = sjson.DeleteBytes(c.Config, "used_at")
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
+		c.Config, err = sjson.DeleteBytes(c.Config, "address_type")
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
+		for _, id := range c.Identifiers {
+			if id == "" {
+				continue
+			}
+
+			c.Config, err = sjson.SetBytes(c.Config, "addresses.-1", &CredentialsCodeAddress{
+				Address: id,
+				Channel: channel,
+			})
+			if err != nil {
+				return errors.WithStack(err)
+			}
+		}
+
+		// This is needed because sjson adds spaces which can trip string comparisons.
+		c.Config, err = json.Marshal(json.RawMessage(c.Config))
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
+		c.Version = 1
+	}
+	return nil
+}
diff --git a/identity/credentials_migrate_test.go b/identity/credentials_migrate_test.go
index 2916bc892bde..43291d63e771 100644
--- a/identity/credentials_migrate_test.go
+++ b/identity/credentials_migrate_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/gofrs/uuid"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -30,43 +31,63 @@ func TestUpgradeCredentials(t *testing.T) {
 		snapshotx.SnapshotTExcept(t, &wc, nil)
 	})
 
-	identityID := uuid.FromStringOrNil("4d64fa08-20fc-450d-bebd-ebd7c7b6e249")
+	run := func(t *testing.T, identifiers []string, config string, version int, credentialsType CredentialsType, expectedVersion int) {
+		if identifiers == nil {
+			identifiers = []string{"hi@example.org"}
+		}
+		i := &Identity{
+			ID: uuid.FromStringOrNil("4d64fa08-20fc-450d-bebd-ebd7c7b6e249"),
+			Credentials: map[CredentialsType]Credentials{
+				credentialsType: {
+					Identifiers: identifiers,
+					Type:        credentialsType,
+					Version:     version,
+					Config:      []byte(config),
+				}},
+		}
+
+		require.NoError(t, UpgradeCredentials(i))
+		wc := WithCredentialsAndAdminMetadataInJSON(*i)
+		snapshotx.SnapshotT(t, &wc)
+		assert.Equal(t, expectedVersion, i.Credentials[credentialsType].Version)
+	}
+
+	t.Run("type=code", func(t *testing.T) {
+		t.Run("from=v0 with email empty space value", func(t *testing.T) {
+			t.Run("with one identifier", func(t *testing.T) {
+				run(t, nil, `{"address_type": "email                               ", "used_at": {"Time": "0001-01-01T00:00:00Z", "Valid": false}}`, 0, CredentialsTypeCodeAuth, 1)
+			})
+
+			t.Run("with two identifiers", func(t *testing.T) {
+				run(t, []string{"foo@example.org", "bar@example.org"}, `{"address_type": "email                               ", "used_at": {"Time": "0001-01-01T00:00:00Z", "Valid": false}}`, 0, CredentialsTypeCodeAuth, 1)
+			})
+		})
+
+		t.Run("from=v0 with empty value", func(t *testing.T) {
+			run(t, nil, `{"address_type": "", "used_at": {"Time": "0001-01-01T00:00:00Z", "Valid": false}}`, 0, CredentialsTypeCodeAuth, 1)
+		})
+
+		t.Run("from=v0 with correct value", func(t *testing.T) {
+			run(t, nil, `{"address_type": "email", "used_at": {"Time": "0001-01-01T00:00:00Z", "Valid": false}}`, 0, CredentialsTypeCodeAuth, 1)
+		})
+
+		t.Run("from=v0 with unknown value", func(t *testing.T) {
+			run(t, nil, `{"address_type": "other", "used_at": {"Time": "0001-01-01T00:00:00Z", "Valid": false}}`, 0, CredentialsTypeCodeAuth, 1)
+		})
+
+		t.Run("from=v2 with empty value", func(t *testing.T) {
+			run(t, []string{"foo@example.org", "+12341234"}, `{"addresses": [{"address":"foo@example.org","channel":"email"},{"address":"+12341234","channel":"sms"}]}`, 1, CredentialsTypeCodeAuth, 1)
+		})
+	})
+
 	t.Run("type=webauthn", func(t *testing.T) {
 		t.Run("from=v0", func(t *testing.T) {
-			i := &Identity{
-				ID: identityID,
-				Credentials: map[CredentialsType]Credentials{
-					CredentialsTypeWebAuthn: {
-						Identifiers: []string{"4d64fa08-20fc-450d-bebd-ebd7c7b6e249"},
-						Type:        CredentialsTypeWebAuthn,
-						Version:     0,
-						Config:      webAuthnV0,
-					}},
-			}
-
-			require.NoError(t, UpgradeCredentials(i))
-			wc := WithCredentialsAndAdminMetadataInJSON(*i)
-			snapshotx.SnapshotTExcept(t, &wc, nil)
-
-			assert.Equal(t, 1, i.Credentials[CredentialsTypeWebAuthn].Version)
+			run(t, []string{"4d64fa08-20fc-450d-bebd-ebd7c7b6e249"}, string(webAuthnV0), 0, CredentialsTypeWebAuthn, 1)
 		})
 
 		t.Run("from=v1", func(t *testing.T) {
-			i := &Identity{
-				ID: identityID,
-				Credentials: map[CredentialsType]Credentials{
-					CredentialsTypeWebAuthn: {
-						Type:    CredentialsTypeWebAuthn,
-						Version: 1,
-						Config:  webAuthnV1,
-					}},
-			}
-
-			require.NoError(t, UpgradeCredentials(i))
-			wc := WithCredentialsAndAdminMetadataInJSON(*i)
-			snapshotx.SnapshotTExcept(t, &wc, nil)
-
-			assert.Equal(t, 1, i.Credentials[CredentialsTypeWebAuthn].Version)
+
+			run(t, []string{}, string(webAuthnV1), 1, CredentialsTypeWebAuthn, 1)
 		})
 	})
 }
diff --git a/identity/credentials_password.go b/identity/credentials_password.go
index 85f5ac1d7d0c..4a6e7ebc7144 100644
--- a/identity/credentials_password.go
+++ b/identity/credentials_password.go
@@ -9,4 +9,13 @@ package identity
 type CredentialsPassword struct {
 	// HashedPassword is a hash-representation of the password.
 	HashedPassword string `json:"hashed_password"`
+
+	// UsePasswordMigrationHook is set to true if the password should be migrated
+	// using the password migration hook. If set, and the HashedPassword is empty, a
+	// webhook will be called during login to migrate the password.
+	UsePasswordMigrationHook bool `json:"use_password_migration_hook,omitempty"`
+}
+
+func (cp *CredentialsPassword) ShouldUsePasswordMigrationHook() bool {
+	return cp != nil && cp.HashedPassword == "" && cp.UsePasswordMigrationHook
 }
diff --git a/identity/credentials_password_test.go b/identity/credentials_password_test.go
new file mode 100644
index 000000000000..6e62720779e6
--- /dev/null
+++ b/identity/credentials_password_test.go
@@ -0,0 +1,46 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package identity
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCredentialsPassword_ShouldUsePasswordMigrationHook(t *testing.T) {
+	tests := []struct {
+		name string
+		cp   *CredentialsPassword
+		want bool
+	}{{
+		name: "pw set",
+		cp: &CredentialsPassword{
+			HashedPassword:           "pw",
+			UsePasswordMigrationHook: true,
+		},
+		want: false,
+	}, {
+		name: "pw not set",
+		cp: &CredentialsPassword{
+			HashedPassword:           "",
+			UsePasswordMigrationHook: true,
+		},
+		want: true,
+	}, {
+		name: "nil",
+		want: false,
+	}, {
+		name: "pw not set, hook not set",
+		cp: &CredentialsPassword{
+			HashedPassword: "",
+		},
+		want: false,
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, tt.cp.ShouldUsePasswordMigrationHook(), "ShouldUsePasswordMigrationHook()")
+		})
+	}
+}
diff --git a/identity/credentials_webauthn.go b/identity/credentials_webauthn.go
index 0816046d23e4..ae6b2e34cb77 100644
--- a/identity/credentials_webauthn.go
+++ b/identity/credentials_webauthn.go
@@ -6,6 +6,8 @@ package identity
 import (
 	"time"
 
+	"github.com/go-webauthn/webauthn/protocol"
+
 	"github.com/go-webauthn/webauthn/webauthn"
 
 	"github.com/ory/kratos/x/webauthnx/aaguid"
@@ -27,11 +29,17 @@ func CredentialFromWebAuthn(credential *webauthn.Credential, isPasswordless bool
 		IsPasswordless:  isPasswordless,
 		AttestationType: credential.AttestationType,
 		AddedAt:         time.Now().UTC().Round(time.Second),
-		Authenticator: AuthenticatorWebAuthn{
+		Authenticator: &AuthenticatorWebAuthn{
 			AAGUID:       credential.Authenticator.AAGUID,
 			SignCount:    credential.Authenticator.SignCount,
 			CloneWarning: credential.Authenticator.CloneWarning,
 		},
+		Flags: &CredentialWebAuthnFlags{
+			UserPresent:    credential.Flags.UserPresent,
+			UserVerified:   credential.Flags.UserVerified,
+			BackupEligible: credential.Flags.BackupEligible,
+			BackupState:    credential.Flags.BackupState,
+		},
 	}
 	id := aaguid.Lookup(credential.Authenticator.AAGUID)
 	if id != nil {
@@ -49,8 +57,16 @@ func (c CredentialsWebAuthn) ToWebAuthn() (result []webauthn.Credential) {
 }
 
 // PasswordlessOnly returns only passwordless credentials.
-func (c CredentialsWebAuthn) PasswordlessOnly() (result []webauthn.Credential) {
+func (c CredentialsWebAuthn) PasswordlessOnly(authenticatorResponseFlags *protocol.AuthenticatorFlags) (result []webauthn.Credential) {
 	for k, cc := range c {
+		// Upgrade path for legacy webauthn credentials. Only possible if we are handling a response from an authenticator.
+		if c[k].Flags == nil && authenticatorResponseFlags != nil {
+			c[k].Flags = &CredentialWebAuthnFlags{
+				BackupEligible: authenticatorResponseFlags.HasBackupEligible(),
+				BackupState:    authenticatorResponseFlags.HasBackupState(),
+			}
+		}
+
 		if cc.IsPasswordless {
 			result = append(result, *c[k].ToWebAuthn())
 		}
@@ -61,38 +77,91 @@ func (c CredentialsWebAuthn) PasswordlessOnly() (result []webauthn.Credential) {
 // ToWebAuthnFiltered returns only the appropriate credentials for the requested
 // AAL. For AAL1, only passwordless credentials are returned, for AAL2, only
 // non-passwordless credentials are returned.
-func (c CredentialsWebAuthn) ToWebAuthnFiltered(aal AuthenticatorAssuranceLevel) (result []webauthn.Credential) {
+//
+// authenticatorResponseFlags should be passed  if the response is from an authenticator. It will be used to
+// upgrade legacy webauthn credentials' BackupEligible and BackupState flags.
+func (c CredentialsWebAuthn) ToWebAuthnFiltered(aal AuthenticatorAssuranceLevel, authenticatorResponseFlags *protocol.AuthenticatorFlags) (result []webauthn.Credential) {
 	for k, cc := range c {
+		// Upgrade path for legacy webauthn credentials. Only possible if we are handling a response from an authenticator.
+		if c[k].Flags == nil && authenticatorResponseFlags != nil {
+			c[k].Flags = &CredentialWebAuthnFlags{
+				BackupEligible: authenticatorResponseFlags.HasBackupEligible(),
+				BackupState:    authenticatorResponseFlags.HasBackupState(),
+			}
+		}
+
 		if (aal == AuthenticatorAssuranceLevel1 && cc.IsPasswordless) ||
 			(aal == AuthenticatorAssuranceLevel2 && !cc.IsPasswordless) {
 			result = append(result, *c[k].ToWebAuthn())
 		}
-
 	}
 	return result
 }
 
 func (c *CredentialWebAuthn) ToWebAuthn() *webauthn.Credential {
-	return &webauthn.Credential{
+	wc := &webauthn.Credential{
 		ID:              c.ID,
 		PublicKey:       c.PublicKey,
 		AttestationType: c.AttestationType,
-		Authenticator: webauthn.Authenticator{
+		Transport:       c.Transport,
+	}
+
+	if c.Authenticator != nil {
+		wc.Authenticator = webauthn.Authenticator{
 			AAGUID:       c.Authenticator.AAGUID,
 			SignCount:    c.Authenticator.SignCount,
 			CloneWarning: c.Authenticator.CloneWarning,
-		},
+		}
 	}
+
+	if c.Flags != nil {
+		wc.Flags = webauthn.CredentialFlags{
+			UserPresent:    c.Flags.UserPresent,
+			UserVerified:   c.Flags.UserVerified,
+			BackupEligible: c.Flags.BackupEligible,
+			BackupState:    c.Flags.BackupState,
+		}
+	}
+
+	if c.Attestation != nil {
+		wc.Attestation = webauthn.CredentialAttestation{
+			ClientDataJSON:     c.Attestation.ClientDataJSON,
+			ClientDataHash:     c.Attestation.ClientDataHash,
+			AuthenticatorData:  c.Attestation.AuthenticatorData,
+			PublicKeyAlgorithm: c.Attestation.PublicKeyAlgorithm,
+			Object:             c.Attestation.Object,
+		}
+	}
+
+	return wc
 }
 
 type CredentialWebAuthn struct {
-	ID              []byte                `json:"id"`
-	PublicKey       []byte                `json:"public_key"`
-	AttestationType string                `json:"attestation_type"`
-	Authenticator   AuthenticatorWebAuthn `json:"authenticator"`
-	DisplayName     string                `json:"display_name"`
-	AddedAt         time.Time             `json:"added_at"`
-	IsPasswordless  bool                  `json:"is_passwordless"`
+	ID              []byte                            `json:"id"`
+	PublicKey       []byte                            `json:"public_key"`
+	AttestationType string                            `json:"attestation_type"`
+	Authenticator   *AuthenticatorWebAuthn            `json:"authenticator,omitempty"`
+	DisplayName     string                            `json:"display_name"`
+	AddedAt         time.Time                         `json:"added_at"`
+	IsPasswordless  bool                              `json:"is_passwordless"`
+	Flags           *CredentialWebAuthnFlags          `json:"flags,omitempty"`
+	Transport       []protocol.AuthenticatorTransport `json:"transport,omitempty"`
+	Attestation     *CredentialWebAuthnAttestation    `json:"attestation,omitempty"`
+}
+
+type CredentialWebAuthnFlags struct {
+	UserPresent    bool `json:"user_present"`
+	UserVerified   bool `json:"user_verified"`
+	BackupEligible bool `json:"backup_eligible"`
+	BackupState    bool `json:"backup_state"`
+}
+
+type CredentialWebAuthnAttestation struct {
+	ClientDataJSON     []byte `json:"client_dataJSON"`
+	ClientDataHash     []byte `json:"client_data_hash"`
+	AuthenticatorData  []byte `json:"authenticator_data"`
+	PublicKeyAlgorithm int64  `json:"public_key_algorithm"`
+	Object             []byte `json:"object"`
 }
 
 type AuthenticatorWebAuthn struct {
diff --git a/identity/credentials_webauthn_test.go b/identity/credentials_webauthn_test.go
index ed3dc9689a7b..8918898e71be 100644
--- a/identity/credentials_webauthn_test.go
+++ b/identity/credentials_webauthn_test.go
@@ -28,16 +28,16 @@ func TestCredentialConversion(t *testing.T) {
 	actual := CredentialFromWebAuthn(expected, false).ToWebAuthn()
 	assert.Equal(t, expected, actual)
 
-	actualList := CredentialsWebAuthn{*CredentialFromWebAuthn(expected, false)}.ToWebAuthnFiltered(AuthenticatorAssuranceLevel2)
+	actualList := CredentialsWebAuthn{*CredentialFromWebAuthn(expected, false)}.ToWebAuthnFiltered(AuthenticatorAssuranceLevel2, nil)
 	assert.Equal(t, []webauthn.Credential{*expected}, actualList)
 
-	actualList = CredentialsWebAuthn{*CredentialFromWebAuthn(expected, true)}.ToWebAuthnFiltered(AuthenticatorAssuranceLevel1)
+	actualList = CredentialsWebAuthn{*CredentialFromWebAuthn(expected, true)}.ToWebAuthnFiltered(AuthenticatorAssuranceLevel1, nil)
 	assert.Equal(t, []webauthn.Credential{*expected}, actualList)
 
-	actualList = CredentialsWebAuthn{*CredentialFromWebAuthn(expected, true)}.ToWebAuthnFiltered(AuthenticatorAssuranceLevel2)
+	actualList = CredentialsWebAuthn{*CredentialFromWebAuthn(expected, true)}.ToWebAuthnFiltered(AuthenticatorAssuranceLevel2, nil)
 	assert.Len(t, actualList, 0)
 
-	actualList = CredentialsWebAuthn{*CredentialFromWebAuthn(expected, false)}.ToWebAuthnFiltered(AuthenticatorAssuranceLevel1)
+	actualList = CredentialsWebAuthn{*CredentialFromWebAuthn(expected, false)}.ToWebAuthnFiltered(AuthenticatorAssuranceLevel1, nil)
 	assert.Len(t, actualList, 0)
 
 	fromWebAuthn := CredentialFromWebAuthn(expected, true)
@@ -58,7 +58,7 @@ func TestPasswordlessOnly(t *testing.T) {
 	e := *CredentialFromWebAuthn(&webauthn.Credential{ID: []byte("e")}, true)
 	expected := CredentialsWebAuthn{a, b, c, d, e}
 
-	actual := expected.PasswordlessOnly()
+	actual := expected.PasswordlessOnly(nil)
 	require.Len(t, actual, 2)
 	assert.Equal(t, []webauthn.Credential{*c.ToWebAuthn(), *e.ToWebAuthn()}, actual)
 }
diff --git a/identity/extension_credentials.go b/identity/extension_credentials.go
index 3baa826b2e9c..c9e56ab5ee60 100644
--- a/identity/extension_credentials.go
+++ b/identity/extension_credentials.go
@@ -4,22 +4,28 @@
 package identity
 
 import (
+	"encoding/json"
 	"fmt"
+	"sort"
 	"strings"
 	"sync"
 
+	"github.com/pkg/errors"
+	"github.com/samber/lo"
+
+	"github.com/ory/kratos/x"
+
 	"github.com/ory/jsonschema/v3"
+	"github.com/ory/kratos/schema"
 	"github.com/ory/x/sqlxx"
 	"github.com/ory/x/stringslice"
-	"github.com/ory/x/stringsx"
-
-	"github.com/ory/kratos/schema"
 )
 
 type SchemaExtensionCredentials struct {
-	i *Identity
-	v map[CredentialsType][]string
-	l sync.Mutex
+	i         *Identity
+	v         map[CredentialsType][]string
+	addresses []CredentialsCodeAddress
+	l         sync.Mutex
 }
 
 func NewSchemaExtensionCredentials(i *Identity) *SchemaExtensionCredentials {
@@ -35,6 +41,7 @@ func (r *SchemaExtensionCredentials) setIdentifier(ct CredentialsType, value int
 			Config:      sqlxx.JSONRawMessage{},
 		}
 	}
+
 	if r.v == nil {
 		r.v = make(map[CredentialsType][]string)
 	}
@@ -57,22 +64,62 @@ func (r *SchemaExtensionCredentials) Run(ctx jsonschema.ValidationContext, s sch
 	}
 
 	if s.Credentials.Code.Identifier {
-		switch f := stringsx.SwitchExact(s.Credentials.Code.Via); {
-		case f.AddCase(AddressTypeEmail):
-			if !jsonschema.Formats["email"](value) {
-				return ctx.Error("format", "%q is not a valid %q", value, s.Credentials.Code.Via)
+		via, err := NewCodeChannel(s.Credentials.Code.Via)
+		if err != nil {
+			return ctx.Error("ory.sh~/kratos/credentials/code/via", "channel type %q must be one of %s", s.Credentials.Code.Via, strings.Join([]string{
+				string(CodeChannelEmail),
+				string(CodeChannelSMS),
+			}, ", "))
+		}
+
+		cred := r.i.GetCredentialsOr(CredentialsTypeCodeAuth, &Credentials{
+			Type:        CredentialsTypeCodeAuth,
+			Identifiers: []string{},
+			Config:      sqlxx.JSONRawMessage("{}"),
+			Version:     1,
+		})
+
+		var conf CredentialsCode
+		conf.Addresses = r.addresses
+		value, err := x.NormalizeIdentifier(fmt.Sprintf("%s", value), string(via))
+		if err != nil {
+			return &jsonschema.ValidationError{Message: err.Error()}
+		}
+
+		conf.Addresses = append(conf.Addresses, CredentialsCodeAddress{
+			Channel: via,
+			Address: value,
+		})
+
+		conf.Addresses = lo.UniqBy(conf.Addresses, func(item CredentialsCodeAddress) string {
+			return fmt.Sprintf("%x:%s", item.Address, item.Channel)
+		})
+
+		sort.SliceStable(conf.Addresses, func(i, j int) bool {
+			if conf.Addresses[i].Address == conf.Addresses[j].Address {
+				return conf.Addresses[i].Channel < conf.Addresses[j].Channel
 			}
+			return conf.Addresses[i].Address < conf.Addresses[j].Address
+		})
 
-			r.setIdentifier(CredentialsTypeCodeAuth, value)
-		// case f.AddCase(AddressTypePhone):
-		// 	if !jsonschema.Formats["tel"](value) {
-		// 		return ctx.Error("format", "%q is not a valid %q", value, s.Credentials.Code.Via)
-		// 	}
+		if r.v == nil {
+			r.v = make(map[CredentialsType][]string)
+		}
 
-		// 	r.setIdentifier(CredentialsTypeCodeAuth, value, CredentialsIdentifierAddressTypePhone)
-		default:
-			return ctx.Error("", "credentials.code.via has unknown value %q", s.Credentials.Code.Via)
+		r.v[CredentialsTypeCodeAuth] = stringslice.Unique(append(r.v[CredentialsTypeCodeAuth],
+			lo.Map(conf.Addresses, func(item CredentialsCodeAddress, _ int) string {
+				return item.Address
+			})...,
+		))
+		r.addresses = conf.Addresses
+
+		cred.Identifiers = r.v[CredentialsTypeCodeAuth]
+		cred.Config, err = json.Marshal(conf)
+		if err != nil {
+			return errors.WithStack(err)
 		}
+
+		r.i.SetCredentials(CredentialsTypeCodeAuth, *cred)
 	}
 
 	return nil
diff --git a/identity/extension_credentials_test.go b/identity/extension_credentials_test.go
index 95cd9d000c6a..25c1c827303b 100644
--- a/identity/extension_credentials_test.go
+++ b/identity/extension_credentials_test.go
@@ -9,6 +9,10 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/ory/x/sqlxx"
+
+	"github.com/ory/x/snapshotx"
+
 	"github.com/ory/jsonschema/v3"
 	_ "github.com/ory/jsonschema/v3/fileloader"
 
@@ -23,70 +27,130 @@ var ctx = context.Background()
 
 func TestSchemaExtensionCredentials(t *testing.T) {
 	for k, tc := range []struct {
-		expectErr error
-		schema    string
-		doc       string
-		expect    []string
-		existing  *identity.Credentials
-		ct        identity.CredentialsType
+		expectErr           error
+		schema              string
+		doc                 string
+		expectedIdentifiers []string
+		existing            *identity.Credentials
+		ct                  identity.CredentialsType
 	}{
 		{
-			doc:    `{"email":"foo@ory.sh"}`,
-			schema: "file://./stub/extension/credentials/schema.json",
-			expect: []string{"foo@ory.sh"},
-			ct:     identity.CredentialsTypePassword,
+			doc:                 `{"email":"foo@ory.sh"}`,
+			schema:              "file://./stub/extension/credentials/schema.json",
+			expectedIdentifiers: []string{"foo@ory.sh"},
+			ct:                  identity.CredentialsTypePassword,
 		},
 		{
-			doc:    `{"emails":["foo@ory.sh","foo@ory.sh","bar@ory.sh"], "username": "foobar"}`,
-			schema: "file://./stub/extension/credentials/multi.schema.json",
-			expect: []string{"foo@ory.sh", "bar@ory.sh", "foobar"},
-			ct:     identity.CredentialsTypePassword,
+			doc:                 `{"emails":["foo@ory.sh","foo@ory.sh","bar@ory.sh"], "username": "foobar"}`,
+			schema:              "file://./stub/extension/credentials/multi.schema.json",
+			expectedIdentifiers: []string{"foo@ory.sh", "bar@ory.sh", "foobar"},
+			ct:                  identity.CredentialsTypePassword,
 		},
 		{
-			doc:    `{"emails":["foo@ory.sh","foo@ory.sh","bar@ory.sh"], "username": "foobar"}`,
-			schema: "file://./stub/extension/credentials/multi.schema.json",
-			expect: []string{"foo@ory.sh", "bar@ory.sh"},
-			ct:     identity.CredentialsTypeWebAuthn,
+			doc:                 `{"emails":["foo@ory.sh","foo@ory.sh","bar@ory.sh"], "username": "foobar"}`,
+			schema:              "file://./stub/extension/credentials/multi.schema.json",
+			expectedIdentifiers: []string{"foo@ory.sh", "bar@ory.sh"},
+			ct:                  identity.CredentialsTypeWebAuthn,
 		},
 		{
-			doc:    `{"emails":["FOO@ory.sh","bar@ory.sh"], "username": "foobar"}`,
-			schema: "file://./stub/extension/credentials/multi.schema.json",
-			expect: []string{"foo@ory.sh", "bar@ory.sh", "foobar"},
+			doc:                 `{"emails":["FOO@ory.sh","bar@ory.sh"], "username": "foobar"}`,
+			schema:              "file://./stub/extension/credentials/multi.schema.json",
+			expectedIdentifiers: []string{"foo@ory.sh", "bar@ory.sh", "foobar"},
 			existing: &identity.Credentials{
 				Identifiers: []string{"not-foo@ory.sh"},
 			},
 			ct: identity.CredentialsTypePassword,
 		},
 		{
-			doc:    `{"email":"foo@ory.sh"}`,
-			schema: "file://./stub/extension/credentials/webauthn.schema.json",
-			expect: []string{"foo@ory.sh"},
-			ct:     identity.CredentialsTypeWebAuthn,
+			doc:                 `{"email":"foo@ory.sh"}`,
+			schema:              "file://./stub/extension/credentials/webauthn.schema.json",
+			expectedIdentifiers: []string{"foo@ory.sh"},
+			ct:                  identity.CredentialsTypeWebAuthn,
 		},
 		{
-			doc:    `{"email":"FOO@ory.sh"}`,
-			schema: "file://./stub/extension/credentials/webauthn.schema.json",
-			expect: []string{"foo@ory.sh"},
+			doc:                 `{"email":"FOO@ory.sh"}`,
+			schema:              "file://./stub/extension/credentials/webauthn.schema.json",
+			expectedIdentifiers: []string{"foo@ory.sh"},
 			existing: &identity.Credentials{
 				Identifiers: []string{"not-foo@ory.sh"},
 			},
 			ct: identity.CredentialsTypeWebAuthn,
 		},
 		{
-			doc:    `{"email":"foo@ory.sh"}`,
-			schema: "file://./stub/extension/credentials/code.schema.json",
-			expect: []string{"foo@ory.sh"},
-			ct:     identity.CredentialsTypeCodeAuth,
+			doc:                 `{"email":"foo@ory.sh"}`,
+			schema:              "file://./stub/extension/credentials/code.schema.json",
+			expectedIdentifiers: []string{"foo@ory.sh"},
+			ct:                  identity.CredentialsTypeCodeAuth,
 		},
 		{
-			doc:    `{"email":"FOO@ory.sh"}`,
-			schema: "file://./stub/extension/credentials/code.schema.json",
-			expect: []string{"foo@ory.sh"},
+			doc:                 `{"email":"FOO@ory.sh"}`,
+			schema:              "file://./stub/extension/credentials/code.schema.json",
+			expectedIdentifiers: []string{"foo@ory.sh"},
 			existing: &identity.Credentials{
 				Identifiers: []string{"not-foo@ory.sh"},
 			},
 			ct: identity.CredentialsTypeCodeAuth,
 		},
+		{
+			doc:                 `{"email":"FOO@ory.sh"}`,
+			schema:              "file://./stub/extension/credentials/code.schema.json",
+			expectedIdentifiers: []string{"foo@ory.sh"},
+			existing: &identity.Credentials{
+				Identifiers: []string{"not-foo@ory.sh", "foo@ory.sh"},
+				Config:      sqlxx.JSONRawMessage(`{"addresses":[{"channel":"email","address":"not-foo@ory.sh"}]}`),
+			},
+			ct: identity.CredentialsTypeCodeAuth,
+		},
+		{
+			doc:                 `{"email":"FOO@ory.sh","phone":"+49 176 671 11 638"}`,
+			schema:              "file://./stub/extension/credentials/code-phone-email.schema.json",
+			expectedIdentifiers: []string{"+4917667111638", "foo@ory.sh"},
+			existing: &identity.Credentials{
+				Identifiers: []string{"not-foo@ory.sh", "foo@ory.sh"},
+				Config:      sqlxx.JSONRawMessage(`{"addresses":[{"channel":"email","address":"not-foo@ory.sh"}]}`),
+			},
+			ct: identity.CredentialsTypeCodeAuth,
+		},
+		{
+			doc:                 `{"email":"FOO@ory.sh","phone":"+49 176 671 11 638"}`,
+			schema:              "file://./stub/extension/credentials/code-phone-email.schema.json",
+			expectedIdentifiers: []string{"+4917667111638", "foo@ory.sh"},
+			existing: &identity.Credentials{
+				Identifiers: []string{"not-foo@ory.sh", "foo@ory.sh"},
+				Config:      sqlxx.JSONRawMessage(`{"addresses":[{"channel":"email","address":"not-foo@ory.sh"}]}`),
+			},
+			ct: identity.CredentialsTypeCodeAuth,
+		},
+		{
+			doc:                 `{"email":"FOO@ory.sh","email2":"FOO@ory.sh","phone":"+49 176 671 11 638"}`,
+			schema:              "file://./stub/extension/credentials/code-phone-email.schema.json",
+			expectedIdentifiers: []string{"+4917667111638", "foo@ory.sh"},
+			existing: &identity.Credentials{
+				Identifiers: []string{"not-foo@ory.sh", "fOo@ory.sh"},
+				Config:      sqlxx.JSONRawMessage(`{"addresses":[{"channel":"email","address":"not-foo@ory.sh"}]}`),
+			},
+			ct: identity.CredentialsTypeCodeAuth,
+		},
+		{
+			doc:                 `{"email":"FOO@ory.sh","email2":"FOO@ory.sh","email3":"bar@ory.sh","phone":"+49 176 671 11 638"}`,
+			schema:              "file://./stub/extension/credentials/code-phone-email.schema.json",
+			expectedIdentifiers: []string{"+4917667111638", "foo@ory.sh", "bar@ory.sh"},
+			existing: &identity.Credentials{
+				Identifiers: []string{"not-foo@ory.sh", "fOo@ory.sh"},
+				Config:      sqlxx.JSONRawMessage(`{"addresses":[{"channel":"email","address":"not-foo@ory.sh"}]}`),
+			},
+			ct: identity.CredentialsTypeCodeAuth,
+		},
+		{
+			doc:                 `{"email":"bar@ory.sh"}`,
+			schema:              "file://./stub/extension/credentials/email.schema.json",
+			expectedIdentifiers: []string{"bar@ory.sh"},
+			existing: &identity.Credentials{
+				Identifiers: []string{"foo@ory.sh"},
+				Config:      sqlxx.JSONRawMessage(`{"addresses":[{"channel":"email","address":"foo@ory.sh"}]}`),
+			},
+			ct: identity.CredentialsTypeCodeAuth,
+		},
 	} {
 		t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
 			c := jsonschema.NewCompiler()
@@ -103,12 +167,15 @@ func TestSchemaExtensionCredentials(t *testing.T) {
 			err = c.MustCompile(ctx, tc.schema).Validate(bytes.NewBufferString(tc.doc))
 			if tc.expectErr != nil {
 				require.EqualError(t, err, tc.expectErr.Error())
+			} else {
+				require.NoError(t, err)
 			}
 			require.NoError(t, e.Finish())
 
 			credentials, ok := i.GetCredentials(tc.ct)
 			require.True(t, ok)
-			assert.ElementsMatch(t, tc.expect, credentials.Identifiers)
+			assert.ElementsMatch(t, tc.expectedIdentifiers, credentials.Identifiers)
+			snapshotx.SnapshotT(t, credentials, snapshotx.ExceptPaths("identifiers"))
 		})
 	}
 }
diff --git a/identity/extension_verification.go b/identity/extension_verification.go
index 3b3f92581c37..677a49934bdd 100644
--- a/identity/extension_verification.go
+++ b/identity/extension_verification.go
@@ -5,12 +5,12 @@ package identity
 
 import (
 	"fmt"
+	"maps"
+	"slices"
 	"strings"
 	"sync"
 	"time"
 
-	"golang.org/x/exp/maps"
-
 	"github.com/ory/jsonschema/v3"
 	"github.com/ory/kratos/schema"
 )
@@ -60,7 +60,7 @@ func (r *SchemaExtensionVerification) Run(ctx jsonschema.ValidationContext, s sc
 			formatString = "email"
 			formatter, ok := jsonschema.Formats[formatString]
 			if !ok {
-				supportedKeys := maps.Keys(jsonschema.Formats)
+				supportedKeys := slices.Collect(maps.Keys(jsonschema.Formats))
 				return ctx.Error("format", "format %q is not supported. Supported formats are [%s]", formatString, strings.Join(supportedKeys, ", "))
 			}
 
diff --git a/identity/handler.go b/identity/handler.go
index cf4d3ff835e6..6d458636854d 100644
--- a/identity/handler.go
+++ b/identity/handler.go
@@ -11,6 +11,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/gofrs/uuid"
+
 	"github.com/ory/x/crdbx"
 	"github.com/ory/x/pagination/keysetpagination"
 
@@ -117,10 +119,7 @@ func (h *Handler) RegisterAdminRoutes(admin *x.RouterAdmin) {
 // Paginated Identity List Response
 //
 // swagger:response listIdentities
-//
-//nolint:deadcode,unused
-//lint:ignore U1000 Used to generate Swagger and OpenAPI definitions
-type listIdentitiesResponse struct {
+type _ struct {
 	migrationpagination.ResponseHeaderAnnotation
 
 	// List of identities
@@ -131,15 +130,19 @@ type listIdentitiesResponse struct {
 
 // Paginated List Identity Parameters
 //
-// swagger:parameters listIdentities
+// Note: Filters cannot be combined.
 //
-//nolint:deadcode,unused
-//lint:ignore U1000 Used to generate Swagger and OpenAPI definitions
-type listIdentitiesParameters struct {
+// swagger:parameters listIdentities
+type _ struct {
 	migrationpagination.RequestParameters
 
-	// List of ids used to filter identities.
-	// If this list is empty, then no filter will be applied.
+	// Retrieve multiple identities by their IDs.
+	//
+	// This parameter has the following limitations:
+	//
+	// - Duplicate or non-existent IDs are ignored.
+	// - The order of returned IDs may be different from the request.
+	// - This filter does not support pagination. You must implement your own pagination as the maximum number of items returned by this endpoint may not exceed a certain threshold (currently 500).
 	//
 	// required: false
 	// in: query
@@ -171,14 +174,82 @@ type listIdentitiesParameters struct {
 	// in: query
 	DeclassifyCredentials []string `json:"include_credential"`
 
+	// List identities that belong to a specific organization.
+	//
+	// required: false
+	// in: query
+	OrganizationID string `json:"organization_id"`
+
 	crdbx.ConsistencyRequestParameters
 }
 
+func parseListIdentitiesParameters(r *http.Request) (params ListIdentityParameters, err error) {
+	query := r.URL.Query()
+	var requestedFilters int
+
+	params.Expand = ExpandDefault
+
+	if ids := query["ids"]; len(ids) > 0 {
+		requestedFilters++
+		for _, v := range ids {
+			id, err := uuid.FromString(v)
+			if err != nil {
+				return params, errors.WithStack(herodot.ErrBadRequest.WithReasonf("Invalid UUID value `%s` for parameter `ids`.", v))
+			}
+			params.IdsFilter = append(params.IdsFilter, id)
+		}
+	}
+	if len(params.IdsFilter) > 500 {
+		return params, errors.WithStack(herodot.ErrBadRequest.WithReason("The number of ids to filter must not exceed 500."))
+	}
+
+	if orgID := query.Get("organization_id"); orgID != "" {
+		requestedFilters++
+		params.OrganizationID, err = uuid.FromString(orgID)
+		if err != nil {
+			return params, errors.WithStack(herodot.ErrBadRequest.WithReasonf("Invalid UUID value `%s` for parameter `organization_id`.", orgID))
+		}
+	}
+
+	if identifier := query.Get("credentials_identifier"); identifier != "" {
+		requestedFilters++
+		params.Expand = ExpandEverything
+		params.CredentialsIdentifier = identifier
+	}
+
+	if identifier := query.Get("preview_credentials_identifier_similar"); identifier != "" {
+		requestedFilters++
+		params.Expand = ExpandEverything
+		params.CredentialsIdentifierSimilar = identifier
+	}
+
+	for _, v := range query["include_credential"] {
+		params.Expand = ExpandEverything
+		tc, ok := ParseCredentialsType(v)
+		if !ok {
+			return params, errors.WithStack(herodot.ErrBadRequest.WithReasonf("Invalid value `%s` for parameter `include_credential`.", v))
+		}
+		params.DeclassifyCredentials = append(params.DeclassifyCredentials, tc)
+	}
+
+	if requestedFilters > 1 {
+		return params, errors.WithStack(herodot.ErrBadRequest.WithReason("You cannot combine multiple filters in this API"))
+	}
+
+	params.KeySetPagination, params.PagePagination, err = x.ParseKeysetOrPagePagination(r)
+	if err != nil {
+		return params, err
+	}
+	params.ConsistencyLevel = crdbx.ConsistencyLevelFromRequest(r)
+
+	return params, nil
+}
+
 // swagger:route GET /admin/identities identity listIdentities
 //
 // # List Identities
 //
-// Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system.
+// Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system. Note: filters cannot be combined.
 //
 //	Produces:
 //	- application/json
@@ -192,37 +263,7 @@ type listIdentitiesParameters struct {
 //	  200: listIdentities
 //	  default: errorGeneric
 func (h *Handler) list(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	includeCredentials := r.URL.Query()["include_credential"]
-	var declassify []CredentialsType
-	for _, v := range includeCredentials {
-		tc, ok := ParseCredentialsType(v)
-		if ok {
-			declassify = append(declassify, tc)
-		} else {
-			h.r.Writer().WriteError(w, r, errors.WithStack(herodot.ErrBadRequest.WithReasonf("Invalid value `%s` for parameter `include_credential`.", declassify)))
-			return
-		}
-	}
-
-	var (
-		err    error
-		params = ListIdentityParameters{
-			Expand:                       ExpandDefault,
-			IdsFilter:                    r.URL.Query()["ids"],
-			CredentialsIdentifier:        r.URL.Query().Get("credentials_identifier"),
-			CredentialsIdentifierSimilar: r.URL.Query().Get("preview_credentials_identifier_similar"),
-			ConsistencyLevel:             crdbx.ConsistencyLevelFromRequest(r),
-			DeclassifyCredentials:        declassify,
-		}
-	)
-	if params.CredentialsIdentifier != "" && params.CredentialsIdentifierSimilar != "" {
-		h.r.Writer().WriteError(w, r, herodot.ErrBadRequest.WithReason("Cannot pass both credentials_identifier and preview_credentials_identifier_similar."))
-		return
-	}
-	if params.CredentialsIdentifier != "" || params.CredentialsIdentifierSimilar != "" || len(params.DeclassifyCredentials) > 0 {
-		params.Expand = ExpandEverything
-	}
-	params.KeySetPagination, params.PagePagination, err = x.ParseKeysetOrPagePagination(r)
+	params, err := parseListIdentitiesParameters(r)
 	if err != nil {
 		h.r.Writer().WriteError(w, r, err)
 		return
@@ -245,7 +286,7 @@ func (h *Handler) list(w http.ResponseWriter, r *http.Request, _ httprouter.Para
 		}
 		u := *r.URL
 		pagepagination.PaginationHeader(w, &u, total, params.PagePagination.Page, params.PagePagination.ItemsPerPage)
-	} else {
+	} else if nextPage != nil {
 		u := *r.URL
 		keysetpagination.Header(w, &u, nextPage)
 	}
@@ -424,6 +465,9 @@ type AdminIdentityImportCredentialsPasswordConfig struct {
 
 	// The password in plain text if no hash is available.
 	Password string `json:"password"`
+
+	// If set to true, the password will be migrated using the password migration hook.
+	UsePasswordMigrationHook bool `json:"use_password_migration_hook,omitempty"`
 }
 
 // Create Identity and Import Social Sign In Credentials
@@ -614,13 +658,22 @@ func (h *Handler) batchPatchIdentities(w http.ResponseWriter, r *http.Request, _
 		}
 	}
 
-	if err := h.r.IdentityManager().CreateIdentities(r.Context(), identities); err != nil {
+	err := h.r.IdentityManager().CreateIdentities(r.Context(), identities)
+	partialErr := new(CreateIdentitiesError)
+	if err != nil && !errors.As(err, &partialErr) {
 		h.r.Writer().WriteError(w, r, err)
 		return
 	}
 	for resIdx, identitiesIdx := range indexInIdentities {
 		if identitiesIdx != nil {
-			res.Identities[resIdx].IdentityID = &identities[*identitiesIdx].ID
+			ident := identities[*identitiesIdx]
+			// Check if the identity was created successfully.
+			if failed := partialErr.Find(ident); failed != nil {
+				res.Identities[resIdx].Action = ActionError
+				res.Identities[resIdx].Error = failed.Error
+			} else {
+				res.Identities[resIdx].IdentityID = &ident.ID
+			}
 		}
 	}
 
diff --git a/identity/handler_import.go b/identity/handler_import.go
index a3a7ca2ab0a1..babb09579af1 100644
--- a/identity/handler_import.go
+++ b/identity/handler_import.go
@@ -19,7 +19,15 @@ func (h *Handler) importCredentials(ctx context.Context, i *Identity, creds *Ide
 		return nil
 	}
 
+	// This method only support password and OIDC import at the moment.
+	// If other methods are added please ensure that the available AAL is set correctly in the identity.
+	//
+	// It would actually be good if we would validate the identity post-creation to see if the credentials are working.
 	if creds.Password != nil {
+		// This method is somewhat hacky, because it does not set the credential's identifier. It relies on the
+		// identity validation to set the identifier, which is called after this method.
+		//
+		// It would be good to make this explicit.
 		if err := h.importPasswordCredentials(ctx, i, creds.Password); err != nil {
 			return err
 		}
@@ -35,6 +43,10 @@ func (h *Handler) importCredentials(ctx context.Context, i *Identity, creds *Ide
 }
 
 func (h *Handler) importPasswordCredentials(ctx context.Context, i *Identity, creds *AdminIdentityImportCredentialsPassword) (err error) {
+	if creds.Config.UsePasswordMigrationHook {
+		return i.SetCredentialsWithConfig(CredentialsTypePassword, Credentials{}, CredentialsPassword{UsePasswordMigrationHook: true})
+	}
+
 	// In here we deliberately ignore any password policies as the point here is to import passwords, even if they
 	// are not matching the policy, as the user needs to able to sign in with their old password.
 	hashed := []byte(creds.Config.HashedPassword)
diff --git a/identity/handler_test.go b/identity/handler_test.go
index 53ca219b231b..66f4936961f3 100644
--- a/identity/handler_test.go
+++ b/identity/handler_test.go
@@ -307,6 +307,21 @@ func TestHandler(t *testing.T) {
 			}
 		})
 
+		t.Run("with password migration hook enabled", func(t *testing.T) {
+			res := send(t, adminTS, "POST", "/identities", http.StatusCreated, identity.CreateIdentityBody{
+				Traits: []byte(`{"email": "pw-migration-hook@ory.sh"}`),
+				Credentials: &identity.IdentityWithCredentials{Password: &identity.AdminIdentityImportCredentialsPassword{
+					Config: identity.AdminIdentityImportCredentialsPasswordConfig{UsePasswordMigrationHook: true},
+				}},
+			})
+			actual, err := reg.PrivilegedIdentityPool().GetIdentityConfidential(ctx, uuid.FromStringOrNil(res.Get("id").String()))
+			require.NoError(t, err)
+
+			snapshotx.SnapshotT(t, identity.WithCredentialsAndAdminMetadataInJSON(*actual), snapshotx.ExceptNestedKeys(ignoreDefault...), snapshotx.ExceptNestedKeys("hashed_password"))
+
+			assert.True(t, gjson.GetBytes(actual.Credentials[identity.CredentialsTypePassword].Config, "use_password_migration_hook").Bool())
+		})
+
 		t.Run("with not-normalized email", func(t *testing.T) {
 			res := send(t, adminTS, "POST", "/identities", http.StatusCreated, identity.CreateIdentityBody{
 				SchemaID: "customer",
@@ -354,21 +369,55 @@ func TestHandler(t *testing.T) {
 				id := x.ParseUUID(res.Get("id").String())
 				ids = append(ids, id)
 			}
-			require.Equal(t, len(ids), identitiesAmount)
+			require.Len(t, ids, identitiesAmount)
 		})
 
-		t.Run("case= list few identities", func(t *testing.T) {
-			url := "/identities?ids=" + ids[0].String()
+		t.Run("case=list few identities", func(t *testing.T) {
+			url := "/identities?ids=" + ids[0].String() + "&ids=" + ids[0].String() // duplicate ID is deduplicated in result
 			for i := 1; i < listAmount; i++ {
 				url += "&ids=" + ids[i].String()
 			}
-			res := get(t, adminTS, url, 200)
+			res := get(t, adminTS, url, http.StatusOK)
 
 			identities := res.Array()
-			require.Equal(t, len(identities), listAmount)
+			require.Len(t, identities, listAmount)
 		})
 	})
 
+	t.Run("case=list identities by ID is capped at 500", func(t *testing.T) {
+		url := "/identities?ids=" + x.NewUUID().String()
+		for i := 0; i < 501; i++ {
+			url += "&ids=" + x.NewUUID().String()
+		}
+		res := get(t, adminTS, url, http.StatusBadRequest)
+		assert.Contains(t, res.Get("error.reason").String(), "must not exceed 500")
+	})
+
+	t.Run("case=list identities cannot combine filters", func(t *testing.T) {
+		filters := []string{
+			"ids=" + x.NewUUID().String(),
+			"credentials_identifier=foo@bar.com",
+			"preview_credentials_identifier_similar=bar.com",
+			"organization_id=" + x.NewUUID().String(),
+		}
+		for i := range filters {
+			for j := range filters {
+				if i == j {
+					continue // OK to use the same filter multiple times. Behavior varies by filter, though.
+				}
+
+				url := "/identities?" + filters[i] + "&" + filters[j]
+				res := get(t, adminTS, url, http.StatusBadRequest)
+				assert.Contains(t, res.Get("error.reason").String(), "cannot combine multiple filters")
+			}
+		}
+	})
+
+	t.Run("case=malformed ids should return an error", func(t *testing.T) {
+		res := get(t, adminTS, "/identities?ids=not-a-uuid", http.StatusBadRequest)
+		assert.Contains(t, res.Get("error.reason").String(), "Invalid UUID value `not-a-uuid` for parameter `ids`.", "%s", res.Raw)
+	})
+
 	t.Run("suite=create and update", func(t *testing.T) {
 		var i identity.Identity
 		createOidcIdentity := func(t *testing.T, identifier, accessToken, refreshToken, idToken string, encrypt bool) string {
@@ -734,7 +783,7 @@ func TestHandler(t *testing.T) {
 	})
 
 	t.Run("suite=PATCH identities", func(t *testing.T) {
-		t.Run("case=fails on > 100 identities", func(t *testing.T) {
+		t.Run("case=fails with too many patches", func(t *testing.T) {
 			tooMany := make([]*identity.BatchIdentityPatch, identity.BatchPatchIdentitiesLimit+1)
 			for i := range tooMany {
 				tooMany[i] = &identity.BatchIdentityPatch{Create: validCreateIdentityBody("too-many-patches", i)}
@@ -744,53 +793,83 @@ func TestHandler(t *testing.T) {
 			assert.Contains(t, res.Get("error.reason").String(), strconv.Itoa(identity.BatchPatchIdentitiesLimit),
 				"the error reason should contain the limit")
 		})
-		t.Run("case=fails all on a bad identity", func(t *testing.T) {
+		t.Run("case=fails some on a bad identity", func(t *testing.T) {
 			// Test setup: we have a list of valid identitiy patches and a list of invalid ones.
 			// Each run adds one invalid patch to the list and sends it to the server.
-			// --> we expect the server to fail all patches in the list.
-			// Finally, we send just the valid patches
+			// --> we expect the server to fail only the bad patches in the list.
+			// Finally, we send just valid patches
 			// --> we expect the server to succeed all patches in the list.
-			validPatches := []*identity.BatchIdentityPatch{
-				{Create: validCreateIdentityBody("valid-patch", 0)},
-				{Create: validCreateIdentityBody("valid-patch", 1)},
-				{Create: validCreateIdentityBody("valid-patch", 2)},
-				{Create: validCreateIdentityBody("valid-patch", 3)},
-				{Create: validCreateIdentityBody("valid-patch", 4)},
-			}
 
-			for _, tt := range []struct {
-				name         string
-				body         *identity.CreateIdentityBody
-				expectStatus int
-			}{
-				{
-					name:         "missing all fields",
-					body:         &identity.CreateIdentityBody{},
-					expectStatus: http.StatusBadRequest,
-				},
-				{
-					name:         "duplicate identity",
-					body:         validCreateIdentityBody("valid-patch", 0),
-					expectStatus: http.StatusConflict,
-				},
-				{
-					name: "invalid traits",
-					body: &identity.CreateIdentityBody{
-						Traits: json.RawMessage(`"invalid traits"`),
-					},
-					expectStatus: http.StatusBadRequest,
-				},
-			} {
-				t.Run("invalid because "+tt.name, func(t *testing.T) {
-					patches := append([]*identity.BatchIdentityPatch{}, validPatches...)
-					patches = append(patches, &identity.BatchIdentityPatch{Create: tt.body})
+			t.Run("case=invalid patches fail", func(t *testing.T) {
+				patches := []*identity.BatchIdentityPatch{
+					{Create: validCreateIdentityBody("valid", 0)},
+					{Create: validCreateIdentityBody("valid", 1)},
+					{Create: &identity.CreateIdentityBody{}}, // <-- invalid: missing all fields
+					{Create: validCreateIdentityBody("valid", 2)},
+					{Create: validCreateIdentityBody("valid", 0)}, // <-- duplicate
+					{Create: validCreateIdentityBody("valid", 3)},
+					{Create: &identity.CreateIdentityBody{Traits: json.RawMessage(`"invalid traits"`)}}, // <-- invalid traits
+					{Create: validCreateIdentityBody("valid", 4)},
+				}
+				expectedToPass := []*identity.BatchIdentityPatch{patches[0], patches[1], patches[3], patches[5], patches[7]}
+
+				// Create unique IDs for each patch
+				patchIDs := make([]string, len(patches))
+				for i, p := range patches {
+					id := uuid.NewV5(uuid.Nil, fmt.Sprintf("%d", i))
+					p.ID = &id
+					patchIDs[i] = id.String()
+				}
 
-					req := &identity.BatchPatchIdentitiesBody{Identities: patches}
-					send(t, adminTS, "PATCH", "/identities", tt.expectStatus, req)
-				})
-			}
+				req := &identity.BatchPatchIdentitiesBody{Identities: patches}
+				body := send(t, adminTS, "PATCH", "/identities", http.StatusOK, req)
+				var actions []string
+				require.NoErrorf(t, json.Unmarshal(([]byte)(body.Get("identities.#.action").Raw), &actions), "%s", body)
+				assert.Equalf(t,
+					[]string{"create", "create", "error", "create", "error", "create", "error", "create"},
+					actions, "%s", body)
+
+				// Check that all patch IDs are returned
+				for i, gotPatchID := range body.Get("identities.#.patch_id").Array() {
+					assert.Equal(t, patchIDs[i], gotPatchID.String())
+				}
+
+				// Check specific errors
+				assert.Equal(t, "Bad Request", body.Get("identities.2.error.status").String())
+				assert.Equal(t, "Conflict", body.Get("identities.4.error.status").String())
+				assert.Equal(t, "Bad Request", body.Get("identities.6.error.status").String())
+
+				var identityIDs []uuid.UUID
+				require.NoErrorf(t, json.Unmarshal(([]byte)(body.Get("identities.#.identity").Raw), &identityIDs), "%s", body)
+
+				actualIdentities, _, err := reg.Persister().ListIdentities(ctx, identity.ListIdentityParameters{IdsFilter: identityIDs})
+				require.NoError(t, err)
+				actualIdentityIDs := make([]uuid.UUID, len(actualIdentities))
+				for i, id := range actualIdentities {
+					actualIdentityIDs[i] = id.ID
+				}
+				assert.ElementsMatchf(t, identityIDs, actualIdentityIDs, "%s", body)
+
+				expectedTraits := make(map[string]string, len(expectedToPass))
+				for i, p := range expectedToPass {
+					expectedTraits[identityIDs[i].String()] = string(p.Create.Traits)
+				}
+				actualTraits := make(map[string]string, len(actualIdentities))
+				for _, id := range actualIdentities {
+					actualTraits[id.ID.String()] = string(id.Traits)
+				}
+
+				assert.Equal(t, expectedTraits, actualTraits)
+			})
 
 			t.Run("valid patches succeed", func(t *testing.T) {
+				validPatches := []*identity.BatchIdentityPatch{
+					{Create: validCreateIdentityBody("valid-patch", 0)},
+					{Create: validCreateIdentityBody("valid-patch", 1)},
+					{Create: validCreateIdentityBody("valid-patch", 2)},
+					{Create: validCreateIdentityBody("valid-patch", 3)},
+					{Create: validCreateIdentityBody("valid-patch", 4)},
+				}
 				req := &identity.BatchPatchIdentitiesBody{Identities: validPatches}
 				send(t, adminTS, "PATCH", "/identities", http.StatusOK, req)
 			})
@@ -1442,6 +1521,44 @@ func TestHandler(t *testing.T) {
 		}
 	})
 
+	t.Run("organizations", func(t *testing.T) {
+		t.Run("case=should list organization identities", func(t *testing.T) {
+			for name, ts := range map[string]*httptest.Server{"admin": adminTS} {
+				t.Run("endpoint="+name, func(t *testing.T) {
+					orgID := uuid.Must(uuid.NewV4())
+					email := x.NewUUID().String() + "@ory.sh"
+					reg.IdentityManager().Create(ctx, &identity.Identity{
+						Traits:         identity.Traits(`{"email":"` + email + `"}`),
+						OrganizationID: uuid.NullUUID{UUID: orgID, Valid: true},
+					})
+
+					res := get(t, ts, "/identities?organization_id="+orgID.String(), http.StatusOK)
+					assert.Len(t, res.Array(), 1)
+					assert.EqualValues(t, email, res.Get(`0.traits.email`).String(), "%s", res.Raw)
+				})
+			}
+		})
+
+		t.Run("case=malformed organization id should return an error", func(t *testing.T) {
+			for name, ts := range map[string]*httptest.Server{"admin": adminTS} {
+				t.Run("endpoint="+name, func(t *testing.T) {
+					res := get(t, ts, "/identities?organization_id=not-a-uuid", http.StatusBadRequest)
+					assert.Contains(t, res.Get("error.reason").String(), "Invalid UUID value `not-a-uuid` for parameter `organization_id`.", "%s", res.Raw)
+				})
+			}
+		})
+
+		t.Run("case=unknown organization id should return an empty list", func(t *testing.T) {
+			for name, ts := range map[string]*httptest.Server{"admin": adminTS} {
+				t.Run("endpoint="+name, func(t *testing.T) {
+					id := x.NewUUID()
+					res := get(t, ts, "/identities?organization_id="+id.String(), http.StatusOK)
+					assert.Len(t, res.Array(), 0)
+				})
+			}
+		})
+	})
+
 	t.Run("case=should list all identities with credentials", func(t *testing.T) {
 		t.Run("include_credential=oidc should include OIDC credentials config", func(t *testing.T) {
 			res := get(t, adminTS, "/identities?include_credential=oidc&credentials_identifier=bar:foo.oidc@bar.com", http.StatusOK)
@@ -1614,7 +1731,7 @@ func TestHandler(t *testing.T) {
 							AddedAt:     time.Date(2022, 12, 16, 14, 11, 55, 0, time.UTC),
 							PublicKey:   []byte("pQECAyYgASFYIMJLQhJxQRzhnKPTcPCUODOmxYDYo2obrm9bhp5lvSZ3IlggXjhZvJaPUqF9PXqZqTdWYPR7R+b2n/Wi+IxKKXsS4rU="),
 							DisplayName: "test",
-							Authenticator: identity.AuthenticatorWebAuthn{
+							Authenticator: &identity.AuthenticatorWebAuthn{
 								AAGUID:       []byte("rc4AAjW8xgpkiwsl8fBVAw=="),
 								SignCount:    0,
 								CloneWarning: false,
@@ -1627,7 +1744,7 @@ func TestHandler(t *testing.T) {
 							AddedAt:     time.Date(2022, 12, 16, 14, 11, 55, 0, time.UTC),
 							PublicKey:   []byte("pQECAyYgASFYIMJLQhJxQRzhnKPTcPCUODOmxYDYo2obrm9bhp5lvSZ3IlggXjhZvJaPUqF9PXqZqTdWYPR7R+b2n/Wi+IxKKXsS4rU="),
 							DisplayName: "test",
-							Authenticator: identity.AuthenticatorWebAuthn{
+							Authenticator: &identity.AuthenticatorWebAuthn{
 								AAGUID:       []byte("rc4AAjW8xgpkiwsl8fBVAw=="),
 								SignCount:    0,
 								CloneWarning: false,
@@ -1640,7 +1757,7 @@ func TestHandler(t *testing.T) {
 							AddedAt:     time.Date(2022, 12, 16, 14, 11, 55, 0, time.UTC),
 							PublicKey:   []byte("pQECAyYgASFYIMJLQhJxQRzhnKPTcPCUODOmxYDYo2obrm9bhp5lvSZ3IlggXjhZvJaPUqF9PXqZqTdWYPR7R+b2n/Wi+IxKKXsS4rU="),
 							DisplayName: "test",
-							Authenticator: identity.AuthenticatorWebAuthn{
+							Authenticator: &identity.AuthenticatorWebAuthn{
 								AAGUID:       []byte("rc4AAjW8xgpkiwsl8fBVAw=="),
 								SignCount:    0,
 								CloneWarning: false,
@@ -1653,7 +1770,7 @@ func TestHandler(t *testing.T) {
 							AddedAt:     time.Date(2022, 12, 16, 14, 11, 55, 0, time.UTC),
 							PublicKey:   []byte("pQECAyYgASFYIMJLQhJxQRzhnKPTcPCUODOmxYDYo2obrm9bhp5lvSZ3IlggXjhZvJaPUqF9PXqZqTdWYPR7R+b2n/Wi+IxKKXsS4rU="),
 							DisplayName: "test",
-							Authenticator: identity.AuthenticatorWebAuthn{
+							Authenticator: &identity.AuthenticatorWebAuthn{
 								AAGUID:       []byte("rc4AAjW8xgpkiwsl8fBVAw=="),
 								SignCount:    0,
 								CloneWarning: false,
@@ -1860,7 +1977,7 @@ func validCreateIdentityBody(prefix string, i int) *identity.CreateIdentityBody
 		identity.VerifiableAddressStatusCompleted,
 	}
 
-	for j := 0; j < 4; j++ {
+	for j := range 4 {
 		email := fmt.Sprintf("%s-%d-%d@ory.sh", prefix, i, j)
 		traits.Emails = append(traits.Emails, email)
 		verifiableAddresses = append(verifiableAddresses, identity.VerifiableAddress{
diff --git a/identity/identity.go b/identity/identity.go
index 3f692b831f2b..d21cadb36ab3 100644
--- a/identity/identity.go
+++ b/identity/identity.go
@@ -11,22 +11,17 @@ import (
 	"sync"
 	"time"
 
+	"github.com/gofrs/uuid"
+	"github.com/pkg/errors"
 	"github.com/samber/lo"
-
-	"github.com/tidwall/sjson"
-
 	"github.com/tidwall/gjson"
-
-	"github.com/ory/kratos/cipher"
+	"github.com/tidwall/sjson"
 
 	"github.com/ory/herodot"
+	"github.com/ory/kratos/cipher"
+	"github.com/ory/kratos/driver/config"
 	"github.com/ory/x/pagination/keysetpagination"
 	"github.com/ory/x/sqlxx"
-
-	"github.com/ory/kratos/driver/config"
-
-	"github.com/gofrs/uuid"
-	"github.com/pkg/errors"
 )
 
 // An Identity's State
@@ -68,9 +63,17 @@ type Identity struct {
 	// Credentials represents all credentials that can be used for authenticating this identity.
 	Credentials map[CredentialsType]Credentials `json:"credentials,omitempty" faker:"-" db:"-"`
 
-	// AvailableAAL defines the maximum available AAL for this identity. If the user has only a password
-	// configured, the AAL will be 1. If the user has a password and a TOTP configured, the AAL will be 2.
-	AvailableAAL NullableAuthenticatorAssuranceLevel `json:"-" faker:"-" db:"available_aal"`
+	// InternalAvailableAAL defines the maximum available AAL for this identity.
+	//
+	// - If the user has at least one two-factor authentication method configured, the AAL will be 2.
+	// - If the user has only a password configured, the AAL will be 1.
+	//
+	// This field is AAL2 as soon as a second factor credential is found. A first factor is not required for this
+	// field to return `aal2`.
+	//
+	// This field is primarily used to determine whether the user needs to upgrade to AAL2 without having to check
+	// all the credentials in the database. Use with caution!
+	InternalAvailableAAL NullableAuthenticatorAssuranceLevel `json:"-" faker:"-" db:"available_aal"`
 
 	// // IdentifierCredentials contains the access and refresh token for oidc identifier
 	// IdentifierCredentials []IdentifierCredential `json:"identifier_credentials,omitempty" faker:"-" db:"-"`
@@ -345,24 +348,27 @@ func (i *Identity) UnmarshalJSON(b []byte) error {
 	return err
 }
 
+// SetAvailableAAL sets the InternalAvailableAAL field based on the credentials stored in the identity.
+//
+// If a second factor is set up, the AAL will be set to 2. If only a first factor is set up, the AAL will be set to 1.
+//
+// A first factor is NOT required for the AAL to be set to 2 if a second factor is set up.
 func (i *Identity) SetAvailableAAL(ctx context.Context, m *Manager) (err error) {
-	i.AvailableAAL = NewNullableAuthenticatorAssuranceLevel(NoAuthenticatorAssuranceLevel)
-	if c, err := m.CountActiveFirstFactorCredentials(ctx, i); err != nil {
+	if c, err := m.CountActiveMultiFactorCredentials(ctx, i); err != nil {
 		return err
-	} else if c == 0 {
-		// No first factor set up - AAL is 0
+	} else if c > 0 {
+		i.InternalAvailableAAL = NewNullableAuthenticatorAssuranceLevel(AuthenticatorAssuranceLevel2)
 		return nil
 	}
 
-	i.AvailableAAL = NewNullableAuthenticatorAssuranceLevel(AuthenticatorAssuranceLevel1)
-	if c, err := m.CountActiveMultiFactorCredentials(ctx, i); err != nil {
+	if c, err := m.CountActiveFirstFactorCredentials(ctx, i); err != nil {
 		return err
-	} else if c == 0 {
-		// No second factor set up - AAL is 1
+	} else if c > 0 {
+		i.InternalAvailableAAL = NewNullableAuthenticatorAssuranceLevel(AuthenticatorAssuranceLevel1)
 		return nil
 	}
 
-	i.AvailableAAL = NewNullableAuthenticatorAssuranceLevel(AuthenticatorAssuranceLevel2)
+	i.InternalAvailableAAL = NewNullableAuthenticatorAssuranceLevel(NoAuthenticatorAssuranceLevel)
 	return nil
 }
 
@@ -634,6 +640,9 @@ const (
 	// Create this identity.
 	ActionCreate BatchPatchAction = "create"
 
+	// Error indicates that the patch failed.
+	ActionError BatchPatchAction = "error"
+
 	// Future actions:
 	//
 	// Delete this identity.
@@ -666,4 +675,7 @@ type BatchIdentityPatchResponse struct {
 
 	// The ID of this patch response, if an ID was specified in the patch.
 	PatchID *uuid.UUID `json:"patch_id,omitempty"`
+
+	// The error message, if the action was "error".
+	Error *herodot.DefaultError `json:"error,omitempty"`
 }
diff --git a/identity/identity_test.go b/identity/identity_test.go
index d14388feacd4..3a84b7624abe 100644
--- a/identity/identity_test.go
+++ b/identity/identity_test.go
@@ -314,7 +314,7 @@ func TestVerifiableAddresses(t *testing.T) {
 type cipherProvider struct{}
 
 func (c *cipherProvider) Cipher(ctx context.Context) cipher.Cipher {
-	return cipher.NewNoop(nil)
+	return cipher.NewNoop()
 }
 
 func TestWithDeclassifiedCredentials(t *testing.T) {
diff --git a/identity/manager.go b/identity/manager.go
index 04fb3edae500..a09a08a778cd 100644
--- a/identity/manager.go
+++ b/identity/manager.go
@@ -6,14 +6,12 @@ package identity
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"reflect"
 	"slices"
 	"sort"
 
-	"go.opentelemetry.io/otel/trace"
-
 	"github.com/ory/kratos/schema"
-	"github.com/ory/kratos/x/events"
 	"github.com/ory/x/sqlcon"
 
 	"github.com/ory/x/otelx"
@@ -29,8 +27,6 @@ import (
 
 	"github.com/ory/herodot"
 	"github.com/ory/jsonschema/v3"
-	"github.com/ory/x/errorsx"
-
 	"github.com/ory/kratos/courier"
 )
 
@@ -96,10 +92,6 @@ func (m *Manager) Create(ctx context.Context, i *Identity, opts ...ManagerOption
 		return err
 	}
 
-	if err := i.SetAvailableAAL(ctx, m); err != nil {
-		return err
-	}
-
 	if err := m.r.PrivilegedIdentityPool().CreateIdentity(ctx, i); err != nil {
 		if errors.Is(err, sqlcon.ErrUniqueViolation) {
 			return m.findExistingAuthMethod(ctx, err, i)
@@ -107,7 +99,6 @@ func (m *Manager) Create(ctx context.Context, i *Identity, opts ...ManagerOption
 		return err
 	}
 
-	trace.SpanFromContext(ctx).AddEvent(events.NewIdentityCreated(ctx, i.ID))
 	return nil
 }
 
@@ -218,6 +209,15 @@ func (m *Manager) findExistingAuthMethod(ctx context.Context, e error, i *Identi
 			}
 
 			duplicateCredErr.AddCredentialsType(cred.Type)
+
+		case CredentialsTypeCodeAuth:
+			identifierHint := foundConflictAddress
+			if len(cred.Identifiers) > 0 {
+				identifierHint = cred.Identifiers[0]
+			}
+
+			duplicateCredErr.SetIdentifierHint(identifierHint)
+			duplicateCredErr.AddCredentialsType(cred.Type)
 		case CredentialsTypeOIDC:
 			var cfg CredentialsOIDC
 			if err := json.Unmarshal(cred.Config, &cfg); err != nil {
@@ -309,6 +309,9 @@ func (e *ErrDuplicateCredentials) AvailableCredentials() []string {
 }
 
 func (e *ErrDuplicateCredentials) AvailableOIDCProviders() []string {
+	if e.availableOIDCProviders == nil {
+		return []string{}
+	}
 	slices.Sort(e.availableOIDCProviders)
 	return e.availableOIDCProviders
 }
@@ -316,38 +319,102 @@ func (e *ErrDuplicateCredentials) AvailableOIDCProviders() []string {
 func (e *ErrDuplicateCredentials) IdentifierHint() string {
 	return e.identifierHint
 }
+
 func (e *ErrDuplicateCredentials) HasHints() bool {
 	return len(e.availableCredentials) > 0 || len(e.availableOIDCProviders) > 0 || len(e.identifierHint) > 0
 }
 
+type FailedIdentity struct {
+	Identity *Identity
+	Error    *herodot.DefaultError
+}
+
+type CreateIdentitiesError struct {
+	failedIdentities map[*Identity]*herodot.DefaultError
+}
+
+func NewCreateIdentitiesError(capacity int) *CreateIdentitiesError {
+	return &CreateIdentitiesError{
+		failedIdentities: make(map[*Identity]*herodot.DefaultError, capacity),
+	}
+}
+
+func (e *CreateIdentitiesError) Error() string {
+	e.init()
+	return fmt.Sprintf("create identities error: %d identities failed", len(e.failedIdentities))
+}
+func (e *CreateIdentitiesError) Unwrap() []error {
+	e.init()
+	var errs []error
+	for _, err := range e.failedIdentities {
+		errs = append(errs, err)
+	}
+	return errs
+}
+
+func (e *CreateIdentitiesError) AddFailedIdentity(ident *Identity, err *herodot.DefaultError) {
+	e.init()
+	e.failedIdentities[ident] = err
+}
+func (e *CreateIdentitiesError) Merge(other *CreateIdentitiesError) {
+	e.init()
+	for k, v := range other.failedIdentities {
+		e.failedIdentities[k] = v
+	}
+}
+func (e *CreateIdentitiesError) Contains(ident *Identity) bool {
+	e.init()
+	_, found := e.failedIdentities[ident]
+	return found
+}
+func (e *CreateIdentitiesError) Find(ident *Identity) *FailedIdentity {
+	e.init()
+	if err, found := e.failedIdentities[ident]; found {
+		return &FailedIdentity{Identity: ident, Error: err}
+	}
+
+	return nil
+}
+func (e *CreateIdentitiesError) ErrOrNil() error {
+	if e == nil || len(e.failedIdentities) == 0 {
+		return nil
+	}
+	return e
+}
+func (e *CreateIdentitiesError) init() {
+	if e.failedIdentities == nil {
+		e.failedIdentities = map[*Identity]*herodot.DefaultError{}
+	}
+}
+
 func (m *Manager) CreateIdentities(ctx context.Context, identities []*Identity, opts ...ManagerOption) (err error) {
 	ctx, span := m.r.Tracer(ctx).Tracer().Start(ctx, "identity.Manager.CreateIdentities")
 	defer otelx.End(span, &err)
 
-	for _, i := range identities {
-		if i.SchemaID == "" {
-			i.SchemaID = m.r.Config().DefaultIdentityTraitsSchemaID(ctx)
-		}
-
-		if err := i.SetAvailableAAL(ctx, m); err != nil {
-			return err
+	createIdentitiesError := NewCreateIdentitiesError(len(identities))
+	validIdentities := make([]*Identity, 0, len(identities))
+	for _, ident := range identities {
+		if ident.SchemaID == "" {
+			ident.SchemaID = m.r.Config().DefaultIdentityTraitsSchemaID(ctx)
 		}
 
 		o := newManagerOptions(opts)
-		if err := m.ValidateIdentity(ctx, i, o); err != nil {
-			return err
+		if err := m.ValidateIdentity(ctx, ident, o); err != nil {
+			createIdentitiesError.AddFailedIdentity(ident, herodot.ErrBadRequest.WithReasonf("%s", err).WithWrap(err))
+			continue
 		}
+		validIdentities = append(validIdentities, ident)
 	}
 
-	if err := m.r.PrivilegedIdentityPool().CreateIdentities(ctx, identities...); err != nil {
-		return err
-	}
-
-	for _, i := range identities {
-		trace.SpanFromContext(ctx).AddEvent(events.NewIdentityCreated(ctx, i.ID))
+	if err := m.r.PrivilegedIdentityPool().CreateIdentities(ctx, validIdentities...); err != nil {
+		if partialErr := new(CreateIdentitiesError); errors.As(err, &partialErr) {
+			createIdentitiesError.Merge(partialErr)
+		} else {
+			return err
+		}
 	}
 
-	return nil
+	return createIdentitiesError.ErrOrNil()
 }
 
 func (m *Manager) requiresPrivilegedAccess(ctx context.Context, original, updated *Identity, o *ManagerOptions) (err error) {
@@ -358,6 +425,7 @@ func (m *Manager) requiresPrivilegedAccess(ctx context.Context, original, update
 		if !CredentialsEqual(updated.Credentials, original.Credentials) {
 			// reset the identity
 			*updated = *original
+
 			return errors.WithStack(ErrProtectedFieldModified)
 		}
 
@@ -390,10 +458,6 @@ func (m *Manager) Update(ctx context.Context, updated *Identity, opts ...Manager
 		return err
 	}
 
-	if err := updated.SetAvailableAAL(ctx, m); err != nil {
-		return err
-	}
-
 	return m.r.PrivilegedIdentityPool().UpdateIdentity(ctx, updated)
 }
 
@@ -416,7 +480,6 @@ func (m *Manager) UpdateSchemaID(ctx context.Context, id uuid.UUID, schemaID str
 		return err
 	}
 
-	trace.SpanFromContext(ctx).AddEvent(events.NewIdentityUpdated(ctx, id))
 	return m.r.PrivilegedIdentityPool().UpdateIdentity(ctx, original)
 }
 
@@ -444,6 +507,30 @@ func (m *Manager) SetTraits(ctx context.Context, id uuid.UUID, traits Traits, op
 	return updated, nil
 }
 
+// RefreshAvailableAAL refreshes the available AAL for the identity.
+//
+// This method is a no-op if everything is up-to date.
+//
+// Please make sure to load all credentials before using this method.
+func (m *Manager) RefreshAvailableAAL(ctx context.Context, i *Identity) (err error) {
+	if len(i.Credentials) == 0 {
+		if err := m.r.PrivilegedIdentityPool().HydrateIdentityAssociations(ctx, i, ExpandCredentials); err != nil {
+			return err
+		}
+	}
+
+	aalBefore := i.InternalAvailableAAL
+	if err := i.SetAvailableAAL(ctx, m); err != nil {
+		return err
+	}
+
+	if aalBefore.String != i.InternalAvailableAAL.String || aalBefore.Valid != i.InternalAvailableAAL.Valid {
+		return m.r.PrivilegedIdentityPool().UpdateIdentityColumns(ctx, i, "available_aal")
+	}
+
+	return nil
+}
+
 func (m *Manager) UpdateTraits(ctx context.Context, id uuid.UUID, traits Traits, opts ...ManagerOption) (err error) {
 	ctx, span := m.r.Tracer(ctx).Tracer().Start(ctx, "identity.Manager.UpdateTraits")
 	defer otelx.End(span, &err)
@@ -453,22 +540,22 @@ func (m *Manager) UpdateTraits(ctx context.Context, id uuid.UUID, traits Traits,
 		return err
 	}
 
-	trace.SpanFromContext(ctx).AddEvent(events.NewIdentityUpdated(ctx, id))
 	return m.r.PrivilegedIdentityPool().UpdateIdentity(ctx, updated)
 }
 
 func (m *Manager) ValidateIdentity(ctx context.Context, i *Identity, o *ManagerOptions) (err error) {
-	// This trace is more noisy than it's worth in diagnostic power.
-	// ctx, span := m.r.Tracer(ctx).Tracer().Start(ctx, "identity.Manager.validate")
-	// defer otelx.End(span, &err)
-
 	if err := m.r.IdentityValidator().Validate(ctx, i); err != nil {
-		if _, ok := errorsx.Cause(err).(*jsonschema.ValidationError); ok && !o.ExposeValidationErrors {
+		var validationErr *jsonschema.ValidationError
+		if errors.As(err, &validationErr) && !o.ExposeValidationErrors {
 			return herodot.ErrBadRequest.WithReasonf("%s", err).WithWrap(err)
 		}
 		return err
 	}
 
+	if err := i.SetAvailableAAL(ctx, m); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -478,7 +565,7 @@ func (m *Manager) CountActiveFirstFactorCredentials(ctx context.Context, i *Iden
 	// defer otelx.End(span, &err)
 
 	for _, strategy := range m.r.ActiveCredentialsCounterStrategies(ctx) {
-		current, err := strategy.CountActiveFirstFactorCredentials(i.Credentials)
+		current, err := strategy.CountActiveFirstFactorCredentials(ctx, i.Credentials)
 		if err != nil {
 			return 0, err
 		}
@@ -494,7 +581,7 @@ func (m *Manager) CountActiveMultiFactorCredentials(ctx context.Context, i *Iden
 	// defer otelx.End(span, &err)
 
 	for _, strategy := range m.r.ActiveCredentialsCounterStrategies(ctx) {
-		current, err := strategy.CountActiveMultiFactorCredentials(i.Credentials)
+		current, err := strategy.CountActiveMultiFactorCredentials(ctx, i.Credentials)
 		if err != nil {
 			return 0, err
 		}
diff --git a/identity/manager_test.go b/identity/manager_test.go
index f45a3f05e4fc..b7659eba68a1 100644
--- a/identity/manager_test.go
+++ b/identity/manager_test.go
@@ -4,6 +4,7 @@
 package identity_test
 
 import (
+	"encoding/json"
 	"fmt"
 	"testing"
 	"time"
@@ -12,6 +13,8 @@ import (
 	"github.com/ory/x/pointerx"
 	"github.com/ory/x/sqlcon"
 
+	_ "embed"
+
 	"github.com/gofrs/uuid"
 
 	"github.com/ory/x/sqlxx"
@@ -28,6 +31,9 @@ import (
 	"github.com/ory/kratos/x"
 )
 
+//go:embed stub/aal.json
+var refreshAALStubs []byte
+
 func TestManager(t *testing.T) {
 	conf, reg := internal.NewFastRegistryWithMocks(t, configx.WithValues(map[string]interface{}{
 		config.ViperKeyPublicBaseURL:                     "https://www.ory.sh/",
@@ -70,6 +76,37 @@ func TestManager(t *testing.T) {
 		}
 	}
 
+	t.Run("method=CreateIdentities", func(t *testing.T) {
+		t.Run("case=should set AAL to 2 if password and TOTP is set", func(t *testing.T) {
+			email := uuid.Must(uuid.NewV4()).String() + "@ory.sh"
+			original := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
+			original.Traits = newTraits(email, "")
+			original.Credentials = map[identity.CredentialsType]identity.Credentials{
+				identity.CredentialsTypePassword: {
+					Type: identity.CredentialsTypePassword,
+					// By explicitly not setting the identifier, we mimic the behavior of the PATCH endpoint.
+					// This tests a bug we introduced on the PATCH endpoint where the AAL value would not be correct.
+					Identifiers: []string{},
+					Config:      sqlxx.JSONRawMessage(`{"hashed_password":"$2a$08$.cOYmAd.vCpDOoiVJrO5B.hjTLKQQ6cAK40u8uB.FnZDyPvVvQ9Q."}`),
+				},
+				identity.CredentialsTypeTOTP: {
+					Type: identity.CredentialsTypeTOTP,
+					// By explicitly not setting the identifier, we mimic the behavior of the PATCH endpoint.
+					// This tests a bug we introduced on the PATCH endpoint where the AAL value would not be correct.
+					Identifiers: []string{},
+					Config:      sqlxx.JSONRawMessage(`{"totp_url":"otpauth://totp/test"}`),
+				},
+			}
+			require.NoError(t, reg.IdentityManager().CreateIdentities(ctx, []*identity.Identity{original}))
+			fromStore, err := reg.PrivilegedIdentityPool().GetIdentity(ctx, original.ID, identity.ExpandNothing)
+			require.NoError(t, err)
+
+			got, ok := fromStore.InternalAvailableAAL.ToAAL()
+			require.True(t, ok)
+			assert.Equal(t, identity.AuthenticatorAssuranceLevel2, got)
+		})
+	})
+
 	t.Run("method=Create", func(t *testing.T) {
 		t.Run("case=should create identity and track extension fields", func(t *testing.T) {
 			email := uuid.Must(uuid.NewV4()).String() + "@ory.sh"
@@ -77,7 +114,7 @@ func TestManager(t *testing.T) {
 			original.Traits = newTraits(email, "")
 			require.NoError(t, reg.IdentityManager().Create(ctx, original))
 			checkExtensionFieldsForIdentities(t, email, original)
-			got, ok := original.AvailableAAL.ToAAL()
+			got, ok := original.InternalAvailableAAL.ToAAL()
 			require.True(t, ok)
 			assert.Equal(t, identity.NoAuthenticatorAssuranceLevel, got)
 		})
@@ -88,7 +125,7 @@ func TestManager(t *testing.T) {
 				original := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
 				original.Traits = newTraits(email, "")
 				require.NoError(t, reg.IdentityManager().Create(ctx, original))
-				got, ok := original.AvailableAAL.ToAAL()
+				got, ok := original.InternalAvailableAAL.ToAAL()
 				require.True(t, ok)
 				assert.Equal(t, identity.NoAuthenticatorAssuranceLevel, got)
 			})
@@ -105,7 +142,7 @@ func TestManager(t *testing.T) {
 					},
 				}
 				require.NoError(t, reg.IdentityManager().Create(ctx, original))
-				got, ok := original.AvailableAAL.ToAAL()
+				got, ok := original.InternalAvailableAAL.ToAAL()
 				require.True(t, ok)
 				assert.Equal(t, identity.AuthenticatorAssuranceLevel1, got)
 			})
@@ -127,12 +164,12 @@ func TestManager(t *testing.T) {
 					},
 				}
 				require.NoError(t, reg.IdentityManager().Create(ctx, original))
-				got, ok := original.AvailableAAL.ToAAL()
+				got, ok := original.InternalAvailableAAL.ToAAL()
 				require.True(t, ok)
 				assert.Equal(t, identity.AuthenticatorAssuranceLevel2, got)
 			})
 
-			t.Run("case=should set AAL to 0 if only TOTP is set", func(t *testing.T) {
+			t.Run("case=should set AAL to 2 if only TOTP is set", func(t *testing.T) {
 				email := uuid.Must(uuid.NewV4()).String() + "@ory.sh"
 				original := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
 				original.Traits = newTraits(email, "")
@@ -144,9 +181,9 @@ func TestManager(t *testing.T) {
 					},
 				}
 				require.NoError(t, reg.IdentityManager().Create(ctx, original))
-				got, ok := original.AvailableAAL.ToAAL()
+				got, ok := original.InternalAvailableAAL.ToAAL()
 				require.True(t, ok)
-				assert.Equal(t, identity.NoAuthenticatorAssuranceLevel, got)
+				assert.Equal(t, identity.AuthenticatorAssuranceLevel2, got)
 			})
 		})
 
@@ -192,7 +229,7 @@ func TestManager(t *testing.T) {
 					err := reg.IdentityManager().Create(ctx, second)
 					require.Error(t, err)
 
-					var verr = new(identity.ErrDuplicateCredentials)
+					verr := new(identity.ErrDuplicateCredentials)
 					assert.ErrorAs(t, err, &verr)
 					assert.EqualValues(t, []string{identity.CredentialsTypePassword.String()}, verr.AvailableCredentials())
 					assert.Len(t, verr.AvailableOIDCProviders(), 0)
@@ -216,7 +253,7 @@ func TestManager(t *testing.T) {
 					err := reg.IdentityManager().Create(ctx, second)
 					require.Error(t, err)
 
-					var verr = new(identity.ErrDuplicateCredentials)
+					verr := new(identity.ErrDuplicateCredentials)
 					assert.ErrorAs(t, err, &verr)
 					assert.EqualValues(t, []string{identity.CredentialsTypeWebAuthn.String()}, verr.AvailableCredentials())
 					assert.Len(t, verr.AvailableOIDCProviders(), 0)
@@ -241,7 +278,7 @@ func TestManager(t *testing.T) {
 					err := reg.IdentityManager().Create(ctx, second)
 					require.Error(t, err)
 
-					var verr = new(identity.ErrDuplicateCredentials)
+					verr := new(identity.ErrDuplicateCredentials)
 					assert.ErrorAs(t, err, &verr)
 					assert.ElementsMatch(t, []string{"oidc"}, verr.AvailableCredentials())
 					assert.ElementsMatch(t, []string{"google", "github"}, verr.AvailableOIDCProviders())
@@ -276,12 +313,36 @@ func TestManager(t *testing.T) {
 					err := reg.IdentityManager().Create(ctx, second)
 					require.Error(t, err)
 
-					var verr = new(identity.ErrDuplicateCredentials)
+					verr := new(identity.ErrDuplicateCredentials)
 					assert.ErrorAs(t, err, &verr)
 					assert.ElementsMatch(t, []string{"password", "oidc", "webauthn"}, verr.AvailableCredentials())
 					assert.ElementsMatch(t, []string{"google", "github"}, verr.AvailableOIDCProviders())
 					assert.Equal(t, email, verr.IdentifierHint())
 				})
+
+				t.Run("type=code", func(t *testing.T) {
+					email := uuid.Must(uuid.NewV4()).String() + "@ory.sh"
+					creds := map[identity.CredentialsType]identity.Credentials{
+						identity.CredentialsTypeCodeAuth: {
+							Type:        identity.CredentialsTypeCodeAuth,
+							Identifiers: []string{email},
+							Config:      sqlxx.JSONRawMessage(`{}`),
+						},
+					}
+
+					first := createIdentity(email, "email_creds", creds)
+					require.NoError(t, reg.IdentityManager().Create(ctx, first))
+
+					second := createIdentity(email, "email_creds", creds)
+					err := reg.IdentityManager().Create(ctx, second)
+					require.Error(t, err)
+
+					verr := new(identity.ErrDuplicateCredentials)
+					assert.ErrorAs(t, err, &verr)
+					assert.EqualValues(t, []string{identity.CredentialsTypeCodeAuth.String()}, verr.AvailableCredentials())
+					assert.Len(t, verr.AvailableOIDCProviders(), 0)
+					assert.Equal(t, verr.IdentifierHint(), email)
+				})
 			})
 
 			runAddress := func(t *testing.T, field string) {
@@ -306,7 +367,7 @@ func TestManager(t *testing.T) {
 					err := reg.IdentityManager().Create(ctx, second)
 					require.Error(t, err)
 
-					var verr = new(identity.ErrDuplicateCredentials)
+					verr := new(identity.ErrDuplicateCredentials)
 					assert.ErrorAs(t, err, &verr)
 					assert.EqualValues(t, []string{identity.CredentialsTypePassword.String()}, verr.AvailableCredentials())
 					assert.Len(t, verr.AvailableOIDCProviders(), 0)
@@ -335,7 +396,7 @@ func TestManager(t *testing.T) {
 					err := reg.IdentityManager().Create(ctx, second)
 					require.Error(t, err)
 
-					var verr = new(identity.ErrDuplicateCredentials)
+					verr := new(identity.ErrDuplicateCredentials)
 					assert.ErrorAs(t, err, &verr)
 					assert.EqualValues(t, []string{identity.CredentialsTypeOIDC.String()}, verr.AvailableCredentials())
 					assert.EqualValues(t, verr.AvailableOIDCProviders(), []string{"github", "google"})
@@ -378,7 +439,7 @@ func TestManager(t *testing.T) {
 				},
 			}
 			require.NoError(t, reg.IdentityManager().Update(ctx, original, identity.ManagerAllowWriteProtectedTraits))
-			assert.EqualValues(t, identity.AuthenticatorAssuranceLevel1, original.AvailableAAL.String)
+			assert.EqualValues(t, identity.AuthenticatorAssuranceLevel1, original.InternalAvailableAAL.String)
 		})
 
 		t.Run("case=should set AAL to 2 if password and TOTP is set", func(t *testing.T) {
@@ -393,19 +454,19 @@ func TestManager(t *testing.T) {
 				},
 			}
 			require.NoError(t, reg.IdentityManager().Create(ctx, original))
-			assert.EqualValues(t, identity.AuthenticatorAssuranceLevel1, original.AvailableAAL.String)
+			assert.EqualValues(t, identity.AuthenticatorAssuranceLevel1, original.InternalAvailableAAL.String)
 			require.NoError(t, reg.IdentityManager().Update(ctx, original, identity.ManagerAllowWriteProtectedTraits))
-			assert.EqualValues(t, identity.AuthenticatorAssuranceLevel1, original.AvailableAAL.String, "Updating without changes should not change AAL")
+			assert.EqualValues(t, identity.AuthenticatorAssuranceLevel1, original.InternalAvailableAAL.String, "Updating without changes should not change AAL")
 			original.Credentials[identity.CredentialsTypeTOTP] = identity.Credentials{
 				Type:        identity.CredentialsTypeTOTP,
 				Identifiers: []string{email},
 				Config:      sqlxx.JSONRawMessage(`{"totp_url":"otpauth://totp/test"}`),
 			}
 			require.NoError(t, reg.IdentityManager().Update(ctx, original, identity.ManagerAllowWriteProtectedTraits))
-			assert.EqualValues(t, identity.AuthenticatorAssuranceLevel2, original.AvailableAAL.String)
+			assert.EqualValues(t, identity.AuthenticatorAssuranceLevel2, original.InternalAvailableAAL.String)
 		})
 
-		t.Run("case=should set AAL to 0 if only TOTP is set", func(t *testing.T) {
+		t.Run("case=should set AAL to 2 if only TOTP is set", func(t *testing.T) {
 			email := uuid.Must(uuid.NewV4()).String() + "@ory.sh"
 			original := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
 			original.Traits = newTraits(email, "")
@@ -418,8 +479,8 @@ func TestManager(t *testing.T) {
 				},
 			}
 			require.NoError(t, reg.IdentityManager().Update(ctx, original, identity.ManagerAllowWriteProtectedTraits))
-			assert.True(t, original.AvailableAAL.Valid)
-			assert.EqualValues(t, identity.NoAuthenticatorAssuranceLevel, original.AvailableAAL.String)
+			assert.True(t, original.InternalAvailableAAL.Valid)
+			assert.EqualValues(t, identity.AuthenticatorAssuranceLevel2, original.InternalAvailableAAL.String)
 		})
 
 		t.Run("case=should not update protected traits without option", func(t *testing.T) {
@@ -616,6 +677,67 @@ func TestManager(t *testing.T) {
 			// That is why we only check the identity in the store.
 			checkExtensionFields(fromStore, "email-updatetraits-1@ory.sh")(t)
 		})
+
+		t.Run("case=should always update updated_at field", func(t *testing.T) {
+			original := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
+			original.Traits = newTraits("email-updatetraits-3@ory.sh", "")
+			require.NoError(t, reg.IdentityManager().Create(ctx, original))
+
+			time.Sleep(time.Millisecond)
+
+			require.NoError(t, reg.IdentityManager().UpdateTraits(
+				ctx, original.ID, newTraits("email-updatetraits-4@ory.sh", ""),
+				identity.ManagerAllowWriteProtectedTraits))
+
+			updated, err := reg.IdentityPool().GetIdentity(ctx, original.ID, identity.ExpandNothing)
+			require.NoError(t, err)
+			assert.NotEqual(t, original.UpdatedAt, updated.UpdatedAt, "UpdatedAt field should be updated")
+		})
+	})
+
+	t.Run("method=RefreshAvailableAAL", func(t *testing.T) {
+		var cases []struct {
+			Credentials []identity.Credentials `json:"credentials"`
+			Description string                 `json:"description"`
+			Expected    string                 `json:"expected"`
+		}
+		require.NoError(t, json.Unmarshal(refreshAALStubs, &cases))
+
+		for k, tc := range cases {
+			t.Run("case="+tc.Description, func(t *testing.T) {
+				email := x.NewUUID().String() + "@ory.sh"
+				id := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
+				id.Traits = identity.Traits(`{"email":"` + email + `"}`)
+				require.NoError(t, reg.IdentityManager().Create(ctx, id))
+				assert.EqualValues(t, identity.NoAuthenticatorAssuranceLevel, id.InternalAvailableAAL.String)
+
+				for _, c := range tc.Credentials {
+					for k := range c.Identifiers {
+						switch c.Identifiers[k] {
+						case "{email}":
+							c.Identifiers[k] = email
+						case "{id}":
+							c.Identifiers[k] = id.ID.String()
+						}
+					}
+					id.SetCredentials(c.Type, c)
+				}
+
+				// We use the privileged pool here because we don't want to refresh AAL here but in the code below.
+				require.NoError(t, reg.PrivilegedIdentityPool().UpdateIdentity(ctx, id))
+
+				expand := identity.ExpandNothing
+				if k%2 == 1 { // expand every other test case to test if RefreshAvailableAAL behaves correctly
+					expand = identity.ExpandCredentials
+				}
+
+				actual, err := reg.IdentityPool().GetIdentity(ctx, id.ID, expand)
+				require.NoError(t, err)
+				require.NoError(t, reg.IdentityManager().RefreshAvailableAAL(ctx, actual))
+				assert.NotEmpty(t, actual.Credentials)
+				assert.EqualValues(t, tc.Expected, actual.InternalAvailableAAL.String)
+			})
+		}
 	})
 
 	t.Run("method=ConflictingIdentity", func(t *testing.T) {
diff --git a/identity/pool.go b/identity/pool.go
index 3ea7d4129f6f..f57cd87ca475 100644
--- a/identity/pool.go
+++ b/identity/pool.go
@@ -18,14 +18,17 @@ import (
 type (
 	ListIdentityParameters struct {
 		Expand                       Expandables
-		IdsFilter                    []string
+		IdsFilter                    []uuid.UUID
 		CredentialsIdentifier        string
 		CredentialsIdentifierSimilar string
 		DeclassifyCredentials        []CredentialsType
 		KeySetPagination             []keysetpagination.Option
+		OrganizationID               uuid.UUID
+		ConsistencyLevel             crdbx.ConsistencyLevel
+		StatementTransformer         func(string) string
+
 		// DEPRECATED
-		PagePagination   *x.Page
-		ConsistencyLevel crdbx.ConsistencyLevel
+		PagePagination *x.Page
 	}
 
 	Pool interface {
@@ -61,9 +64,13 @@ type (
 		FindByCredentialsIdentifier(ctx context.Context, ct CredentialsType, match string) (*Identity, *Credentials, error)
 
 		// DeleteIdentity removes an identity by its id. Will return an error
-		// if identity exists, backend connectivity is broken, or trait validation fails.
+		// if identity does not exists, or backend connectivity is broken.
 		DeleteIdentity(context.Context, uuid.UUID) error
 
+		// DeleteIdentities removes identities by its id. Will return an error
+		// if any identity does not exists, or backend connectivity is broken.
+		DeleteIdentities(context.Context, []uuid.UUID) error
+
 		// UpdateVerifiableAddress updates an identity's verifiable address.
 		UpdateVerifiableAddress(ctx context.Context, address *VerifiableAddress) error
 
@@ -78,7 +85,13 @@ type (
 		// UpdateIdentity updates an identity including its confidential / privileged / protected data.
 		UpdateIdentity(context.Context, *Identity) error
 
-		// GetIdentityConfidential returns the identity including it's raw credentials. This should only be used internally.
+		// UpdateIdentityColumns updates targeted columns of an identity.
+		UpdateIdentityColumns(ctx context.Context, i *Identity, columns ...string) error
+
+		// GetIdentityConfidential returns the identity including it's raw credentials.
+		//
+		// This should only be used internally. Please be aware that this method uses HydrateIdentityAssociations
+		// internally, which must not be executed as part of a transaction.
 		GetIdentityConfidential(context.Context, uuid.UUID) (*Identity, error)
 
 		// ListVerifiableAddresses lists all tracked verifiable addresses, regardless of whether they are already verified
@@ -89,6 +102,9 @@ type (
 		ListRecoveryAddresses(ctx context.Context, page, itemsPerPage int) ([]RecoveryAddress, error)
 
 		// HydrateIdentityAssociations hydrates the associations of an identity.
+		//
+		// Please be aware that this method must not be called within a transaction if more than one element is expanded.
+		// It may error with "conn busy" otherwise.
 		HydrateIdentityAssociations(ctx context.Context, i *Identity, expandables Expandables) error
 
 		// InjectTraitsSchemaURL sets the identity's traits JSON schema URL from the schema's ID.
@@ -101,3 +117,10 @@ type (
 		FindIdentityByWebauthnUserHandle(ctx context.Context, userHandle []byte) (*Identity, error)
 	}
 )
+
+func (p ListIdentityParameters) TransformStatement(statement string) string {
+	if p.StatementTransformer != nil {
+		return p.StatementTransformer(statement)
+	}
+	return statement
+}
diff --git a/identity/stub/aal.json b/identity/stub/aal.json
new file mode 100644
index 000000000000..bb206c54b395
--- /dev/null
+++ b/identity/stub/aal.json
@@ -0,0 +1,76 @@
+[
+  {
+    "description": "password is available aal1",
+    "expected": "aal1",
+    "credentials": [
+      {
+        "type": "password",
+        "identifiers": [
+          "{email}"
+        ],
+        "config": {
+          "hashed_password": "$2a$fake"
+        }
+      }
+    ]
+  },
+  {
+    "description": "password without identifier is no credential and ergo aal0",
+    "expected": "aal0",
+    "credentials": [
+      {
+        "type": "password",
+        "config": {
+          "hashed_password": "$2a$fake"
+        }
+      }
+    ]
+  },
+  {
+    "description": "second factor totp returns available aal2 even if no password is set",
+    "expected": "aal2",
+    "credentials": [
+      {
+        "type": "totp",
+        "config": {
+          "totp_url": "totp://"
+        }
+      }
+    ]
+  },
+  {
+    "description": "second factor totp returns aal0 if totp credentials is not set up",
+    "expected": "aal0",
+    "credentials": [
+      {
+        "type": "totp",
+        "identifiers": [
+          "{email}"
+        ],
+        "config": {}
+      }
+    ]
+  },
+  {
+    "description": "password and totp is also available aal2",
+    "expected": "aal1",
+    "credentials": [
+      {
+        "type": "password",
+        "identifiers": [
+          "{email}"
+        ],
+        "config": {
+          "hashed_password": "$2a$fake"
+        }
+      },
+      {
+        "type": "totp",
+        "identifiers": [
+          "{email}"
+        ],
+        "config": {}
+      }
+    ]
+  }
+]
diff --git a/identity/stub/extension/credentials/code-phone-email.schema.json b/identity/stub/extension/credentials/code-phone-email.schema.json
new file mode 100644
index 000000000000..4e51a5a0aae8
--- /dev/null
+++ b/identity/stub/extension/credentials/code-phone-email.schema.json
@@ -0,0 +1,77 @@
+{
+  "type": "object",
+  "properties": {
+    "email": {
+      "type": "string",
+      "format": "email",
+      "ory.sh/kratos": {
+        "credentials": {
+          "password": {
+            "identifier": true
+          },
+          "webauthn": {
+            "identifier": true
+          },
+          "code": {
+            "identifier": true,
+            "via": "email"
+          }
+        }
+      }
+    },
+    "email2": {
+      "type": "string",
+      "format": "email",
+      "ory.sh/kratos": {
+        "credentials": {
+          "password": {
+            "identifier": true
+          },
+          "webauthn": {
+            "identifier": true
+          },
+          "code": {
+            "identifier": true,
+            "via": "email"
+          }
+        }
+      }
+    },
+    "email3": {
+      "type": "string",
+      "format": "email",
+      "ory.sh/kratos": {
+        "credentials": {
+          "password": {
+            "identifier": true
+          },
+          "webauthn": {
+            "identifier": true
+          },
+          "code": {
+            "identifier": true,
+            "via": "email"
+          }
+        }
+      }
+    },
+    "phone": {
+      "type": "string",
+      "format": "tel",
+      "ory.sh/kratos": {
+        "credentials": {
+          "password": {
+            "identifier": true
+          },
+          "webauthn": {
+            "identifier": true
+          },
+          "code": {
+            "identifier": true,
+            "via": "sms"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/identity/stub/extension/credentials/email.schema.json b/identity/stub/extension/credentials/email.schema.json
new file mode 100644
index 000000000000..848bfe54c952
--- /dev/null
+++ b/identity/stub/extension/credentials/email.schema.json
@@ -0,0 +1,44 @@
+{
+  "$id": "https://schemas.ory.sh/presets/kratos/identity.email.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Person",
+  "type": "object",
+  "properties": {
+    "email": {
+      "type": "string",
+      "format": "email",
+      "title": "E-Mail",
+      "ory.sh/kratos": {
+        "credentials": {
+          "password": {
+            "identifier": true
+          },
+          "webauthn": {
+            "identifier": true
+          },
+          "totp": {
+            "account_name": true
+          },
+          "code": {
+            "identifier": true,
+            "via": "email"
+          },
+          "passkey": {
+            "display_name": true
+          }
+        },
+        "recovery": {
+          "via": "email"
+        },
+        "verification": {
+          "via": "email"
+        }
+      },
+      "maxLength": 320
+    }
+  },
+  "required": [
+    "email"
+  ],
+  "additionalProperties": false
+}
diff --git a/identity/test/pool.go b/identity/test/pool.go
index 458c057da916..2e53fa2a53a2 100644
--- a/identity/test/pool.go
+++ b/identity/test/pool.go
@@ -13,10 +13,6 @@ import (
 	"testing"
 	"time"
 
-	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
-
-	"github.com/ory/x/crdbx"
-
 	"github.com/go-faker/faker/v4"
 	"github.com/gofrs/uuid"
 	"github.com/stretchr/testify/assert"
@@ -24,12 +20,15 @@ import (
 	"github.com/tidwall/gjson"
 
 	"github.com/ory/kratos/driver/config"
+	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/internal/testhelpers"
 	"github.com/ory/kratos/persistence"
+	idpersistence "github.com/ory/kratos/persistence/sql/identity"
 	"github.com/ory/kratos/schema"
 	"github.com/ory/kratos/x"
 	"github.com/ory/x/assertx"
+	"github.com/ory/x/crdbx"
 	"github.com/ory/x/errorsx"
 	"github.com/ory/x/pagination/keysetpagination"
 	"github.com/ory/x/randx"
@@ -316,14 +315,14 @@ func TestPool(ctx context.Context, p persistence.Persister, m *identity.Manager,
 
 		t.Run("case=create with null AAL", func(t *testing.T) {
 			expected := passwordIdentity("", "id-"+uuid.Must(uuid.NewV4()).String())
-			expected.AvailableAAL.Valid = false
+			expected.InternalAvailableAAL.Valid = false
 			require.NoError(t, p.CreateIdentity(ctx, expected))
 			createdIDs = append(createdIDs, expected.ID)
 
 			actual, err := p.GetIdentity(ctx, expected.ID, identity.ExpandDefault)
 			require.NoError(t, err)
 
-			assert.False(t, actual.AvailableAAL.Valid)
+			assert.False(t, actual.InternalAvailableAAL.Valid)
 		})
 
 		t.Run("suite=create multiple identities", func(t *testing.T) {
@@ -351,12 +350,60 @@ func TestPool(ctx context.Context, p persistence.Persister, m *identity.Manager,
 					assert.Equal(t, id.Credentials["password"].Identifiers, credFromDB.Identifiers)
 					assert.WithinDuration(t, time.Now().UTC(), credFromDB.CreatedAt, time.Minute)
 					assert.WithinDuration(t, time.Now().UTC(), credFromDB.UpdatedAt, time.Minute)
+					// because of mysql precision
 					assert.WithinDuration(t, id.CreatedAt, idFromDB.CreatedAt, time.Second)
 					assert.WithinDuration(t, id.UpdatedAt, idFromDB.UpdatedAt, time.Second)
 
 					require.NoError(t, p.DeleteIdentity(ctx, id.ID))
 				}
 			})
+
+			t.Run("create exactly the non-conflicting ones", func(t *testing.T) {
+				identities := make([]*identity.Identity, 100)
+				for i := range identities {
+					identities[i] = NewTestIdentity(4, "persister-create-multiple-2", i%60)
+				}
+				err := p.CreateIdentities(ctx, identities...)
+				if dbname == "mysql" {
+					// partial inserts are not supported on mysql
+					assert.ErrorIs(t, err, sqlcon.ErrUniqueViolation)
+					return
+				}
+
+				errWithCtx := new(identity.CreateIdentitiesError)
+				require.ErrorAsf(t, err, &errWithCtx, "%#v", err)
+
+				for _, id := range identities[:60] {
+					require.NotZero(t, id.ID)
+
+					idFromDB, err := p.GetIdentity(ctx, id.ID, identity.ExpandEverything)
+					require.NoError(t, err)
+
+					credFromDB := idFromDB.Credentials[identity.CredentialsTypePassword]
+					assert.Equal(t, id.ID, idFromDB.ID)
+					assert.Equal(t, id.SchemaID, idFromDB.SchemaID)
+					assert.Equal(t, id.SchemaURL, idFromDB.SchemaURL)
+					assert.Equal(t, id.State, idFromDB.State)
+
+					// We test that the values are plausible in the handler test already.
+					assert.Equal(t, len(id.VerifiableAddresses), len(idFromDB.VerifiableAddresses))
+					assert.Equal(t, len(id.RecoveryAddresses), len(idFromDB.RecoveryAddresses))
+
+					assert.Equal(t, id.Credentials["password"].Identifiers, credFromDB.Identifiers)
+					assert.WithinDuration(t, time.Now().UTC(), credFromDB.CreatedAt, time.Minute)
+					assert.WithinDuration(t, time.Now().UTC(), credFromDB.UpdatedAt, time.Minute)
+					// because of mysql precision
+					assert.WithinDuration(t, id.CreatedAt, idFromDB.CreatedAt, time.Second)
+					assert.WithinDuration(t, id.UpdatedAt, idFromDB.UpdatedAt, time.Second)
+
+					require.NoError(t, p.DeleteIdentity(ctx, id.ID))
+				}
+
+				for _, id := range identities[60:] {
+					failed := errWithCtx.Find(id)
+					assert.NotNil(t, failed)
+				}
+			})
 		})
 
 		t.Run("case=should error when the identity ID does not exist", func(t *testing.T) {
@@ -549,6 +596,22 @@ func TestPool(ctx context.Context, p persistence.Persister, m *identity.Manager,
 			require.Contains(t, err.Error(), "malformed")
 		})
 
+		t.Run("case=update an identity column", func(t *testing.T) {
+			initial := oidcIdentity("", x.NewUUID().String())
+			initial.InternalAvailableAAL = identity.NewNullableAuthenticatorAssuranceLevel(identity.NoAuthenticatorAssuranceLevel)
+			require.NoError(t, p.CreateIdentity(ctx, initial))
+			createdIDs = append(createdIDs, initial.ID)
+
+			initial.InternalAvailableAAL = identity.NewNullableAuthenticatorAssuranceLevel(identity.AuthenticatorAssuranceLevel1)
+			initial.State = identity.StateInactive
+			require.NoError(t, p.UpdateIdentityColumns(ctx, initial, "available_aal"))
+
+			actual, err := p.GetIdentity(ctx, initial.ID, identity.ExpandDefault)
+			require.NoError(t, err)
+			assert.Equal(t, string(identity.AuthenticatorAssuranceLevel1), actual.InternalAvailableAAL.String)
+			assert.Equal(t, identity.StateActive, actual.State, "the state remains unchanged")
+		})
+
 		t.Run("case=should fail to insert identity because credentials from traits exist", func(t *testing.T) {
 			first := passwordIdentity("", "test-identity@ory.sh")
 			first.Traits = identity.Traits(`{}`)
@@ -660,10 +723,7 @@ func TestPool(ctx context.Context, p persistence.Persister, m *identity.Manager,
 			})
 
 			t.Run("list some using ids filter", func(t *testing.T) {
-				var filterIds []string
-				for _, id := range createdIDs[:2] {
-					filterIds = append(filterIds, id.String())
-				}
+				filterIds := createdIDs[:2]
 
 				is, _, err := p.ListIdentities(ctx, identity.ListIdentityParameters{Expand: identity.ExpandDefault, IdsFilter: filterIds})
 				require.NoError(t, err)
@@ -849,8 +909,12 @@ func TestPool(ctx context.Context, p persistence.Persister, m *identity.Manager,
 			// assert.EqualValues(t, expected.Credentials[CredentialsTypePassword].CreatedAt.Unix(), creds.CreatedAt.Unix())
 			// assert.EqualValues(t, expected.Credentials[CredentialsTypePassword].UpdatedAt.Unix(), creds.UpdatedAt.Unix())
 
-			expected.Credentials = nil
-			assertEqual(t, expected, actual)
+			require.Equal(t, expected.Traits, actual.Traits)
+			require.Equal(t, expected.ID, actual.ID)
+			require.NotNil(t, actual.Credentials[identity.CredentialsTypePassword])
+			assert.EqualValues(t, expected.Credentials[identity.CredentialsTypePassword].ID, actual.Credentials[identity.CredentialsTypePassword].ID)
+			assert.EqualValues(t, expected.Credentials[identity.CredentialsTypePassword].Identifiers, actual.Credentials[identity.CredentialsTypePassword].Identifiers)
+			assert.JSONEq(t, string(expected.Credentials[identity.CredentialsTypePassword].Config), string(actual.Credentials[identity.CredentialsTypePassword].Config))
 
 			t.Run("not if on another network", func(t *testing.T) {
 				_, p := testhelpers.NewNetwork(t, ctx, p)
@@ -1014,8 +1078,12 @@ func TestPool(ctx context.Context, p persistence.Persister, m *identity.Manager,
 			assert.EqualValues(t, []string{strings.ToLower(identifier)}, creds.Identifiers)
 			assert.JSONEq(t, string(expected.Credentials[identity.CredentialsTypePassword].Config), string(creds.Config))
 
-			expected.Credentials = nil
-			assertEqual(t, expected, actual)
+			require.Equal(t, expected.Traits, actual.Traits)
+			require.Equal(t, expected.ID, actual.ID)
+			require.NotNil(t, actual.Credentials[identity.CredentialsTypePassword])
+			assert.EqualValues(t, expected.Credentials[identity.CredentialsTypePassword].ID, actual.Credentials[identity.CredentialsTypePassword].ID)
+			assert.EqualValues(t, []string{strings.ToLower(identifier)}, actual.Credentials[identity.CredentialsTypePassword].Identifiers)
+			assert.JSONEq(t, string(expected.Credentials[identity.CredentialsTypePassword].Config), string(actual.Credentials[identity.CredentialsTypePassword].Config))
 
 			t.Run("not if on another network", func(t *testing.T) {
 				_, p := testhelpers.NewNetwork(t, ctx, p)
@@ -1190,6 +1258,27 @@ func TestPool(ctx context.Context, p persistence.Persister, m *identity.Manager,
 			})
 		})
 
+		t.Run("suite=credential-types", func(t *testing.T) {
+			for _, ct := range identity.AllCredentialTypes {
+				t.Run("type="+ct.String(), func(t *testing.T) {
+					id, err := idpersistence.FindIdentityCredentialsTypeByName(p.GetConnection(ctx), ct)
+					require.NoError(t, err)
+
+					require.NotEqual(t, uuid.Nil, id)
+					name, err := idpersistence.FindIdentityCredentialsTypeByID(p.GetConnection(ctx), id)
+					require.NoError(t, err)
+
+					assert.Equal(t, ct, name)
+				})
+			}
+
+			_, err := idpersistence.FindIdentityCredentialsTypeByName(p.GetConnection(ctx), "unknown")
+			require.Error(t, err)
+
+			_, err = idpersistence.FindIdentityCredentialsTypeByID(p.GetConnection(ctx), x.NewUUID())
+			require.Error(t, err)
+		})
+
 		t.Run("suite=recovery-address", func(t *testing.T) {
 			createIdentityWithAddresses := func(t *testing.T, email string) *identity.Identity {
 				var i identity.Identity
@@ -1338,7 +1427,7 @@ func TestPool(ctx context.Context, p persistence.Persister, m *identity.Manager,
 			i, c, err := p.FindByCredentialsIdentifier(ctx, m[0].Name, "nid1")
 			require.NoError(t, err)
 			assert.Equal(t, "nid1", c.Identifiers[0])
-			require.Len(t, i.Credentials, 0)
+			require.Len(t, i.Credentials, 1)
 
 			_, _, err = p.FindByCredentialsIdentifier(ctx, m[0].Name, "nid2")
 			require.ErrorIs(t, err, sqlcon.ErrNoRows)
diff --git a/internal/client-go/.openapi-generator/FILES b/internal/client-go/.openapi-generator/FILES
index fdf34c5e1507..118cf9b06463 100644
--- a/internal/client-go/.openapi-generator/FILES
+++ b/internal/client-go/.openapi-generator/FILES
@@ -15,12 +15,13 @@ docs/ConsistencyRequestParameters.md
 docs/ContinueWith.md
 docs/ContinueWithRecoveryUi.md
 docs/ContinueWithRecoveryUiFlow.md
+docs/ContinueWithRedirectBrowserTo.md
 docs/ContinueWithSetOrySessionToken.md
 docs/ContinueWithSettingsUi.md
 docs/ContinueWithSettingsUiFlow.md
 docs/ContinueWithVerificationUi.md
 docs/ContinueWithVerificationUiFlow.md
-docs/CourierApi.md
+docs/CourierAPI.md
 docs/CourierMessageStatus.md
 docs/CourierMessageType.md
 docs/CreateIdentityBody.md
@@ -32,15 +33,16 @@ docs/ErrorBrowserLocationChangeRequired.md
 docs/ErrorFlowReplaced.md
 docs/ErrorGeneric.md
 docs/FlowError.md
-docs/FrontendApi.md
+docs/FrontendAPI.md
 docs/GenericError.md
 docs/GetVersion200Response.md
 docs/HealthNotReadyStatus.md
 docs/HealthStatus.md
 docs/Identity.md
-docs/IdentityApi.md
+docs/IdentityAPI.md
 docs/IdentityCredentials.md
 docs/IdentityCredentialsCode.md
+docs/IdentityCredentialsCodeAddress.md
 docs/IdentityCredentialsOidc.md
 docs/IdentityCredentialsOidcProvider.md
 docs/IdentityCredentialsPassword.md
@@ -61,7 +63,7 @@ docs/LoginFlowState.md
 docs/LogoutFlow.md
 docs/Message.md
 docs/MessageDispatch.md
-docs/MetadataApi.md
+docs/MetadataAPI.md
 docs/NeedsPrivilegedSessionError.md
 docs/OAuth2Client.md
 docs/OAuth2ConsentRequestOpenIDConnectContext.md
@@ -99,6 +101,7 @@ docs/UiText.md
 docs/UpdateIdentityBody.md
 docs/UpdateLoginFlowBody.md
 docs/UpdateLoginFlowWithCodeMethod.md
+docs/UpdateLoginFlowWithIdentifierFirstMethod.md
 docs/UpdateLoginFlowWithLookupSecretMethod.md
 docs/UpdateLoginFlowWithOidcMethod.md
 docs/UpdateLoginFlowWithPasskeyMethod.md
@@ -139,6 +142,7 @@ model_consistency_request_parameters.go
 model_continue_with.go
 model_continue_with_recovery_ui.go
 model_continue_with_recovery_ui_flow.go
+model_continue_with_redirect_browser_to.go
 model_continue_with_set_ory_session_token.go
 model_continue_with_settings_ui.go
 model_continue_with_settings_ui_flow.go
@@ -162,6 +166,7 @@ model_health_status.go
 model_identity.go
 model_identity_credentials.go
 model_identity_credentials_code.go
+model_identity_credentials_code_address.go
 model_identity_credentials_oidc.go
 model_identity_credentials_oidc_provider.go
 model_identity_credentials_password.go
@@ -219,6 +224,7 @@ model_ui_text.go
 model_update_identity_body.go
 model_update_login_flow_body.go
 model_update_login_flow_with_code_method.go
+model_update_login_flow_with_identifier_first_method.go
 model_update_login_flow_with_lookup_secret_method.go
 model_update_login_flow_with_oidc_method.go
 model_update_login_flow_with_passkey_method.go
diff --git a/internal/client-go/README.md b/internal/client-go/README.md
index 04dd61ab7d1e..97593523117a 100644
--- a/internal/client-go/README.md
+++ b/internal/client-go/README.md
@@ -79,59 +79,59 @@ All URIs are relative to *http://localhost*
 
 Class | Method | HTTP request | Description
 ------------ | ------------- | ------------- | -------------
-*CourierApi* | [**GetCourierMessage**](docs/CourierApi.md#getcouriermessage) | **Get** /admin/courier/messages/{id} | Get a Message
-*CourierApi* | [**ListCourierMessages**](docs/CourierApi.md#listcouriermessages) | **Get** /admin/courier/messages | List Messages
-*FrontendApi* | [**CreateBrowserLoginFlow**](docs/FrontendApi.md#createbrowserloginflow) | **Get** /self-service/login/browser | Create Login Flow for Browsers
-*FrontendApi* | [**CreateBrowserLogoutFlow**](docs/FrontendApi.md#createbrowserlogoutflow) | **Get** /self-service/logout/browser | Create a Logout URL for Browsers
-*FrontendApi* | [**CreateBrowserRecoveryFlow**](docs/FrontendApi.md#createbrowserrecoveryflow) | **Get** /self-service/recovery/browser | Create Recovery Flow for Browsers
-*FrontendApi* | [**CreateBrowserRegistrationFlow**](docs/FrontendApi.md#createbrowserregistrationflow) | **Get** /self-service/registration/browser | Create Registration Flow for Browsers
-*FrontendApi* | [**CreateBrowserSettingsFlow**](docs/FrontendApi.md#createbrowsersettingsflow) | **Get** /self-service/settings/browser | Create Settings Flow for Browsers
-*FrontendApi* | [**CreateBrowserVerificationFlow**](docs/FrontendApi.md#createbrowserverificationflow) | **Get** /self-service/verification/browser | Create Verification Flow for Browser Clients
-*FrontendApi* | [**CreateNativeLoginFlow**](docs/FrontendApi.md#createnativeloginflow) | **Get** /self-service/login/api | Create Login Flow for Native Apps
-*FrontendApi* | [**CreateNativeRecoveryFlow**](docs/FrontendApi.md#createnativerecoveryflow) | **Get** /self-service/recovery/api | Create Recovery Flow for Native Apps
-*FrontendApi* | [**CreateNativeRegistrationFlow**](docs/FrontendApi.md#createnativeregistrationflow) | **Get** /self-service/registration/api | Create Registration Flow for Native Apps
-*FrontendApi* | [**CreateNativeSettingsFlow**](docs/FrontendApi.md#createnativesettingsflow) | **Get** /self-service/settings/api | Create Settings Flow for Native Apps
-*FrontendApi* | [**CreateNativeVerificationFlow**](docs/FrontendApi.md#createnativeverificationflow) | **Get** /self-service/verification/api | Create Verification Flow for Native Apps
-*FrontendApi* | [**DisableMyOtherSessions**](docs/FrontendApi.md#disablemyothersessions) | **Delete** /sessions | Disable my other sessions
-*FrontendApi* | [**DisableMySession**](docs/FrontendApi.md#disablemysession) | **Delete** /sessions/{id} | Disable one of my sessions
-*FrontendApi* | [**ExchangeSessionToken**](docs/FrontendApi.md#exchangesessiontoken) | **Get** /sessions/token-exchange | Exchange Session Token
-*FrontendApi* | [**GetFlowError**](docs/FrontendApi.md#getflowerror) | **Get** /self-service/errors | Get User-Flow Errors
-*FrontendApi* | [**GetLoginFlow**](docs/FrontendApi.md#getloginflow) | **Get** /self-service/login/flows | Get Login Flow
-*FrontendApi* | [**GetRecoveryFlow**](docs/FrontendApi.md#getrecoveryflow) | **Get** /self-service/recovery/flows | Get Recovery Flow
-*FrontendApi* | [**GetRegistrationFlow**](docs/FrontendApi.md#getregistrationflow) | **Get** /self-service/registration/flows | Get Registration Flow
-*FrontendApi* | [**GetSettingsFlow**](docs/FrontendApi.md#getsettingsflow) | **Get** /self-service/settings/flows | Get Settings Flow
-*FrontendApi* | [**GetVerificationFlow**](docs/FrontendApi.md#getverificationflow) | **Get** /self-service/verification/flows | Get Verification Flow
-*FrontendApi* | [**GetWebAuthnJavaScript**](docs/FrontendApi.md#getwebauthnjavascript) | **Get** /.well-known/ory/webauthn.js | Get WebAuthn JavaScript
-*FrontendApi* | [**ListMySessions**](docs/FrontendApi.md#listmysessions) | **Get** /sessions | Get My Active Sessions
-*FrontendApi* | [**PerformNativeLogout**](docs/FrontendApi.md#performnativelogout) | **Delete** /self-service/logout/api | Perform Logout for Native Apps
-*FrontendApi* | [**ToSession**](docs/FrontendApi.md#tosession) | **Get** /sessions/whoami | Check Who the Current HTTP Session Belongs To
-*FrontendApi* | [**UpdateLoginFlow**](docs/FrontendApi.md#updateloginflow) | **Post** /self-service/login | Submit a Login Flow
-*FrontendApi* | [**UpdateLogoutFlow**](docs/FrontendApi.md#updatelogoutflow) | **Get** /self-service/logout | Update Logout Flow
-*FrontendApi* | [**UpdateRecoveryFlow**](docs/FrontendApi.md#updaterecoveryflow) | **Post** /self-service/recovery | Update Recovery Flow
-*FrontendApi* | [**UpdateRegistrationFlow**](docs/FrontendApi.md#updateregistrationflow) | **Post** /self-service/registration | Update Registration Flow
-*FrontendApi* | [**UpdateSettingsFlow**](docs/FrontendApi.md#updatesettingsflow) | **Post** /self-service/settings | Complete Settings Flow
-*FrontendApi* | [**UpdateVerificationFlow**](docs/FrontendApi.md#updateverificationflow) | **Post** /self-service/verification | Complete Verification Flow
-*IdentityApi* | [**BatchPatchIdentities**](docs/IdentityApi.md#batchpatchidentities) | **Patch** /admin/identities | Create multiple identities
-*IdentityApi* | [**CreateIdentity**](docs/IdentityApi.md#createidentity) | **Post** /admin/identities | Create an Identity
-*IdentityApi* | [**CreateRecoveryCodeForIdentity**](docs/IdentityApi.md#createrecoverycodeforidentity) | **Post** /admin/recovery/code | Create a Recovery Code
-*IdentityApi* | [**CreateRecoveryLinkForIdentity**](docs/IdentityApi.md#createrecoverylinkforidentity) | **Post** /admin/recovery/link | Create a Recovery Link
-*IdentityApi* | [**DeleteIdentity**](docs/IdentityApi.md#deleteidentity) | **Delete** /admin/identities/{id} | Delete an Identity
-*IdentityApi* | [**DeleteIdentityCredentials**](docs/IdentityApi.md#deleteidentitycredentials) | **Delete** /admin/identities/{id}/credentials/{type} | Delete a credential for a specific identity
-*IdentityApi* | [**DeleteIdentitySessions**](docs/IdentityApi.md#deleteidentitysessions) | **Delete** /admin/identities/{id}/sessions | Delete &amp; Invalidate an Identity&#39;s Sessions
-*IdentityApi* | [**DisableSession**](docs/IdentityApi.md#disablesession) | **Delete** /admin/sessions/{id} | Deactivate a Session
-*IdentityApi* | [**ExtendSession**](docs/IdentityApi.md#extendsession) | **Patch** /admin/sessions/{id}/extend | Extend a Session
-*IdentityApi* | [**GetIdentity**](docs/IdentityApi.md#getidentity) | **Get** /admin/identities/{id} | Get an Identity
-*IdentityApi* | [**GetIdentitySchema**](docs/IdentityApi.md#getidentityschema) | **Get** /schemas/{id} | Get Identity JSON Schema
-*IdentityApi* | [**GetSession**](docs/IdentityApi.md#getsession) | **Get** /admin/sessions/{id} | Get Session
-*IdentityApi* | [**ListIdentities**](docs/IdentityApi.md#listidentities) | **Get** /admin/identities | List Identities
-*IdentityApi* | [**ListIdentitySchemas**](docs/IdentityApi.md#listidentityschemas) | **Get** /schemas | Get all Identity Schemas
-*IdentityApi* | [**ListIdentitySessions**](docs/IdentityApi.md#listidentitysessions) | **Get** /admin/identities/{id}/sessions | List an Identity&#39;s Sessions
-*IdentityApi* | [**ListSessions**](docs/IdentityApi.md#listsessions) | **Get** /admin/sessions | List All Sessions
-*IdentityApi* | [**PatchIdentity**](docs/IdentityApi.md#patchidentity) | **Patch** /admin/identities/{id} | Patch an Identity
-*IdentityApi* | [**UpdateIdentity**](docs/IdentityApi.md#updateidentity) | **Put** /admin/identities/{id} | Update an Identity
-*MetadataApi* | [**GetVersion**](docs/MetadataApi.md#getversion) | **Get** /version | Return Running Software Version.
-*MetadataApi* | [**IsAlive**](docs/MetadataApi.md#isalive) | **Get** /health/alive | Check HTTP Server Status
-*MetadataApi* | [**IsReady**](docs/MetadataApi.md#isready) | **Get** /health/ready | Check HTTP Server and Database Status
+*CourierAPI* | [**GetCourierMessage**](docs/CourierAPI.md#getcouriermessage) | **Get** /admin/courier/messages/{id} | Get a Message
+*CourierAPI* | [**ListCourierMessages**](docs/CourierAPI.md#listcouriermessages) | **Get** /admin/courier/messages | List Messages
+*FrontendAPI* | [**CreateBrowserLoginFlow**](docs/FrontendAPI.md#createbrowserloginflow) | **Get** /self-service/login/browser | Create Login Flow for Browsers
+*FrontendAPI* | [**CreateBrowserLogoutFlow**](docs/FrontendAPI.md#createbrowserlogoutflow) | **Get** /self-service/logout/browser | Create a Logout URL for Browsers
+*FrontendAPI* | [**CreateBrowserRecoveryFlow**](docs/FrontendAPI.md#createbrowserrecoveryflow) | **Get** /self-service/recovery/browser | Create Recovery Flow for Browsers
+*FrontendAPI* | [**CreateBrowserRegistrationFlow**](docs/FrontendAPI.md#createbrowserregistrationflow) | **Get** /self-service/registration/browser | Create Registration Flow for Browsers
+*FrontendAPI* | [**CreateBrowserSettingsFlow**](docs/FrontendAPI.md#createbrowsersettingsflow) | **Get** /self-service/settings/browser | Create Settings Flow for Browsers
+*FrontendAPI* | [**CreateBrowserVerificationFlow**](docs/FrontendAPI.md#createbrowserverificationflow) | **Get** /self-service/verification/browser | Create Verification Flow for Browser Clients
+*FrontendAPI* | [**CreateNativeLoginFlow**](docs/FrontendAPI.md#createnativeloginflow) | **Get** /self-service/login/api | Create Login Flow for Native Apps
+*FrontendAPI* | [**CreateNativeRecoveryFlow**](docs/FrontendAPI.md#createnativerecoveryflow) | **Get** /self-service/recovery/api | Create Recovery Flow for Native Apps
+*FrontendAPI* | [**CreateNativeRegistrationFlow**](docs/FrontendAPI.md#createnativeregistrationflow) | **Get** /self-service/registration/api | Create Registration Flow for Native Apps
+*FrontendAPI* | [**CreateNativeSettingsFlow**](docs/FrontendAPI.md#createnativesettingsflow) | **Get** /self-service/settings/api | Create Settings Flow for Native Apps
+*FrontendAPI* | [**CreateNativeVerificationFlow**](docs/FrontendAPI.md#createnativeverificationflow) | **Get** /self-service/verification/api | Create Verification Flow for Native Apps
+*FrontendAPI* | [**DisableMyOtherSessions**](docs/FrontendAPI.md#disablemyothersessions) | **Delete** /sessions | Disable my other sessions
+*FrontendAPI* | [**DisableMySession**](docs/FrontendAPI.md#disablemysession) | **Delete** /sessions/{id} | Disable one of my sessions
+*FrontendAPI* | [**ExchangeSessionToken**](docs/FrontendAPI.md#exchangesessiontoken) | **Get** /sessions/token-exchange | Exchange Session Token
+*FrontendAPI* | [**GetFlowError**](docs/FrontendAPI.md#getflowerror) | **Get** /self-service/errors | Get User-Flow Errors
+*FrontendAPI* | [**GetLoginFlow**](docs/FrontendAPI.md#getloginflow) | **Get** /self-service/login/flows | Get Login Flow
+*FrontendAPI* | [**GetRecoveryFlow**](docs/FrontendAPI.md#getrecoveryflow) | **Get** /self-service/recovery/flows | Get Recovery Flow
+*FrontendAPI* | [**GetRegistrationFlow**](docs/FrontendAPI.md#getregistrationflow) | **Get** /self-service/registration/flows | Get Registration Flow
+*FrontendAPI* | [**GetSettingsFlow**](docs/FrontendAPI.md#getsettingsflow) | **Get** /self-service/settings/flows | Get Settings Flow
+*FrontendAPI* | [**GetVerificationFlow**](docs/FrontendAPI.md#getverificationflow) | **Get** /self-service/verification/flows | Get Verification Flow
+*FrontendAPI* | [**GetWebAuthnJavaScript**](docs/FrontendAPI.md#getwebauthnjavascript) | **Get** /.well-known/ory/webauthn.js | Get WebAuthn JavaScript
+*FrontendAPI* | [**ListMySessions**](docs/FrontendAPI.md#listmysessions) | **Get** /sessions | Get My Active Sessions
+*FrontendAPI* | [**PerformNativeLogout**](docs/FrontendAPI.md#performnativelogout) | **Delete** /self-service/logout/api | Perform Logout for Native Apps
+*FrontendAPI* | [**ToSession**](docs/FrontendAPI.md#tosession) | **Get** /sessions/whoami | Check Who the Current HTTP Session Belongs To
+*FrontendAPI* | [**UpdateLoginFlow**](docs/FrontendAPI.md#updateloginflow) | **Post** /self-service/login | Submit a Login Flow
+*FrontendAPI* | [**UpdateLogoutFlow**](docs/FrontendAPI.md#updatelogoutflow) | **Get** /self-service/logout | Update Logout Flow
+*FrontendAPI* | [**UpdateRecoveryFlow**](docs/FrontendAPI.md#updaterecoveryflow) | **Post** /self-service/recovery | Update Recovery Flow
+*FrontendAPI* | [**UpdateRegistrationFlow**](docs/FrontendAPI.md#updateregistrationflow) | **Post** /self-service/registration | Update Registration Flow
+*FrontendAPI* | [**UpdateSettingsFlow**](docs/FrontendAPI.md#updatesettingsflow) | **Post** /self-service/settings | Complete Settings Flow
+*FrontendAPI* | [**UpdateVerificationFlow**](docs/FrontendAPI.md#updateverificationflow) | **Post** /self-service/verification | Complete Verification Flow
+*IdentityAPI* | [**BatchPatchIdentities**](docs/IdentityAPI.md#batchpatchidentities) | **Patch** /admin/identities | Create multiple identities
+*IdentityAPI* | [**CreateIdentity**](docs/IdentityAPI.md#createidentity) | **Post** /admin/identities | Create an Identity
+*IdentityAPI* | [**CreateRecoveryCodeForIdentity**](docs/IdentityAPI.md#createrecoverycodeforidentity) | **Post** /admin/recovery/code | Create a Recovery Code
+*IdentityAPI* | [**CreateRecoveryLinkForIdentity**](docs/IdentityAPI.md#createrecoverylinkforidentity) | **Post** /admin/recovery/link | Create a Recovery Link
+*IdentityAPI* | [**DeleteIdentity**](docs/IdentityAPI.md#deleteidentity) | **Delete** /admin/identities/{id} | Delete an Identity
+*IdentityAPI* | [**DeleteIdentityCredentials**](docs/IdentityAPI.md#deleteidentitycredentials) | **Delete** /admin/identities/{id}/credentials/{type} | Delete a credential for a specific identity
+*IdentityAPI* | [**DeleteIdentitySessions**](docs/IdentityAPI.md#deleteidentitysessions) | **Delete** /admin/identities/{id}/sessions | Delete &amp; Invalidate an Identity&#39;s Sessions
+*IdentityAPI* | [**DisableSession**](docs/IdentityAPI.md#disablesession) | **Delete** /admin/sessions/{id} | Deactivate a Session
+*IdentityAPI* | [**ExtendSession**](docs/IdentityAPI.md#extendsession) | **Patch** /admin/sessions/{id}/extend | Extend a Session
+*IdentityAPI* | [**GetIdentity**](docs/IdentityAPI.md#getidentity) | **Get** /admin/identities/{id} | Get an Identity
+*IdentityAPI* | [**GetIdentitySchema**](docs/IdentityAPI.md#getidentityschema) | **Get** /schemas/{id} | Get Identity JSON Schema
+*IdentityAPI* | [**GetSession**](docs/IdentityAPI.md#getsession) | **Get** /admin/sessions/{id} | Get Session
+*IdentityAPI* | [**ListIdentities**](docs/IdentityAPI.md#listidentities) | **Get** /admin/identities | List Identities
+*IdentityAPI* | [**ListIdentitySchemas**](docs/IdentityAPI.md#listidentityschemas) | **Get** /schemas | Get all Identity Schemas
+*IdentityAPI* | [**ListIdentitySessions**](docs/IdentityAPI.md#listidentitysessions) | **Get** /admin/identities/{id}/sessions | List an Identity&#39;s Sessions
+*IdentityAPI* | [**ListSessions**](docs/IdentityAPI.md#listsessions) | **Get** /admin/sessions | List All Sessions
+*IdentityAPI* | [**PatchIdentity**](docs/IdentityAPI.md#patchidentity) | **Patch** /admin/identities/{id} | Patch an Identity
+*IdentityAPI* | [**UpdateIdentity**](docs/IdentityAPI.md#updateidentity) | **Put** /admin/identities/{id} | Update an Identity
+*MetadataAPI* | [**GetVersion**](docs/MetadataAPI.md#getversion) | **Get** /version | Return Running Software Version.
+*MetadataAPI* | [**IsAlive**](docs/MetadataAPI.md#isalive) | **Get** /health/alive | Check HTTP Server Status
+*MetadataAPI* | [**IsReady**](docs/MetadataAPI.md#isready) | **Get** /health/ready | Check HTTP Server and Database Status
 
 
 ## Documentation For Models
@@ -142,6 +142,7 @@ Class | Method | HTTP request | Description
  - [ContinueWith](docs/ContinueWith.md)
  - [ContinueWithRecoveryUi](docs/ContinueWithRecoveryUi.md)
  - [ContinueWithRecoveryUiFlow](docs/ContinueWithRecoveryUiFlow.md)
+ - [ContinueWithRedirectBrowserTo](docs/ContinueWithRedirectBrowserTo.md)
  - [ContinueWithSetOrySessionToken](docs/ContinueWithSetOrySessionToken.md)
  - [ContinueWithSettingsUi](docs/ContinueWithSettingsUi.md)
  - [ContinueWithSettingsUiFlow](docs/ContinueWithSettingsUiFlow.md)
@@ -165,6 +166,7 @@ Class | Method | HTTP request | Description
  - [Identity](docs/Identity.md)
  - [IdentityCredentials](docs/IdentityCredentials.md)
  - [IdentityCredentialsCode](docs/IdentityCredentialsCode.md)
+ - [IdentityCredentialsCodeAddress](docs/IdentityCredentialsCodeAddress.md)
  - [IdentityCredentialsOidc](docs/IdentityCredentialsOidc.md)
  - [IdentityCredentialsOidcProvider](docs/IdentityCredentialsOidcProvider.md)
  - [IdentityCredentialsPassword](docs/IdentityCredentialsPassword.md)
@@ -222,6 +224,7 @@ Class | Method | HTTP request | Description
  - [UpdateIdentityBody](docs/UpdateIdentityBody.md)
  - [UpdateLoginFlowBody](docs/UpdateLoginFlowBody.md)
  - [UpdateLoginFlowWithCodeMethod](docs/UpdateLoginFlowWithCodeMethod.md)
+ - [UpdateLoginFlowWithIdentifierFirstMethod](docs/UpdateLoginFlowWithIdentifierFirstMethod.md)
  - [UpdateLoginFlowWithLookupSecretMethod](docs/UpdateLoginFlowWithLookupSecretMethod.md)
  - [UpdateLoginFlowWithOidcMethod](docs/UpdateLoginFlowWithOidcMethod.md)
  - [UpdateLoginFlowWithPasskeyMethod](docs/UpdateLoginFlowWithPasskeyMethod.md)
diff --git a/internal/client-go/api_courier.go b/internal/client-go/api_courier.go
index 91bcc08025eb..36f10d0a6281 100644
--- a/internal/client-go/api_courier.go
+++ b/internal/client-go/api_courier.go
@@ -25,48 +25,48 @@ var (
 	_ context.Context
 )
 
-type CourierApi interface {
+type CourierAPI interface {
 
 	/*
 	 * GetCourierMessage Get a Message
 	 * Gets a specific messages by the given ID.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 	 * @param id MessageID is the ID of the message.
-	 * @return CourierApiApiGetCourierMessageRequest
+	 * @return CourierAPIApiGetCourierMessageRequest
 	 */
-	GetCourierMessage(ctx context.Context, id string) CourierApiApiGetCourierMessageRequest
+	GetCourierMessage(ctx context.Context, id string) CourierAPIApiGetCourierMessageRequest
 
 	/*
 	 * GetCourierMessageExecute executes the request
 	 * @return Message
 	 */
-	GetCourierMessageExecute(r CourierApiApiGetCourierMessageRequest) (*Message, *http.Response, error)
+	GetCourierMessageExecute(r CourierAPIApiGetCourierMessageRequest) (*Message, *http.Response, error)
 
 	/*
 	 * ListCourierMessages List Messages
 	 * Lists all messages by given status and recipient.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-	 * @return CourierApiApiListCourierMessagesRequest
+	 * @return CourierAPIApiListCourierMessagesRequest
 	 */
-	ListCourierMessages(ctx context.Context) CourierApiApiListCourierMessagesRequest
+	ListCourierMessages(ctx context.Context) CourierAPIApiListCourierMessagesRequest
 
 	/*
 	 * ListCourierMessagesExecute executes the request
 	 * @return []Message
 	 */
-	ListCourierMessagesExecute(r CourierApiApiListCourierMessagesRequest) ([]Message, *http.Response, error)
+	ListCourierMessagesExecute(r CourierAPIApiListCourierMessagesRequest) ([]Message, *http.Response, error)
 }
 
-// CourierApiService CourierApi service
-type CourierApiService service
+// CourierAPIService CourierAPI service
+type CourierAPIService service
 
-type CourierApiApiGetCourierMessageRequest struct {
+type CourierAPIApiGetCourierMessageRequest struct {
 	ctx        context.Context
-	ApiService CourierApi
+	ApiService CourierAPI
 	id         string
 }
 
-func (r CourierApiApiGetCourierMessageRequest) Execute() (*Message, *http.Response, error) {
+func (r CourierAPIApiGetCourierMessageRequest) Execute() (*Message, *http.Response, error) {
 	return r.ApiService.GetCourierMessageExecute(r)
 }
 
@@ -75,10 +75,10 @@ func (r CourierApiApiGetCourierMessageRequest) Execute() (*Message, *http.Respon
  * Gets a specific messages by the given ID.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
  * @param id MessageID is the ID of the message.
- * @return CourierApiApiGetCourierMessageRequest
+ * @return CourierAPIApiGetCourierMessageRequest
  */
-func (a *CourierApiService) GetCourierMessage(ctx context.Context, id string) CourierApiApiGetCourierMessageRequest {
-	return CourierApiApiGetCourierMessageRequest{
+func (a *CourierAPIService) GetCourierMessage(ctx context.Context, id string) CourierAPIApiGetCourierMessageRequest {
+	return CourierAPIApiGetCourierMessageRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -89,7 +89,7 @@ func (a *CourierApiService) GetCourierMessage(ctx context.Context, id string) Co
  * Execute executes the request
  * @return Message
  */
-func (a *CourierApiService) GetCourierMessageExecute(r CourierApiApiGetCourierMessageRequest) (*Message, *http.Response, error) {
+func (a *CourierAPIService) GetCourierMessageExecute(r CourierAPIApiGetCourierMessageRequest) (*Message, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -99,7 +99,7 @@ func (a *CourierApiService) GetCourierMessageExecute(r CourierApiApiGetCourierMe
 		localVarReturnValue  *Message
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "CourierApiService.GetCourierMessage")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "CourierAPIService.GetCourierMessage")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -196,33 +196,33 @@ func (a *CourierApiService) GetCourierMessageExecute(r CourierApiApiGetCourierMe
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type CourierApiApiListCourierMessagesRequest struct {
+type CourierAPIApiListCourierMessagesRequest struct {
 	ctx        context.Context
-	ApiService CourierApi
+	ApiService CourierAPI
 	pageSize   *int64
 	pageToken  *string
 	status     *CourierMessageStatus
 	recipient  *string
 }
 
-func (r CourierApiApiListCourierMessagesRequest) PageSize(pageSize int64) CourierApiApiListCourierMessagesRequest {
+func (r CourierAPIApiListCourierMessagesRequest) PageSize(pageSize int64) CourierAPIApiListCourierMessagesRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r CourierApiApiListCourierMessagesRequest) PageToken(pageToken string) CourierApiApiListCourierMessagesRequest {
+func (r CourierAPIApiListCourierMessagesRequest) PageToken(pageToken string) CourierAPIApiListCourierMessagesRequest {
 	r.pageToken = &pageToken
 	return r
 }
-func (r CourierApiApiListCourierMessagesRequest) Status(status CourierMessageStatus) CourierApiApiListCourierMessagesRequest {
+func (r CourierAPIApiListCourierMessagesRequest) Status(status CourierMessageStatus) CourierAPIApiListCourierMessagesRequest {
 	r.status = &status
 	return r
 }
-func (r CourierApiApiListCourierMessagesRequest) Recipient(recipient string) CourierApiApiListCourierMessagesRequest {
+func (r CourierAPIApiListCourierMessagesRequest) Recipient(recipient string) CourierAPIApiListCourierMessagesRequest {
 	r.recipient = &recipient
 	return r
 }
 
-func (r CourierApiApiListCourierMessagesRequest) Execute() ([]Message, *http.Response, error) {
+func (r CourierAPIApiListCourierMessagesRequest) Execute() ([]Message, *http.Response, error) {
 	return r.ApiService.ListCourierMessagesExecute(r)
 }
 
@@ -230,10 +230,10 @@ func (r CourierApiApiListCourierMessagesRequest) Execute() ([]Message, *http.Res
  * ListCourierMessages List Messages
  * Lists all messages by given status and recipient.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- * @return CourierApiApiListCourierMessagesRequest
+ * @return CourierAPIApiListCourierMessagesRequest
  */
-func (a *CourierApiService) ListCourierMessages(ctx context.Context) CourierApiApiListCourierMessagesRequest {
-	return CourierApiApiListCourierMessagesRequest{
+func (a *CourierAPIService) ListCourierMessages(ctx context.Context) CourierAPIApiListCourierMessagesRequest {
+	return CourierAPIApiListCourierMessagesRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -243,7 +243,7 @@ func (a *CourierApiService) ListCourierMessages(ctx context.Context) CourierApiA
  * Execute executes the request
  * @return []Message
  */
-func (a *CourierApiService) ListCourierMessagesExecute(r CourierApiApiListCourierMessagesRequest) ([]Message, *http.Response, error) {
+func (a *CourierAPIService) ListCourierMessagesExecute(r CourierAPIApiListCourierMessagesRequest) ([]Message, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -253,7 +253,7 @@ func (a *CourierApiService) ListCourierMessagesExecute(r CourierApiApiListCourie
 		localVarReturnValue  []Message
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "CourierApiService.ListCourierMessages")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "CourierAPIService.ListCourierMessages")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
diff --git a/internal/client-go/api_frontend.go b/internal/client-go/api_frontend.go
index cfb87b55902a..97266e9c4c94 100644
--- a/internal/client-go/api_frontend.go
+++ b/internal/client-go/api_frontend.go
@@ -25,7 +25,7 @@ var (
 	_ context.Context
 )
 
-type FrontendApi interface {
+type FrontendAPI interface {
 
 	/*
 			 * CreateBrowserLoginFlow Create Login Flow for Browsers
@@ -53,15 +53,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserLoginFlowRequest
+			 * @return FrontendAPIApiCreateBrowserLoginFlowRequest
 	*/
-	CreateBrowserLoginFlow(ctx context.Context) FrontendApiApiCreateBrowserLoginFlowRequest
+	CreateBrowserLoginFlow(ctx context.Context) FrontendAPIApiCreateBrowserLoginFlowRequest
 
 	/*
 	 * CreateBrowserLoginFlowExecute executes the request
 	 * @return LoginFlow
 	 */
-	CreateBrowserLoginFlowExecute(r FrontendApiApiCreateBrowserLoginFlowRequest) (*LoginFlow, *http.Response, error)
+	CreateBrowserLoginFlowExecute(r FrontendAPIApiCreateBrowserLoginFlowRequest) (*LoginFlow, *http.Response, error)
 
 	/*
 			 * CreateBrowserLogoutFlow Create a Logout URL for Browsers
@@ -76,15 +76,15 @@ type FrontendApi interface {
 
 		When calling this endpoint from a backend, please ensure to properly forward the HTTP cookies.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserLogoutFlowRequest
+			 * @return FrontendAPIApiCreateBrowserLogoutFlowRequest
 	*/
-	CreateBrowserLogoutFlow(ctx context.Context) FrontendApiApiCreateBrowserLogoutFlowRequest
+	CreateBrowserLogoutFlow(ctx context.Context) FrontendAPIApiCreateBrowserLogoutFlowRequest
 
 	/*
 	 * CreateBrowserLogoutFlowExecute executes the request
 	 * @return LogoutFlow
 	 */
-	CreateBrowserLogoutFlowExecute(r FrontendApiApiCreateBrowserLogoutFlowRequest) (*LogoutFlow, *http.Response, error)
+	CreateBrowserLogoutFlowExecute(r FrontendAPIApiCreateBrowserLogoutFlowRequest) (*LogoutFlow, *http.Response, error)
 
 	/*
 			 * CreateBrowserRecoveryFlow Create Recovery Flow for Browsers
@@ -99,15 +99,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserRecoveryFlowRequest
+			 * @return FrontendAPIApiCreateBrowserRecoveryFlowRequest
 	*/
-	CreateBrowserRecoveryFlow(ctx context.Context) FrontendApiApiCreateBrowserRecoveryFlowRequest
+	CreateBrowserRecoveryFlow(ctx context.Context) FrontendAPIApiCreateBrowserRecoveryFlowRequest
 
 	/*
 	 * CreateBrowserRecoveryFlowExecute executes the request
 	 * @return RecoveryFlow
 	 */
-	CreateBrowserRecoveryFlowExecute(r FrontendApiApiCreateBrowserRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
+	CreateBrowserRecoveryFlowExecute(r FrontendAPIApiCreateBrowserRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
 
 	/*
 			 * CreateBrowserRegistrationFlow Create Registration Flow for Browsers
@@ -131,15 +131,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserRegistrationFlowRequest
+			 * @return FrontendAPIApiCreateBrowserRegistrationFlowRequest
 	*/
-	CreateBrowserRegistrationFlow(ctx context.Context) FrontendApiApiCreateBrowserRegistrationFlowRequest
+	CreateBrowserRegistrationFlow(ctx context.Context) FrontendAPIApiCreateBrowserRegistrationFlowRequest
 
 	/*
 	 * CreateBrowserRegistrationFlowExecute executes the request
 	 * @return RegistrationFlow
 	 */
-	CreateBrowserRegistrationFlowExecute(r FrontendApiApiCreateBrowserRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
+	CreateBrowserRegistrationFlowExecute(r FrontendAPIApiCreateBrowserRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
 
 	/*
 			 * CreateBrowserSettingsFlow Create Settings Flow for Browsers
@@ -170,15 +170,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserSettingsFlowRequest
+			 * @return FrontendAPIApiCreateBrowserSettingsFlowRequest
 	*/
-	CreateBrowserSettingsFlow(ctx context.Context) FrontendApiApiCreateBrowserSettingsFlowRequest
+	CreateBrowserSettingsFlow(ctx context.Context) FrontendAPIApiCreateBrowserSettingsFlowRequest
 
 	/*
 	 * CreateBrowserSettingsFlowExecute executes the request
 	 * @return SettingsFlow
 	 */
-	CreateBrowserSettingsFlowExecute(r FrontendApiApiCreateBrowserSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
+	CreateBrowserSettingsFlowExecute(r FrontendAPIApiCreateBrowserSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
 
 	/*
 			 * CreateBrowserVerificationFlow Create Verification Flow for Browser Clients
@@ -191,15 +191,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserVerificationFlowRequest
+			 * @return FrontendAPIApiCreateBrowserVerificationFlowRequest
 	*/
-	CreateBrowserVerificationFlow(ctx context.Context) FrontendApiApiCreateBrowserVerificationFlowRequest
+	CreateBrowserVerificationFlow(ctx context.Context) FrontendAPIApiCreateBrowserVerificationFlowRequest
 
 	/*
 	 * CreateBrowserVerificationFlowExecute executes the request
 	 * @return VerificationFlow
 	 */
-	CreateBrowserVerificationFlowExecute(r FrontendApiApiCreateBrowserVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
+	CreateBrowserVerificationFlowExecute(r FrontendAPIApiCreateBrowserVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
 
 	/*
 			 * CreateNativeLoginFlow Create Login Flow for Native Apps
@@ -224,15 +224,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateNativeLoginFlowRequest
+			 * @return FrontendAPIApiCreateNativeLoginFlowRequest
 	*/
-	CreateNativeLoginFlow(ctx context.Context) FrontendApiApiCreateNativeLoginFlowRequest
+	CreateNativeLoginFlow(ctx context.Context) FrontendAPIApiCreateNativeLoginFlowRequest
 
 	/*
 	 * CreateNativeLoginFlowExecute executes the request
 	 * @return LoginFlow
 	 */
-	CreateNativeLoginFlowExecute(r FrontendApiApiCreateNativeLoginFlowRequest) (*LoginFlow, *http.Response, error)
+	CreateNativeLoginFlowExecute(r FrontendAPIApiCreateNativeLoginFlowRequest) (*LoginFlow, *http.Response, error)
 
 	/*
 			 * CreateNativeRecoveryFlow Create Recovery Flow for Native Apps
@@ -250,15 +250,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateNativeRecoveryFlowRequest
+			 * @return FrontendAPIApiCreateNativeRecoveryFlowRequest
 	*/
-	CreateNativeRecoveryFlow(ctx context.Context) FrontendApiApiCreateNativeRecoveryFlowRequest
+	CreateNativeRecoveryFlow(ctx context.Context) FrontendAPIApiCreateNativeRecoveryFlowRequest
 
 	/*
 	 * CreateNativeRecoveryFlowExecute executes the request
 	 * @return RecoveryFlow
 	 */
-	CreateNativeRecoveryFlowExecute(r FrontendApiApiCreateNativeRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
+	CreateNativeRecoveryFlowExecute(r FrontendAPIApiCreateNativeRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
 
 	/*
 			 * CreateNativeRegistrationFlow Create Registration Flow for Native Apps
@@ -282,15 +282,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateNativeRegistrationFlowRequest
+			 * @return FrontendAPIApiCreateNativeRegistrationFlowRequest
 	*/
-	CreateNativeRegistrationFlow(ctx context.Context) FrontendApiApiCreateNativeRegistrationFlowRequest
+	CreateNativeRegistrationFlow(ctx context.Context) FrontendAPIApiCreateNativeRegistrationFlowRequest
 
 	/*
 	 * CreateNativeRegistrationFlowExecute executes the request
 	 * @return RegistrationFlow
 	 */
-	CreateNativeRegistrationFlowExecute(r FrontendApiApiCreateNativeRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
+	CreateNativeRegistrationFlowExecute(r FrontendAPIApiCreateNativeRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
 
 	/*
 			 * CreateNativeSettingsFlow Create Settings Flow for Native Apps
@@ -317,15 +317,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateNativeSettingsFlowRequest
+			 * @return FrontendAPIApiCreateNativeSettingsFlowRequest
 	*/
-	CreateNativeSettingsFlow(ctx context.Context) FrontendApiApiCreateNativeSettingsFlowRequest
+	CreateNativeSettingsFlow(ctx context.Context) FrontendAPIApiCreateNativeSettingsFlowRequest
 
 	/*
 	 * CreateNativeSettingsFlowExecute executes the request
 	 * @return SettingsFlow
 	 */
-	CreateNativeSettingsFlowExecute(r FrontendApiApiCreateNativeSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
+	CreateNativeSettingsFlowExecute(r FrontendAPIApiCreateNativeSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
 
 	/*
 			 * CreateNativeVerificationFlow Create Verification Flow for Native Apps
@@ -341,30 +341,30 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateNativeVerificationFlowRequest
+			 * @return FrontendAPIApiCreateNativeVerificationFlowRequest
 	*/
-	CreateNativeVerificationFlow(ctx context.Context) FrontendApiApiCreateNativeVerificationFlowRequest
+	CreateNativeVerificationFlow(ctx context.Context) FrontendAPIApiCreateNativeVerificationFlowRequest
 
 	/*
 	 * CreateNativeVerificationFlowExecute executes the request
 	 * @return VerificationFlow
 	 */
-	CreateNativeVerificationFlowExecute(r FrontendApiApiCreateNativeVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
+	CreateNativeVerificationFlowExecute(r FrontendAPIApiCreateNativeVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
 
 	/*
 			 * DisableMyOtherSessions Disable my other sessions
 			 * Calling this endpoint invalidates all except the current session that belong to the logged-in user.
 		Session data are not deleted.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiDisableMyOtherSessionsRequest
+			 * @return FrontendAPIApiDisableMyOtherSessionsRequest
 	*/
-	DisableMyOtherSessions(ctx context.Context) FrontendApiApiDisableMyOtherSessionsRequest
+	DisableMyOtherSessions(ctx context.Context) FrontendAPIApiDisableMyOtherSessionsRequest
 
 	/*
 	 * DisableMyOtherSessionsExecute executes the request
 	 * @return DeleteMySessionsCount
 	 */
-	DisableMyOtherSessionsExecute(r FrontendApiApiDisableMyOtherSessionsRequest) (*DeleteMySessionsCount, *http.Response, error)
+	DisableMyOtherSessionsExecute(r FrontendAPIApiDisableMyOtherSessionsRequest) (*DeleteMySessionsCount, *http.Response, error)
 
 	/*
 			 * DisableMySession Disable one of my sessions
@@ -372,27 +372,27 @@ type FrontendApi interface {
 		Session data are not deleted.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID is the session's ID.
-			 * @return FrontendApiApiDisableMySessionRequest
+			 * @return FrontendAPIApiDisableMySessionRequest
 	*/
-	DisableMySession(ctx context.Context, id string) FrontendApiApiDisableMySessionRequest
+	DisableMySession(ctx context.Context, id string) FrontendAPIApiDisableMySessionRequest
 
 	/*
 	 * DisableMySessionExecute executes the request
 	 */
-	DisableMySessionExecute(r FrontendApiApiDisableMySessionRequest) (*http.Response, error)
+	DisableMySessionExecute(r FrontendAPIApiDisableMySessionRequest) (*http.Response, error)
 
 	/*
 	 * ExchangeSessionToken Exchange Session Token
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-	 * @return FrontendApiApiExchangeSessionTokenRequest
+	 * @return FrontendAPIApiExchangeSessionTokenRequest
 	 */
-	ExchangeSessionToken(ctx context.Context) FrontendApiApiExchangeSessionTokenRequest
+	ExchangeSessionToken(ctx context.Context) FrontendAPIApiExchangeSessionTokenRequest
 
 	/*
 	 * ExchangeSessionTokenExecute executes the request
 	 * @return SuccessfulNativeLogin
 	 */
-	ExchangeSessionTokenExecute(r FrontendApiApiExchangeSessionTokenRequest) (*SuccessfulNativeLogin, *http.Response, error)
+	ExchangeSessionTokenExecute(r FrontendAPIApiExchangeSessionTokenRequest) (*SuccessfulNativeLogin, *http.Response, error)
 
 	/*
 			 * GetFlowError Get User-Flow Errors
@@ -404,15 +404,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User User Facing Error Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-facing-errors).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetFlowErrorRequest
+			 * @return FrontendAPIApiGetFlowErrorRequest
 	*/
-	GetFlowError(ctx context.Context) FrontendApiApiGetFlowErrorRequest
+	GetFlowError(ctx context.Context) FrontendAPIApiGetFlowErrorRequest
 
 	/*
 	 * GetFlowErrorExecute executes the request
 	 * @return FlowError
 	 */
-	GetFlowErrorExecute(r FrontendApiApiGetFlowErrorRequest) (*FlowError, *http.Response, error)
+	GetFlowErrorExecute(r FrontendAPIApiGetFlowErrorRequest) (*FlowError, *http.Response, error)
 
 	/*
 			 * GetLoginFlow Get Login Flow
@@ -440,15 +440,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetLoginFlowRequest
+			 * @return FrontendAPIApiGetLoginFlowRequest
 	*/
-	GetLoginFlow(ctx context.Context) FrontendApiApiGetLoginFlowRequest
+	GetLoginFlow(ctx context.Context) FrontendAPIApiGetLoginFlowRequest
 
 	/*
 	 * GetLoginFlowExecute executes the request
 	 * @return LoginFlow
 	 */
-	GetLoginFlowExecute(r FrontendApiApiGetLoginFlowRequest) (*LoginFlow, *http.Response, error)
+	GetLoginFlowExecute(r FrontendAPIApiGetLoginFlowRequest) (*LoginFlow, *http.Response, error)
 
 	/*
 			 * GetRecoveryFlow Get Recovery Flow
@@ -471,15 +471,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetRecoveryFlowRequest
+			 * @return FrontendAPIApiGetRecoveryFlowRequest
 	*/
-	GetRecoveryFlow(ctx context.Context) FrontendApiApiGetRecoveryFlowRequest
+	GetRecoveryFlow(ctx context.Context) FrontendAPIApiGetRecoveryFlowRequest
 
 	/*
 	 * GetRecoveryFlowExecute executes the request
 	 * @return RecoveryFlow
 	 */
-	GetRecoveryFlowExecute(r FrontendApiApiGetRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
+	GetRecoveryFlowExecute(r FrontendAPIApiGetRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
 
 	/*
 			 * GetRegistrationFlow Get Registration Flow
@@ -507,15 +507,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetRegistrationFlowRequest
+			 * @return FrontendAPIApiGetRegistrationFlowRequest
 	*/
-	GetRegistrationFlow(ctx context.Context) FrontendApiApiGetRegistrationFlowRequest
+	GetRegistrationFlow(ctx context.Context) FrontendAPIApiGetRegistrationFlowRequest
 
 	/*
 	 * GetRegistrationFlowExecute executes the request
 	 * @return RegistrationFlow
 	 */
-	GetRegistrationFlowExecute(r FrontendApiApiGetRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
+	GetRegistrationFlowExecute(r FrontendAPIApiGetRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
 
 	/*
 			 * GetSettingsFlow Get Settings Flow
@@ -539,15 +539,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetSettingsFlowRequest
+			 * @return FrontendAPIApiGetSettingsFlowRequest
 	*/
-	GetSettingsFlow(ctx context.Context) FrontendApiApiGetSettingsFlowRequest
+	GetSettingsFlow(ctx context.Context) FrontendAPIApiGetSettingsFlowRequest
 
 	/*
 	 * GetSettingsFlowExecute executes the request
 	 * @return SettingsFlow
 	 */
-	GetSettingsFlowExecute(r FrontendApiApiGetSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
+	GetSettingsFlowExecute(r FrontendAPIApiGetSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
 
 	/*
 			 * GetVerificationFlow Get Verification Flow
@@ -570,15 +570,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetVerificationFlowRequest
+			 * @return FrontendAPIApiGetVerificationFlowRequest
 	*/
-	GetVerificationFlow(ctx context.Context) FrontendApiApiGetVerificationFlowRequest
+	GetVerificationFlow(ctx context.Context) FrontendAPIApiGetVerificationFlowRequest
 
 	/*
 	 * GetVerificationFlowExecute executes the request
 	 * @return VerificationFlow
 	 */
-	GetVerificationFlowExecute(r FrontendApiApiGetVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
+	GetVerificationFlowExecute(r FrontendAPIApiGetVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
 
 	/*
 			 * GetWebAuthnJavaScript Get WebAuthn JavaScript
@@ -592,30 +592,30 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetWebAuthnJavaScriptRequest
+			 * @return FrontendAPIApiGetWebAuthnJavaScriptRequest
 	*/
-	GetWebAuthnJavaScript(ctx context.Context) FrontendApiApiGetWebAuthnJavaScriptRequest
+	GetWebAuthnJavaScript(ctx context.Context) FrontendAPIApiGetWebAuthnJavaScriptRequest
 
 	/*
 	 * GetWebAuthnJavaScriptExecute executes the request
 	 * @return string
 	 */
-	GetWebAuthnJavaScriptExecute(r FrontendApiApiGetWebAuthnJavaScriptRequest) (string, *http.Response, error)
+	GetWebAuthnJavaScriptExecute(r FrontendAPIApiGetWebAuthnJavaScriptRequest) (string, *http.Response, error)
 
 	/*
 			 * ListMySessions Get My Active Sessions
 			 * This endpoints returns all other active sessions that belong to the logged-in user.
 		The current session can be retrieved by calling the `/sessions/whoami` endpoint.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiListMySessionsRequest
+			 * @return FrontendAPIApiListMySessionsRequest
 	*/
-	ListMySessions(ctx context.Context) FrontendApiApiListMySessionsRequest
+	ListMySessions(ctx context.Context) FrontendAPIApiListMySessionsRequest
 
 	/*
 	 * ListMySessionsExecute executes the request
 	 * @return []Session
 	 */
-	ListMySessionsExecute(r FrontendApiApiListMySessionsRequest) ([]Session, *http.Response, error)
+	ListMySessionsExecute(r FrontendAPIApiListMySessionsRequest) ([]Session, *http.Response, error)
 
 	/*
 			 * PerformNativeLogout Perform Logout for Native Apps
@@ -628,14 +628,14 @@ type FrontendApi interface {
 		This endpoint does not remove any HTTP
 		Cookies - use the Browser-Based Self-Service Logout Flow instead.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiPerformNativeLogoutRequest
+			 * @return FrontendAPIApiPerformNativeLogoutRequest
 	*/
-	PerformNativeLogout(ctx context.Context) FrontendApiApiPerformNativeLogoutRequest
+	PerformNativeLogout(ctx context.Context) FrontendAPIApiPerformNativeLogoutRequest
 
 	/*
 	 * PerformNativeLogoutExecute executes the request
 	 */
-	PerformNativeLogoutExecute(r FrontendApiApiPerformNativeLogoutRequest) (*http.Response, error)
+	PerformNativeLogoutExecute(r FrontendAPIApiPerformNativeLogoutRequest) (*http.Response, error)
 
 	/*
 			 * ToSession Check Who the Current HTTP Session Belongs To
@@ -699,15 +699,15 @@ type FrontendApi interface {
 		`session_inactive`: No active session was found in the request (e.g. no Ory Session Cookie / Ory Session Token).
 		`session_aal2_required`: An active session was found but it does not fulfil the Authenticator Assurance Level, implying that the session must (e.g.) authenticate the second factor.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiToSessionRequest
+			 * @return FrontendAPIApiToSessionRequest
 	*/
-	ToSession(ctx context.Context) FrontendApiApiToSessionRequest
+	ToSession(ctx context.Context) FrontendAPIApiToSessionRequest
 
 	/*
 	 * ToSessionExecute executes the request
 	 * @return Session
 	 */
-	ToSessionExecute(r FrontendApiApiToSessionRequest) (*Session, *http.Response, error)
+	ToSessionExecute(r FrontendAPIApiToSessionRequest) (*Session, *http.Response, error)
 
 	/*
 			 * UpdateLoginFlow Submit a Login Flow
@@ -739,15 +739,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateLoginFlowRequest
+			 * @return FrontendAPIApiUpdateLoginFlowRequest
 	*/
-	UpdateLoginFlow(ctx context.Context) FrontendApiApiUpdateLoginFlowRequest
+	UpdateLoginFlow(ctx context.Context) FrontendAPIApiUpdateLoginFlowRequest
 
 	/*
 	 * UpdateLoginFlowExecute executes the request
 	 * @return SuccessfulNativeLogin
 	 */
-	UpdateLoginFlowExecute(r FrontendApiApiUpdateLoginFlowRequest) (*SuccessfulNativeLogin, *http.Response, error)
+	UpdateLoginFlowExecute(r FrontendAPIApiUpdateLoginFlowRequest) (*SuccessfulNativeLogin, *http.Response, error)
 
 	/*
 			 * UpdateLogoutFlow Update Logout Flow
@@ -765,14 +765,14 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Logout Documentation](https://www.ory.sh/docs/next/kratos/self-service/flows/user-logout).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateLogoutFlowRequest
+			 * @return FrontendAPIApiUpdateLogoutFlowRequest
 	*/
-	UpdateLogoutFlow(ctx context.Context) FrontendApiApiUpdateLogoutFlowRequest
+	UpdateLogoutFlow(ctx context.Context) FrontendAPIApiUpdateLogoutFlowRequest
 
 	/*
 	 * UpdateLogoutFlowExecute executes the request
 	 */
-	UpdateLogoutFlowExecute(r FrontendApiApiUpdateLogoutFlowRequest) (*http.Response, error)
+	UpdateLogoutFlowExecute(r FrontendAPIApiUpdateLogoutFlowRequest) (*http.Response, error)
 
 	/*
 			 * UpdateRecoveryFlow Update Recovery Flow
@@ -793,15 +793,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateRecoveryFlowRequest
+			 * @return FrontendAPIApiUpdateRecoveryFlowRequest
 	*/
-	UpdateRecoveryFlow(ctx context.Context) FrontendApiApiUpdateRecoveryFlowRequest
+	UpdateRecoveryFlow(ctx context.Context) FrontendAPIApiUpdateRecoveryFlowRequest
 
 	/*
 	 * UpdateRecoveryFlowExecute executes the request
 	 * @return RecoveryFlow
 	 */
-	UpdateRecoveryFlowExecute(r FrontendApiApiUpdateRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
+	UpdateRecoveryFlowExecute(r FrontendAPIApiUpdateRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
 
 	/*
 			 * UpdateRegistrationFlow Update Registration Flow
@@ -834,15 +834,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateRegistrationFlowRequest
+			 * @return FrontendAPIApiUpdateRegistrationFlowRequest
 	*/
-	UpdateRegistrationFlow(ctx context.Context) FrontendApiApiUpdateRegistrationFlowRequest
+	UpdateRegistrationFlow(ctx context.Context) FrontendAPIApiUpdateRegistrationFlowRequest
 
 	/*
 	 * UpdateRegistrationFlowExecute executes the request
 	 * @return SuccessfulNativeRegistration
 	 */
-	UpdateRegistrationFlowExecute(r FrontendApiApiUpdateRegistrationFlowRequest) (*SuccessfulNativeRegistration, *http.Response, error)
+	UpdateRegistrationFlowExecute(r FrontendAPIApiUpdateRegistrationFlowRequest) (*SuccessfulNativeRegistration, *http.Response, error)
 
 	/*
 			 * UpdateSettingsFlow Complete Settings Flow
@@ -890,15 +890,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateSettingsFlowRequest
+			 * @return FrontendAPIApiUpdateSettingsFlowRequest
 	*/
-	UpdateSettingsFlow(ctx context.Context) FrontendApiApiUpdateSettingsFlowRequest
+	UpdateSettingsFlow(ctx context.Context) FrontendAPIApiUpdateSettingsFlowRequest
 
 	/*
 	 * UpdateSettingsFlowExecute executes the request
 	 * @return SettingsFlow
 	 */
-	UpdateSettingsFlowExecute(r FrontendApiApiUpdateSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
+	UpdateSettingsFlowExecute(r FrontendAPIApiUpdateSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
 
 	/*
 			 * UpdateVerificationFlow Complete Verification Flow
@@ -919,23 +919,23 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateVerificationFlowRequest
+			 * @return FrontendAPIApiUpdateVerificationFlowRequest
 	*/
-	UpdateVerificationFlow(ctx context.Context) FrontendApiApiUpdateVerificationFlowRequest
+	UpdateVerificationFlow(ctx context.Context) FrontendAPIApiUpdateVerificationFlowRequest
 
 	/*
 	 * UpdateVerificationFlowExecute executes the request
 	 * @return VerificationFlow
 	 */
-	UpdateVerificationFlowExecute(r FrontendApiApiUpdateVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
+	UpdateVerificationFlowExecute(r FrontendAPIApiUpdateVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
 }
 
-// FrontendApiService FrontendApi service
-type FrontendApiService service
+// FrontendAPIService FrontendAPI service
+type FrontendAPIService service
 
-type FrontendApiApiCreateBrowserLoginFlowRequest struct {
+type FrontendAPIApiCreateBrowserLoginFlowRequest struct {
 	ctx            context.Context
-	ApiService     FrontendApi
+	ApiService     FrontendAPI
 	refresh        *bool
 	aal            *string
 	returnTo       *string
@@ -945,36 +945,36 @@ type FrontendApiApiCreateBrowserLoginFlowRequest struct {
 	via            *string
 }
 
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Refresh(refresh bool) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Refresh(refresh bool) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.refresh = &refresh
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Aal(aal string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Aal(aal string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.aal = &aal
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Cookie(cookie string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Cookie(cookie string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.cookie = &cookie
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) LoginChallenge(loginChallenge string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) LoginChallenge(loginChallenge string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.loginChallenge = &loginChallenge
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Organization(organization string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Organization(organization string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.organization = &organization
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Via(via string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Via(via string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.via = &via
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserLoginFlowExecute(r)
 }
 
@@ -1005,10 +1005,10 @@ This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Fi
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserLoginFlowRequest
+  - @return FrontendAPIApiCreateBrowserLoginFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserLoginFlow(ctx context.Context) FrontendApiApiCreateBrowserLoginFlowRequest {
-	return FrontendApiApiCreateBrowserLoginFlowRequest{
+func (a *FrontendAPIService) CreateBrowserLoginFlow(ctx context.Context) FrontendAPIApiCreateBrowserLoginFlowRequest {
+	return FrontendAPIApiCreateBrowserLoginFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1018,7 +1018,7 @@ func (a *FrontendApiService) CreateBrowserLoginFlow(ctx context.Context) Fronten
  * Execute executes the request
  * @return LoginFlow
  */
-func (a *FrontendApiService) CreateBrowserLoginFlowExecute(r FrontendApiApiCreateBrowserLoginFlowRequest) (*LoginFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserLoginFlowExecute(r FrontendAPIApiCreateBrowserLoginFlowRequest) (*LoginFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1028,7 +1028,7 @@ func (a *FrontendApiService) CreateBrowserLoginFlowExecute(r FrontendApiApiCreat
 		localVarReturnValue  *LoginFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserLoginFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserLoginFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1131,23 +1131,23 @@ func (a *FrontendApiService) CreateBrowserLoginFlowExecute(r FrontendApiApiCreat
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateBrowserLogoutFlowRequest struct {
+type FrontendAPIApiCreateBrowserLogoutFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	cookie     *string
 	returnTo   *string
 }
 
-func (r FrontendApiApiCreateBrowserLogoutFlowRequest) Cookie(cookie string) FrontendApiApiCreateBrowserLogoutFlowRequest {
+func (r FrontendAPIApiCreateBrowserLogoutFlowRequest) Cookie(cookie string) FrontendAPIApiCreateBrowserLogoutFlowRequest {
 	r.cookie = &cookie
 	return r
 }
-func (r FrontendApiApiCreateBrowserLogoutFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserLogoutFlowRequest {
+func (r FrontendAPIApiCreateBrowserLogoutFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserLogoutFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserLogoutFlowRequest) Execute() (*LogoutFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserLogoutFlowRequest) Execute() (*LogoutFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserLogoutFlowExecute(r)
 }
 
@@ -1164,10 +1164,10 @@ a 401 error.
 
 When calling this endpoint from a backend, please ensure to properly forward the HTTP cookies.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserLogoutFlowRequest
+  - @return FrontendAPIApiCreateBrowserLogoutFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserLogoutFlow(ctx context.Context) FrontendApiApiCreateBrowserLogoutFlowRequest {
-	return FrontendApiApiCreateBrowserLogoutFlowRequest{
+func (a *FrontendAPIService) CreateBrowserLogoutFlow(ctx context.Context) FrontendAPIApiCreateBrowserLogoutFlowRequest {
+	return FrontendAPIApiCreateBrowserLogoutFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1177,7 +1177,7 @@ func (a *FrontendApiService) CreateBrowserLogoutFlow(ctx context.Context) Fronte
  * Execute executes the request
  * @return LogoutFlow
  */
-func (a *FrontendApiService) CreateBrowserLogoutFlowExecute(r FrontendApiApiCreateBrowserLogoutFlowRequest) (*LogoutFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserLogoutFlowExecute(r FrontendAPIApiCreateBrowserLogoutFlowRequest) (*LogoutFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1187,7 +1187,7 @@ func (a *FrontendApiService) CreateBrowserLogoutFlowExecute(r FrontendApiApiCrea
 		localVarReturnValue  *LogoutFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserLogoutFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserLogoutFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1287,18 +1287,18 @@ func (a *FrontendApiService) CreateBrowserLogoutFlowExecute(r FrontendApiApiCrea
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateBrowserRecoveryFlowRequest struct {
+type FrontendAPIApiCreateBrowserRecoveryFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	returnTo   *string
 }
 
-func (r FrontendApiApiCreateBrowserRecoveryFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserRecoveryFlowRequest {
+func (r FrontendAPIApiCreateBrowserRecoveryFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserRecoveryFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserRecoveryFlowExecute(r)
 }
 
@@ -1316,10 +1316,10 @@ This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Fi
 
 More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserRecoveryFlowRequest
+  - @return FrontendAPIApiCreateBrowserRecoveryFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserRecoveryFlow(ctx context.Context) FrontendApiApiCreateBrowserRecoveryFlowRequest {
-	return FrontendApiApiCreateBrowserRecoveryFlowRequest{
+func (a *FrontendAPIService) CreateBrowserRecoveryFlow(ctx context.Context) FrontendAPIApiCreateBrowserRecoveryFlowRequest {
+	return FrontendAPIApiCreateBrowserRecoveryFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1329,7 +1329,7 @@ func (a *FrontendApiService) CreateBrowserRecoveryFlow(ctx context.Context) Fron
  * Execute executes the request
  * @return RecoveryFlow
  */
-func (a *FrontendApiService) CreateBrowserRecoveryFlowExecute(r FrontendApiApiCreateBrowserRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserRecoveryFlowExecute(r FrontendAPIApiCreateBrowserRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1339,7 +1339,7 @@ func (a *FrontendApiService) CreateBrowserRecoveryFlowExecute(r FrontendApiApiCr
 		localVarReturnValue  *RecoveryFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserRecoveryFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserRecoveryFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1424,33 +1424,33 @@ func (a *FrontendApiService) CreateBrowserRecoveryFlowExecute(r FrontendApiApiCr
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateBrowserRegistrationFlowRequest struct {
+type FrontendAPIApiCreateBrowserRegistrationFlowRequest struct {
 	ctx                       context.Context
-	ApiService                FrontendApi
+	ApiService                FrontendAPI
 	returnTo                  *string
 	loginChallenge            *string
 	afterVerificationReturnTo *string
 	organization              *string
 }
 
-func (r FrontendApiApiCreateBrowserRegistrationFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserRegistrationFlowRequest {
+func (r FrontendAPIApiCreateBrowserRegistrationFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserRegistrationFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r FrontendApiApiCreateBrowserRegistrationFlowRequest) LoginChallenge(loginChallenge string) FrontendApiApiCreateBrowserRegistrationFlowRequest {
+func (r FrontendAPIApiCreateBrowserRegistrationFlowRequest) LoginChallenge(loginChallenge string) FrontendAPIApiCreateBrowserRegistrationFlowRequest {
 	r.loginChallenge = &loginChallenge
 	return r
 }
-func (r FrontendApiApiCreateBrowserRegistrationFlowRequest) AfterVerificationReturnTo(afterVerificationReturnTo string) FrontendApiApiCreateBrowserRegistrationFlowRequest {
+func (r FrontendAPIApiCreateBrowserRegistrationFlowRequest) AfterVerificationReturnTo(afterVerificationReturnTo string) FrontendAPIApiCreateBrowserRegistrationFlowRequest {
 	r.afterVerificationReturnTo = &afterVerificationReturnTo
 	return r
 }
-func (r FrontendApiApiCreateBrowserRegistrationFlowRequest) Organization(organization string) FrontendApiApiCreateBrowserRegistrationFlowRequest {
+func (r FrontendAPIApiCreateBrowserRegistrationFlowRequest) Organization(organization string) FrontendAPIApiCreateBrowserRegistrationFlowRequest {
 	r.organization = &organization
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserRegistrationFlowExecute(r)
 }
 
@@ -1477,10 +1477,10 @@ This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Fi
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserRegistrationFlowRequest
+  - @return FrontendAPIApiCreateBrowserRegistrationFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserRegistrationFlow(ctx context.Context) FrontendApiApiCreateBrowserRegistrationFlowRequest {
-	return FrontendApiApiCreateBrowserRegistrationFlowRequest{
+func (a *FrontendAPIService) CreateBrowserRegistrationFlow(ctx context.Context) FrontendAPIApiCreateBrowserRegistrationFlowRequest {
+	return FrontendAPIApiCreateBrowserRegistrationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1490,7 +1490,7 @@ func (a *FrontendApiService) CreateBrowserRegistrationFlow(ctx context.Context)
  * Execute executes the request
  * @return RegistrationFlow
  */
-func (a *FrontendApiService) CreateBrowserRegistrationFlowExecute(r FrontendApiApiCreateBrowserRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserRegistrationFlowExecute(r FrontendAPIApiCreateBrowserRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1500,7 +1500,7 @@ func (a *FrontendApiService) CreateBrowserRegistrationFlowExecute(r FrontendApiA
 		localVarReturnValue  *RegistrationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserRegistrationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserRegistrationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1584,23 +1584,23 @@ func (a *FrontendApiService) CreateBrowserRegistrationFlowExecute(r FrontendApiA
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateBrowserSettingsFlowRequest struct {
+type FrontendAPIApiCreateBrowserSettingsFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	returnTo   *string
 	cookie     *string
 }
 
-func (r FrontendApiApiCreateBrowserSettingsFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserSettingsFlowRequest {
+func (r FrontendAPIApiCreateBrowserSettingsFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserSettingsFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r FrontendApiApiCreateBrowserSettingsFlowRequest) Cookie(cookie string) FrontendApiApiCreateBrowserSettingsFlowRequest {
+func (r FrontendAPIApiCreateBrowserSettingsFlowRequest) Cookie(cookie string) FrontendAPIApiCreateBrowserSettingsFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserSettingsFlowExecute(r)
 }
 
@@ -1634,10 +1634,10 @@ This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Fi
 
 More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserSettingsFlowRequest
+  - @return FrontendAPIApiCreateBrowserSettingsFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserSettingsFlow(ctx context.Context) FrontendApiApiCreateBrowserSettingsFlowRequest {
-	return FrontendApiApiCreateBrowserSettingsFlowRequest{
+func (a *FrontendAPIService) CreateBrowserSettingsFlow(ctx context.Context) FrontendAPIApiCreateBrowserSettingsFlowRequest {
+	return FrontendAPIApiCreateBrowserSettingsFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1647,7 +1647,7 @@ func (a *FrontendApiService) CreateBrowserSettingsFlow(ctx context.Context) Fron
  * Execute executes the request
  * @return SettingsFlow
  */
-func (a *FrontendApiService) CreateBrowserSettingsFlowExecute(r FrontendApiApiCreateBrowserSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserSettingsFlowExecute(r FrontendAPIApiCreateBrowserSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1657,7 +1657,7 @@ func (a *FrontendApiService) CreateBrowserSettingsFlowExecute(r FrontendApiApiCr
 		localVarReturnValue  *SettingsFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserSettingsFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserSettingsFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1765,18 +1765,18 @@ func (a *FrontendApiService) CreateBrowserSettingsFlowExecute(r FrontendApiApiCr
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateBrowserVerificationFlowRequest struct {
+type FrontendAPIApiCreateBrowserVerificationFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	returnTo   *string
 }
 
-func (r FrontendApiApiCreateBrowserVerificationFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserVerificationFlowRequest {
+func (r FrontendAPIApiCreateBrowserVerificationFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserVerificationFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserVerificationFlowExecute(r)
 }
 
@@ -1792,10 +1792,10 @@ This endpoint is NOT INTENDED for API clients and only works with browsers (Chro
 
 More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserVerificationFlowRequest
+  - @return FrontendAPIApiCreateBrowserVerificationFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserVerificationFlow(ctx context.Context) FrontendApiApiCreateBrowserVerificationFlowRequest {
-	return FrontendApiApiCreateBrowserVerificationFlowRequest{
+func (a *FrontendAPIService) CreateBrowserVerificationFlow(ctx context.Context) FrontendAPIApiCreateBrowserVerificationFlowRequest {
+	return FrontendAPIApiCreateBrowserVerificationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1805,7 +1805,7 @@ func (a *FrontendApiService) CreateBrowserVerificationFlow(ctx context.Context)
  * Execute executes the request
  * @return VerificationFlow
  */
-func (a *FrontendApiService) CreateBrowserVerificationFlowExecute(r FrontendApiApiCreateBrowserVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserVerificationFlowExecute(r FrontendAPIApiCreateBrowserVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1815,7 +1815,7 @@ func (a *FrontendApiService) CreateBrowserVerificationFlowExecute(r FrontendApiA
 		localVarReturnValue  *VerificationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserVerificationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserVerificationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1890,43 +1890,48 @@ func (a *FrontendApiService) CreateBrowserVerificationFlowExecute(r FrontendApiA
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateNativeLoginFlowRequest struct {
+type FrontendAPIApiCreateNativeLoginFlowRequest struct {
 	ctx                            context.Context
-	ApiService                     FrontendApi
+	ApiService                     FrontendAPI
 	refresh                        *bool
 	aal                            *string
 	xSessionToken                  *string
 	returnSessionTokenExchangeCode *bool
 	returnTo                       *string
+	organization                   *string
 	via                            *string
 }
 
-func (r FrontendApiApiCreateNativeLoginFlowRequest) Refresh(refresh bool) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) Refresh(refresh bool) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.refresh = &refresh
 	return r
 }
-func (r FrontendApiApiCreateNativeLoginFlowRequest) Aal(aal string) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) Aal(aal string) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.aal = &aal
 	return r
 }
-func (r FrontendApiApiCreateNativeLoginFlowRequest) XSessionToken(xSessionToken string) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) XSessionToken(xSessionToken string) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiCreateNativeLoginFlowRequest) ReturnSessionTokenExchangeCode(returnSessionTokenExchangeCode bool) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) ReturnSessionTokenExchangeCode(returnSessionTokenExchangeCode bool) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.returnSessionTokenExchangeCode = &returnSessionTokenExchangeCode
 	return r
 }
-func (r FrontendApiApiCreateNativeLoginFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r FrontendApiApiCreateNativeLoginFlowRequest) Via(via string) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) Organization(organization string) FrontendAPIApiCreateNativeLoginFlowRequest {
+	r.organization = &organization
+	return r
+}
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) Via(via string) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.via = &via
 	return r
 }
 
-func (r FrontendApiApiCreateNativeLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
 	return r.ApiService.CreateNativeLoginFlowExecute(r)
 }
 
@@ -1953,10 +1958,10 @@ This endpoint MUST ONLY be used in scenarios such as native mobile apps (React N
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateNativeLoginFlowRequest
+  - @return FrontendAPIApiCreateNativeLoginFlowRequest
 */
-func (a *FrontendApiService) CreateNativeLoginFlow(ctx context.Context) FrontendApiApiCreateNativeLoginFlowRequest {
-	return FrontendApiApiCreateNativeLoginFlowRequest{
+func (a *FrontendAPIService) CreateNativeLoginFlow(ctx context.Context) FrontendAPIApiCreateNativeLoginFlowRequest {
+	return FrontendAPIApiCreateNativeLoginFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1966,7 +1971,7 @@ func (a *FrontendApiService) CreateNativeLoginFlow(ctx context.Context) Frontend
  * Execute executes the request
  * @return LoginFlow
  */
-func (a *FrontendApiService) CreateNativeLoginFlowExecute(r FrontendApiApiCreateNativeLoginFlowRequest) (*LoginFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateNativeLoginFlowExecute(r FrontendAPIApiCreateNativeLoginFlowRequest) (*LoginFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1976,7 +1981,7 @@ func (a *FrontendApiService) CreateNativeLoginFlowExecute(r FrontendApiApiCreate
 		localVarReturnValue  *LoginFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateNativeLoginFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateNativeLoginFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1999,6 +2004,9 @@ func (a *FrontendApiService) CreateNativeLoginFlowExecute(r FrontendApiApiCreate
 	if r.returnTo != nil {
 		localVarQueryParams.Add("return_to", parameterToString(*r.returnTo, ""))
 	}
+	if r.organization != nil {
+		localVarQueryParams.Add("organization", parameterToString(*r.organization, ""))
+	}
 	if r.via != nil {
 		localVarQueryParams.Add("via", parameterToString(*r.via, ""))
 	}
@@ -2076,12 +2084,12 @@ func (a *FrontendApiService) CreateNativeLoginFlowExecute(r FrontendApiApiCreate
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateNativeRecoveryFlowRequest struct {
+type FrontendAPIApiCreateNativeRecoveryFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 }
 
-func (r FrontendApiApiCreateNativeRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateNativeRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
 	return r.ApiService.CreateNativeRecoveryFlowExecute(r)
 }
 
@@ -2101,10 +2109,10 @@ This endpoint MUST ONLY be used in scenarios such as native mobile apps (React N
 
 More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateNativeRecoveryFlowRequest
+  - @return FrontendAPIApiCreateNativeRecoveryFlowRequest
 */
-func (a *FrontendApiService) CreateNativeRecoveryFlow(ctx context.Context) FrontendApiApiCreateNativeRecoveryFlowRequest {
-	return FrontendApiApiCreateNativeRecoveryFlowRequest{
+func (a *FrontendAPIService) CreateNativeRecoveryFlow(ctx context.Context) FrontendAPIApiCreateNativeRecoveryFlowRequest {
+	return FrontendAPIApiCreateNativeRecoveryFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2114,7 +2122,7 @@ func (a *FrontendApiService) CreateNativeRecoveryFlow(ctx context.Context) Front
  * Execute executes the request
  * @return RecoveryFlow
  */
-func (a *FrontendApiService) CreateNativeRecoveryFlowExecute(r FrontendApiApiCreateNativeRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateNativeRecoveryFlowExecute(r FrontendAPIApiCreateNativeRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2124,7 +2132,7 @@ func (a *FrontendApiService) CreateNativeRecoveryFlowExecute(r FrontendApiApiCre
 		localVarReturnValue  *RecoveryFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateNativeRecoveryFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateNativeRecoveryFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2206,23 +2214,28 @@ func (a *FrontendApiService) CreateNativeRecoveryFlowExecute(r FrontendApiApiCre
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateNativeRegistrationFlowRequest struct {
+type FrontendAPIApiCreateNativeRegistrationFlowRequest struct {
 	ctx                            context.Context
-	ApiService                     FrontendApi
+	ApiService                     FrontendAPI
 	returnSessionTokenExchangeCode *bool
 	returnTo                       *string
+	organization                   *string
 }
 
-func (r FrontendApiApiCreateNativeRegistrationFlowRequest) ReturnSessionTokenExchangeCode(returnSessionTokenExchangeCode bool) FrontendApiApiCreateNativeRegistrationFlowRequest {
+func (r FrontendAPIApiCreateNativeRegistrationFlowRequest) ReturnSessionTokenExchangeCode(returnSessionTokenExchangeCode bool) FrontendAPIApiCreateNativeRegistrationFlowRequest {
 	r.returnSessionTokenExchangeCode = &returnSessionTokenExchangeCode
 	return r
 }
-func (r FrontendApiApiCreateNativeRegistrationFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateNativeRegistrationFlowRequest {
+func (r FrontendAPIApiCreateNativeRegistrationFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateNativeRegistrationFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
+func (r FrontendAPIApiCreateNativeRegistrationFlowRequest) Organization(organization string) FrontendAPIApiCreateNativeRegistrationFlowRequest {
+	r.organization = &organization
+	return r
+}
 
-func (r FrontendApiApiCreateNativeRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateNativeRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
 	return r.ApiService.CreateNativeRegistrationFlowExecute(r)
 }
 
@@ -2248,10 +2261,10 @@ This endpoint MUST ONLY be used in scenarios such as native mobile apps (React N
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateNativeRegistrationFlowRequest
+  - @return FrontendAPIApiCreateNativeRegistrationFlowRequest
 */
-func (a *FrontendApiService) CreateNativeRegistrationFlow(ctx context.Context) FrontendApiApiCreateNativeRegistrationFlowRequest {
-	return FrontendApiApiCreateNativeRegistrationFlowRequest{
+func (a *FrontendAPIService) CreateNativeRegistrationFlow(ctx context.Context) FrontendAPIApiCreateNativeRegistrationFlowRequest {
+	return FrontendAPIApiCreateNativeRegistrationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2261,7 +2274,7 @@ func (a *FrontendApiService) CreateNativeRegistrationFlow(ctx context.Context) F
  * Execute executes the request
  * @return RegistrationFlow
  */
-func (a *FrontendApiService) CreateNativeRegistrationFlowExecute(r FrontendApiApiCreateNativeRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateNativeRegistrationFlowExecute(r FrontendAPIApiCreateNativeRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2271,7 +2284,7 @@ func (a *FrontendApiService) CreateNativeRegistrationFlowExecute(r FrontendApiAp
 		localVarReturnValue  *RegistrationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateNativeRegistrationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateNativeRegistrationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2288,6 +2301,9 @@ func (a *FrontendApiService) CreateNativeRegistrationFlowExecute(r FrontendApiAp
 	if r.returnTo != nil {
 		localVarQueryParams.Add("return_to", parameterToString(*r.returnTo, ""))
 	}
+	if r.organization != nil {
+		localVarQueryParams.Add("organization", parameterToString(*r.organization, ""))
+	}
 	// to determine the Content-Type header
 	localVarHTTPContentTypes := []string{}
 
@@ -2359,18 +2375,18 @@ func (a *FrontendApiService) CreateNativeRegistrationFlowExecute(r FrontendApiAp
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateNativeSettingsFlowRequest struct {
+type FrontendAPIApiCreateNativeSettingsFlowRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	xSessionToken *string
 }
 
-func (r FrontendApiApiCreateNativeSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendApiApiCreateNativeSettingsFlowRequest {
+func (r FrontendAPIApiCreateNativeSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendAPIApiCreateNativeSettingsFlowRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
 
-func (r FrontendApiApiCreateNativeSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateNativeSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
 	return r.ApiService.CreateNativeSettingsFlowExecute(r)
 }
 
@@ -2400,10 +2416,10 @@ This endpoint MUST ONLY be used in scenarios such as native mobile apps (React N
 
 More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateNativeSettingsFlowRequest
+  - @return FrontendAPIApiCreateNativeSettingsFlowRequest
 */
-func (a *FrontendApiService) CreateNativeSettingsFlow(ctx context.Context) FrontendApiApiCreateNativeSettingsFlowRequest {
-	return FrontendApiApiCreateNativeSettingsFlowRequest{
+func (a *FrontendAPIService) CreateNativeSettingsFlow(ctx context.Context) FrontendAPIApiCreateNativeSettingsFlowRequest {
+	return FrontendAPIApiCreateNativeSettingsFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2413,7 +2429,7 @@ func (a *FrontendApiService) CreateNativeSettingsFlow(ctx context.Context) Front
  * Execute executes the request
  * @return SettingsFlow
  */
-func (a *FrontendApiService) CreateNativeSettingsFlowExecute(r FrontendApiApiCreateNativeSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateNativeSettingsFlowExecute(r FrontendAPIApiCreateNativeSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2423,7 +2439,7 @@ func (a *FrontendApiService) CreateNativeSettingsFlowExecute(r FrontendApiApiCre
 		localVarReturnValue  *SettingsFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateNativeSettingsFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateNativeSettingsFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2508,12 +2524,18 @@ func (a *FrontendApiService) CreateNativeSettingsFlowExecute(r FrontendApiApiCre
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateNativeVerificationFlowRequest struct {
+type FrontendAPIApiCreateNativeVerificationFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
+	returnTo   *string
+}
+
+func (r FrontendAPIApiCreateNativeVerificationFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateNativeVerificationFlowRequest {
+	r.returnTo = &returnTo
+	return r
 }
 
-func (r FrontendApiApiCreateNativeVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateNativeVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
 	return r.ApiService.CreateNativeVerificationFlowExecute(r)
 }
 
@@ -2531,10 +2553,10 @@ This endpoint MUST ONLY be used in scenarios such as native mobile apps (React N
 
 More information can be found at [Ory Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateNativeVerificationFlowRequest
+  - @return FrontendAPIApiCreateNativeVerificationFlowRequest
 */
-func (a *FrontendApiService) CreateNativeVerificationFlow(ctx context.Context) FrontendApiApiCreateNativeVerificationFlowRequest {
-	return FrontendApiApiCreateNativeVerificationFlowRequest{
+func (a *FrontendAPIService) CreateNativeVerificationFlow(ctx context.Context) FrontendAPIApiCreateNativeVerificationFlowRequest {
+	return FrontendAPIApiCreateNativeVerificationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2544,7 +2566,7 @@ func (a *FrontendApiService) CreateNativeVerificationFlow(ctx context.Context) F
  * Execute executes the request
  * @return VerificationFlow
  */
-func (a *FrontendApiService) CreateNativeVerificationFlowExecute(r FrontendApiApiCreateNativeVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateNativeVerificationFlowExecute(r FrontendAPIApiCreateNativeVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2554,7 +2576,7 @@ func (a *FrontendApiService) CreateNativeVerificationFlowExecute(r FrontendApiAp
 		localVarReturnValue  *VerificationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateNativeVerificationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateNativeVerificationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2565,6 +2587,9 @@ func (a *FrontendApiService) CreateNativeVerificationFlowExecute(r FrontendApiAp
 	localVarQueryParams := url.Values{}
 	localVarFormParams := url.Values{}
 
+	if r.returnTo != nil {
+		localVarQueryParams.Add("return_to", parameterToString(*r.returnTo, ""))
+	}
 	// to determine the Content-Type header
 	localVarHTTPContentTypes := []string{}
 
@@ -2636,23 +2661,23 @@ func (a *FrontendApiService) CreateNativeVerificationFlowExecute(r FrontendApiAp
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiDisableMyOtherSessionsRequest struct {
+type FrontendAPIApiDisableMyOtherSessionsRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	xSessionToken *string
 	cookie        *string
 }
 
-func (r FrontendApiApiDisableMyOtherSessionsRequest) XSessionToken(xSessionToken string) FrontendApiApiDisableMyOtherSessionsRequest {
+func (r FrontendAPIApiDisableMyOtherSessionsRequest) XSessionToken(xSessionToken string) FrontendAPIApiDisableMyOtherSessionsRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiDisableMyOtherSessionsRequest) Cookie(cookie string) FrontendApiApiDisableMyOtherSessionsRequest {
+func (r FrontendAPIApiDisableMyOtherSessionsRequest) Cookie(cookie string) FrontendAPIApiDisableMyOtherSessionsRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiDisableMyOtherSessionsRequest) Execute() (*DeleteMySessionsCount, *http.Response, error) {
+func (r FrontendAPIApiDisableMyOtherSessionsRequest) Execute() (*DeleteMySessionsCount, *http.Response, error) {
 	return r.ApiService.DisableMyOtherSessionsExecute(r)
 }
 
@@ -2662,10 +2687,10 @@ func (r FrontendApiApiDisableMyOtherSessionsRequest) Execute() (*DeleteMySession
 
 Session data are not deleted.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiDisableMyOtherSessionsRequest
+  - @return FrontendAPIApiDisableMyOtherSessionsRequest
 */
-func (a *FrontendApiService) DisableMyOtherSessions(ctx context.Context) FrontendApiApiDisableMyOtherSessionsRequest {
-	return FrontendApiApiDisableMyOtherSessionsRequest{
+func (a *FrontendAPIService) DisableMyOtherSessions(ctx context.Context) FrontendAPIApiDisableMyOtherSessionsRequest {
+	return FrontendAPIApiDisableMyOtherSessionsRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2675,7 +2700,7 @@ func (a *FrontendApiService) DisableMyOtherSessions(ctx context.Context) Fronten
  * Execute executes the request
  * @return DeleteMySessionsCount
  */
-func (a *FrontendApiService) DisableMyOtherSessionsExecute(r FrontendApiApiDisableMyOtherSessionsRequest) (*DeleteMySessionsCount, *http.Response, error) {
+func (a *FrontendAPIService) DisableMyOtherSessionsExecute(r FrontendAPIApiDisableMyOtherSessionsRequest) (*DeleteMySessionsCount, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -2685,7 +2710,7 @@ func (a *FrontendApiService) DisableMyOtherSessionsExecute(r FrontendApiApiDisab
 		localVarReturnValue  *DeleteMySessionsCount
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.DisableMyOtherSessions")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.DisableMyOtherSessions")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2783,24 +2808,24 @@ func (a *FrontendApiService) DisableMyOtherSessionsExecute(r FrontendApiApiDisab
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiDisableMySessionRequest struct {
+type FrontendAPIApiDisableMySessionRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	id            string
 	xSessionToken *string
 	cookie        *string
 }
 
-func (r FrontendApiApiDisableMySessionRequest) XSessionToken(xSessionToken string) FrontendApiApiDisableMySessionRequest {
+func (r FrontendAPIApiDisableMySessionRequest) XSessionToken(xSessionToken string) FrontendAPIApiDisableMySessionRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiDisableMySessionRequest) Cookie(cookie string) FrontendApiApiDisableMySessionRequest {
+func (r FrontendAPIApiDisableMySessionRequest) Cookie(cookie string) FrontendAPIApiDisableMySessionRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiDisableMySessionRequest) Execute() (*http.Response, error) {
+func (r FrontendAPIApiDisableMySessionRequest) Execute() (*http.Response, error) {
 	return r.ApiService.DisableMySessionExecute(r)
 }
 
@@ -2811,10 +2836,10 @@ func (r FrontendApiApiDisableMySessionRequest) Execute() (*http.Response, error)
 Session data are not deleted.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID is the session's ID.
-  - @return FrontendApiApiDisableMySessionRequest
+  - @return FrontendAPIApiDisableMySessionRequest
 */
-func (a *FrontendApiService) DisableMySession(ctx context.Context, id string) FrontendApiApiDisableMySessionRequest {
-	return FrontendApiApiDisableMySessionRequest{
+func (a *FrontendAPIService) DisableMySession(ctx context.Context, id string) FrontendAPIApiDisableMySessionRequest {
+	return FrontendAPIApiDisableMySessionRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -2824,7 +2849,7 @@ func (a *FrontendApiService) DisableMySession(ctx context.Context, id string) Fr
 /*
  * Execute executes the request
  */
-func (a *FrontendApiService) DisableMySessionExecute(r FrontendApiApiDisableMySessionRequest) (*http.Response, error) {
+func (a *FrontendAPIService) DisableMySessionExecute(r FrontendAPIApiDisableMySessionRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -2833,7 +2858,7 @@ func (a *FrontendApiService) DisableMySessionExecute(r FrontendApiApiDisableMySe
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.DisableMySession")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.DisableMySession")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2923,33 +2948,33 @@ func (a *FrontendApiService) DisableMySessionExecute(r FrontendApiApiDisableMySe
 	return localVarHTTPResponse, nil
 }
 
-type FrontendApiApiExchangeSessionTokenRequest struct {
+type FrontendAPIApiExchangeSessionTokenRequest struct {
 	ctx          context.Context
-	ApiService   FrontendApi
+	ApiService   FrontendAPI
 	initCode     *string
 	returnToCode *string
 }
 
-func (r FrontendApiApiExchangeSessionTokenRequest) InitCode(initCode string) FrontendApiApiExchangeSessionTokenRequest {
+func (r FrontendAPIApiExchangeSessionTokenRequest) InitCode(initCode string) FrontendAPIApiExchangeSessionTokenRequest {
 	r.initCode = &initCode
 	return r
 }
-func (r FrontendApiApiExchangeSessionTokenRequest) ReturnToCode(returnToCode string) FrontendApiApiExchangeSessionTokenRequest {
+func (r FrontendAPIApiExchangeSessionTokenRequest) ReturnToCode(returnToCode string) FrontendAPIApiExchangeSessionTokenRequest {
 	r.returnToCode = &returnToCode
 	return r
 }
 
-func (r FrontendApiApiExchangeSessionTokenRequest) Execute() (*SuccessfulNativeLogin, *http.Response, error) {
+func (r FrontendAPIApiExchangeSessionTokenRequest) Execute() (*SuccessfulNativeLogin, *http.Response, error) {
 	return r.ApiService.ExchangeSessionTokenExecute(r)
 }
 
 /*
  * ExchangeSessionToken Exchange Session Token
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- * @return FrontendApiApiExchangeSessionTokenRequest
+ * @return FrontendAPIApiExchangeSessionTokenRequest
  */
-func (a *FrontendApiService) ExchangeSessionToken(ctx context.Context) FrontendApiApiExchangeSessionTokenRequest {
-	return FrontendApiApiExchangeSessionTokenRequest{
+func (a *FrontendAPIService) ExchangeSessionToken(ctx context.Context) FrontendAPIApiExchangeSessionTokenRequest {
+	return FrontendAPIApiExchangeSessionTokenRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2959,7 +2984,7 @@ func (a *FrontendApiService) ExchangeSessionToken(ctx context.Context) FrontendA
  * Execute executes the request
  * @return SuccessfulNativeLogin
  */
-func (a *FrontendApiService) ExchangeSessionTokenExecute(r FrontendApiApiExchangeSessionTokenRequest) (*SuccessfulNativeLogin, *http.Response, error) {
+func (a *FrontendAPIService) ExchangeSessionTokenExecute(r FrontendAPIApiExchangeSessionTokenRequest) (*SuccessfulNativeLogin, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2969,7 +2994,7 @@ func (a *FrontendApiService) ExchangeSessionTokenExecute(r FrontendApiApiExchang
 		localVarReturnValue  *SuccessfulNativeLogin
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.ExchangeSessionToken")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.ExchangeSessionToken")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3079,18 +3104,18 @@ func (a *FrontendApiService) ExchangeSessionTokenExecute(r FrontendApiApiExchang
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetFlowErrorRequest struct {
+type FrontendAPIApiGetFlowErrorRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	id         *string
 }
 
-func (r FrontendApiApiGetFlowErrorRequest) Id(id string) FrontendApiApiGetFlowErrorRequest {
+func (r FrontendAPIApiGetFlowErrorRequest) Id(id string) FrontendAPIApiGetFlowErrorRequest {
 	r.id = &id
 	return r
 }
 
-func (r FrontendApiApiGetFlowErrorRequest) Execute() (*FlowError, *http.Response, error) {
+func (r FrontendAPIApiGetFlowErrorRequest) Execute() (*FlowError, *http.Response, error) {
 	return r.ApiService.GetFlowErrorExecute(r)
 }
 
@@ -3104,10 +3129,10 @@ This endpoint supports stub values to help you implement the error UI:
 
 More information can be found at [Ory Kratos User User Facing Error Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-facing-errors).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetFlowErrorRequest
+  - @return FrontendAPIApiGetFlowErrorRequest
 */
-func (a *FrontendApiService) GetFlowError(ctx context.Context) FrontendApiApiGetFlowErrorRequest {
-	return FrontendApiApiGetFlowErrorRequest{
+func (a *FrontendAPIService) GetFlowError(ctx context.Context) FrontendAPIApiGetFlowErrorRequest {
+	return FrontendAPIApiGetFlowErrorRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3117,7 +3142,7 @@ func (a *FrontendApiService) GetFlowError(ctx context.Context) FrontendApiApiGet
  * Execute executes the request
  * @return FlowError
  */
-func (a *FrontendApiService) GetFlowErrorExecute(r FrontendApiApiGetFlowErrorRequest) (*FlowError, *http.Response, error) {
+func (a *FrontendAPIService) GetFlowErrorExecute(r FrontendAPIApiGetFlowErrorRequest) (*FlowError, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -3127,7 +3152,7 @@ func (a *FrontendApiService) GetFlowErrorExecute(r FrontendApiApiGetFlowErrorReq
 		localVarReturnValue  *FlowError
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetFlowError")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetFlowError")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3225,23 +3250,23 @@ func (a *FrontendApiService) GetFlowErrorExecute(r FrontendApiApiGetFlowErrorReq
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetLoginFlowRequest struct {
+type FrontendAPIApiGetLoginFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	id         *string
 	cookie     *string
 }
 
-func (r FrontendApiApiGetLoginFlowRequest) Id(id string) FrontendApiApiGetLoginFlowRequest {
+func (r FrontendAPIApiGetLoginFlowRequest) Id(id string) FrontendAPIApiGetLoginFlowRequest {
 	r.id = &id
 	return r
 }
-func (r FrontendApiApiGetLoginFlowRequest) Cookie(cookie string) FrontendApiApiGetLoginFlowRequest {
+func (r FrontendAPIApiGetLoginFlowRequest) Cookie(cookie string) FrontendAPIApiGetLoginFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiGetLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
+func (r FrontendAPIApiGetLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
 	return r.ApiService.GetLoginFlowExecute(r)
 }
 
@@ -3271,10 +3296,10 @@ This request may fail due to several reasons. The `error.id` can be one of:
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetLoginFlowRequest
+  - @return FrontendAPIApiGetLoginFlowRequest
 */
-func (a *FrontendApiService) GetLoginFlow(ctx context.Context) FrontendApiApiGetLoginFlowRequest {
-	return FrontendApiApiGetLoginFlowRequest{
+func (a *FrontendAPIService) GetLoginFlow(ctx context.Context) FrontendAPIApiGetLoginFlowRequest {
+	return FrontendAPIApiGetLoginFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3284,7 +3309,7 @@ func (a *FrontendApiService) GetLoginFlow(ctx context.Context) FrontendApiApiGet
  * Execute executes the request
  * @return LoginFlow
  */
-func (a *FrontendApiService) GetLoginFlowExecute(r FrontendApiApiGetLoginFlowRequest) (*LoginFlow, *http.Response, error) {
+func (a *FrontendAPIService) GetLoginFlowExecute(r FrontendAPIApiGetLoginFlowRequest) (*LoginFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -3294,7 +3319,7 @@ func (a *FrontendApiService) GetLoginFlowExecute(r FrontendApiApiGetLoginFlowReq
 		localVarReturnValue  *LoginFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetLoginFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetLoginFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3403,23 +3428,23 @@ func (a *FrontendApiService) GetLoginFlowExecute(r FrontendApiApiGetLoginFlowReq
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetRecoveryFlowRequest struct {
+type FrontendAPIApiGetRecoveryFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	id         *string
 	cookie     *string
 }
 
-func (r FrontendApiApiGetRecoveryFlowRequest) Id(id string) FrontendApiApiGetRecoveryFlowRequest {
+func (r FrontendAPIApiGetRecoveryFlowRequest) Id(id string) FrontendAPIApiGetRecoveryFlowRequest {
 	r.id = &id
 	return r
 }
-func (r FrontendApiApiGetRecoveryFlowRequest) Cookie(cookie string) FrontendApiApiGetRecoveryFlowRequest {
+func (r FrontendAPIApiGetRecoveryFlowRequest) Cookie(cookie string) FrontendAPIApiGetRecoveryFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiGetRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
+func (r FrontendAPIApiGetRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
 	return r.ApiService.GetRecoveryFlowExecute(r)
 }
 
@@ -3444,10 +3469,10 @@ res.render('recovery', flow)
 
 More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetRecoveryFlowRequest
+  - @return FrontendAPIApiGetRecoveryFlowRequest
 */
-func (a *FrontendApiService) GetRecoveryFlow(ctx context.Context) FrontendApiApiGetRecoveryFlowRequest {
-	return FrontendApiApiGetRecoveryFlowRequest{
+func (a *FrontendAPIService) GetRecoveryFlow(ctx context.Context) FrontendAPIApiGetRecoveryFlowRequest {
+	return FrontendAPIApiGetRecoveryFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3457,7 +3482,7 @@ func (a *FrontendApiService) GetRecoveryFlow(ctx context.Context) FrontendApiApi
  * Execute executes the request
  * @return RecoveryFlow
  */
-func (a *FrontendApiService) GetRecoveryFlowExecute(r FrontendApiApiGetRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
+func (a *FrontendAPIService) GetRecoveryFlowExecute(r FrontendAPIApiGetRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -3467,7 +3492,7 @@ func (a *FrontendApiService) GetRecoveryFlowExecute(r FrontendApiApiGetRecoveryF
 		localVarReturnValue  *RecoveryFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetRecoveryFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetRecoveryFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3566,23 +3591,23 @@ func (a *FrontendApiService) GetRecoveryFlowExecute(r FrontendApiApiGetRecoveryF
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetRegistrationFlowRequest struct {
+type FrontendAPIApiGetRegistrationFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	id         *string
 	cookie     *string
 }
 
-func (r FrontendApiApiGetRegistrationFlowRequest) Id(id string) FrontendApiApiGetRegistrationFlowRequest {
+func (r FrontendAPIApiGetRegistrationFlowRequest) Id(id string) FrontendAPIApiGetRegistrationFlowRequest {
 	r.id = &id
 	return r
 }
-func (r FrontendApiApiGetRegistrationFlowRequest) Cookie(cookie string) FrontendApiApiGetRegistrationFlowRequest {
+func (r FrontendAPIApiGetRegistrationFlowRequest) Cookie(cookie string) FrontendAPIApiGetRegistrationFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiGetRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
+func (r FrontendAPIApiGetRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
 	return r.ApiService.GetRegistrationFlowExecute(r)
 }
 
@@ -3612,10 +3637,10 @@ This request may fail due to several reasons. The `error.id` can be one of:
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetRegistrationFlowRequest
+  - @return FrontendAPIApiGetRegistrationFlowRequest
 */
-func (a *FrontendApiService) GetRegistrationFlow(ctx context.Context) FrontendApiApiGetRegistrationFlowRequest {
-	return FrontendApiApiGetRegistrationFlowRequest{
+func (a *FrontendAPIService) GetRegistrationFlow(ctx context.Context) FrontendAPIApiGetRegistrationFlowRequest {
+	return FrontendAPIApiGetRegistrationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3625,7 +3650,7 @@ func (a *FrontendApiService) GetRegistrationFlow(ctx context.Context) FrontendAp
  * Execute executes the request
  * @return RegistrationFlow
  */
-func (a *FrontendApiService) GetRegistrationFlowExecute(r FrontendApiApiGetRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
+func (a *FrontendAPIService) GetRegistrationFlowExecute(r FrontendAPIApiGetRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -3635,7 +3660,7 @@ func (a *FrontendApiService) GetRegistrationFlowExecute(r FrontendApiApiGetRegis
 		localVarReturnValue  *RegistrationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetRegistrationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetRegistrationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3744,28 +3769,28 @@ func (a *FrontendApiService) GetRegistrationFlowExecute(r FrontendApiApiGetRegis
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetSettingsFlowRequest struct {
+type FrontendAPIApiGetSettingsFlowRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	id            *string
 	xSessionToken *string
 	cookie        *string
 }
 
-func (r FrontendApiApiGetSettingsFlowRequest) Id(id string) FrontendApiApiGetSettingsFlowRequest {
+func (r FrontendAPIApiGetSettingsFlowRequest) Id(id string) FrontendAPIApiGetSettingsFlowRequest {
 	r.id = &id
 	return r
 }
-func (r FrontendApiApiGetSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendApiApiGetSettingsFlowRequest {
+func (r FrontendAPIApiGetSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendAPIApiGetSettingsFlowRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiGetSettingsFlowRequest) Cookie(cookie string) FrontendApiApiGetSettingsFlowRequest {
+func (r FrontendAPIApiGetSettingsFlowRequest) Cookie(cookie string) FrontendAPIApiGetSettingsFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiGetSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
+func (r FrontendAPIApiGetSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
 	return r.ApiService.GetSettingsFlowExecute(r)
 }
 
@@ -3792,10 +3817,10 @@ identity logged in instead.
 
 More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetSettingsFlowRequest
+  - @return FrontendAPIApiGetSettingsFlowRequest
 */
-func (a *FrontendApiService) GetSettingsFlow(ctx context.Context) FrontendApiApiGetSettingsFlowRequest {
-	return FrontendApiApiGetSettingsFlowRequest{
+func (a *FrontendAPIService) GetSettingsFlow(ctx context.Context) FrontendAPIApiGetSettingsFlowRequest {
+	return FrontendAPIApiGetSettingsFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3805,7 +3830,7 @@ func (a *FrontendApiService) GetSettingsFlow(ctx context.Context) FrontendApiApi
  * Execute executes the request
  * @return SettingsFlow
  */
-func (a *FrontendApiService) GetSettingsFlowExecute(r FrontendApiApiGetSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
+func (a *FrontendAPIService) GetSettingsFlowExecute(r FrontendAPIApiGetSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -3815,7 +3840,7 @@ func (a *FrontendApiService) GetSettingsFlowExecute(r FrontendApiApiGetSettingsF
 		localVarReturnValue  *SettingsFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetSettingsFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetSettingsFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3937,23 +3962,23 @@ func (a *FrontendApiService) GetSettingsFlowExecute(r FrontendApiApiGetSettingsF
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetVerificationFlowRequest struct {
+type FrontendAPIApiGetVerificationFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	id         *string
 	cookie     *string
 }
 
-func (r FrontendApiApiGetVerificationFlowRequest) Id(id string) FrontendApiApiGetVerificationFlowRequest {
+func (r FrontendAPIApiGetVerificationFlowRequest) Id(id string) FrontendAPIApiGetVerificationFlowRequest {
 	r.id = &id
 	return r
 }
-func (r FrontendApiApiGetVerificationFlowRequest) Cookie(cookie string) FrontendApiApiGetVerificationFlowRequest {
+func (r FrontendAPIApiGetVerificationFlowRequest) Cookie(cookie string) FrontendAPIApiGetVerificationFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiGetVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
+func (r FrontendAPIApiGetVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
 	return r.ApiService.GetVerificationFlowExecute(r)
 }
 
@@ -3978,10 +4003,10 @@ res.render('verification', flow)
 
 More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetVerificationFlowRequest
+  - @return FrontendAPIApiGetVerificationFlowRequest
 */
-func (a *FrontendApiService) GetVerificationFlow(ctx context.Context) FrontendApiApiGetVerificationFlowRequest {
-	return FrontendApiApiGetVerificationFlowRequest{
+func (a *FrontendAPIService) GetVerificationFlow(ctx context.Context) FrontendAPIApiGetVerificationFlowRequest {
+	return FrontendAPIApiGetVerificationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3991,7 +4016,7 @@ func (a *FrontendApiService) GetVerificationFlow(ctx context.Context) FrontendAp
  * Execute executes the request
  * @return VerificationFlow
  */
-func (a *FrontendApiService) GetVerificationFlowExecute(r FrontendApiApiGetVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
+func (a *FrontendAPIService) GetVerificationFlowExecute(r FrontendAPIApiGetVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -4001,7 +4026,7 @@ func (a *FrontendApiService) GetVerificationFlowExecute(r FrontendApiApiGetVerif
 		localVarReturnValue  *VerificationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetVerificationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetVerificationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4100,12 +4125,12 @@ func (a *FrontendApiService) GetVerificationFlowExecute(r FrontendApiApiGetVerif
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetWebAuthnJavaScriptRequest struct {
+type FrontendAPIApiGetWebAuthnJavaScriptRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 }
 
-func (r FrontendApiApiGetWebAuthnJavaScriptRequest) Execute() (string, *http.Response, error) {
+func (r FrontendAPIApiGetWebAuthnJavaScriptRequest) Execute() (string, *http.Response, error) {
 	return r.ApiService.GetWebAuthnJavaScriptExecute(r)
 }
 
@@ -4121,10 +4146,10 @@ If you are building a JavaScript Browser App (e.g. in ReactJS or AngularJS) you
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetWebAuthnJavaScriptRequest
+  - @return FrontendAPIApiGetWebAuthnJavaScriptRequest
 */
-func (a *FrontendApiService) GetWebAuthnJavaScript(ctx context.Context) FrontendApiApiGetWebAuthnJavaScriptRequest {
-	return FrontendApiApiGetWebAuthnJavaScriptRequest{
+func (a *FrontendAPIService) GetWebAuthnJavaScript(ctx context.Context) FrontendAPIApiGetWebAuthnJavaScriptRequest {
+	return FrontendAPIApiGetWebAuthnJavaScriptRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4134,7 +4159,7 @@ func (a *FrontendApiService) GetWebAuthnJavaScript(ctx context.Context) Frontend
  * Execute executes the request
  * @return string
  */
-func (a *FrontendApiService) GetWebAuthnJavaScriptExecute(r FrontendApiApiGetWebAuthnJavaScriptRequest) (string, *http.Response, error) {
+func (a *FrontendAPIService) GetWebAuthnJavaScriptExecute(r FrontendAPIApiGetWebAuthnJavaScriptRequest) (string, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -4144,7 +4169,7 @@ func (a *FrontendApiService) GetWebAuthnJavaScriptExecute(r FrontendApiApiGetWeb
 		localVarReturnValue  string
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetWebAuthnJavaScript")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetWebAuthnJavaScript")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4209,9 +4234,9 @@ func (a *FrontendApiService) GetWebAuthnJavaScriptExecute(r FrontendApiApiGetWeb
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiListMySessionsRequest struct {
+type FrontendAPIApiListMySessionsRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	perPage       *int64
 	page          *int64
 	pageSize      *int64
@@ -4220,32 +4245,32 @@ type FrontendApiApiListMySessionsRequest struct {
 	cookie        *string
 }
 
-func (r FrontendApiApiListMySessionsRequest) PerPage(perPage int64) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) PerPage(perPage int64) FrontendAPIApiListMySessionsRequest {
 	r.perPage = &perPage
 	return r
 }
-func (r FrontendApiApiListMySessionsRequest) Page(page int64) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) Page(page int64) FrontendAPIApiListMySessionsRequest {
 	r.page = &page
 	return r
 }
-func (r FrontendApiApiListMySessionsRequest) PageSize(pageSize int64) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) PageSize(pageSize int64) FrontendAPIApiListMySessionsRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r FrontendApiApiListMySessionsRequest) PageToken(pageToken string) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) PageToken(pageToken string) FrontendAPIApiListMySessionsRequest {
 	r.pageToken = &pageToken
 	return r
 }
-func (r FrontendApiApiListMySessionsRequest) XSessionToken(xSessionToken string) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) XSessionToken(xSessionToken string) FrontendAPIApiListMySessionsRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiListMySessionsRequest) Cookie(cookie string) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) Cookie(cookie string) FrontendAPIApiListMySessionsRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiListMySessionsRequest) Execute() ([]Session, *http.Response, error) {
+func (r FrontendAPIApiListMySessionsRequest) Execute() ([]Session, *http.Response, error) {
 	return r.ApiService.ListMySessionsExecute(r)
 }
 
@@ -4255,10 +4280,10 @@ func (r FrontendApiApiListMySessionsRequest) Execute() ([]Session, *http.Respons
 
 The current session can be retrieved by calling the `/sessions/whoami` endpoint.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiListMySessionsRequest
+  - @return FrontendAPIApiListMySessionsRequest
 */
-func (a *FrontendApiService) ListMySessions(ctx context.Context) FrontendApiApiListMySessionsRequest {
-	return FrontendApiApiListMySessionsRequest{
+func (a *FrontendAPIService) ListMySessions(ctx context.Context) FrontendAPIApiListMySessionsRequest {
+	return FrontendAPIApiListMySessionsRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4268,7 +4293,7 @@ func (a *FrontendApiService) ListMySessions(ctx context.Context) FrontendApiApiL
  * Execute executes the request
  * @return []Session
  */
-func (a *FrontendApiService) ListMySessionsExecute(r FrontendApiApiListMySessionsRequest) ([]Session, *http.Response, error) {
+func (a *FrontendAPIService) ListMySessionsExecute(r FrontendAPIApiListMySessionsRequest) ([]Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -4278,7 +4303,7 @@ func (a *FrontendApiService) ListMySessionsExecute(r FrontendApiApiListMySession
 		localVarReturnValue  []Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.ListMySessions")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.ListMySessions")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4388,18 +4413,18 @@ func (a *FrontendApiService) ListMySessionsExecute(r FrontendApiApiListMySession
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiPerformNativeLogoutRequest struct {
+type FrontendAPIApiPerformNativeLogoutRequest struct {
 	ctx                     context.Context
-	ApiService              FrontendApi
+	ApiService              FrontendAPI
 	performNativeLogoutBody *PerformNativeLogoutBody
 }
 
-func (r FrontendApiApiPerformNativeLogoutRequest) PerformNativeLogoutBody(performNativeLogoutBody PerformNativeLogoutBody) FrontendApiApiPerformNativeLogoutRequest {
+func (r FrontendAPIApiPerformNativeLogoutRequest) PerformNativeLogoutBody(performNativeLogoutBody PerformNativeLogoutBody) FrontendAPIApiPerformNativeLogoutRequest {
 	r.performNativeLogoutBody = &performNativeLogoutBody
 	return r
 }
 
-func (r FrontendApiApiPerformNativeLogoutRequest) Execute() (*http.Response, error) {
+func (r FrontendAPIApiPerformNativeLogoutRequest) Execute() (*http.Response, error) {
 	return r.ApiService.PerformNativeLogoutExecute(r)
 }
 
@@ -4415,10 +4440,10 @@ If the Ory Session Token is malformed or does not exist a 403 Forbidden response
 This endpoint does not remove any HTTP
 Cookies - use the Browser-Based Self-Service Logout Flow instead.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiPerformNativeLogoutRequest
+  - @return FrontendAPIApiPerformNativeLogoutRequest
 */
-func (a *FrontendApiService) PerformNativeLogout(ctx context.Context) FrontendApiApiPerformNativeLogoutRequest {
-	return FrontendApiApiPerformNativeLogoutRequest{
+func (a *FrontendAPIService) PerformNativeLogout(ctx context.Context) FrontendAPIApiPerformNativeLogoutRequest {
+	return FrontendAPIApiPerformNativeLogoutRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4427,7 +4452,7 @@ func (a *FrontendApiService) PerformNativeLogout(ctx context.Context) FrontendAp
 /*
  * Execute executes the request
  */
-func (a *FrontendApiService) PerformNativeLogoutExecute(r FrontendApiApiPerformNativeLogoutRequest) (*http.Response, error) {
+func (a *FrontendAPIService) PerformNativeLogoutExecute(r FrontendAPIApiPerformNativeLogoutRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -4436,7 +4461,7 @@ func (a *FrontendApiService) PerformNativeLogoutExecute(r FrontendApiApiPerformN
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.PerformNativeLogout")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.PerformNativeLogout")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4514,28 +4539,28 @@ func (a *FrontendApiService) PerformNativeLogoutExecute(r FrontendApiApiPerformN
 	return localVarHTTPResponse, nil
 }
 
-type FrontendApiApiToSessionRequest struct {
+type FrontendAPIApiToSessionRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	xSessionToken *string
 	cookie        *string
 	tokenizeAs    *string
 }
 
-func (r FrontendApiApiToSessionRequest) XSessionToken(xSessionToken string) FrontendApiApiToSessionRequest {
+func (r FrontendAPIApiToSessionRequest) XSessionToken(xSessionToken string) FrontendAPIApiToSessionRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiToSessionRequest) Cookie(cookie string) FrontendApiApiToSessionRequest {
+func (r FrontendAPIApiToSessionRequest) Cookie(cookie string) FrontendAPIApiToSessionRequest {
 	r.cookie = &cookie
 	return r
 }
-func (r FrontendApiApiToSessionRequest) TokenizeAs(tokenizeAs string) FrontendApiApiToSessionRequest {
+func (r FrontendAPIApiToSessionRequest) TokenizeAs(tokenizeAs string) FrontendAPIApiToSessionRequest {
 	r.tokenizeAs = &tokenizeAs
 	return r
 }
 
-func (r FrontendApiApiToSessionRequest) Execute() (*Session, *http.Response, error) {
+func (r FrontendAPIApiToSessionRequest) Execute() (*Session, *http.Response, error) {
 	return r.ApiService.ToSessionExecute(r)
 }
 
@@ -4602,10 +4627,10 @@ As explained above, this request may fail due to several reasons. The `error.id`
 `session_inactive`: No active session was found in the request (e.g. no Ory Session Cookie / Ory Session Token).
 `session_aal2_required`: An active session was found but it does not fulfil the Authenticator Assurance Level, implying that the session must (e.g.) authenticate the second factor.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiToSessionRequest
+  - @return FrontendAPIApiToSessionRequest
 */
-func (a *FrontendApiService) ToSession(ctx context.Context) FrontendApiApiToSessionRequest {
-	return FrontendApiApiToSessionRequest{
+func (a *FrontendAPIService) ToSession(ctx context.Context) FrontendAPIApiToSessionRequest {
+	return FrontendAPIApiToSessionRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4615,7 +4640,7 @@ func (a *FrontendApiService) ToSession(ctx context.Context) FrontendApiApiToSess
  * Execute executes the request
  * @return Session
  */
-func (a *FrontendApiService) ToSessionExecute(r FrontendApiApiToSessionRequest) (*Session, *http.Response, error) {
+func (a *FrontendAPIService) ToSessionExecute(r FrontendAPIApiToSessionRequest) (*Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -4625,7 +4650,7 @@ func (a *FrontendApiService) ToSessionExecute(r FrontendApiApiToSessionRequest)
 		localVarReturnValue  *Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.ToSession")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.ToSession")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4726,33 +4751,33 @@ func (a *FrontendApiService) ToSessionExecute(r FrontendApiApiToSessionRequest)
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateLoginFlowRequest struct {
+type FrontendAPIApiUpdateLoginFlowRequest struct {
 	ctx                 context.Context
-	ApiService          FrontendApi
+	ApiService          FrontendAPI
 	flow                *string
 	updateLoginFlowBody *UpdateLoginFlowBody
 	xSessionToken       *string
 	cookie              *string
 }
 
-func (r FrontendApiApiUpdateLoginFlowRequest) Flow(flow string) FrontendApiApiUpdateLoginFlowRequest {
+func (r FrontendAPIApiUpdateLoginFlowRequest) Flow(flow string) FrontendAPIApiUpdateLoginFlowRequest {
 	r.flow = &flow
 	return r
 }
-func (r FrontendApiApiUpdateLoginFlowRequest) UpdateLoginFlowBody(updateLoginFlowBody UpdateLoginFlowBody) FrontendApiApiUpdateLoginFlowRequest {
+func (r FrontendAPIApiUpdateLoginFlowRequest) UpdateLoginFlowBody(updateLoginFlowBody UpdateLoginFlowBody) FrontendAPIApiUpdateLoginFlowRequest {
 	r.updateLoginFlowBody = &updateLoginFlowBody
 	return r
 }
-func (r FrontendApiApiUpdateLoginFlowRequest) XSessionToken(xSessionToken string) FrontendApiApiUpdateLoginFlowRequest {
+func (r FrontendAPIApiUpdateLoginFlowRequest) XSessionToken(xSessionToken string) FrontendAPIApiUpdateLoginFlowRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiUpdateLoginFlowRequest) Cookie(cookie string) FrontendApiApiUpdateLoginFlowRequest {
+func (r FrontendAPIApiUpdateLoginFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateLoginFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateLoginFlowRequest) Execute() (*SuccessfulNativeLogin, *http.Response, error) {
+func (r FrontendAPIApiUpdateLoginFlowRequest) Execute() (*SuccessfulNativeLogin, *http.Response, error) {
 	return r.ApiService.UpdateLoginFlowExecute(r)
 }
 
@@ -4787,10 +4812,10 @@ Most likely used in Social Sign In flows.
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateLoginFlowRequest
+  - @return FrontendAPIApiUpdateLoginFlowRequest
 */
-func (a *FrontendApiService) UpdateLoginFlow(ctx context.Context) FrontendApiApiUpdateLoginFlowRequest {
-	return FrontendApiApiUpdateLoginFlowRequest{
+func (a *FrontendAPIService) UpdateLoginFlow(ctx context.Context) FrontendAPIApiUpdateLoginFlowRequest {
+	return FrontendAPIApiUpdateLoginFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4800,7 +4825,7 @@ func (a *FrontendApiService) UpdateLoginFlow(ctx context.Context) FrontendApiApi
  * Execute executes the request
  * @return SuccessfulNativeLogin
  */
-func (a *FrontendApiService) UpdateLoginFlowExecute(r FrontendApiApiUpdateLoginFlowRequest) (*SuccessfulNativeLogin, *http.Response, error) {
+func (a *FrontendAPIService) UpdateLoginFlowExecute(r FrontendAPIApiUpdateLoginFlowRequest) (*SuccessfulNativeLogin, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -4810,7 +4835,7 @@ func (a *FrontendApiService) UpdateLoginFlowExecute(r FrontendApiApiUpdateLoginF
 		localVarReturnValue  *SuccessfulNativeLogin
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateLoginFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateLoginFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4927,28 +4952,28 @@ func (a *FrontendApiService) UpdateLoginFlowExecute(r FrontendApiApiUpdateLoginF
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateLogoutFlowRequest struct {
+type FrontendAPIApiUpdateLogoutFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	token      *string
 	returnTo   *string
 	cookie     *string
 }
 
-func (r FrontendApiApiUpdateLogoutFlowRequest) Token(token string) FrontendApiApiUpdateLogoutFlowRequest {
+func (r FrontendAPIApiUpdateLogoutFlowRequest) Token(token string) FrontendAPIApiUpdateLogoutFlowRequest {
 	r.token = &token
 	return r
 }
-func (r FrontendApiApiUpdateLogoutFlowRequest) ReturnTo(returnTo string) FrontendApiApiUpdateLogoutFlowRequest {
+func (r FrontendAPIApiUpdateLogoutFlowRequest) ReturnTo(returnTo string) FrontendAPIApiUpdateLogoutFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r FrontendApiApiUpdateLogoutFlowRequest) Cookie(cookie string) FrontendApiApiUpdateLogoutFlowRequest {
+func (r FrontendAPIApiUpdateLogoutFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateLogoutFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateLogoutFlowRequest) Execute() (*http.Response, error) {
+func (r FrontendAPIApiUpdateLogoutFlowRequest) Execute() (*http.Response, error) {
 	return r.ApiService.UpdateLogoutFlowExecute(r)
 }
 
@@ -4968,10 +4993,10 @@ call the `/self-service/logout/api` URL directly with the Ory Session Token.
 
 More information can be found at [Ory Kratos User Logout Documentation](https://www.ory.sh/docs/next/kratos/self-service/flows/user-logout).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateLogoutFlowRequest
+  - @return FrontendAPIApiUpdateLogoutFlowRequest
 */
-func (a *FrontendApiService) UpdateLogoutFlow(ctx context.Context) FrontendApiApiUpdateLogoutFlowRequest {
-	return FrontendApiApiUpdateLogoutFlowRequest{
+func (a *FrontendAPIService) UpdateLogoutFlow(ctx context.Context) FrontendAPIApiUpdateLogoutFlowRequest {
+	return FrontendAPIApiUpdateLogoutFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4980,7 +5005,7 @@ func (a *FrontendApiService) UpdateLogoutFlow(ctx context.Context) FrontendApiAp
 /*
  * Execute executes the request
  */
-func (a *FrontendApiService) UpdateLogoutFlowExecute(r FrontendApiApiUpdateLogoutFlowRequest) (*http.Response, error) {
+func (a *FrontendAPIService) UpdateLogoutFlowExecute(r FrontendAPIApiUpdateLogoutFlowRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -4989,7 +5014,7 @@ func (a *FrontendApiService) UpdateLogoutFlowExecute(r FrontendApiApiUpdateLogou
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateLogoutFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateLogoutFlow")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -5061,33 +5086,33 @@ func (a *FrontendApiService) UpdateLogoutFlowExecute(r FrontendApiApiUpdateLogou
 	return localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateRecoveryFlowRequest struct {
+type FrontendAPIApiUpdateRecoveryFlowRequest struct {
 	ctx                    context.Context
-	ApiService             FrontendApi
+	ApiService             FrontendAPI
 	flow                   *string
 	updateRecoveryFlowBody *UpdateRecoveryFlowBody
 	token                  *string
 	cookie                 *string
 }
 
-func (r FrontendApiApiUpdateRecoveryFlowRequest) Flow(flow string) FrontendApiApiUpdateRecoveryFlowRequest {
+func (r FrontendAPIApiUpdateRecoveryFlowRequest) Flow(flow string) FrontendAPIApiUpdateRecoveryFlowRequest {
 	r.flow = &flow
 	return r
 }
-func (r FrontendApiApiUpdateRecoveryFlowRequest) UpdateRecoveryFlowBody(updateRecoveryFlowBody UpdateRecoveryFlowBody) FrontendApiApiUpdateRecoveryFlowRequest {
+func (r FrontendAPIApiUpdateRecoveryFlowRequest) UpdateRecoveryFlowBody(updateRecoveryFlowBody UpdateRecoveryFlowBody) FrontendAPIApiUpdateRecoveryFlowRequest {
 	r.updateRecoveryFlowBody = &updateRecoveryFlowBody
 	return r
 }
-func (r FrontendApiApiUpdateRecoveryFlowRequest) Token(token string) FrontendApiApiUpdateRecoveryFlowRequest {
+func (r FrontendAPIApiUpdateRecoveryFlowRequest) Token(token string) FrontendAPIApiUpdateRecoveryFlowRequest {
 	r.token = &token
 	return r
 }
-func (r FrontendApiApiUpdateRecoveryFlowRequest) Cookie(cookie string) FrontendApiApiUpdateRecoveryFlowRequest {
+func (r FrontendAPIApiUpdateRecoveryFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateRecoveryFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
+func (r FrontendAPIApiUpdateRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
 	return r.ApiService.UpdateRecoveryFlowExecute(r)
 }
 
@@ -5111,10 +5136,10 @@ a new Recovery Flow ID which contains an error message that the recovery link wa
 
 More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateRecoveryFlowRequest
+  - @return FrontendAPIApiUpdateRecoveryFlowRequest
 */
-func (a *FrontendApiService) UpdateRecoveryFlow(ctx context.Context) FrontendApiApiUpdateRecoveryFlowRequest {
-	return FrontendApiApiUpdateRecoveryFlowRequest{
+func (a *FrontendAPIService) UpdateRecoveryFlow(ctx context.Context) FrontendAPIApiUpdateRecoveryFlowRequest {
+	return FrontendAPIApiUpdateRecoveryFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -5124,7 +5149,7 @@ func (a *FrontendApiService) UpdateRecoveryFlow(ctx context.Context) FrontendApi
  * Execute executes the request
  * @return RecoveryFlow
  */
-func (a *FrontendApiService) UpdateRecoveryFlowExecute(r FrontendApiApiUpdateRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
+func (a *FrontendAPIService) UpdateRecoveryFlowExecute(r FrontendAPIApiUpdateRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -5134,7 +5159,7 @@ func (a *FrontendApiService) UpdateRecoveryFlowExecute(r FrontendApiApiUpdateRec
 		localVarReturnValue  *RecoveryFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateRecoveryFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateRecoveryFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -5251,28 +5276,28 @@ func (a *FrontendApiService) UpdateRecoveryFlowExecute(r FrontendApiApiUpdateRec
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateRegistrationFlowRequest struct {
+type FrontendAPIApiUpdateRegistrationFlowRequest struct {
 	ctx                        context.Context
-	ApiService                 FrontendApi
+	ApiService                 FrontendAPI
 	flow                       *string
 	updateRegistrationFlowBody *UpdateRegistrationFlowBody
 	cookie                     *string
 }
 
-func (r FrontendApiApiUpdateRegistrationFlowRequest) Flow(flow string) FrontendApiApiUpdateRegistrationFlowRequest {
+func (r FrontendAPIApiUpdateRegistrationFlowRequest) Flow(flow string) FrontendAPIApiUpdateRegistrationFlowRequest {
 	r.flow = &flow
 	return r
 }
-func (r FrontendApiApiUpdateRegistrationFlowRequest) UpdateRegistrationFlowBody(updateRegistrationFlowBody UpdateRegistrationFlowBody) FrontendApiApiUpdateRegistrationFlowRequest {
+func (r FrontendAPIApiUpdateRegistrationFlowRequest) UpdateRegistrationFlowBody(updateRegistrationFlowBody UpdateRegistrationFlowBody) FrontendAPIApiUpdateRegistrationFlowRequest {
 	r.updateRegistrationFlowBody = &updateRegistrationFlowBody
 	return r
 }
-func (r FrontendApiApiUpdateRegistrationFlowRequest) Cookie(cookie string) FrontendApiApiUpdateRegistrationFlowRequest {
+func (r FrontendAPIApiUpdateRegistrationFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateRegistrationFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateRegistrationFlowRequest) Execute() (*SuccessfulNativeRegistration, *http.Response, error) {
+func (r FrontendAPIApiUpdateRegistrationFlowRequest) Execute() (*SuccessfulNativeRegistration, *http.Response, error) {
 	return r.ApiService.UpdateRegistrationFlowExecute(r)
 }
 
@@ -5308,10 +5333,10 @@ Most likely used in Social Sign In flows.
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateRegistrationFlowRequest
+  - @return FrontendAPIApiUpdateRegistrationFlowRequest
 */
-func (a *FrontendApiService) UpdateRegistrationFlow(ctx context.Context) FrontendApiApiUpdateRegistrationFlowRequest {
-	return FrontendApiApiUpdateRegistrationFlowRequest{
+func (a *FrontendAPIService) UpdateRegistrationFlow(ctx context.Context) FrontendAPIApiUpdateRegistrationFlowRequest {
+	return FrontendAPIApiUpdateRegistrationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -5321,7 +5346,7 @@ func (a *FrontendApiService) UpdateRegistrationFlow(ctx context.Context) Fronten
  * Execute executes the request
  * @return SuccessfulNativeRegistration
  */
-func (a *FrontendApiService) UpdateRegistrationFlowExecute(r FrontendApiApiUpdateRegistrationFlowRequest) (*SuccessfulNativeRegistration, *http.Response, error) {
+func (a *FrontendAPIService) UpdateRegistrationFlowExecute(r FrontendAPIApiUpdateRegistrationFlowRequest) (*SuccessfulNativeRegistration, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -5331,7 +5356,7 @@ func (a *FrontendApiService) UpdateRegistrationFlowExecute(r FrontendApiApiUpdat
 		localVarReturnValue  *SuccessfulNativeRegistration
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateRegistrationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateRegistrationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -5445,33 +5470,33 @@ func (a *FrontendApiService) UpdateRegistrationFlowExecute(r FrontendApiApiUpdat
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateSettingsFlowRequest struct {
+type FrontendAPIApiUpdateSettingsFlowRequest struct {
 	ctx                    context.Context
-	ApiService             FrontendApi
+	ApiService             FrontendAPI
 	flow                   *string
 	updateSettingsFlowBody *UpdateSettingsFlowBody
 	xSessionToken          *string
 	cookie                 *string
 }
 
-func (r FrontendApiApiUpdateSettingsFlowRequest) Flow(flow string) FrontendApiApiUpdateSettingsFlowRequest {
+func (r FrontendAPIApiUpdateSettingsFlowRequest) Flow(flow string) FrontendAPIApiUpdateSettingsFlowRequest {
 	r.flow = &flow
 	return r
 }
-func (r FrontendApiApiUpdateSettingsFlowRequest) UpdateSettingsFlowBody(updateSettingsFlowBody UpdateSettingsFlowBody) FrontendApiApiUpdateSettingsFlowRequest {
+func (r FrontendAPIApiUpdateSettingsFlowRequest) UpdateSettingsFlowBody(updateSettingsFlowBody UpdateSettingsFlowBody) FrontendAPIApiUpdateSettingsFlowRequest {
 	r.updateSettingsFlowBody = &updateSettingsFlowBody
 	return r
 }
-func (r FrontendApiApiUpdateSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendApiApiUpdateSettingsFlowRequest {
+func (r FrontendAPIApiUpdateSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendAPIApiUpdateSettingsFlowRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiUpdateSettingsFlowRequest) Cookie(cookie string) FrontendApiApiUpdateSettingsFlowRequest {
+func (r FrontendAPIApiUpdateSettingsFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateSettingsFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
+func (r FrontendAPIApiUpdateSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
 	return r.ApiService.UpdateSettingsFlowExecute(r)
 }
 
@@ -5522,10 +5547,10 @@ Most likely used in Social Sign In flows.
 
 More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateSettingsFlowRequest
+  - @return FrontendAPIApiUpdateSettingsFlowRequest
 */
-func (a *FrontendApiService) UpdateSettingsFlow(ctx context.Context) FrontendApiApiUpdateSettingsFlowRequest {
-	return FrontendApiApiUpdateSettingsFlowRequest{
+func (a *FrontendAPIService) UpdateSettingsFlow(ctx context.Context) FrontendAPIApiUpdateSettingsFlowRequest {
+	return FrontendAPIApiUpdateSettingsFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -5535,7 +5560,7 @@ func (a *FrontendApiService) UpdateSettingsFlow(ctx context.Context) FrontendApi
  * Execute executes the request
  * @return SettingsFlow
  */
-func (a *FrontendApiService) UpdateSettingsFlowExecute(r FrontendApiApiUpdateSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
+func (a *FrontendAPIService) UpdateSettingsFlowExecute(r FrontendAPIApiUpdateSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -5545,7 +5570,7 @@ func (a *FrontendApiService) UpdateSettingsFlowExecute(r FrontendApiApiUpdateSet
 		localVarReturnValue  *SettingsFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateSettingsFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateSettingsFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -5682,33 +5707,33 @@ func (a *FrontendApiService) UpdateSettingsFlowExecute(r FrontendApiApiUpdateSet
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateVerificationFlowRequest struct {
+type FrontendAPIApiUpdateVerificationFlowRequest struct {
 	ctx                        context.Context
-	ApiService                 FrontendApi
+	ApiService                 FrontendAPI
 	flow                       *string
 	updateVerificationFlowBody *UpdateVerificationFlowBody
 	token                      *string
 	cookie                     *string
 }
 
-func (r FrontendApiApiUpdateVerificationFlowRequest) Flow(flow string) FrontendApiApiUpdateVerificationFlowRequest {
+func (r FrontendAPIApiUpdateVerificationFlowRequest) Flow(flow string) FrontendAPIApiUpdateVerificationFlowRequest {
 	r.flow = &flow
 	return r
 }
-func (r FrontendApiApiUpdateVerificationFlowRequest) UpdateVerificationFlowBody(updateVerificationFlowBody UpdateVerificationFlowBody) FrontendApiApiUpdateVerificationFlowRequest {
+func (r FrontendAPIApiUpdateVerificationFlowRequest) UpdateVerificationFlowBody(updateVerificationFlowBody UpdateVerificationFlowBody) FrontendAPIApiUpdateVerificationFlowRequest {
 	r.updateVerificationFlowBody = &updateVerificationFlowBody
 	return r
 }
-func (r FrontendApiApiUpdateVerificationFlowRequest) Token(token string) FrontendApiApiUpdateVerificationFlowRequest {
+func (r FrontendAPIApiUpdateVerificationFlowRequest) Token(token string) FrontendAPIApiUpdateVerificationFlowRequest {
 	r.token = &token
 	return r
 }
-func (r FrontendApiApiUpdateVerificationFlowRequest) Cookie(cookie string) FrontendApiApiUpdateVerificationFlowRequest {
+func (r FrontendAPIApiUpdateVerificationFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateVerificationFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
+func (r FrontendAPIApiUpdateVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
 	return r.ApiService.UpdateVerificationFlowExecute(r)
 }
 
@@ -5732,10 +5757,10 @@ a new Verification Flow ID which contains an error message that the verification
 
 More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateVerificationFlowRequest
+  - @return FrontendAPIApiUpdateVerificationFlowRequest
 */
-func (a *FrontendApiService) UpdateVerificationFlow(ctx context.Context) FrontendApiApiUpdateVerificationFlowRequest {
-	return FrontendApiApiUpdateVerificationFlowRequest{
+func (a *FrontendAPIService) UpdateVerificationFlow(ctx context.Context) FrontendAPIApiUpdateVerificationFlowRequest {
+	return FrontendAPIApiUpdateVerificationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -5745,7 +5770,7 @@ func (a *FrontendApiService) UpdateVerificationFlow(ctx context.Context) Fronten
  * Execute executes the request
  * @return VerificationFlow
  */
-func (a *FrontendApiService) UpdateVerificationFlowExecute(r FrontendApiApiUpdateVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
+func (a *FrontendAPIService) UpdateVerificationFlowExecute(r FrontendAPIApiUpdateVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -5755,7 +5780,7 @@ func (a *FrontendApiService) UpdateVerificationFlowExecute(r FrontendApiApiUpdat
 		localVarReturnValue  *VerificationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateVerificationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateVerificationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
diff --git a/internal/client-go/api_identity.go b/internal/client-go/api_identity.go
index b48819525a13..2daa8d8d4971 100644
--- a/internal/client-go/api_identity.go
+++ b/internal/client-go/api_identity.go
@@ -26,7 +26,7 @@ var (
 	_ context.Context
 )
 
-type IdentityApi interface {
+type IdentityAPI interface {
 
 	/*
 			 * BatchPatchIdentities Create multiple identities
@@ -36,15 +36,15 @@ type IdentityApi interface {
 		credentials](https://www.ory.sh/docs/kratos/manage-identities/import-user-accounts-identities)
 		for instance passwords, social sign in configurations or multifactor methods.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return IdentityApiApiBatchPatchIdentitiesRequest
+			 * @return IdentityAPIApiBatchPatchIdentitiesRequest
 	*/
-	BatchPatchIdentities(ctx context.Context) IdentityApiApiBatchPatchIdentitiesRequest
+	BatchPatchIdentities(ctx context.Context) IdentityAPIApiBatchPatchIdentitiesRequest
 
 	/*
 	 * BatchPatchIdentitiesExecute executes the request
 	 * @return BatchPatchIdentitiesResponse
 	 */
-	BatchPatchIdentitiesExecute(r IdentityApiApiBatchPatchIdentitiesRequest) (*BatchPatchIdentitiesResponse, *http.Response, error)
+	BatchPatchIdentitiesExecute(r IdentityAPIApiBatchPatchIdentitiesRequest) (*BatchPatchIdentitiesResponse, *http.Response, error)
 
 	/*
 			 * CreateIdentity Create an Identity
@@ -52,45 +52,45 @@ type IdentityApi interface {
 		[import credentials](https://www.ory.sh/docs/kratos/manage-identities/import-user-accounts-identities)
 		for instance passwords, social sign in configurations or multifactor methods.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return IdentityApiApiCreateIdentityRequest
+			 * @return IdentityAPIApiCreateIdentityRequest
 	*/
-	CreateIdentity(ctx context.Context) IdentityApiApiCreateIdentityRequest
+	CreateIdentity(ctx context.Context) IdentityAPIApiCreateIdentityRequest
 
 	/*
 	 * CreateIdentityExecute executes the request
 	 * @return Identity
 	 */
-	CreateIdentityExecute(r IdentityApiApiCreateIdentityRequest) (*Identity, *http.Response, error)
+	CreateIdentityExecute(r IdentityAPIApiCreateIdentityRequest) (*Identity, *http.Response, error)
 
 	/*
 			 * CreateRecoveryCodeForIdentity Create a Recovery Code
 			 * This endpoint creates a recovery code which should be given to the user in order for them to recover
 		(or activate) their account.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return IdentityApiApiCreateRecoveryCodeForIdentityRequest
+			 * @return IdentityAPIApiCreateRecoveryCodeForIdentityRequest
 	*/
-	CreateRecoveryCodeForIdentity(ctx context.Context) IdentityApiApiCreateRecoveryCodeForIdentityRequest
+	CreateRecoveryCodeForIdentity(ctx context.Context) IdentityAPIApiCreateRecoveryCodeForIdentityRequest
 
 	/*
 	 * CreateRecoveryCodeForIdentityExecute executes the request
 	 * @return RecoveryCodeForIdentity
 	 */
-	CreateRecoveryCodeForIdentityExecute(r IdentityApiApiCreateRecoveryCodeForIdentityRequest) (*RecoveryCodeForIdentity, *http.Response, error)
+	CreateRecoveryCodeForIdentityExecute(r IdentityAPIApiCreateRecoveryCodeForIdentityRequest) (*RecoveryCodeForIdentity, *http.Response, error)
 
 	/*
 			 * CreateRecoveryLinkForIdentity Create a Recovery Link
 			 * This endpoint creates a recovery link which should be given to the user in order for them to recover
 		(or activate) their account.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return IdentityApiApiCreateRecoveryLinkForIdentityRequest
+			 * @return IdentityAPIApiCreateRecoveryLinkForIdentityRequest
 	*/
-	CreateRecoveryLinkForIdentity(ctx context.Context) IdentityApiApiCreateRecoveryLinkForIdentityRequest
+	CreateRecoveryLinkForIdentity(ctx context.Context) IdentityAPIApiCreateRecoveryLinkForIdentityRequest
 
 	/*
 	 * CreateRecoveryLinkForIdentityExecute executes the request
 	 * @return RecoveryLinkForIdentity
 	 */
-	CreateRecoveryLinkForIdentityExecute(r IdentityApiApiCreateRecoveryLinkForIdentityRequest) (*RecoveryLinkForIdentity, *http.Response, error)
+	CreateRecoveryLinkForIdentityExecute(r IdentityAPIApiCreateRecoveryLinkForIdentityRequest) (*RecoveryLinkForIdentity, *http.Response, error)
 
 	/*
 			 * DeleteIdentity Delete an Identity
@@ -99,14 +99,14 @@ type IdentityApi interface {
 		assumed that is has been deleted already.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID is the identity's ID.
-			 * @return IdentityApiApiDeleteIdentityRequest
+			 * @return IdentityAPIApiDeleteIdentityRequest
 	*/
-	DeleteIdentity(ctx context.Context, id string) IdentityApiApiDeleteIdentityRequest
+	DeleteIdentity(ctx context.Context, id string) IdentityAPIApiDeleteIdentityRequest
 
 	/*
 	 * DeleteIdentityExecute executes the request
 	 */
-	DeleteIdentityExecute(r IdentityApiApiDeleteIdentityRequest) (*http.Response, error)
+	DeleteIdentityExecute(r IdentityAPIApiDeleteIdentityRequest) (*http.Response, error)
 
 	/*
 			 * DeleteIdentityCredentials Delete a credential for a specific identity
@@ -114,43 +114,43 @@ type IdentityApi interface {
 		You cannot delete password or code auth credentials through this API.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID is the identity's ID.
-			 * @param type_ Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
-			 * @return IdentityApiApiDeleteIdentityCredentialsRequest
+			 * @param type_ Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+			 * @return IdentityAPIApiDeleteIdentityCredentialsRequest
 	*/
-	DeleteIdentityCredentials(ctx context.Context, id string, type_ string) IdentityApiApiDeleteIdentityCredentialsRequest
+	DeleteIdentityCredentials(ctx context.Context, id string, type_ string) IdentityAPIApiDeleteIdentityCredentialsRequest
 
 	/*
 	 * DeleteIdentityCredentialsExecute executes the request
 	 */
-	DeleteIdentityCredentialsExecute(r IdentityApiApiDeleteIdentityCredentialsRequest) (*http.Response, error)
+	DeleteIdentityCredentialsExecute(r IdentityAPIApiDeleteIdentityCredentialsRequest) (*http.Response, error)
 
 	/*
 	 * DeleteIdentitySessions Delete & Invalidate an Identity's Sessions
 	 * Calling this endpoint irrecoverably and permanently deletes and invalidates all sessions that belong to the given Identity.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 	 * @param id ID is the identity's ID.
-	 * @return IdentityApiApiDeleteIdentitySessionsRequest
+	 * @return IdentityAPIApiDeleteIdentitySessionsRequest
 	 */
-	DeleteIdentitySessions(ctx context.Context, id string) IdentityApiApiDeleteIdentitySessionsRequest
+	DeleteIdentitySessions(ctx context.Context, id string) IdentityAPIApiDeleteIdentitySessionsRequest
 
 	/*
 	 * DeleteIdentitySessionsExecute executes the request
 	 */
-	DeleteIdentitySessionsExecute(r IdentityApiApiDeleteIdentitySessionsRequest) (*http.Response, error)
+	DeleteIdentitySessionsExecute(r IdentityAPIApiDeleteIdentitySessionsRequest) (*http.Response, error)
 
 	/*
 	 * DisableSession Deactivate a Session
 	 * Calling this endpoint deactivates the specified session. Session data is not deleted.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 	 * @param id ID is the session's ID.
-	 * @return IdentityApiApiDisableSessionRequest
+	 * @return IdentityAPIApiDisableSessionRequest
 	 */
-	DisableSession(ctx context.Context, id string) IdentityApiApiDisableSessionRequest
+	DisableSession(ctx context.Context, id string) IdentityAPIApiDisableSessionRequest
 
 	/*
 	 * DisableSessionExecute executes the request
 	 */
-	DisableSessionExecute(r IdentityApiApiDisableSessionRequest) (*http.Response, error)
+	DisableSessionExecute(r IdentityAPIApiDisableSessionRequest) (*http.Response, error)
 
 	/*
 			 * ExtendSession Extend a Session
@@ -167,15 +167,15 @@ type IdentityApi interface {
 		Retrieve the session ID from the `/sessions/whoami` endpoint / `toSession` SDK method.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID is the session's ID.
-			 * @return IdentityApiApiExtendSessionRequest
+			 * @return IdentityAPIApiExtendSessionRequest
 	*/
-	ExtendSession(ctx context.Context, id string) IdentityApiApiExtendSessionRequest
+	ExtendSession(ctx context.Context, id string) IdentityAPIApiExtendSessionRequest
 
 	/*
 	 * ExtendSessionExecute executes the request
 	 * @return Session
 	 */
-	ExtendSessionExecute(r IdentityApiApiExtendSessionRequest) (*Session, *http.Response, error)
+	ExtendSessionExecute(r IdentityAPIApiExtendSessionRequest) (*Session, *http.Response, error)
 
 	/*
 			 * GetIdentity Get an Identity
@@ -183,30 +183,30 @@ type IdentityApi interface {
 		include credentials (e.g. social sign in connections) in the response by using the `include_credential` query parameter.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID must be set to the ID of identity you want to get
-			 * @return IdentityApiApiGetIdentityRequest
+			 * @return IdentityAPIApiGetIdentityRequest
 	*/
-	GetIdentity(ctx context.Context, id string) IdentityApiApiGetIdentityRequest
+	GetIdentity(ctx context.Context, id string) IdentityAPIApiGetIdentityRequest
 
 	/*
 	 * GetIdentityExecute executes the request
 	 * @return Identity
 	 */
-	GetIdentityExecute(r IdentityApiApiGetIdentityRequest) (*Identity, *http.Response, error)
+	GetIdentityExecute(r IdentityAPIApiGetIdentityRequest) (*Identity, *http.Response, error)
 
 	/*
 	 * GetIdentitySchema Get Identity JSON Schema
 	 * Return a specific identity schema.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 	 * @param id ID must be set to the ID of schema you want to get
-	 * @return IdentityApiApiGetIdentitySchemaRequest
+	 * @return IdentityAPIApiGetIdentitySchemaRequest
 	 */
-	GetIdentitySchema(ctx context.Context, id string) IdentityApiApiGetIdentitySchemaRequest
+	GetIdentitySchema(ctx context.Context, id string) IdentityAPIApiGetIdentitySchemaRequest
 
 	/*
 	 * GetIdentitySchemaExecute executes the request
 	 * @return map[string]interface{}
 	 */
-	GetIdentitySchemaExecute(r IdentityApiApiGetIdentitySchemaRequest) (map[string]interface{}, *http.Response, error)
+	GetIdentitySchemaExecute(r IdentityAPIApiGetIdentitySchemaRequest) (map[string]interface{}, *http.Response, error)
 
 	/*
 			 * GetSession Get Session
@@ -215,72 +215,72 @@ type IdentityApi interface {
 		Getting a session object with all specified expandables that exist in an administrative context.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID is the session's ID.
-			 * @return IdentityApiApiGetSessionRequest
+			 * @return IdentityAPIApiGetSessionRequest
 	*/
-	GetSession(ctx context.Context, id string) IdentityApiApiGetSessionRequest
+	GetSession(ctx context.Context, id string) IdentityAPIApiGetSessionRequest
 
 	/*
 	 * GetSessionExecute executes the request
 	 * @return Session
 	 */
-	GetSessionExecute(r IdentityApiApiGetSessionRequest) (*Session, *http.Response, error)
+	GetSessionExecute(r IdentityAPIApiGetSessionRequest) (*Session, *http.Response, error)
 
 	/*
 	 * ListIdentities List Identities
-	 * Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system.
+	 * Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system. Note: filters cannot be combined.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-	 * @return IdentityApiApiListIdentitiesRequest
+	 * @return IdentityAPIApiListIdentitiesRequest
 	 */
-	ListIdentities(ctx context.Context) IdentityApiApiListIdentitiesRequest
+	ListIdentities(ctx context.Context) IdentityAPIApiListIdentitiesRequest
 
 	/*
 	 * ListIdentitiesExecute executes the request
 	 * @return []Identity
 	 */
-	ListIdentitiesExecute(r IdentityApiApiListIdentitiesRequest) ([]Identity, *http.Response, error)
+	ListIdentitiesExecute(r IdentityAPIApiListIdentitiesRequest) ([]Identity, *http.Response, error)
 
 	/*
 	 * ListIdentitySchemas Get all Identity Schemas
 	 * Returns a list of all identity schemas currently in use.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-	 * @return IdentityApiApiListIdentitySchemasRequest
+	 * @return IdentityAPIApiListIdentitySchemasRequest
 	 */
-	ListIdentitySchemas(ctx context.Context) IdentityApiApiListIdentitySchemasRequest
+	ListIdentitySchemas(ctx context.Context) IdentityAPIApiListIdentitySchemasRequest
 
 	/*
 	 * ListIdentitySchemasExecute executes the request
 	 * @return []IdentitySchemaContainer
 	 */
-	ListIdentitySchemasExecute(r IdentityApiApiListIdentitySchemasRequest) ([]IdentitySchemaContainer, *http.Response, error)
+	ListIdentitySchemasExecute(r IdentityAPIApiListIdentitySchemasRequest) ([]IdentitySchemaContainer, *http.Response, error)
 
 	/*
 	 * ListIdentitySessions List an Identity's Sessions
 	 * This endpoint returns all sessions that belong to the given Identity.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 	 * @param id ID is the identity's ID.
-	 * @return IdentityApiApiListIdentitySessionsRequest
+	 * @return IdentityAPIApiListIdentitySessionsRequest
 	 */
-	ListIdentitySessions(ctx context.Context, id string) IdentityApiApiListIdentitySessionsRequest
+	ListIdentitySessions(ctx context.Context, id string) IdentityAPIApiListIdentitySessionsRequest
 
 	/*
 	 * ListIdentitySessionsExecute executes the request
 	 * @return []Session
 	 */
-	ListIdentitySessionsExecute(r IdentityApiApiListIdentitySessionsRequest) ([]Session, *http.Response, error)
+	ListIdentitySessionsExecute(r IdentityAPIApiListIdentitySessionsRequest) ([]Session, *http.Response, error)
 
 	/*
 	 * ListSessions List All Sessions
 	 * Listing all sessions that exist.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-	 * @return IdentityApiApiListSessionsRequest
+	 * @return IdentityAPIApiListSessionsRequest
 	 */
-	ListSessions(ctx context.Context) IdentityApiApiListSessionsRequest
+	ListSessions(ctx context.Context) IdentityAPIApiListSessionsRequest
 
 	/*
 	 * ListSessionsExecute executes the request
 	 * @return []Session
 	 */
-	ListSessionsExecute(r IdentityApiApiListSessionsRequest) ([]Session, *http.Response, error)
+	ListSessionsExecute(r IdentityAPIApiListSessionsRequest) ([]Session, *http.Response, error)
 
 	/*
 			 * PatchIdentity Patch an Identity
@@ -288,15 +288,15 @@ type IdentityApi interface {
 		The fields `id`, `stateChangedAt` and `credentials` can not be updated using this method.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID must be set to the ID of identity you want to update
-			 * @return IdentityApiApiPatchIdentityRequest
+			 * @return IdentityAPIApiPatchIdentityRequest
 	*/
-	PatchIdentity(ctx context.Context, id string) IdentityApiApiPatchIdentityRequest
+	PatchIdentity(ctx context.Context, id string) IdentityAPIApiPatchIdentityRequest
 
 	/*
 	 * PatchIdentityExecute executes the request
 	 * @return Identity
 	 */
-	PatchIdentityExecute(r IdentityApiApiPatchIdentityRequest) (*Identity, *http.Response, error)
+	PatchIdentityExecute(r IdentityAPIApiPatchIdentityRequest) (*Identity, *http.Response, error)
 
 	/*
 			 * UpdateIdentity Update an Identity
@@ -304,32 +304,32 @@ type IdentityApi interface {
 		payload (except credentials) is expected. It is possible to update the identity's credentials as well.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID must be set to the ID of identity you want to update
-			 * @return IdentityApiApiUpdateIdentityRequest
+			 * @return IdentityAPIApiUpdateIdentityRequest
 	*/
-	UpdateIdentity(ctx context.Context, id string) IdentityApiApiUpdateIdentityRequest
+	UpdateIdentity(ctx context.Context, id string) IdentityAPIApiUpdateIdentityRequest
 
 	/*
 	 * UpdateIdentityExecute executes the request
 	 * @return Identity
 	 */
-	UpdateIdentityExecute(r IdentityApiApiUpdateIdentityRequest) (*Identity, *http.Response, error)
+	UpdateIdentityExecute(r IdentityAPIApiUpdateIdentityRequest) (*Identity, *http.Response, error)
 }
 
-// IdentityApiService IdentityApi service
-type IdentityApiService service
+// IdentityAPIService IdentityAPI service
+type IdentityAPIService service
 
-type IdentityApiApiBatchPatchIdentitiesRequest struct {
+type IdentityAPIApiBatchPatchIdentitiesRequest struct {
 	ctx                 context.Context
-	ApiService          IdentityApi
+	ApiService          IdentityAPI
 	patchIdentitiesBody *PatchIdentitiesBody
 }
 
-func (r IdentityApiApiBatchPatchIdentitiesRequest) PatchIdentitiesBody(patchIdentitiesBody PatchIdentitiesBody) IdentityApiApiBatchPatchIdentitiesRequest {
+func (r IdentityAPIApiBatchPatchIdentitiesRequest) PatchIdentitiesBody(patchIdentitiesBody PatchIdentitiesBody) IdentityAPIApiBatchPatchIdentitiesRequest {
 	r.patchIdentitiesBody = &patchIdentitiesBody
 	return r
 }
 
-func (r IdentityApiApiBatchPatchIdentitiesRequest) Execute() (*BatchPatchIdentitiesResponse, *http.Response, error) {
+func (r IdentityAPIApiBatchPatchIdentitiesRequest) Execute() (*BatchPatchIdentitiesResponse, *http.Response, error) {
 	return r.ApiService.BatchPatchIdentitiesExecute(r)
 }
 
@@ -342,10 +342,10 @@ This endpoint can also be used to [import
 credentials](https://www.ory.sh/docs/kratos/manage-identities/import-user-accounts-identities)
 for instance passwords, social sign in configurations or multifactor methods.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return IdentityApiApiBatchPatchIdentitiesRequest
+  - @return IdentityAPIApiBatchPatchIdentitiesRequest
 */
-func (a *IdentityApiService) BatchPatchIdentities(ctx context.Context) IdentityApiApiBatchPatchIdentitiesRequest {
-	return IdentityApiApiBatchPatchIdentitiesRequest{
+func (a *IdentityAPIService) BatchPatchIdentities(ctx context.Context) IdentityAPIApiBatchPatchIdentitiesRequest {
+	return IdentityAPIApiBatchPatchIdentitiesRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -355,7 +355,7 @@ func (a *IdentityApiService) BatchPatchIdentities(ctx context.Context) IdentityA
  * Execute executes the request
  * @return BatchPatchIdentitiesResponse
  */
-func (a *IdentityApiService) BatchPatchIdentitiesExecute(r IdentityApiApiBatchPatchIdentitiesRequest) (*BatchPatchIdentitiesResponse, *http.Response, error) {
+func (a *IdentityAPIService) BatchPatchIdentitiesExecute(r IdentityAPIApiBatchPatchIdentitiesRequest) (*BatchPatchIdentitiesResponse, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPatch
 		localVarPostBody     interface{}
@@ -365,7 +365,7 @@ func (a *IdentityApiService) BatchPatchIdentitiesExecute(r IdentityApiApiBatchPa
 		localVarReturnValue  *BatchPatchIdentitiesResponse
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.BatchPatchIdentities")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.BatchPatchIdentities")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -473,18 +473,18 @@ func (a *IdentityApiService) BatchPatchIdentitiesExecute(r IdentityApiApiBatchPa
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiCreateIdentityRequest struct {
+type IdentityAPIApiCreateIdentityRequest struct {
 	ctx                context.Context
-	ApiService         IdentityApi
+	ApiService         IdentityAPI
 	createIdentityBody *CreateIdentityBody
 }
 
-func (r IdentityApiApiCreateIdentityRequest) CreateIdentityBody(createIdentityBody CreateIdentityBody) IdentityApiApiCreateIdentityRequest {
+func (r IdentityAPIApiCreateIdentityRequest) CreateIdentityBody(createIdentityBody CreateIdentityBody) IdentityAPIApiCreateIdentityRequest {
 	r.createIdentityBody = &createIdentityBody
 	return r
 }
 
-func (r IdentityApiApiCreateIdentityRequest) Execute() (*Identity, *http.Response, error) {
+func (r IdentityAPIApiCreateIdentityRequest) Execute() (*Identity, *http.Response, error) {
 	return r.ApiService.CreateIdentityExecute(r)
 }
 
@@ -495,10 +495,10 @@ func (r IdentityApiApiCreateIdentityRequest) Execute() (*Identity, *http.Respons
 [import credentials](https://www.ory.sh/docs/kratos/manage-identities/import-user-accounts-identities)
 for instance passwords, social sign in configurations or multifactor methods.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return IdentityApiApiCreateIdentityRequest
+  - @return IdentityAPIApiCreateIdentityRequest
 */
-func (a *IdentityApiService) CreateIdentity(ctx context.Context) IdentityApiApiCreateIdentityRequest {
-	return IdentityApiApiCreateIdentityRequest{
+func (a *IdentityAPIService) CreateIdentity(ctx context.Context) IdentityAPIApiCreateIdentityRequest {
+	return IdentityAPIApiCreateIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -508,7 +508,7 @@ func (a *IdentityApiService) CreateIdentity(ctx context.Context) IdentityApiApiC
  * Execute executes the request
  * @return Identity
  */
-func (a *IdentityApiService) CreateIdentityExecute(r IdentityApiApiCreateIdentityRequest) (*Identity, *http.Response, error) {
+func (a *IdentityAPIService) CreateIdentityExecute(r IdentityAPIApiCreateIdentityRequest) (*Identity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -518,7 +518,7 @@ func (a *IdentityApiService) CreateIdentityExecute(r IdentityApiApiCreateIdentit
 		localVarReturnValue  *Identity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.CreateIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.CreateIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -626,18 +626,18 @@ func (a *IdentityApiService) CreateIdentityExecute(r IdentityApiApiCreateIdentit
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiCreateRecoveryCodeForIdentityRequest struct {
+type IdentityAPIApiCreateRecoveryCodeForIdentityRequest struct {
 	ctx                               context.Context
-	ApiService                        IdentityApi
+	ApiService                        IdentityAPI
 	createRecoveryCodeForIdentityBody *CreateRecoveryCodeForIdentityBody
 }
 
-func (r IdentityApiApiCreateRecoveryCodeForIdentityRequest) CreateRecoveryCodeForIdentityBody(createRecoveryCodeForIdentityBody CreateRecoveryCodeForIdentityBody) IdentityApiApiCreateRecoveryCodeForIdentityRequest {
+func (r IdentityAPIApiCreateRecoveryCodeForIdentityRequest) CreateRecoveryCodeForIdentityBody(createRecoveryCodeForIdentityBody CreateRecoveryCodeForIdentityBody) IdentityAPIApiCreateRecoveryCodeForIdentityRequest {
 	r.createRecoveryCodeForIdentityBody = &createRecoveryCodeForIdentityBody
 	return r
 }
 
-func (r IdentityApiApiCreateRecoveryCodeForIdentityRequest) Execute() (*RecoveryCodeForIdentity, *http.Response, error) {
+func (r IdentityAPIApiCreateRecoveryCodeForIdentityRequest) Execute() (*RecoveryCodeForIdentity, *http.Response, error) {
 	return r.ApiService.CreateRecoveryCodeForIdentityExecute(r)
 }
 
@@ -647,10 +647,10 @@ func (r IdentityApiApiCreateRecoveryCodeForIdentityRequest) Execute() (*Recovery
 
 (or activate) their account.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return IdentityApiApiCreateRecoveryCodeForIdentityRequest
+  - @return IdentityAPIApiCreateRecoveryCodeForIdentityRequest
 */
-func (a *IdentityApiService) CreateRecoveryCodeForIdentity(ctx context.Context) IdentityApiApiCreateRecoveryCodeForIdentityRequest {
-	return IdentityApiApiCreateRecoveryCodeForIdentityRequest{
+func (a *IdentityAPIService) CreateRecoveryCodeForIdentity(ctx context.Context) IdentityAPIApiCreateRecoveryCodeForIdentityRequest {
+	return IdentityAPIApiCreateRecoveryCodeForIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -660,7 +660,7 @@ func (a *IdentityApiService) CreateRecoveryCodeForIdentity(ctx context.Context)
  * Execute executes the request
  * @return RecoveryCodeForIdentity
  */
-func (a *IdentityApiService) CreateRecoveryCodeForIdentityExecute(r IdentityApiApiCreateRecoveryCodeForIdentityRequest) (*RecoveryCodeForIdentity, *http.Response, error) {
+func (a *IdentityAPIService) CreateRecoveryCodeForIdentityExecute(r IdentityAPIApiCreateRecoveryCodeForIdentityRequest) (*RecoveryCodeForIdentity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -670,7 +670,7 @@ func (a *IdentityApiService) CreateRecoveryCodeForIdentityExecute(r IdentityApiA
 		localVarReturnValue  *RecoveryCodeForIdentity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.CreateRecoveryCodeForIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.CreateRecoveryCodeForIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -778,23 +778,23 @@ func (a *IdentityApiService) CreateRecoveryCodeForIdentityExecute(r IdentityApiA
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiCreateRecoveryLinkForIdentityRequest struct {
+type IdentityAPIApiCreateRecoveryLinkForIdentityRequest struct {
 	ctx                               context.Context
-	ApiService                        IdentityApi
+	ApiService                        IdentityAPI
 	returnTo                          *string
 	createRecoveryLinkForIdentityBody *CreateRecoveryLinkForIdentityBody
 }
 
-func (r IdentityApiApiCreateRecoveryLinkForIdentityRequest) ReturnTo(returnTo string) IdentityApiApiCreateRecoveryLinkForIdentityRequest {
+func (r IdentityAPIApiCreateRecoveryLinkForIdentityRequest) ReturnTo(returnTo string) IdentityAPIApiCreateRecoveryLinkForIdentityRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r IdentityApiApiCreateRecoveryLinkForIdentityRequest) CreateRecoveryLinkForIdentityBody(createRecoveryLinkForIdentityBody CreateRecoveryLinkForIdentityBody) IdentityApiApiCreateRecoveryLinkForIdentityRequest {
+func (r IdentityAPIApiCreateRecoveryLinkForIdentityRequest) CreateRecoveryLinkForIdentityBody(createRecoveryLinkForIdentityBody CreateRecoveryLinkForIdentityBody) IdentityAPIApiCreateRecoveryLinkForIdentityRequest {
 	r.createRecoveryLinkForIdentityBody = &createRecoveryLinkForIdentityBody
 	return r
 }
 
-func (r IdentityApiApiCreateRecoveryLinkForIdentityRequest) Execute() (*RecoveryLinkForIdentity, *http.Response, error) {
+func (r IdentityAPIApiCreateRecoveryLinkForIdentityRequest) Execute() (*RecoveryLinkForIdentity, *http.Response, error) {
 	return r.ApiService.CreateRecoveryLinkForIdentityExecute(r)
 }
 
@@ -804,10 +804,10 @@ func (r IdentityApiApiCreateRecoveryLinkForIdentityRequest) Execute() (*Recovery
 
 (or activate) their account.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return IdentityApiApiCreateRecoveryLinkForIdentityRequest
+  - @return IdentityAPIApiCreateRecoveryLinkForIdentityRequest
 */
-func (a *IdentityApiService) CreateRecoveryLinkForIdentity(ctx context.Context) IdentityApiApiCreateRecoveryLinkForIdentityRequest {
-	return IdentityApiApiCreateRecoveryLinkForIdentityRequest{
+func (a *IdentityAPIService) CreateRecoveryLinkForIdentity(ctx context.Context) IdentityAPIApiCreateRecoveryLinkForIdentityRequest {
+	return IdentityAPIApiCreateRecoveryLinkForIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -817,7 +817,7 @@ func (a *IdentityApiService) CreateRecoveryLinkForIdentity(ctx context.Context)
  * Execute executes the request
  * @return RecoveryLinkForIdentity
  */
-func (a *IdentityApiService) CreateRecoveryLinkForIdentityExecute(r IdentityApiApiCreateRecoveryLinkForIdentityRequest) (*RecoveryLinkForIdentity, *http.Response, error) {
+func (a *IdentityAPIService) CreateRecoveryLinkForIdentityExecute(r IdentityAPIApiCreateRecoveryLinkForIdentityRequest) (*RecoveryLinkForIdentity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -827,7 +827,7 @@ func (a *IdentityApiService) CreateRecoveryLinkForIdentityExecute(r IdentityApiA
 		localVarReturnValue  *RecoveryLinkForIdentity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.CreateRecoveryLinkForIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.CreateRecoveryLinkForIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -938,13 +938,13 @@ func (a *IdentityApiService) CreateRecoveryLinkForIdentityExecute(r IdentityApiA
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiDeleteIdentityRequest struct {
+type IdentityAPIApiDeleteIdentityRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 }
 
-func (r IdentityApiApiDeleteIdentityRequest) Execute() (*http.Response, error) {
+func (r IdentityAPIApiDeleteIdentityRequest) Execute() (*http.Response, error) {
 	return r.ApiService.DeleteIdentityExecute(r)
 }
 
@@ -956,10 +956,10 @@ This endpoint returns 204 when the identity was deleted or when the identity was
 assumed that is has been deleted already.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID is the identity's ID.
-  - @return IdentityApiApiDeleteIdentityRequest
+  - @return IdentityAPIApiDeleteIdentityRequest
 */
-func (a *IdentityApiService) DeleteIdentity(ctx context.Context, id string) IdentityApiApiDeleteIdentityRequest {
-	return IdentityApiApiDeleteIdentityRequest{
+func (a *IdentityAPIService) DeleteIdentity(ctx context.Context, id string) IdentityAPIApiDeleteIdentityRequest {
+	return IdentityAPIApiDeleteIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -969,7 +969,7 @@ func (a *IdentityApiService) DeleteIdentity(ctx context.Context, id string) Iden
 /*
  * Execute executes the request
  */
-func (a *IdentityApiService) DeleteIdentityExecute(r IdentityApiApiDeleteIdentityRequest) (*http.Response, error) {
+func (a *IdentityAPIService) DeleteIdentityExecute(r IdentityAPIApiDeleteIdentityRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -978,7 +978,7 @@ func (a *IdentityApiService) DeleteIdentityExecute(r IdentityApiApiDeleteIdentit
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.DeleteIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.DeleteIdentity")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1066,20 +1066,20 @@ func (a *IdentityApiService) DeleteIdentityExecute(r IdentityApiApiDeleteIdentit
 	return localVarHTTPResponse, nil
 }
 
-type IdentityApiApiDeleteIdentityCredentialsRequest struct {
+type IdentityAPIApiDeleteIdentityCredentialsRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 	type_      string
 	identifier *string
 }
 
-func (r IdentityApiApiDeleteIdentityCredentialsRequest) Identifier(identifier string) IdentityApiApiDeleteIdentityCredentialsRequest {
+func (r IdentityAPIApiDeleteIdentityCredentialsRequest) Identifier(identifier string) IdentityAPIApiDeleteIdentityCredentialsRequest {
 	r.identifier = &identifier
 	return r
 }
 
-func (r IdentityApiApiDeleteIdentityCredentialsRequest) Execute() (*http.Response, error) {
+func (r IdentityAPIApiDeleteIdentityCredentialsRequest) Execute() (*http.Response, error) {
 	return r.ApiService.DeleteIdentityCredentialsExecute(r)
 }
 
@@ -1090,11 +1090,11 @@ func (r IdentityApiApiDeleteIdentityCredentialsRequest) Execute() (*http.Respons
 You cannot delete password or code auth credentials through this API.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID is the identity's ID.
-  - @param type_ Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
-  - @return IdentityApiApiDeleteIdentityCredentialsRequest
+  - @param type_ Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+  - @return IdentityAPIApiDeleteIdentityCredentialsRequest
 */
-func (a *IdentityApiService) DeleteIdentityCredentials(ctx context.Context, id string, type_ string) IdentityApiApiDeleteIdentityCredentialsRequest {
-	return IdentityApiApiDeleteIdentityCredentialsRequest{
+func (a *IdentityAPIService) DeleteIdentityCredentials(ctx context.Context, id string, type_ string) IdentityAPIApiDeleteIdentityCredentialsRequest {
+	return IdentityAPIApiDeleteIdentityCredentialsRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1105,7 +1105,7 @@ func (a *IdentityApiService) DeleteIdentityCredentials(ctx context.Context, id s
 /*
  * Execute executes the request
  */
-func (a *IdentityApiService) DeleteIdentityCredentialsExecute(r IdentityApiApiDeleteIdentityCredentialsRequest) (*http.Response, error) {
+func (a *IdentityAPIService) DeleteIdentityCredentialsExecute(r IdentityAPIApiDeleteIdentityCredentialsRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -1114,7 +1114,7 @@ func (a *IdentityApiService) DeleteIdentityCredentialsExecute(r IdentityApiApiDe
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.DeleteIdentityCredentials")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.DeleteIdentityCredentials")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1206,13 +1206,13 @@ func (a *IdentityApiService) DeleteIdentityCredentialsExecute(r IdentityApiApiDe
 	return localVarHTTPResponse, nil
 }
 
-type IdentityApiApiDeleteIdentitySessionsRequest struct {
+type IdentityAPIApiDeleteIdentitySessionsRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 }
 
-func (r IdentityApiApiDeleteIdentitySessionsRequest) Execute() (*http.Response, error) {
+func (r IdentityAPIApiDeleteIdentitySessionsRequest) Execute() (*http.Response, error) {
 	return r.ApiService.DeleteIdentitySessionsExecute(r)
 }
 
@@ -1221,10 +1221,10 @@ func (r IdentityApiApiDeleteIdentitySessionsRequest) Execute() (*http.Response,
  * Calling this endpoint irrecoverably and permanently deletes and invalidates all sessions that belong to the given Identity.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
  * @param id ID is the identity's ID.
- * @return IdentityApiApiDeleteIdentitySessionsRequest
+ * @return IdentityAPIApiDeleteIdentitySessionsRequest
  */
-func (a *IdentityApiService) DeleteIdentitySessions(ctx context.Context, id string) IdentityApiApiDeleteIdentitySessionsRequest {
-	return IdentityApiApiDeleteIdentitySessionsRequest{
+func (a *IdentityAPIService) DeleteIdentitySessions(ctx context.Context, id string) IdentityAPIApiDeleteIdentitySessionsRequest {
+	return IdentityAPIApiDeleteIdentitySessionsRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1234,7 +1234,7 @@ func (a *IdentityApiService) DeleteIdentitySessions(ctx context.Context, id stri
 /*
  * Execute executes the request
  */
-func (a *IdentityApiService) DeleteIdentitySessionsExecute(r IdentityApiApiDeleteIdentitySessionsRequest) (*http.Response, error) {
+func (a *IdentityAPIService) DeleteIdentitySessionsExecute(r IdentityAPIApiDeleteIdentitySessionsRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -1243,7 +1243,7 @@ func (a *IdentityApiService) DeleteIdentitySessionsExecute(r IdentityApiApiDelet
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.DeleteIdentitySessions")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.DeleteIdentitySessions")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1351,13 +1351,13 @@ func (a *IdentityApiService) DeleteIdentitySessionsExecute(r IdentityApiApiDelet
 	return localVarHTTPResponse, nil
 }
 
-type IdentityApiApiDisableSessionRequest struct {
+type IdentityAPIApiDisableSessionRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 }
 
-func (r IdentityApiApiDisableSessionRequest) Execute() (*http.Response, error) {
+func (r IdentityAPIApiDisableSessionRequest) Execute() (*http.Response, error) {
 	return r.ApiService.DisableSessionExecute(r)
 }
 
@@ -1366,10 +1366,10 @@ func (r IdentityApiApiDisableSessionRequest) Execute() (*http.Response, error) {
  * Calling this endpoint deactivates the specified session. Session data is not deleted.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
  * @param id ID is the session's ID.
- * @return IdentityApiApiDisableSessionRequest
+ * @return IdentityAPIApiDisableSessionRequest
  */
-func (a *IdentityApiService) DisableSession(ctx context.Context, id string) IdentityApiApiDisableSessionRequest {
-	return IdentityApiApiDisableSessionRequest{
+func (a *IdentityAPIService) DisableSession(ctx context.Context, id string) IdentityAPIApiDisableSessionRequest {
+	return IdentityAPIApiDisableSessionRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1379,7 +1379,7 @@ func (a *IdentityApiService) DisableSession(ctx context.Context, id string) Iden
 /*
  * Execute executes the request
  */
-func (a *IdentityApiService) DisableSessionExecute(r IdentityApiApiDisableSessionRequest) (*http.Response, error) {
+func (a *IdentityAPIService) DisableSessionExecute(r IdentityAPIApiDisableSessionRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -1388,7 +1388,7 @@ func (a *IdentityApiService) DisableSessionExecute(r IdentityApiApiDisableSessio
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.DisableSession")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.DisableSession")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1486,13 +1486,13 @@ func (a *IdentityApiService) DisableSessionExecute(r IdentityApiApiDisableSessio
 	return localVarHTTPResponse, nil
 }
 
-type IdentityApiApiExtendSessionRequest struct {
+type IdentityAPIApiExtendSessionRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 }
 
-func (r IdentityApiApiExtendSessionRequest) Execute() (*Session, *http.Response, error) {
+func (r IdentityAPIApiExtendSessionRequest) Execute() (*Session, *http.Response, error) {
 	return r.ApiService.ExtendSessionExecute(r)
 }
 
@@ -1512,10 +1512,10 @@ scenarios. This endpoint also returns 404 errors if the session does not exist.
 Retrieve the session ID from the `/sessions/whoami` endpoint / `toSession` SDK method.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID is the session's ID.
-  - @return IdentityApiApiExtendSessionRequest
+  - @return IdentityAPIApiExtendSessionRequest
 */
-func (a *IdentityApiService) ExtendSession(ctx context.Context, id string) IdentityApiApiExtendSessionRequest {
-	return IdentityApiApiExtendSessionRequest{
+func (a *IdentityAPIService) ExtendSession(ctx context.Context, id string) IdentityAPIApiExtendSessionRequest {
+	return IdentityAPIApiExtendSessionRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1526,7 +1526,7 @@ func (a *IdentityApiService) ExtendSession(ctx context.Context, id string) Ident
  * Execute executes the request
  * @return Session
  */
-func (a *IdentityApiService) ExtendSessionExecute(r IdentityApiApiExtendSessionRequest) (*Session, *http.Response, error) {
+func (a *IdentityAPIService) ExtendSessionExecute(r IdentityAPIApiExtendSessionRequest) (*Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPatch
 		localVarPostBody     interface{}
@@ -1536,7 +1536,7 @@ func (a *IdentityApiService) ExtendSessionExecute(r IdentityApiApiExtendSessionR
 		localVarReturnValue  *Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.ExtendSession")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.ExtendSession")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1643,19 +1643,19 @@ func (a *IdentityApiService) ExtendSessionExecute(r IdentityApiApiExtendSessionR
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiGetIdentityRequest struct {
+type IdentityAPIApiGetIdentityRequest struct {
 	ctx               context.Context
-	ApiService        IdentityApi
+	ApiService        IdentityAPI
 	id                string
 	includeCredential *[]string
 }
 
-func (r IdentityApiApiGetIdentityRequest) IncludeCredential(includeCredential []string) IdentityApiApiGetIdentityRequest {
+func (r IdentityAPIApiGetIdentityRequest) IncludeCredential(includeCredential []string) IdentityAPIApiGetIdentityRequest {
 	r.includeCredential = &includeCredential
 	return r
 }
 
-func (r IdentityApiApiGetIdentityRequest) Execute() (*Identity, *http.Response, error) {
+func (r IdentityAPIApiGetIdentityRequest) Execute() (*Identity, *http.Response, error) {
 	return r.ApiService.GetIdentityExecute(r)
 }
 
@@ -1666,10 +1666,10 @@ func (r IdentityApiApiGetIdentityRequest) Execute() (*Identity, *http.Response,
 include credentials (e.g. social sign in connections) in the response by using the `include_credential` query parameter.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID must be set to the ID of identity you want to get
-  - @return IdentityApiApiGetIdentityRequest
+  - @return IdentityAPIApiGetIdentityRequest
 */
-func (a *IdentityApiService) GetIdentity(ctx context.Context, id string) IdentityApiApiGetIdentityRequest {
-	return IdentityApiApiGetIdentityRequest{
+func (a *IdentityAPIService) GetIdentity(ctx context.Context, id string) IdentityAPIApiGetIdentityRequest {
+	return IdentityAPIApiGetIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1680,7 +1680,7 @@ func (a *IdentityApiService) GetIdentity(ctx context.Context, id string) Identit
  * Execute executes the request
  * @return Identity
  */
-func (a *IdentityApiService) GetIdentityExecute(r IdentityApiApiGetIdentityRequest) (*Identity, *http.Response, error) {
+func (a *IdentityAPIService) GetIdentityExecute(r IdentityAPIApiGetIdentityRequest) (*Identity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1690,7 +1690,7 @@ func (a *IdentityApiService) GetIdentityExecute(r IdentityApiApiGetIdentityReque
 		localVarReturnValue  *Identity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.GetIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.GetIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1798,13 +1798,13 @@ func (a *IdentityApiService) GetIdentityExecute(r IdentityApiApiGetIdentityReque
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiGetIdentitySchemaRequest struct {
+type IdentityAPIApiGetIdentitySchemaRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 }
 
-func (r IdentityApiApiGetIdentitySchemaRequest) Execute() (map[string]interface{}, *http.Response, error) {
+func (r IdentityAPIApiGetIdentitySchemaRequest) Execute() (map[string]interface{}, *http.Response, error) {
 	return r.ApiService.GetIdentitySchemaExecute(r)
 }
 
@@ -1813,10 +1813,10 @@ func (r IdentityApiApiGetIdentitySchemaRequest) Execute() (map[string]interface{
  * Return a specific identity schema.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
  * @param id ID must be set to the ID of schema you want to get
- * @return IdentityApiApiGetIdentitySchemaRequest
+ * @return IdentityAPIApiGetIdentitySchemaRequest
  */
-func (a *IdentityApiService) GetIdentitySchema(ctx context.Context, id string) IdentityApiApiGetIdentitySchemaRequest {
-	return IdentityApiApiGetIdentitySchemaRequest{
+func (a *IdentityAPIService) GetIdentitySchema(ctx context.Context, id string) IdentityAPIApiGetIdentitySchemaRequest {
+	return IdentityAPIApiGetIdentitySchemaRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1827,7 +1827,7 @@ func (a *IdentityApiService) GetIdentitySchema(ctx context.Context, id string) I
  * Execute executes the request
  * @return map[string]interface{}
  */
-func (a *IdentityApiService) GetIdentitySchemaExecute(r IdentityApiApiGetIdentitySchemaRequest) (map[string]interface{}, *http.Response, error) {
+func (a *IdentityAPIService) GetIdentitySchemaExecute(r IdentityAPIApiGetIdentitySchemaRequest) (map[string]interface{}, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1837,7 +1837,7 @@ func (a *IdentityApiService) GetIdentitySchemaExecute(r IdentityApiApiGetIdentit
 		localVarReturnValue  map[string]interface{}
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.GetIdentitySchema")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.GetIdentitySchema")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1920,19 +1920,19 @@ func (a *IdentityApiService) GetIdentitySchemaExecute(r IdentityApiApiGetIdentit
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiGetSessionRequest struct {
+type IdentityAPIApiGetSessionRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 	expand     *[]string
 }
 
-func (r IdentityApiApiGetSessionRequest) Expand(expand []string) IdentityApiApiGetSessionRequest {
+func (r IdentityAPIApiGetSessionRequest) Expand(expand []string) IdentityAPIApiGetSessionRequest {
 	r.expand = &expand
 	return r
 }
 
-func (r IdentityApiApiGetSessionRequest) Execute() (*Session, *http.Response, error) {
+func (r IdentityAPIApiGetSessionRequest) Execute() (*Session, *http.Response, error) {
 	return r.ApiService.GetSessionExecute(r)
 }
 
@@ -1943,10 +1943,10 @@ func (r IdentityApiApiGetSessionRequest) Execute() (*Session, *http.Response, er
 Getting a session object with all specified expandables that exist in an administrative context.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID is the session's ID.
-  - @return IdentityApiApiGetSessionRequest
+  - @return IdentityAPIApiGetSessionRequest
 */
-func (a *IdentityApiService) GetSession(ctx context.Context, id string) IdentityApiApiGetSessionRequest {
-	return IdentityApiApiGetSessionRequest{
+func (a *IdentityAPIService) GetSession(ctx context.Context, id string) IdentityAPIApiGetSessionRequest {
+	return IdentityAPIApiGetSessionRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1957,7 +1957,7 @@ func (a *IdentityApiService) GetSession(ctx context.Context, id string) Identity
  * Execute executes the request
  * @return Session
  */
-func (a *IdentityApiService) GetSessionExecute(r IdentityApiApiGetSessionRequest) (*Session, *http.Response, error) {
+func (a *IdentityAPIService) GetSessionExecute(r IdentityAPIApiGetSessionRequest) (*Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1967,7 +1967,7 @@ func (a *IdentityApiService) GetSessionExecute(r IdentityApiApiGetSessionRequest
 		localVarReturnValue  *Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.GetSession")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.GetSession")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2075,9 +2075,9 @@ func (a *IdentityApiService) GetSessionExecute(r IdentityApiApiGetSessionRequest
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiListIdentitiesRequest struct {
+type IdentityAPIApiListIdentitiesRequest struct {
 	ctx                                 context.Context
-	ApiService                          IdentityApi
+	ApiService                          IdentityAPI
 	perPage                             *int64
 	page                                *int64
 	pageSize                            *int64
@@ -2087,57 +2087,62 @@ type IdentityApiApiListIdentitiesRequest struct {
 	credentialsIdentifier               *string
 	previewCredentialsIdentifierSimilar *string
 	includeCredential                   *[]string
+	organizationId                      *string
 }
 
-func (r IdentityApiApiListIdentitiesRequest) PerPage(perPage int64) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) PerPage(perPage int64) IdentityAPIApiListIdentitiesRequest {
 	r.perPage = &perPage
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) Page(page int64) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) Page(page int64) IdentityAPIApiListIdentitiesRequest {
 	r.page = &page
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) PageSize(pageSize int64) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) PageSize(pageSize int64) IdentityAPIApiListIdentitiesRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) PageToken(pageToken string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) PageToken(pageToken string) IdentityAPIApiListIdentitiesRequest {
 	r.pageToken = &pageToken
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) Consistency(consistency string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) Consistency(consistency string) IdentityAPIApiListIdentitiesRequest {
 	r.consistency = &consistency
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) Ids(ids []string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) Ids(ids []string) IdentityAPIApiListIdentitiesRequest {
 	r.ids = &ids
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) CredentialsIdentifier(credentialsIdentifier string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) CredentialsIdentifier(credentialsIdentifier string) IdentityAPIApiListIdentitiesRequest {
 	r.credentialsIdentifier = &credentialsIdentifier
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) PreviewCredentialsIdentifierSimilar(previewCredentialsIdentifierSimilar string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) PreviewCredentialsIdentifierSimilar(previewCredentialsIdentifierSimilar string) IdentityAPIApiListIdentitiesRequest {
 	r.previewCredentialsIdentifierSimilar = &previewCredentialsIdentifierSimilar
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) IncludeCredential(includeCredential []string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) IncludeCredential(includeCredential []string) IdentityAPIApiListIdentitiesRequest {
 	r.includeCredential = &includeCredential
 	return r
 }
+func (r IdentityAPIApiListIdentitiesRequest) OrganizationId(organizationId string) IdentityAPIApiListIdentitiesRequest {
+	r.organizationId = &organizationId
+	return r
+}
 
-func (r IdentityApiApiListIdentitiesRequest) Execute() ([]Identity, *http.Response, error) {
+func (r IdentityAPIApiListIdentitiesRequest) Execute() ([]Identity, *http.Response, error) {
 	return r.ApiService.ListIdentitiesExecute(r)
 }
 
 /*
  * ListIdentities List Identities
- * Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system.
+ * Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system. Note: filters cannot be combined.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- * @return IdentityApiApiListIdentitiesRequest
+ * @return IdentityAPIApiListIdentitiesRequest
  */
-func (a *IdentityApiService) ListIdentities(ctx context.Context) IdentityApiApiListIdentitiesRequest {
-	return IdentityApiApiListIdentitiesRequest{
+func (a *IdentityAPIService) ListIdentities(ctx context.Context) IdentityAPIApiListIdentitiesRequest {
+	return IdentityAPIApiListIdentitiesRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2147,7 +2152,7 @@ func (a *IdentityApiService) ListIdentities(ctx context.Context) IdentityApiApiL
  * Execute executes the request
  * @return []Identity
  */
-func (a *IdentityApiService) ListIdentitiesExecute(r IdentityApiApiListIdentitiesRequest) ([]Identity, *http.Response, error) {
+func (a *IdentityAPIService) ListIdentitiesExecute(r IdentityAPIApiListIdentitiesRequest) ([]Identity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2157,7 +2162,7 @@ func (a *IdentityApiService) ListIdentitiesExecute(r IdentityApiApiListIdentitie
 		localVarReturnValue  []Identity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.ListIdentities")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.ListIdentities")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2211,6 +2216,9 @@ func (a *IdentityApiService) ListIdentitiesExecute(r IdentityApiApiListIdentitie
 			localVarQueryParams.Add("include_credential", parameterToString(t, "multi"))
 		}
 	}
+	if r.organizationId != nil {
+		localVarQueryParams.Add("organization_id", parameterToString(*r.organizationId, ""))
+	}
 	// to determine the Content-Type header
 	localVarHTTPContentTypes := []string{}
 
@@ -2286,33 +2294,33 @@ func (a *IdentityApiService) ListIdentitiesExecute(r IdentityApiApiListIdentitie
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiListIdentitySchemasRequest struct {
+type IdentityAPIApiListIdentitySchemasRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	perPage    *int64
 	page       *int64
 	pageSize   *int64
 	pageToken  *string
 }
 
-func (r IdentityApiApiListIdentitySchemasRequest) PerPage(perPage int64) IdentityApiApiListIdentitySchemasRequest {
+func (r IdentityAPIApiListIdentitySchemasRequest) PerPage(perPage int64) IdentityAPIApiListIdentitySchemasRequest {
 	r.perPage = &perPage
 	return r
 }
-func (r IdentityApiApiListIdentitySchemasRequest) Page(page int64) IdentityApiApiListIdentitySchemasRequest {
+func (r IdentityAPIApiListIdentitySchemasRequest) Page(page int64) IdentityAPIApiListIdentitySchemasRequest {
 	r.page = &page
 	return r
 }
-func (r IdentityApiApiListIdentitySchemasRequest) PageSize(pageSize int64) IdentityApiApiListIdentitySchemasRequest {
+func (r IdentityAPIApiListIdentitySchemasRequest) PageSize(pageSize int64) IdentityAPIApiListIdentitySchemasRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r IdentityApiApiListIdentitySchemasRequest) PageToken(pageToken string) IdentityApiApiListIdentitySchemasRequest {
+func (r IdentityAPIApiListIdentitySchemasRequest) PageToken(pageToken string) IdentityAPIApiListIdentitySchemasRequest {
 	r.pageToken = &pageToken
 	return r
 }
 
-func (r IdentityApiApiListIdentitySchemasRequest) Execute() ([]IdentitySchemaContainer, *http.Response, error) {
+func (r IdentityAPIApiListIdentitySchemasRequest) Execute() ([]IdentitySchemaContainer, *http.Response, error) {
 	return r.ApiService.ListIdentitySchemasExecute(r)
 }
 
@@ -2320,10 +2328,10 @@ func (r IdentityApiApiListIdentitySchemasRequest) Execute() ([]IdentitySchemaCon
  * ListIdentitySchemas Get all Identity Schemas
  * Returns a list of all identity schemas currently in use.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- * @return IdentityApiApiListIdentitySchemasRequest
+ * @return IdentityAPIApiListIdentitySchemasRequest
  */
-func (a *IdentityApiService) ListIdentitySchemas(ctx context.Context) IdentityApiApiListIdentitySchemasRequest {
-	return IdentityApiApiListIdentitySchemasRequest{
+func (a *IdentityAPIService) ListIdentitySchemas(ctx context.Context) IdentityAPIApiListIdentitySchemasRequest {
+	return IdentityAPIApiListIdentitySchemasRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2333,7 +2341,7 @@ func (a *IdentityApiService) ListIdentitySchemas(ctx context.Context) IdentityAp
  * Execute executes the request
  * @return []IdentitySchemaContainer
  */
-func (a *IdentityApiService) ListIdentitySchemasExecute(r IdentityApiApiListIdentitySchemasRequest) ([]IdentitySchemaContainer, *http.Response, error) {
+func (a *IdentityAPIService) ListIdentitySchemasExecute(r IdentityAPIApiListIdentitySchemasRequest) ([]IdentitySchemaContainer, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2343,7 +2351,7 @@ func (a *IdentityApiService) ListIdentitySchemasExecute(r IdentityApiApiListIden
 		localVarReturnValue  []IdentitySchemaContainer
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.ListIdentitySchemas")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.ListIdentitySchemas")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2427,9 +2435,9 @@ func (a *IdentityApiService) ListIdentitySchemasExecute(r IdentityApiApiListIden
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiListIdentitySessionsRequest struct {
+type IdentityAPIApiListIdentitySessionsRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 	perPage    *int64
 	page       *int64
@@ -2438,28 +2446,28 @@ type IdentityApiApiListIdentitySessionsRequest struct {
 	active     *bool
 }
 
-func (r IdentityApiApiListIdentitySessionsRequest) PerPage(perPage int64) IdentityApiApiListIdentitySessionsRequest {
+func (r IdentityAPIApiListIdentitySessionsRequest) PerPage(perPage int64) IdentityAPIApiListIdentitySessionsRequest {
 	r.perPage = &perPage
 	return r
 }
-func (r IdentityApiApiListIdentitySessionsRequest) Page(page int64) IdentityApiApiListIdentitySessionsRequest {
+func (r IdentityAPIApiListIdentitySessionsRequest) Page(page int64) IdentityAPIApiListIdentitySessionsRequest {
 	r.page = &page
 	return r
 }
-func (r IdentityApiApiListIdentitySessionsRequest) PageSize(pageSize int64) IdentityApiApiListIdentitySessionsRequest {
+func (r IdentityAPIApiListIdentitySessionsRequest) PageSize(pageSize int64) IdentityAPIApiListIdentitySessionsRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r IdentityApiApiListIdentitySessionsRequest) PageToken(pageToken string) IdentityApiApiListIdentitySessionsRequest {
+func (r IdentityAPIApiListIdentitySessionsRequest) PageToken(pageToken string) IdentityAPIApiListIdentitySessionsRequest {
 	r.pageToken = &pageToken
 	return r
 }
-func (r IdentityApiApiListIdentitySessionsRequest) Active(active bool) IdentityApiApiListIdentitySessionsRequest {
+func (r IdentityAPIApiListIdentitySessionsRequest) Active(active bool) IdentityAPIApiListIdentitySessionsRequest {
 	r.active = &active
 	return r
 }
 
-func (r IdentityApiApiListIdentitySessionsRequest) Execute() ([]Session, *http.Response, error) {
+func (r IdentityAPIApiListIdentitySessionsRequest) Execute() ([]Session, *http.Response, error) {
 	return r.ApiService.ListIdentitySessionsExecute(r)
 }
 
@@ -2468,10 +2476,10 @@ func (r IdentityApiApiListIdentitySessionsRequest) Execute() ([]Session, *http.R
  * This endpoint returns all sessions that belong to the given Identity.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
  * @param id ID is the identity's ID.
- * @return IdentityApiApiListIdentitySessionsRequest
+ * @return IdentityAPIApiListIdentitySessionsRequest
  */
-func (a *IdentityApiService) ListIdentitySessions(ctx context.Context, id string) IdentityApiApiListIdentitySessionsRequest {
-	return IdentityApiApiListIdentitySessionsRequest{
+func (a *IdentityAPIService) ListIdentitySessions(ctx context.Context, id string) IdentityAPIApiListIdentitySessionsRequest {
+	return IdentityAPIApiListIdentitySessionsRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -2482,7 +2490,7 @@ func (a *IdentityApiService) ListIdentitySessions(ctx context.Context, id string
  * Execute executes the request
  * @return []Session
  */
-func (a *IdentityApiService) ListIdentitySessionsExecute(r IdentityApiApiListIdentitySessionsRequest) ([]Session, *http.Response, error) {
+func (a *IdentityAPIService) ListIdentitySessionsExecute(r IdentityAPIApiListIdentitySessionsRequest) ([]Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2492,7 +2500,7 @@ func (a *IdentityApiService) ListIdentitySessionsExecute(r IdentityApiApiListIde
 		localVarReturnValue  []Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.ListIdentitySessions")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.ListIdentitySessions")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2614,33 +2622,33 @@ func (a *IdentityApiService) ListIdentitySessionsExecute(r IdentityApiApiListIde
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiListSessionsRequest struct {
+type IdentityAPIApiListSessionsRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	pageSize   *int64
 	pageToken  *string
 	active     *bool
 	expand     *[]string
 }
 
-func (r IdentityApiApiListSessionsRequest) PageSize(pageSize int64) IdentityApiApiListSessionsRequest {
+func (r IdentityAPIApiListSessionsRequest) PageSize(pageSize int64) IdentityAPIApiListSessionsRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r IdentityApiApiListSessionsRequest) PageToken(pageToken string) IdentityApiApiListSessionsRequest {
+func (r IdentityAPIApiListSessionsRequest) PageToken(pageToken string) IdentityAPIApiListSessionsRequest {
 	r.pageToken = &pageToken
 	return r
 }
-func (r IdentityApiApiListSessionsRequest) Active(active bool) IdentityApiApiListSessionsRequest {
+func (r IdentityAPIApiListSessionsRequest) Active(active bool) IdentityAPIApiListSessionsRequest {
 	r.active = &active
 	return r
 }
-func (r IdentityApiApiListSessionsRequest) Expand(expand []string) IdentityApiApiListSessionsRequest {
+func (r IdentityAPIApiListSessionsRequest) Expand(expand []string) IdentityAPIApiListSessionsRequest {
 	r.expand = &expand
 	return r
 }
 
-func (r IdentityApiApiListSessionsRequest) Execute() ([]Session, *http.Response, error) {
+func (r IdentityAPIApiListSessionsRequest) Execute() ([]Session, *http.Response, error) {
 	return r.ApiService.ListSessionsExecute(r)
 }
 
@@ -2648,10 +2656,10 @@ func (r IdentityApiApiListSessionsRequest) Execute() ([]Session, *http.Response,
  * ListSessions List All Sessions
  * Listing all sessions that exist.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- * @return IdentityApiApiListSessionsRequest
+ * @return IdentityAPIApiListSessionsRequest
  */
-func (a *IdentityApiService) ListSessions(ctx context.Context) IdentityApiApiListSessionsRequest {
-	return IdentityApiApiListSessionsRequest{
+func (a *IdentityAPIService) ListSessions(ctx context.Context) IdentityAPIApiListSessionsRequest {
+	return IdentityAPIApiListSessionsRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2661,7 +2669,7 @@ func (a *IdentityApiService) ListSessions(ctx context.Context) IdentityApiApiLis
  * Execute executes the request
  * @return []Session
  */
-func (a *IdentityApiService) ListSessionsExecute(r IdentityApiApiListSessionsRequest) ([]Session, *http.Response, error) {
+func (a *IdentityAPIService) ListSessionsExecute(r IdentityAPIApiListSessionsRequest) ([]Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2671,7 +2679,7 @@ func (a *IdentityApiService) ListSessionsExecute(r IdentityApiApiListSessionsReq
 		localVarReturnValue  []Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.ListSessions")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.ListSessions")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2787,19 +2795,19 @@ func (a *IdentityApiService) ListSessionsExecute(r IdentityApiApiListSessionsReq
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiPatchIdentityRequest struct {
+type IdentityAPIApiPatchIdentityRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 	jsonPatch  *[]JsonPatch
 }
 
-func (r IdentityApiApiPatchIdentityRequest) JsonPatch(jsonPatch []JsonPatch) IdentityApiApiPatchIdentityRequest {
+func (r IdentityAPIApiPatchIdentityRequest) JsonPatch(jsonPatch []JsonPatch) IdentityAPIApiPatchIdentityRequest {
 	r.jsonPatch = &jsonPatch
 	return r
 }
 
-func (r IdentityApiApiPatchIdentityRequest) Execute() (*Identity, *http.Response, error) {
+func (r IdentityAPIApiPatchIdentityRequest) Execute() (*Identity, *http.Response, error) {
 	return r.ApiService.PatchIdentityExecute(r)
 }
 
@@ -2810,10 +2818,10 @@ func (r IdentityApiApiPatchIdentityRequest) Execute() (*Identity, *http.Response
 The fields `id`, `stateChangedAt` and `credentials` can not be updated using this method.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID must be set to the ID of identity you want to update
-  - @return IdentityApiApiPatchIdentityRequest
+  - @return IdentityAPIApiPatchIdentityRequest
 */
-func (a *IdentityApiService) PatchIdentity(ctx context.Context, id string) IdentityApiApiPatchIdentityRequest {
-	return IdentityApiApiPatchIdentityRequest{
+func (a *IdentityAPIService) PatchIdentity(ctx context.Context, id string) IdentityAPIApiPatchIdentityRequest {
+	return IdentityAPIApiPatchIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -2824,7 +2832,7 @@ func (a *IdentityApiService) PatchIdentity(ctx context.Context, id string) Ident
  * Execute executes the request
  * @return Identity
  */
-func (a *IdentityApiService) PatchIdentityExecute(r IdentityApiApiPatchIdentityRequest) (*Identity, *http.Response, error) {
+func (a *IdentityAPIService) PatchIdentityExecute(r IdentityAPIApiPatchIdentityRequest) (*Identity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPatch
 		localVarPostBody     interface{}
@@ -2834,7 +2842,7 @@ func (a *IdentityApiService) PatchIdentityExecute(r IdentityApiApiPatchIdentityR
 		localVarReturnValue  *Identity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.PatchIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.PatchIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2953,19 +2961,19 @@ func (a *IdentityApiService) PatchIdentityExecute(r IdentityApiApiPatchIdentityR
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiUpdateIdentityRequest struct {
+type IdentityAPIApiUpdateIdentityRequest struct {
 	ctx                context.Context
-	ApiService         IdentityApi
+	ApiService         IdentityAPI
 	id                 string
 	updateIdentityBody *UpdateIdentityBody
 }
 
-func (r IdentityApiApiUpdateIdentityRequest) UpdateIdentityBody(updateIdentityBody UpdateIdentityBody) IdentityApiApiUpdateIdentityRequest {
+func (r IdentityAPIApiUpdateIdentityRequest) UpdateIdentityBody(updateIdentityBody UpdateIdentityBody) IdentityAPIApiUpdateIdentityRequest {
 	r.updateIdentityBody = &updateIdentityBody
 	return r
 }
 
-func (r IdentityApiApiUpdateIdentityRequest) Execute() (*Identity, *http.Response, error) {
+func (r IdentityAPIApiUpdateIdentityRequest) Execute() (*Identity, *http.Response, error) {
 	return r.ApiService.UpdateIdentityExecute(r)
 }
 
@@ -2976,10 +2984,10 @@ func (r IdentityApiApiUpdateIdentityRequest) Execute() (*Identity, *http.Respons
 payload (except credentials) is expected. It is possible to update the identity's credentials as well.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID must be set to the ID of identity you want to update
-  - @return IdentityApiApiUpdateIdentityRequest
+  - @return IdentityAPIApiUpdateIdentityRequest
 */
-func (a *IdentityApiService) UpdateIdentity(ctx context.Context, id string) IdentityApiApiUpdateIdentityRequest {
-	return IdentityApiApiUpdateIdentityRequest{
+func (a *IdentityAPIService) UpdateIdentity(ctx context.Context, id string) IdentityAPIApiUpdateIdentityRequest {
+	return IdentityAPIApiUpdateIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -2990,7 +2998,7 @@ func (a *IdentityApiService) UpdateIdentity(ctx context.Context, id string) Iden
  * Execute executes the request
  * @return Identity
  */
-func (a *IdentityApiService) UpdateIdentityExecute(r IdentityApiApiUpdateIdentityRequest) (*Identity, *http.Response, error) {
+func (a *IdentityAPIService) UpdateIdentityExecute(r IdentityAPIApiUpdateIdentityRequest) (*Identity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPut
 		localVarPostBody     interface{}
@@ -3000,7 +3008,7 @@ func (a *IdentityApiService) UpdateIdentityExecute(r IdentityApiApiUpdateIdentit
 		localVarReturnValue  *Identity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.UpdateIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.UpdateIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
diff --git a/internal/client-go/api_metadata.go b/internal/client-go/api_metadata.go
index e5ac1a854d5d..4bef0d5cb6ca 100644
--- a/internal/client-go/api_metadata.go
+++ b/internal/client-go/api_metadata.go
@@ -24,7 +24,7 @@ var (
 	_ context.Context
 )
 
-type MetadataApi interface {
+type MetadataAPI interface {
 
 	/*
 			 * GetVersion Return Running Software Version.
@@ -36,15 +36,15 @@ type MetadataApi interface {
 		Be aware that if you are running multiple nodes of this service, the version will never
 		refer to the cluster state, only to a single instance.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return MetadataApiApiGetVersionRequest
+			 * @return MetadataAPIApiGetVersionRequest
 	*/
-	GetVersion(ctx context.Context) MetadataApiApiGetVersionRequest
+	GetVersion(ctx context.Context) MetadataAPIApiGetVersionRequest
 
 	/*
 	 * GetVersionExecute executes the request
 	 * @return GetVersion200Response
 	 */
-	GetVersionExecute(r MetadataApiApiGetVersionRequest) (*GetVersion200Response, *http.Response, error)
+	GetVersionExecute(r MetadataAPIApiGetVersionRequest) (*GetVersion200Response, *http.Response, error)
 
 	/*
 			 * IsAlive Check HTTP Server Status
@@ -57,15 +57,15 @@ type MetadataApi interface {
 		Be aware that if you are running multiple nodes of this service, the health status will never
 		refer to the cluster state, only to a single instance.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return MetadataApiApiIsAliveRequest
+			 * @return MetadataAPIApiIsAliveRequest
 	*/
-	IsAlive(ctx context.Context) MetadataApiApiIsAliveRequest
+	IsAlive(ctx context.Context) MetadataAPIApiIsAliveRequest
 
 	/*
 	 * IsAliveExecute executes the request
 	 * @return IsAlive200Response
 	 */
-	IsAliveExecute(r MetadataApiApiIsAliveRequest) (*IsAlive200Response, *http.Response, error)
+	IsAliveExecute(r MetadataAPIApiIsAliveRequest) (*IsAlive200Response, *http.Response, error)
 
 	/*
 			 * IsReady Check HTTP Server and Database Status
@@ -78,26 +78,26 @@ type MetadataApi interface {
 		Be aware that if you are running multiple nodes of Ory Kratos, the health status will never
 		refer to the cluster state, only to a single instance.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return MetadataApiApiIsReadyRequest
+			 * @return MetadataAPIApiIsReadyRequest
 	*/
-	IsReady(ctx context.Context) MetadataApiApiIsReadyRequest
+	IsReady(ctx context.Context) MetadataAPIApiIsReadyRequest
 
 	/*
 	 * IsReadyExecute executes the request
 	 * @return IsAlive200Response
 	 */
-	IsReadyExecute(r MetadataApiApiIsReadyRequest) (*IsAlive200Response, *http.Response, error)
+	IsReadyExecute(r MetadataAPIApiIsReadyRequest) (*IsAlive200Response, *http.Response, error)
 }
 
-// MetadataApiService MetadataApi service
-type MetadataApiService service
+// MetadataAPIService MetadataAPI service
+type MetadataAPIService service
 
-type MetadataApiApiGetVersionRequest struct {
+type MetadataAPIApiGetVersionRequest struct {
 	ctx        context.Context
-	ApiService MetadataApi
+	ApiService MetadataAPI
 }
 
-func (r MetadataApiApiGetVersionRequest) Execute() (*GetVersion200Response, *http.Response, error) {
+func (r MetadataAPIApiGetVersionRequest) Execute() (*GetVersion200Response, *http.Response, error) {
 	return r.ApiService.GetVersionExecute(r)
 }
 
@@ -111,10 +111,10 @@ If the service supports TLS Edge Termination, this endpoint does not require the
 Be aware that if you are running multiple nodes of this service, the version will never
 refer to the cluster state, only to a single instance.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return MetadataApiApiGetVersionRequest
+  - @return MetadataAPIApiGetVersionRequest
 */
-func (a *MetadataApiService) GetVersion(ctx context.Context) MetadataApiApiGetVersionRequest {
-	return MetadataApiApiGetVersionRequest{
+func (a *MetadataAPIService) GetVersion(ctx context.Context) MetadataAPIApiGetVersionRequest {
+	return MetadataAPIApiGetVersionRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -124,7 +124,7 @@ func (a *MetadataApiService) GetVersion(ctx context.Context) MetadataApiApiGetVe
  * Execute executes the request
  * @return GetVersion200Response
  */
-func (a *MetadataApiService) GetVersionExecute(r MetadataApiApiGetVersionRequest) (*GetVersion200Response, *http.Response, error) {
+func (a *MetadataAPIService) GetVersionExecute(r MetadataAPIApiGetVersionRequest) (*GetVersion200Response, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -134,7 +134,7 @@ func (a *MetadataApiService) GetVersionExecute(r MetadataApiApiGetVersionRequest
 		localVarReturnValue  *GetVersion200Response
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataApiService.GetVersion")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataAPIService.GetVersion")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -199,12 +199,12 @@ func (a *MetadataApiService) GetVersionExecute(r MetadataApiApiGetVersionRequest
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type MetadataApiApiIsAliveRequest struct {
+type MetadataAPIApiIsAliveRequest struct {
 	ctx        context.Context
-	ApiService MetadataApi
+	ApiService MetadataAPI
 }
 
-func (r MetadataApiApiIsAliveRequest) Execute() (*IsAlive200Response, *http.Response, error) {
+func (r MetadataAPIApiIsAliveRequest) Execute() (*IsAlive200Response, *http.Response, error) {
 	return r.ApiService.IsAliveExecute(r)
 }
 
@@ -220,10 +220,10 @@ If the service supports TLS Edge Termination, this endpoint does not require the
 Be aware that if you are running multiple nodes of this service, the health status will never
 refer to the cluster state, only to a single instance.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return MetadataApiApiIsAliveRequest
+  - @return MetadataAPIApiIsAliveRequest
 */
-func (a *MetadataApiService) IsAlive(ctx context.Context) MetadataApiApiIsAliveRequest {
-	return MetadataApiApiIsAliveRequest{
+func (a *MetadataAPIService) IsAlive(ctx context.Context) MetadataAPIApiIsAliveRequest {
+	return MetadataAPIApiIsAliveRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -233,7 +233,7 @@ func (a *MetadataApiService) IsAlive(ctx context.Context) MetadataApiApiIsAliveR
  * Execute executes the request
  * @return IsAlive200Response
  */
-func (a *MetadataApiService) IsAliveExecute(r MetadataApiApiIsAliveRequest) (*IsAlive200Response, *http.Response, error) {
+func (a *MetadataAPIService) IsAliveExecute(r MetadataAPIApiIsAliveRequest) (*IsAlive200Response, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -243,7 +243,7 @@ func (a *MetadataApiService) IsAliveExecute(r MetadataApiApiIsAliveRequest) (*Is
 		localVarReturnValue  *IsAlive200Response
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataApiService.IsAlive")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataAPIService.IsAlive")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -315,12 +315,12 @@ func (a *MetadataApiService) IsAliveExecute(r MetadataApiApiIsAliveRequest) (*Is
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type MetadataApiApiIsReadyRequest struct {
+type MetadataAPIApiIsReadyRequest struct {
 	ctx        context.Context
-	ApiService MetadataApi
+	ApiService MetadataAPI
 }
 
-func (r MetadataApiApiIsReadyRequest) Execute() (*IsAlive200Response, *http.Response, error) {
+func (r MetadataAPIApiIsReadyRequest) Execute() (*IsAlive200Response, *http.Response, error) {
 	return r.ApiService.IsReadyExecute(r)
 }
 
@@ -336,10 +336,10 @@ If the service supports TLS Edge Termination, this endpoint does not require the
 Be aware that if you are running multiple nodes of Ory Kratos, the health status will never
 refer to the cluster state, only to a single instance.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return MetadataApiApiIsReadyRequest
+  - @return MetadataAPIApiIsReadyRequest
 */
-func (a *MetadataApiService) IsReady(ctx context.Context) MetadataApiApiIsReadyRequest {
-	return MetadataApiApiIsReadyRequest{
+func (a *MetadataAPIService) IsReady(ctx context.Context) MetadataAPIApiIsReadyRequest {
+	return MetadataAPIApiIsReadyRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -349,7 +349,7 @@ func (a *MetadataApiService) IsReady(ctx context.Context) MetadataApiApiIsReadyR
  * Execute executes the request
  * @return IsAlive200Response
  */
-func (a *MetadataApiService) IsReadyExecute(r MetadataApiApiIsReadyRequest) (*IsAlive200Response, *http.Response, error) {
+func (a *MetadataAPIService) IsReadyExecute(r MetadataAPIApiIsReadyRequest) (*IsAlive200Response, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -359,7 +359,7 @@ func (a *MetadataApiService) IsReadyExecute(r MetadataApiApiIsReadyRequest) (*Is
 		localVarReturnValue  *IsAlive200Response
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataApiService.IsReady")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataAPIService.IsReady")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
diff --git a/internal/client-go/client.go b/internal/client-go/client.go
index 949a0e51ab35..14ee5d7619a6 100644
--- a/internal/client-go/client.go
+++ b/internal/client-go/client.go
@@ -49,13 +49,13 @@ type APIClient struct {
 
 	// API Services
 
-	CourierApi CourierApi
+	CourierAPI CourierAPI
 
-	FrontendApi FrontendApi
+	FrontendAPI FrontendAPI
 
-	IdentityApi IdentityApi
+	IdentityAPI IdentityAPI
 
-	MetadataApi MetadataApi
+	MetadataAPI MetadataAPI
 }
 
 type service struct {
@@ -74,10 +74,10 @@ func NewAPIClient(cfg *Configuration) *APIClient {
 	c.common.client = c
 
 	// API Services
-	c.CourierApi = (*CourierApiService)(&c.common)
-	c.FrontendApi = (*FrontendApiService)(&c.common)
-	c.IdentityApi = (*IdentityApiService)(&c.common)
-	c.MetadataApi = (*MetadataApiService)(&c.common)
+	c.CourierAPI = (*CourierAPIService)(&c.common)
+	c.FrontendAPI = (*FrontendAPIService)(&c.common)
+	c.IdentityAPI = (*IdentityAPIService)(&c.common)
+	c.MetadataAPI = (*MetadataAPIService)(&c.common)
 
 	return c
 }
diff --git a/internal/client-go/model_continue_with.go b/internal/client-go/model_continue_with.go
index 9e97dbf479e7..6fb1056836e6 100644
--- a/internal/client-go/model_continue_with.go
+++ b/internal/client-go/model_continue_with.go
@@ -19,6 +19,7 @@ import (
 // ContinueWith - struct for ContinueWith
 type ContinueWith struct {
 	ContinueWithRecoveryUi         *ContinueWithRecoveryUi
+	ContinueWithRedirectBrowserTo  *ContinueWithRedirectBrowserTo
 	ContinueWithSetOrySessionToken *ContinueWithSetOrySessionToken
 	ContinueWithSettingsUi         *ContinueWithSettingsUi
 	ContinueWithVerificationUi     *ContinueWithVerificationUi
@@ -31,6 +32,13 @@ func ContinueWithRecoveryUiAsContinueWith(v *ContinueWithRecoveryUi) ContinueWit
 	}
 }
 
+// ContinueWithRedirectBrowserToAsContinueWith is a convenience function that returns ContinueWithRedirectBrowserTo wrapped in ContinueWith
+func ContinueWithRedirectBrowserToAsContinueWith(v *ContinueWithRedirectBrowserTo) ContinueWith {
+	return ContinueWith{
+		ContinueWithRedirectBrowserTo: v,
+	}
+}
+
 // ContinueWithSetOrySessionTokenAsContinueWith is a convenience function that returns ContinueWithSetOrySessionToken wrapped in ContinueWith
 func ContinueWithSetOrySessionTokenAsContinueWith(v *ContinueWithSetOrySessionToken) ContinueWith {
 	return ContinueWith{
@@ -62,6 +70,18 @@ func (dst *ContinueWith) UnmarshalJSON(data []byte) error {
 		return fmt.Errorf("Failed to unmarshal JSON into map for the discrimintor lookup.")
 	}
 
+	// check if the discriminator value is 'redirect_browser_to'
+	if jsonDict["action"] == "redirect_browser_to" {
+		// try to unmarshal JSON data into ContinueWithRedirectBrowserTo
+		err = json.Unmarshal(data, &dst.ContinueWithRedirectBrowserTo)
+		if err == nil {
+			return nil // data stored in dst.ContinueWithRedirectBrowserTo, return on the first match
+		} else {
+			dst.ContinueWithRedirectBrowserTo = nil
+			return fmt.Errorf("Failed to unmarshal ContinueWith as ContinueWithRedirectBrowserTo: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'set_ory_session_token'
 	if jsonDict["action"] == "set_ory_session_token" {
 		// try to unmarshal JSON data into ContinueWithSetOrySessionToken
@@ -122,6 +142,18 @@ func (dst *ContinueWith) UnmarshalJSON(data []byte) error {
 		}
 	}
 
+	// check if the discriminator value is 'continueWithRedirectBrowserTo'
+	if jsonDict["action"] == "continueWithRedirectBrowserTo" {
+		// try to unmarshal JSON data into ContinueWithRedirectBrowserTo
+		err = json.Unmarshal(data, &dst.ContinueWithRedirectBrowserTo)
+		if err == nil {
+			return nil // data stored in dst.ContinueWithRedirectBrowserTo, return on the first match
+		} else {
+			dst.ContinueWithRedirectBrowserTo = nil
+			return fmt.Errorf("Failed to unmarshal ContinueWith as ContinueWithRedirectBrowserTo: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'continueWithSetOrySessionToken'
 	if jsonDict["action"] == "continueWithSetOrySessionToken" {
 		// try to unmarshal JSON data into ContinueWithSetOrySessionToken
@@ -167,6 +199,10 @@ func (src ContinueWith) MarshalJSON() ([]byte, error) {
 		return json.Marshal(&src.ContinueWithRecoveryUi)
 	}
 
+	if src.ContinueWithRedirectBrowserTo != nil {
+		return json.Marshal(&src.ContinueWithRedirectBrowserTo)
+	}
+
 	if src.ContinueWithSetOrySessionToken != nil {
 		return json.Marshal(&src.ContinueWithSetOrySessionToken)
 	}
@@ -191,6 +227,10 @@ func (obj *ContinueWith) GetActualInstance() interface{} {
 		return obj.ContinueWithRecoveryUi
 	}
 
+	if obj.ContinueWithRedirectBrowserTo != nil {
+		return obj.ContinueWithRedirectBrowserTo
+	}
+
 	if obj.ContinueWithSetOrySessionToken != nil {
 		return obj.ContinueWithSetOrySessionToken
 	}
diff --git a/internal/client-go/model_continue_with_recovery_ui_flow.go b/internal/client-go/model_continue_with_recovery_ui_flow.go
index 3fde7e717ef2..251725a73c3b 100644
--- a/internal/client-go/model_continue_with_recovery_ui_flow.go
+++ b/internal/client-go/model_continue_with_recovery_ui_flow.go
@@ -19,7 +19,7 @@ import (
 type ContinueWithRecoveryUiFlow struct {
 	// The ID of the recovery flow
 	Id string `json:"id"`
-	// The URL of the recovery flow
+	// The URL of the recovery flow  If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
 	Url *string `json:"url,omitempty"`
 }
 
diff --git a/internal/client-go/model_continue_with_redirect_browser_to.go b/internal/client-go/model_continue_with_redirect_browser_to.go
new file mode 100644
index 000000000000..20c3e4f3c562
--- /dev/null
+++ b/internal/client-go/model_continue_with_redirect_browser_to.go
@@ -0,0 +1,138 @@
+/*
+ * Ory Identities API
+ *
+ * This is the API specification for Ory Identities with features such as registration, login, recovery, account verification, profile settings, password reset, identity management, session management, email and sms delivery, and more.
+ *
+ * API version:
+ * Contact: office@ory.sh
+ */
+
+// Code generated by OpenAPI Generator (https://openapi-generator.tech); DO NOT EDIT.
+
+package client
+
+import (
+	"encoding/json"
+)
+
+// ContinueWithRedirectBrowserTo Indicates, that the UI flow could be continued by showing a recovery ui
+type ContinueWithRedirectBrowserTo struct {
+	// Action will always be `redirect_browser_to` redirect_browser_to ContinueWithActionRedirectBrowserToString
+	Action string `json:"action"`
+	// The URL to redirect the browser to
+	RedirectBrowserTo string `json:"redirect_browser_to"`
+}
+
+// NewContinueWithRedirectBrowserTo instantiates a new ContinueWithRedirectBrowserTo object
+// This constructor will assign default values to properties that have it defined,
+// and makes sure properties required by API are set, but the set of arguments
+// will change when the set of required properties is changed
+func NewContinueWithRedirectBrowserTo(action string, redirectBrowserTo string) *ContinueWithRedirectBrowserTo {
+	this := ContinueWithRedirectBrowserTo{}
+	this.Action = action
+	this.RedirectBrowserTo = redirectBrowserTo
+	return &this
+}
+
+// NewContinueWithRedirectBrowserToWithDefaults instantiates a new ContinueWithRedirectBrowserTo object
+// This constructor will only assign default values to properties that have it defined,
+// but it doesn't guarantee that properties required by API are set
+func NewContinueWithRedirectBrowserToWithDefaults() *ContinueWithRedirectBrowserTo {
+	this := ContinueWithRedirectBrowserTo{}
+	return &this
+}
+
+// GetAction returns the Action field value
+func (o *ContinueWithRedirectBrowserTo) GetAction() string {
+	if o == nil {
+		var ret string
+		return ret
+	}
+
+	return o.Action
+}
+
+// GetActionOk returns a tuple with the Action field value
+// and a boolean to check if the value has been set.
+func (o *ContinueWithRedirectBrowserTo) GetActionOk() (*string, bool) {
+	if o == nil {
+		return nil, false
+	}
+	return &o.Action, true
+}
+
+// SetAction sets field value
+func (o *ContinueWithRedirectBrowserTo) SetAction(v string) {
+	o.Action = v
+}
+
+// GetRedirectBrowserTo returns the RedirectBrowserTo field value
+func (o *ContinueWithRedirectBrowserTo) GetRedirectBrowserTo() string {
+	if o == nil {
+		var ret string
+		return ret
+	}
+
+	return o.RedirectBrowserTo
+}
+
+// GetRedirectBrowserToOk returns a tuple with the RedirectBrowserTo field value
+// and a boolean to check if the value has been set.
+func (o *ContinueWithRedirectBrowserTo) GetRedirectBrowserToOk() (*string, bool) {
+	if o == nil {
+		return nil, false
+	}
+	return &o.RedirectBrowserTo, true
+}
+
+// SetRedirectBrowserTo sets field value
+func (o *ContinueWithRedirectBrowserTo) SetRedirectBrowserTo(v string) {
+	o.RedirectBrowserTo = v
+}
+
+func (o ContinueWithRedirectBrowserTo) MarshalJSON() ([]byte, error) {
+	toSerialize := map[string]interface{}{}
+	if true {
+		toSerialize["action"] = o.Action
+	}
+	if true {
+		toSerialize["redirect_browser_to"] = o.RedirectBrowserTo
+	}
+	return json.Marshal(toSerialize)
+}
+
+type NullableContinueWithRedirectBrowserTo struct {
+	value *ContinueWithRedirectBrowserTo
+	isSet bool
+}
+
+func (v NullableContinueWithRedirectBrowserTo) Get() *ContinueWithRedirectBrowserTo {
+	return v.value
+}
+
+func (v *NullableContinueWithRedirectBrowserTo) Set(val *ContinueWithRedirectBrowserTo) {
+	v.value = val
+	v.isSet = true
+}
+
+func (v NullableContinueWithRedirectBrowserTo) IsSet() bool {
+	return v.isSet
+}
+
+func (v *NullableContinueWithRedirectBrowserTo) Unset() {
+	v.value = nil
+	v.isSet = false
+}
+
+func NewNullableContinueWithRedirectBrowserTo(val *ContinueWithRedirectBrowserTo) *NullableContinueWithRedirectBrowserTo {
+	return &NullableContinueWithRedirectBrowserTo{value: val, isSet: true}
+}
+
+func (v NullableContinueWithRedirectBrowserTo) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.value)
+}
+
+func (v *NullableContinueWithRedirectBrowserTo) UnmarshalJSON(src []byte) error {
+	v.isSet = true
+	return json.Unmarshal(src, &v.value)
+}
diff --git a/internal/client-go/model_continue_with_settings_ui_flow.go b/internal/client-go/model_continue_with_settings_ui_flow.go
index 4ccaf74ef1b8..d6e9b9441f99 100644
--- a/internal/client-go/model_continue_with_settings_ui_flow.go
+++ b/internal/client-go/model_continue_with_settings_ui_flow.go
@@ -19,6 +19,8 @@ import (
 type ContinueWithSettingsUiFlow struct {
 	// The ID of the settings flow
 	Id string `json:"id"`
+	// The URL of the settings flow  If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
+	Url *string `json:"url,omitempty"`
 }
 
 // NewContinueWithSettingsUiFlow instantiates a new ContinueWithSettingsUiFlow object
@@ -63,11 +65,46 @@ func (o *ContinueWithSettingsUiFlow) SetId(v string) {
 	o.Id = v
 }
 
+// GetUrl returns the Url field value if set, zero value otherwise.
+func (o *ContinueWithSettingsUiFlow) GetUrl() string {
+	if o == nil || o.Url == nil {
+		var ret string
+		return ret
+	}
+	return *o.Url
+}
+
+// GetUrlOk returns a tuple with the Url field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *ContinueWithSettingsUiFlow) GetUrlOk() (*string, bool) {
+	if o == nil || o.Url == nil {
+		return nil, false
+	}
+	return o.Url, true
+}
+
+// HasUrl returns a boolean if a field has been set.
+func (o *ContinueWithSettingsUiFlow) HasUrl() bool {
+	if o != nil && o.Url != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetUrl gets a reference to the given string and assigns it to the Url field.
+func (o *ContinueWithSettingsUiFlow) SetUrl(v string) {
+	o.Url = &v
+}
+
 func (o ContinueWithSettingsUiFlow) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
 	if true {
 		toSerialize["id"] = o.Id
 	}
+	if o.Url != nil {
+		toSerialize["url"] = o.Url
+	}
 	return json.Marshal(toSerialize)
 }
 
diff --git a/internal/client-go/model_continue_with_verification_ui_flow.go b/internal/client-go/model_continue_with_verification_ui_flow.go
index 8fdd4609cf93..3c73a0761339 100644
--- a/internal/client-go/model_continue_with_verification_ui_flow.go
+++ b/internal/client-go/model_continue_with_verification_ui_flow.go
@@ -19,7 +19,7 @@ import (
 type ContinueWithVerificationUiFlow struct {
 	// The ID of the verification flow
 	Id string `json:"id"`
-	// The URL of the verification flow
+	// The URL of the verification flow  If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
 	Url *string `json:"url,omitempty"`
 	// The address that should be verified in this flow
 	VerifiableAddress string `json:"verifiable_address"`
diff --git a/internal/client-go/model_identity_credentials.go b/internal/client-go/model_identity_credentials.go
index 7ee96800df4b..de087e64e09f 100644
--- a/internal/client-go/model_identity_credentials.go
+++ b/internal/client-go/model_identity_credentials.go
@@ -23,7 +23,7 @@ type IdentityCredentials struct {
 	CreatedAt *time.Time `json:"created_at,omitempty"`
 	// Identifiers represents a list of unique identifiers this credential type matches.
 	Identifiers []string `json:"identifiers,omitempty"`
-	// Type discriminates between different types of credentials. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+	// Type discriminates between different types of credentials. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
 	Type *string `json:"type,omitempty"`
 	// UpdatedAt is a helper struct field for gobuffalo.pop.
 	UpdatedAt *time.Time `json:"updated_at,omitempty"`
diff --git a/internal/client-go/model_identity_credentials_code.go b/internal/client-go/model_identity_credentials_code.go
index 75857f31c272..53fefb6719eb 100644
--- a/internal/client-go/model_identity_credentials_code.go
+++ b/internal/client-go/model_identity_credentials_code.go
@@ -13,14 +13,11 @@ package client
 
 import (
 	"encoding/json"
-	"time"
 )
 
 // IdentityCredentialsCode CredentialsCode represents a one time login/registration code
 type IdentityCredentialsCode struct {
-	// The type of the address for this code
-	AddressType *string      `json:"address_type,omitempty"`
-	UsedAt      NullableTime `json:"used_at,omitempty"`
+	Addresses []IdentityCredentialsCodeAddress `json:"addresses,omitempty"`
 }
 
 // NewIdentityCredentialsCode instantiates a new IdentityCredentialsCode object
@@ -40,88 +37,42 @@ func NewIdentityCredentialsCodeWithDefaults() *IdentityCredentialsCode {
 	return &this
 }
 
-// GetAddressType returns the AddressType field value if set, zero value otherwise.
-func (o *IdentityCredentialsCode) GetAddressType() string {
-	if o == nil || o.AddressType == nil {
-		var ret string
+// GetAddresses returns the Addresses field value if set, zero value otherwise.
+func (o *IdentityCredentialsCode) GetAddresses() []IdentityCredentialsCodeAddress {
+	if o == nil || o.Addresses == nil {
+		var ret []IdentityCredentialsCodeAddress
 		return ret
 	}
-	return *o.AddressType
+	return o.Addresses
 }
 
-// GetAddressTypeOk returns a tuple with the AddressType field value if set, nil otherwise
+// GetAddressesOk returns a tuple with the Addresses field value if set, nil otherwise
 // and a boolean to check if the value has been set.
-func (o *IdentityCredentialsCode) GetAddressTypeOk() (*string, bool) {
-	if o == nil || o.AddressType == nil {
+func (o *IdentityCredentialsCode) GetAddressesOk() ([]IdentityCredentialsCodeAddress, bool) {
+	if o == nil || o.Addresses == nil {
 		return nil, false
 	}
-	return o.AddressType, true
+	return o.Addresses, true
 }
 
-// HasAddressType returns a boolean if a field has been set.
-func (o *IdentityCredentialsCode) HasAddressType() bool {
-	if o != nil && o.AddressType != nil {
+// HasAddresses returns a boolean if a field has been set.
+func (o *IdentityCredentialsCode) HasAddresses() bool {
+	if o != nil && o.Addresses != nil {
 		return true
 	}
 
 	return false
 }
 
-// SetAddressType gets a reference to the given string and assigns it to the AddressType field.
-func (o *IdentityCredentialsCode) SetAddressType(v string) {
-	o.AddressType = &v
-}
-
-// GetUsedAt returns the UsedAt field value if set, zero value otherwise (both if not set or set to explicit null).
-func (o *IdentityCredentialsCode) GetUsedAt() time.Time {
-	if o == nil || o.UsedAt.Get() == nil {
-		var ret time.Time
-		return ret
-	}
-	return *o.UsedAt.Get()
-}
-
-// GetUsedAtOk returns a tuple with the UsedAt field value if set, nil otherwise
-// and a boolean to check if the value has been set.
-// NOTE: If the value is an explicit nil, `nil, true` will be returned
-func (o *IdentityCredentialsCode) GetUsedAtOk() (*time.Time, bool) {
-	if o == nil {
-		return nil, false
-	}
-	return o.UsedAt.Get(), o.UsedAt.IsSet()
-}
-
-// HasUsedAt returns a boolean if a field has been set.
-func (o *IdentityCredentialsCode) HasUsedAt() bool {
-	if o != nil && o.UsedAt.IsSet() {
-		return true
-	}
-
-	return false
-}
-
-// SetUsedAt gets a reference to the given NullableTime and assigns it to the UsedAt field.
-func (o *IdentityCredentialsCode) SetUsedAt(v time.Time) {
-	o.UsedAt.Set(&v)
-}
-
-// SetUsedAtNil sets the value for UsedAt to be an explicit nil
-func (o *IdentityCredentialsCode) SetUsedAtNil() {
-	o.UsedAt.Set(nil)
-}
-
-// UnsetUsedAt ensures that no value is present for UsedAt, not even an explicit nil
-func (o *IdentityCredentialsCode) UnsetUsedAt() {
-	o.UsedAt.Unset()
+// SetAddresses gets a reference to the given []IdentityCredentialsCodeAddress and assigns it to the Addresses field.
+func (o *IdentityCredentialsCode) SetAddresses(v []IdentityCredentialsCodeAddress) {
+	o.Addresses = v
 }
 
 func (o IdentityCredentialsCode) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
-	if o.AddressType != nil {
-		toSerialize["address_type"] = o.AddressType
-	}
-	if o.UsedAt.IsSet() {
-		toSerialize["used_at"] = o.UsedAt.Get()
+	if o.Addresses != nil {
+		toSerialize["addresses"] = o.Addresses
 	}
 	return json.Marshal(toSerialize)
 }
diff --git a/internal/client-go/model_identity_credentials_code_address.go b/internal/client-go/model_identity_credentials_code_address.go
new file mode 100644
index 000000000000..c739045e79e0
--- /dev/null
+++ b/internal/client-go/model_identity_credentials_code_address.go
@@ -0,0 +1,151 @@
+/*
+ * Ory Identities API
+ *
+ * This is the API specification for Ory Identities with features such as registration, login, recovery, account verification, profile settings, password reset, identity management, session management, email and sms delivery, and more.
+ *
+ * API version:
+ * Contact: office@ory.sh
+ */
+
+// Code generated by OpenAPI Generator (https://openapi-generator.tech); DO NOT EDIT.
+
+package client
+
+import (
+	"encoding/json"
+)
+
+// IdentityCredentialsCodeAddress struct for IdentityCredentialsCodeAddress
+type IdentityCredentialsCodeAddress struct {
+	// The address for this code
+	Address *string `json:"address,omitempty"`
+	Channel *string `json:"channel,omitempty"`
+}
+
+// NewIdentityCredentialsCodeAddress instantiates a new IdentityCredentialsCodeAddress object
+// This constructor will assign default values to properties that have it defined,
+// and makes sure properties required by API are set, but the set of arguments
+// will change when the set of required properties is changed
+func NewIdentityCredentialsCodeAddress() *IdentityCredentialsCodeAddress {
+	this := IdentityCredentialsCodeAddress{}
+	return &this
+}
+
+// NewIdentityCredentialsCodeAddressWithDefaults instantiates a new IdentityCredentialsCodeAddress object
+// This constructor will only assign default values to properties that have it defined,
+// but it doesn't guarantee that properties required by API are set
+func NewIdentityCredentialsCodeAddressWithDefaults() *IdentityCredentialsCodeAddress {
+	this := IdentityCredentialsCodeAddress{}
+	return &this
+}
+
+// GetAddress returns the Address field value if set, zero value otherwise.
+func (o *IdentityCredentialsCodeAddress) GetAddress() string {
+	if o == nil || o.Address == nil {
+		var ret string
+		return ret
+	}
+	return *o.Address
+}
+
+// GetAddressOk returns a tuple with the Address field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *IdentityCredentialsCodeAddress) GetAddressOk() (*string, bool) {
+	if o == nil || o.Address == nil {
+		return nil, false
+	}
+	return o.Address, true
+}
+
+// HasAddress returns a boolean if a field has been set.
+func (o *IdentityCredentialsCodeAddress) HasAddress() bool {
+	if o != nil && o.Address != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetAddress gets a reference to the given string and assigns it to the Address field.
+func (o *IdentityCredentialsCodeAddress) SetAddress(v string) {
+	o.Address = &v
+}
+
+// GetChannel returns the Channel field value if set, zero value otherwise.
+func (o *IdentityCredentialsCodeAddress) GetChannel() string {
+	if o == nil || o.Channel == nil {
+		var ret string
+		return ret
+	}
+	return *o.Channel
+}
+
+// GetChannelOk returns a tuple with the Channel field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *IdentityCredentialsCodeAddress) GetChannelOk() (*string, bool) {
+	if o == nil || o.Channel == nil {
+		return nil, false
+	}
+	return o.Channel, true
+}
+
+// HasChannel returns a boolean if a field has been set.
+func (o *IdentityCredentialsCodeAddress) HasChannel() bool {
+	if o != nil && o.Channel != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetChannel gets a reference to the given string and assigns it to the Channel field.
+func (o *IdentityCredentialsCodeAddress) SetChannel(v string) {
+	o.Channel = &v
+}
+
+func (o IdentityCredentialsCodeAddress) MarshalJSON() ([]byte, error) {
+	toSerialize := map[string]interface{}{}
+	if o.Address != nil {
+		toSerialize["address"] = o.Address
+	}
+	if o.Channel != nil {
+		toSerialize["channel"] = o.Channel
+	}
+	return json.Marshal(toSerialize)
+}
+
+type NullableIdentityCredentialsCodeAddress struct {
+	value *IdentityCredentialsCodeAddress
+	isSet bool
+}
+
+func (v NullableIdentityCredentialsCodeAddress) Get() *IdentityCredentialsCodeAddress {
+	return v.value
+}
+
+func (v *NullableIdentityCredentialsCodeAddress) Set(val *IdentityCredentialsCodeAddress) {
+	v.value = val
+	v.isSet = true
+}
+
+func (v NullableIdentityCredentialsCodeAddress) IsSet() bool {
+	return v.isSet
+}
+
+func (v *NullableIdentityCredentialsCodeAddress) Unset() {
+	v.value = nil
+	v.isSet = false
+}
+
+func NewNullableIdentityCredentialsCodeAddress(val *IdentityCredentialsCodeAddress) *NullableIdentityCredentialsCodeAddress {
+	return &NullableIdentityCredentialsCodeAddress{value: val, isSet: true}
+}
+
+func (v NullableIdentityCredentialsCodeAddress) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.value)
+}
+
+func (v *NullableIdentityCredentialsCodeAddress) UnmarshalJSON(src []byte) error {
+	v.isSet = true
+	return json.Unmarshal(src, &v.value)
+}
diff --git a/internal/client-go/model_identity_credentials_password.go b/internal/client-go/model_identity_credentials_password.go
index 85f942fb6852..df1900568bb3 100644
--- a/internal/client-go/model_identity_credentials_password.go
+++ b/internal/client-go/model_identity_credentials_password.go
@@ -19,6 +19,8 @@ import (
 type IdentityCredentialsPassword struct {
 	// HashedPassword is a hash-representation of the password.
 	HashedPassword *string `json:"hashed_password,omitempty"`
+	// UsePasswordMigrationHook is set to true if the password should be migrated using the password migration hook. If set, and the HashedPassword is empty, a webhook will be called during login to migrate the password.
+	UsePasswordMigrationHook *bool `json:"use_password_migration_hook,omitempty"`
 }
 
 // NewIdentityCredentialsPassword instantiates a new IdentityCredentialsPassword object
@@ -70,11 +72,46 @@ func (o *IdentityCredentialsPassword) SetHashedPassword(v string) {
 	o.HashedPassword = &v
 }
 
+// GetUsePasswordMigrationHook returns the UsePasswordMigrationHook field value if set, zero value otherwise.
+func (o *IdentityCredentialsPassword) GetUsePasswordMigrationHook() bool {
+	if o == nil || o.UsePasswordMigrationHook == nil {
+		var ret bool
+		return ret
+	}
+	return *o.UsePasswordMigrationHook
+}
+
+// GetUsePasswordMigrationHookOk returns a tuple with the UsePasswordMigrationHook field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *IdentityCredentialsPassword) GetUsePasswordMigrationHookOk() (*bool, bool) {
+	if o == nil || o.UsePasswordMigrationHook == nil {
+		return nil, false
+	}
+	return o.UsePasswordMigrationHook, true
+}
+
+// HasUsePasswordMigrationHook returns a boolean if a field has been set.
+func (o *IdentityCredentialsPassword) HasUsePasswordMigrationHook() bool {
+	if o != nil && o.UsePasswordMigrationHook != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetUsePasswordMigrationHook gets a reference to the given bool and assigns it to the UsePasswordMigrationHook field.
+func (o *IdentityCredentialsPassword) SetUsePasswordMigrationHook(v bool) {
+	o.UsePasswordMigrationHook = &v
+}
+
 func (o IdentityCredentialsPassword) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
 	if o.HashedPassword != nil {
 		toSerialize["hashed_password"] = o.HashedPassword
 	}
+	if o.UsePasswordMigrationHook != nil {
+		toSerialize["use_password_migration_hook"] = o.UsePasswordMigrationHook
+	}
 	return json.Marshal(toSerialize)
 }
 
diff --git a/internal/client-go/model_identity_patch_response.go b/internal/client-go/model_identity_patch_response.go
index 2ee305f7da81..f67224edad01 100644
--- a/internal/client-go/model_identity_patch_response.go
+++ b/internal/client-go/model_identity_patch_response.go
@@ -17,8 +17,9 @@ import (
 
 // IdentityPatchResponse Response for a single identity patch
 type IdentityPatchResponse struct {
-	// The action for this specific patch create ActionCreate  Create this identity.
-	Action *string `json:"action,omitempty"`
+	// The action for this specific patch create ActionCreate  Create this identity. error ActionError  Error indicates that the patch failed.
+	Action *string     `json:"action,omitempty"`
+	Error  interface{} `json:"error,omitempty"`
 	// The identity ID payload of this patch
 	Identity *string `json:"identity,omitempty"`
 	// The ID of this patch response, if an ID was specified in the patch.
@@ -74,6 +75,39 @@ func (o *IdentityPatchResponse) SetAction(v string) {
 	o.Action = &v
 }
 
+// GetError returns the Error field value if set, zero value otherwise (both if not set or set to explicit null).
+func (o *IdentityPatchResponse) GetError() interface{} {
+	if o == nil {
+		var ret interface{}
+		return ret
+	}
+	return o.Error
+}
+
+// GetErrorOk returns a tuple with the Error field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+// NOTE: If the value is an explicit nil, `nil, true` will be returned
+func (o *IdentityPatchResponse) GetErrorOk() (*interface{}, bool) {
+	if o == nil || o.Error == nil {
+		return nil, false
+	}
+	return &o.Error, true
+}
+
+// HasError returns a boolean if a field has been set.
+func (o *IdentityPatchResponse) HasError() bool {
+	if o != nil && o.Error != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetError gets a reference to the given interface{} and assigns it to the Error field.
+func (o *IdentityPatchResponse) SetError(v interface{}) {
+	o.Error = v
+}
+
 // GetIdentity returns the Identity field value if set, zero value otherwise.
 func (o *IdentityPatchResponse) GetIdentity() string {
 	if o == nil || o.Identity == nil {
@@ -143,6 +177,9 @@ func (o IdentityPatchResponse) MarshalJSON() ([]byte, error) {
 	if o.Action != nil {
 		toSerialize["action"] = o.Action
 	}
+	if o.Error != nil {
+		toSerialize["error"] = o.Error
+	}
 	if o.Identity != nil {
 		toSerialize["identity"] = o.Identity
 	}
diff --git a/internal/client-go/model_identity_with_credentials_password_config.go b/internal/client-go/model_identity_with_credentials_password_config.go
index 754d59460f83..34f09ae58232 100644
--- a/internal/client-go/model_identity_with_credentials_password_config.go
+++ b/internal/client-go/model_identity_with_credentials_password_config.go
@@ -21,6 +21,8 @@ type IdentityWithCredentialsPasswordConfig struct {
 	HashedPassword *string `json:"hashed_password,omitempty"`
 	// The password in plain text if no hash is available.
 	Password *string `json:"password,omitempty"`
+	// If set to true, the password will be migrated using the password migration hook.
+	UsePasswordMigrationHook *bool `json:"use_password_migration_hook,omitempty"`
 }
 
 // NewIdentityWithCredentialsPasswordConfig instantiates a new IdentityWithCredentialsPasswordConfig object
@@ -104,6 +106,38 @@ func (o *IdentityWithCredentialsPasswordConfig) SetPassword(v string) {
 	o.Password = &v
 }
 
+// GetUsePasswordMigrationHook returns the UsePasswordMigrationHook field value if set, zero value otherwise.
+func (o *IdentityWithCredentialsPasswordConfig) GetUsePasswordMigrationHook() bool {
+	if o == nil || o.UsePasswordMigrationHook == nil {
+		var ret bool
+		return ret
+	}
+	return *o.UsePasswordMigrationHook
+}
+
+// GetUsePasswordMigrationHookOk returns a tuple with the UsePasswordMigrationHook field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *IdentityWithCredentialsPasswordConfig) GetUsePasswordMigrationHookOk() (*bool, bool) {
+	if o == nil || o.UsePasswordMigrationHook == nil {
+		return nil, false
+	}
+	return o.UsePasswordMigrationHook, true
+}
+
+// HasUsePasswordMigrationHook returns a boolean if a field has been set.
+func (o *IdentityWithCredentialsPasswordConfig) HasUsePasswordMigrationHook() bool {
+	if o != nil && o.UsePasswordMigrationHook != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetUsePasswordMigrationHook gets a reference to the given bool and assigns it to the UsePasswordMigrationHook field.
+func (o *IdentityWithCredentialsPasswordConfig) SetUsePasswordMigrationHook(v bool) {
+	o.UsePasswordMigrationHook = &v
+}
+
 func (o IdentityWithCredentialsPasswordConfig) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
 	if o.HashedPassword != nil {
@@ -112,6 +146,9 @@ func (o IdentityWithCredentialsPasswordConfig) MarshalJSON() ([]byte, error) {
 	if o.Password != nil {
 		toSerialize["password"] = o.Password
 	}
+	if o.UsePasswordMigrationHook != nil {
+		toSerialize["use_password_migration_hook"] = o.UsePasswordMigrationHook
+	}
 	return json.Marshal(toSerialize)
 }
 
diff --git a/internal/client-go/model_login_flow.go b/internal/client-go/model_login_flow.go
index 2794adee0b83..5fc35379ea48 100644
--- a/internal/client-go/model_login_flow.go
+++ b/internal/client-go/model_login_flow.go
@@ -18,7 +18,7 @@ import (
 
 // LoginFlow This object represents a login flow. A login flow is initiated at the \"Initiate Login API / Browser Flow\" endpoint by a client.  Once a login flow is completed successfully, a session cookie or session token will be issued.
 type LoginFlow struct {
-	// The active login method  If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+	// The active login method  If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
 	Active *string `json:"active,omitempty"`
 	// CreatedAt is a helper struct field for gobuffalo.pop.
 	CreatedAt *time.Time `json:"created_at,omitempty"`
diff --git a/internal/client-go/model_login_flow_state.go b/internal/client-go/model_login_flow_state.go
index ce5570b79032..58af057c612f 100644
--- a/internal/client-go/model_login_flow_state.go
+++ b/internal/client-go/model_login_flow_state.go
@@ -16,7 +16,7 @@ import (
 	"fmt"
 )
 
-// LoginFlowState The state represents the state of the login flow.  choose_method: ask the user to choose a method (e.g. login account via email) sent_email: the email has been sent to the user passed_challenge: the request was successful and the login challenge was passed.
+// LoginFlowState The experimental state represents the state of a login flow. This field is EXPERIMENTAL and subject to change!
 type LoginFlowState string
 
 // List of loginFlowState
diff --git a/internal/client-go/model_recovery_flow_state.go b/internal/client-go/model_recovery_flow_state.go
index 1c660ba043b9..d1fa3618882a 100644
--- a/internal/client-go/model_recovery_flow_state.go
+++ b/internal/client-go/model_recovery_flow_state.go
@@ -16,7 +16,7 @@ import (
 	"fmt"
 )
 
-// RecoveryFlowState The state represents the state of the recovery flow.  choose_method: ask the user to choose a method (e.g. recover account via email) sent_email: the email has been sent to the user passed_challenge: the request was successful and the recovery challenge was passed.
+// RecoveryFlowState The experimental state represents the state of a recovery flow. This field is EXPERIMENTAL and subject to change!
 type RecoveryFlowState string
 
 // List of recoveryFlowState
diff --git a/internal/client-go/model_registration_flow.go b/internal/client-go/model_registration_flow.go
index c0ba64843d3f..4eb2d78f6052 100644
--- a/internal/client-go/model_registration_flow.go
+++ b/internal/client-go/model_registration_flow.go
@@ -18,7 +18,7 @@ import (
 
 // RegistrationFlow struct for RegistrationFlow
 type RegistrationFlow struct {
-	// Active, if set, contains the registration method that is being used. It is initially not set. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+	// Active, if set, contains the registration method that is being used. It is initially not set. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
 	Active *string `json:"active,omitempty"`
 	// ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated.
 	ExpiresAt time.Time `json:"expires_at"`
diff --git a/internal/client-go/model_registration_flow_state.go b/internal/client-go/model_registration_flow_state.go
index 86f3fd38cff0..15fd9f532d4b 100644
--- a/internal/client-go/model_registration_flow_state.go
+++ b/internal/client-go/model_registration_flow_state.go
@@ -16,7 +16,7 @@ import (
 	"fmt"
 )
 
-// RegistrationFlowState choose_method: ask the user to choose a method (e.g. registration with email) sent_email: the email has been sent to the user passed_challenge: the request was successful and the registration challenge was passed.
+// RegistrationFlowState The experimental state represents the state of a registration flow. This field is EXPERIMENTAL and subject to change!
 type RegistrationFlowState string
 
 // List of registrationFlowState
diff --git a/internal/client-go/model_settings_flow_state.go b/internal/client-go/model_settings_flow_state.go
index f994c786a2d8..70093c9c4a03 100644
--- a/internal/client-go/model_settings_flow_state.go
+++ b/internal/client-go/model_settings_flow_state.go
@@ -16,7 +16,7 @@ import (
 	"fmt"
 )
 
-// SettingsFlowState show_form: No user data has been collected, or it is invalid, and thus the form should be shown. success: Indicates that the settings flow has been updated successfully with the provided data. Done will stay true when repeatedly checking. If set to true, done will revert back to false only when a flow with invalid (e.g. \"please use a valid phone number\") data was sent.
+// SettingsFlowState The experimental state represents the state of a settings flow. This field is EXPERIMENTAL and subject to change!
 type SettingsFlowState string
 
 // List of settingsFlowState
diff --git a/internal/client-go/model_ui_node.go b/internal/client-go/model_ui_node.go
index e73f3c5e37d8..3582d9e85f67 100644
--- a/internal/client-go/model_ui_node.go
+++ b/internal/client-go/model_ui_node.go
@@ -18,7 +18,7 @@ import (
 // UiNode Nodes are represented as HTML elements or their native UI equivalents. For example, a node can be an `<img>` tag, or an `<input element>` but also `some plain text`.
 type UiNode struct {
 	Attributes UiNodeAttributes `json:"attributes"`
-	// Group specifies which group (e.g. password authenticator) this node belongs to. default DefaultGroup password PasswordGroup oidc OpenIDConnectGroup profile ProfileGroup link LinkGroup code CodeGroup totp TOTPGroup lookup_secret LookupGroup webauthn WebAuthnGroup passkey PasskeyGroup
+	// Group specifies which group (e.g. password authenticator) this node belongs to. default DefaultGroup password PasswordGroup oidc OpenIDConnectGroup profile ProfileGroup link LinkGroup code CodeGroup totp TOTPGroup lookup_secret LookupGroup webauthn WebAuthnGroup passkey PasskeyGroup identifier_first IdentifierFirstGroup
 	Group    string     `json:"group"`
 	Messages []UiText   `json:"messages"`
 	Meta     UiNodeMeta `json:"meta"`
diff --git a/internal/client-go/model_ui_node_input_attributes.go b/internal/client-go/model_ui_node_input_attributes.go
index b373dda7ccfd..f8deff5d5417 100644
--- a/internal/client-go/model_ui_node_input_attributes.go
+++ b/internal/client-go/model_ui_node_input_attributes.go
@@ -22,14 +22,20 @@ type UiNodeInputAttributes struct {
 	// Sets the input's disabled field to true or false.
 	Disabled bool    `json:"disabled"`
 	Label    *UiText `json:"label,omitempty"`
+	// MaxLength may contain the input's maximum length.
+	Maxlength *int64 `json:"maxlength,omitempty"`
 	// The input's element name.
 	Name string `json:"name"`
 	// NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0.  In this struct it technically always is \"input\". text Text input Input img Image a Anchor script Script
 	NodeType string `json:"node_type"`
-	// OnClick may contain javascript which should be executed on click. This is primarily used for WebAuthn.
+	// OnClick may contain javascript which should be executed on click. This is primarily used for WebAuthn.  Deprecated: Using OnClick requires the use of eval() which is a security risk. Use OnClickTrigger instead.
 	Onclick *string `json:"onclick,omitempty"`
-	// OnLoad may contain javascript which should be executed on load. This is primarily used for WebAuthn.
+	// OnClickTrigger may contain a WebAuthn trigger which should be executed on click.  The trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login. oryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration oryWebAuthnLogin WebAuthnTriggersWebAuthnLogin oryPasskeyLogin WebAuthnTriggersPasskeyLogin oryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit oryPasskeyRegistration WebAuthnTriggersPasskeyRegistration oryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration
+	OnclickTrigger *string `json:"onclickTrigger,omitempty"`
+	// OnLoad may contain javascript which should be executed on load. This is primarily used for WebAuthn.  Deprecated: Using OnLoad requires the use of eval() which is a security risk. Use OnLoadTrigger instead.
 	Onload *string `json:"onload,omitempty"`
+	// OnLoadTrigger may contain a WebAuthn trigger which should be executed on load.  The trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login. oryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration oryWebAuthnLogin WebAuthnTriggersWebAuthnLogin oryPasskeyLogin WebAuthnTriggersPasskeyLogin oryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit oryPasskeyRegistration WebAuthnTriggersPasskeyRegistration oryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration
+	OnloadTrigger *string `json:"onloadTrigger,omitempty"`
 	// The input's pattern.
 	Pattern *string `json:"pattern,omitempty"`
 	// Mark this input field as required.
@@ -149,6 +155,38 @@ func (o *UiNodeInputAttributes) SetLabel(v UiText) {
 	o.Label = &v
 }
 
+// GetMaxlength returns the Maxlength field value if set, zero value otherwise.
+func (o *UiNodeInputAttributes) GetMaxlength() int64 {
+	if o == nil || o.Maxlength == nil {
+		var ret int64
+		return ret
+	}
+	return *o.Maxlength
+}
+
+// GetMaxlengthOk returns a tuple with the Maxlength field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UiNodeInputAttributes) GetMaxlengthOk() (*int64, bool) {
+	if o == nil || o.Maxlength == nil {
+		return nil, false
+	}
+	return o.Maxlength, true
+}
+
+// HasMaxlength returns a boolean if a field has been set.
+func (o *UiNodeInputAttributes) HasMaxlength() bool {
+	if o != nil && o.Maxlength != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetMaxlength gets a reference to the given int64 and assigns it to the Maxlength field.
+func (o *UiNodeInputAttributes) SetMaxlength(v int64) {
+	o.Maxlength = &v
+}
+
 // GetName returns the Name field value
 func (o *UiNodeInputAttributes) GetName() string {
 	if o == nil {
@@ -229,6 +267,38 @@ func (o *UiNodeInputAttributes) SetOnclick(v string) {
 	o.Onclick = &v
 }
 
+// GetOnclickTrigger returns the OnclickTrigger field value if set, zero value otherwise.
+func (o *UiNodeInputAttributes) GetOnclickTrigger() string {
+	if o == nil || o.OnclickTrigger == nil {
+		var ret string
+		return ret
+	}
+	return *o.OnclickTrigger
+}
+
+// GetOnclickTriggerOk returns a tuple with the OnclickTrigger field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UiNodeInputAttributes) GetOnclickTriggerOk() (*string, bool) {
+	if o == nil || o.OnclickTrigger == nil {
+		return nil, false
+	}
+	return o.OnclickTrigger, true
+}
+
+// HasOnclickTrigger returns a boolean if a field has been set.
+func (o *UiNodeInputAttributes) HasOnclickTrigger() bool {
+	if o != nil && o.OnclickTrigger != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetOnclickTrigger gets a reference to the given string and assigns it to the OnclickTrigger field.
+func (o *UiNodeInputAttributes) SetOnclickTrigger(v string) {
+	o.OnclickTrigger = &v
+}
+
 // GetOnload returns the Onload field value if set, zero value otherwise.
 func (o *UiNodeInputAttributes) GetOnload() string {
 	if o == nil || o.Onload == nil {
@@ -261,6 +331,38 @@ func (o *UiNodeInputAttributes) SetOnload(v string) {
 	o.Onload = &v
 }
 
+// GetOnloadTrigger returns the OnloadTrigger field value if set, zero value otherwise.
+func (o *UiNodeInputAttributes) GetOnloadTrigger() string {
+	if o == nil || o.OnloadTrigger == nil {
+		var ret string
+		return ret
+	}
+	return *o.OnloadTrigger
+}
+
+// GetOnloadTriggerOk returns a tuple with the OnloadTrigger field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UiNodeInputAttributes) GetOnloadTriggerOk() (*string, bool) {
+	if o == nil || o.OnloadTrigger == nil {
+		return nil, false
+	}
+	return o.OnloadTrigger, true
+}
+
+// HasOnloadTrigger returns a boolean if a field has been set.
+func (o *UiNodeInputAttributes) HasOnloadTrigger() bool {
+	if o != nil && o.OnloadTrigger != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetOnloadTrigger gets a reference to the given string and assigns it to the OnloadTrigger field.
+func (o *UiNodeInputAttributes) SetOnloadTrigger(v string) {
+	o.OnloadTrigger = &v
+}
+
 // GetPattern returns the Pattern field value if set, zero value otherwise.
 func (o *UiNodeInputAttributes) GetPattern() string {
 	if o == nil || o.Pattern == nil {
@@ -393,6 +495,9 @@ func (o UiNodeInputAttributes) MarshalJSON() ([]byte, error) {
 	if o.Label != nil {
 		toSerialize["label"] = o.Label
 	}
+	if o.Maxlength != nil {
+		toSerialize["maxlength"] = o.Maxlength
+	}
 	if true {
 		toSerialize["name"] = o.Name
 	}
@@ -402,9 +507,15 @@ func (o UiNodeInputAttributes) MarshalJSON() ([]byte, error) {
 	if o.Onclick != nil {
 		toSerialize["onclick"] = o.Onclick
 	}
+	if o.OnclickTrigger != nil {
+		toSerialize["onclickTrigger"] = o.OnclickTrigger
+	}
 	if o.Onload != nil {
 		toSerialize["onload"] = o.Onload
 	}
+	if o.OnloadTrigger != nil {
+		toSerialize["onloadTrigger"] = o.OnloadTrigger
+	}
 	if o.Pattern != nil {
 		toSerialize["pattern"] = o.Pattern
 	}
diff --git a/internal/client-go/model_update_login_flow_body.go b/internal/client-go/model_update_login_flow_body.go
index b8bb05734e3c..f0d79322c54f 100644
--- a/internal/client-go/model_update_login_flow_body.go
+++ b/internal/client-go/model_update_login_flow_body.go
@@ -18,13 +18,14 @@ import (
 
 // UpdateLoginFlowBody - struct for UpdateLoginFlowBody
 type UpdateLoginFlowBody struct {
-	UpdateLoginFlowWithCodeMethod         *UpdateLoginFlowWithCodeMethod
-	UpdateLoginFlowWithLookupSecretMethod *UpdateLoginFlowWithLookupSecretMethod
-	UpdateLoginFlowWithOidcMethod         *UpdateLoginFlowWithOidcMethod
-	UpdateLoginFlowWithPasskeyMethod      *UpdateLoginFlowWithPasskeyMethod
-	UpdateLoginFlowWithPasswordMethod     *UpdateLoginFlowWithPasswordMethod
-	UpdateLoginFlowWithTotpMethod         *UpdateLoginFlowWithTotpMethod
-	UpdateLoginFlowWithWebAuthnMethod     *UpdateLoginFlowWithWebAuthnMethod
+	UpdateLoginFlowWithCodeMethod            *UpdateLoginFlowWithCodeMethod
+	UpdateLoginFlowWithIdentifierFirstMethod *UpdateLoginFlowWithIdentifierFirstMethod
+	UpdateLoginFlowWithLookupSecretMethod    *UpdateLoginFlowWithLookupSecretMethod
+	UpdateLoginFlowWithOidcMethod            *UpdateLoginFlowWithOidcMethod
+	UpdateLoginFlowWithPasskeyMethod         *UpdateLoginFlowWithPasskeyMethod
+	UpdateLoginFlowWithPasswordMethod        *UpdateLoginFlowWithPasswordMethod
+	UpdateLoginFlowWithTotpMethod            *UpdateLoginFlowWithTotpMethod
+	UpdateLoginFlowWithWebAuthnMethod        *UpdateLoginFlowWithWebAuthnMethod
 }
 
 // UpdateLoginFlowWithCodeMethodAsUpdateLoginFlowBody is a convenience function that returns UpdateLoginFlowWithCodeMethod wrapped in UpdateLoginFlowBody
@@ -34,6 +35,13 @@ func UpdateLoginFlowWithCodeMethodAsUpdateLoginFlowBody(v *UpdateLoginFlowWithCo
 	}
 }
 
+// UpdateLoginFlowWithIdentifierFirstMethodAsUpdateLoginFlowBody is a convenience function that returns UpdateLoginFlowWithIdentifierFirstMethod wrapped in UpdateLoginFlowBody
+func UpdateLoginFlowWithIdentifierFirstMethodAsUpdateLoginFlowBody(v *UpdateLoginFlowWithIdentifierFirstMethod) UpdateLoginFlowBody {
+	return UpdateLoginFlowBody{
+		UpdateLoginFlowWithIdentifierFirstMethod: v,
+	}
+}
+
 // UpdateLoginFlowWithLookupSecretMethodAsUpdateLoginFlowBody is a convenience function that returns UpdateLoginFlowWithLookupSecretMethod wrapped in UpdateLoginFlowBody
 func UpdateLoginFlowWithLookupSecretMethodAsUpdateLoginFlowBody(v *UpdateLoginFlowWithLookupSecretMethod) UpdateLoginFlowBody {
 	return UpdateLoginFlowBody{
@@ -98,6 +106,18 @@ func (dst *UpdateLoginFlowBody) UnmarshalJSON(data []byte) error {
 		}
 	}
 
+	// check if the discriminator value is 'identifier_first'
+	if jsonDict["method"] == "identifier_first" {
+		// try to unmarshal JSON data into UpdateLoginFlowWithIdentifierFirstMethod
+		err = json.Unmarshal(data, &dst.UpdateLoginFlowWithIdentifierFirstMethod)
+		if err == nil {
+			return nil // data stored in dst.UpdateLoginFlowWithIdentifierFirstMethod, return on the first match
+		} else {
+			dst.UpdateLoginFlowWithIdentifierFirstMethod = nil
+			return fmt.Errorf("Failed to unmarshal UpdateLoginFlowBody as UpdateLoginFlowWithIdentifierFirstMethod: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'lookup_secret'
 	if jsonDict["method"] == "lookup_secret" {
 		// try to unmarshal JSON data into UpdateLoginFlowWithLookupSecretMethod
@@ -182,6 +202,18 @@ func (dst *UpdateLoginFlowBody) UnmarshalJSON(data []byte) error {
 		}
 	}
 
+	// check if the discriminator value is 'updateLoginFlowWithIdentifierFirstMethod'
+	if jsonDict["method"] == "updateLoginFlowWithIdentifierFirstMethod" {
+		// try to unmarshal JSON data into UpdateLoginFlowWithIdentifierFirstMethod
+		err = json.Unmarshal(data, &dst.UpdateLoginFlowWithIdentifierFirstMethod)
+		if err == nil {
+			return nil // data stored in dst.UpdateLoginFlowWithIdentifierFirstMethod, return on the first match
+		} else {
+			dst.UpdateLoginFlowWithIdentifierFirstMethod = nil
+			return fmt.Errorf("Failed to unmarshal UpdateLoginFlowBody as UpdateLoginFlowWithIdentifierFirstMethod: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'updateLoginFlowWithLookupSecretMethod'
 	if jsonDict["method"] == "updateLoginFlowWithLookupSecretMethod" {
 		// try to unmarshal JSON data into UpdateLoginFlowWithLookupSecretMethod
@@ -263,6 +295,10 @@ func (src UpdateLoginFlowBody) MarshalJSON() ([]byte, error) {
 		return json.Marshal(&src.UpdateLoginFlowWithCodeMethod)
 	}
 
+	if src.UpdateLoginFlowWithIdentifierFirstMethod != nil {
+		return json.Marshal(&src.UpdateLoginFlowWithIdentifierFirstMethod)
+	}
+
 	if src.UpdateLoginFlowWithLookupSecretMethod != nil {
 		return json.Marshal(&src.UpdateLoginFlowWithLookupSecretMethod)
 	}
@@ -299,6 +335,10 @@ func (obj *UpdateLoginFlowBody) GetActualInstance() interface{} {
 		return obj.UpdateLoginFlowWithCodeMethod
 	}
 
+	if obj.UpdateLoginFlowWithIdentifierFirstMethod != nil {
+		return obj.UpdateLoginFlowWithIdentifierFirstMethod
+	}
+
 	if obj.UpdateLoginFlowWithLookupSecretMethod != nil {
 		return obj.UpdateLoginFlowWithLookupSecretMethod
 	}
diff --git a/internal/client-go/model_update_login_flow_with_code_method.go b/internal/client-go/model_update_login_flow_with_code_method.go
index 5833200a3ce9..06272618da90 100644
--- a/internal/client-go/model_update_login_flow_with_code_method.go
+++ b/internal/client-go/model_update_login_flow_with_code_method.go
@@ -17,6 +17,8 @@ import (
 
 // UpdateLoginFlowWithCodeMethod Update Login flow using the code method
 type UpdateLoginFlowWithCodeMethod struct {
+	// Address is the address to send the code to, in case that there are multiple addresses. This field is only used in two-factor flows and is ineffective for passwordless flows.
+	Address *string `json:"address,omitempty"`
 	// Code is the 6 digits code sent to the user
 	Code *string `json:"code,omitempty"`
 	// CSRFToken is the anti-CSRF token
@@ -50,6 +52,38 @@ func NewUpdateLoginFlowWithCodeMethodWithDefaults() *UpdateLoginFlowWithCodeMeth
 	return &this
 }
 
+// GetAddress returns the Address field value if set, zero value otherwise.
+func (o *UpdateLoginFlowWithCodeMethod) GetAddress() string {
+	if o == nil || o.Address == nil {
+		var ret string
+		return ret
+	}
+	return *o.Address
+}
+
+// GetAddressOk returns a tuple with the Address field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UpdateLoginFlowWithCodeMethod) GetAddressOk() (*string, bool) {
+	if o == nil || o.Address == nil {
+		return nil, false
+	}
+	return o.Address, true
+}
+
+// HasAddress returns a boolean if a field has been set.
+func (o *UpdateLoginFlowWithCodeMethod) HasAddress() bool {
+	if o != nil && o.Address != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetAddress gets a reference to the given string and assigns it to the Address field.
+func (o *UpdateLoginFlowWithCodeMethod) SetAddress(v string) {
+	o.Address = &v
+}
+
 // GetCode returns the Code field value if set, zero value otherwise.
 func (o *UpdateLoginFlowWithCodeMethod) GetCode() string {
 	if o == nil || o.Code == nil {
@@ -228,6 +262,9 @@ func (o *UpdateLoginFlowWithCodeMethod) SetTransientPayload(v map[string]interfa
 
 func (o UpdateLoginFlowWithCodeMethod) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
+	if o.Address != nil {
+		toSerialize["address"] = o.Address
+	}
 	if o.Code != nil {
 		toSerialize["code"] = o.Code
 	}
diff --git a/internal/client-go/model_update_login_flow_with_identifier_first_method.go b/internal/client-go/model_update_login_flow_with_identifier_first_method.go
new file mode 100644
index 000000000000..70cf8002990d
--- /dev/null
+++ b/internal/client-go/model_update_login_flow_with_identifier_first_method.go
@@ -0,0 +1,212 @@
+/*
+ * Ory Identities API
+ *
+ * This is the API specification for Ory Identities with features such as registration, login, recovery, account verification, profile settings, password reset, identity management, session management, email and sms delivery, and more.
+ *
+ * API version:
+ * Contact: office@ory.sh
+ */
+
+// Code generated by OpenAPI Generator (https://openapi-generator.tech); DO NOT EDIT.
+
+package client
+
+import (
+	"encoding/json"
+)
+
+// UpdateLoginFlowWithIdentifierFirstMethod Update Login Flow with Multi-Step Method
+type UpdateLoginFlowWithIdentifierFirstMethod struct {
+	// Sending the anti-csrf token is only required for browser login flows.
+	CsrfToken *string `json:"csrf_token,omitempty"`
+	// Identifier is the email or username of the user trying to log in.
+	Identifier string `json:"identifier"`
+	// Method should be set to \"password\" when logging in using the identifier and password strategy.
+	Method string `json:"method"`
+	// Transient data to pass along to any webhooks
+	TransientPayload map[string]interface{} `json:"transient_payload,omitempty"`
+}
+
+// NewUpdateLoginFlowWithIdentifierFirstMethod instantiates a new UpdateLoginFlowWithIdentifierFirstMethod object
+// This constructor will assign default values to properties that have it defined,
+// and makes sure properties required by API are set, but the set of arguments
+// will change when the set of required properties is changed
+func NewUpdateLoginFlowWithIdentifierFirstMethod(identifier string, method string) *UpdateLoginFlowWithIdentifierFirstMethod {
+	this := UpdateLoginFlowWithIdentifierFirstMethod{}
+	this.Identifier = identifier
+	this.Method = method
+	return &this
+}
+
+// NewUpdateLoginFlowWithIdentifierFirstMethodWithDefaults instantiates a new UpdateLoginFlowWithIdentifierFirstMethod object
+// This constructor will only assign default values to properties that have it defined,
+// but it doesn't guarantee that properties required by API are set
+func NewUpdateLoginFlowWithIdentifierFirstMethodWithDefaults() *UpdateLoginFlowWithIdentifierFirstMethod {
+	this := UpdateLoginFlowWithIdentifierFirstMethod{}
+	return &this
+}
+
+// GetCsrfToken returns the CsrfToken field value if set, zero value otherwise.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetCsrfToken() string {
+	if o == nil || o.CsrfToken == nil {
+		var ret string
+		return ret
+	}
+	return *o.CsrfToken
+}
+
+// GetCsrfTokenOk returns a tuple with the CsrfToken field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetCsrfTokenOk() (*string, bool) {
+	if o == nil || o.CsrfToken == nil {
+		return nil, false
+	}
+	return o.CsrfToken, true
+}
+
+// HasCsrfToken returns a boolean if a field has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) HasCsrfToken() bool {
+	if o != nil && o.CsrfToken != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetCsrfToken gets a reference to the given string and assigns it to the CsrfToken field.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) SetCsrfToken(v string) {
+	o.CsrfToken = &v
+}
+
+// GetIdentifier returns the Identifier field value
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetIdentifier() string {
+	if o == nil {
+		var ret string
+		return ret
+	}
+
+	return o.Identifier
+}
+
+// GetIdentifierOk returns a tuple with the Identifier field value
+// and a boolean to check if the value has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetIdentifierOk() (*string, bool) {
+	if o == nil {
+		return nil, false
+	}
+	return &o.Identifier, true
+}
+
+// SetIdentifier sets field value
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) SetIdentifier(v string) {
+	o.Identifier = v
+}
+
+// GetMethod returns the Method field value
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetMethod() string {
+	if o == nil {
+		var ret string
+		return ret
+	}
+
+	return o.Method
+}
+
+// GetMethodOk returns a tuple with the Method field value
+// and a boolean to check if the value has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetMethodOk() (*string, bool) {
+	if o == nil {
+		return nil, false
+	}
+	return &o.Method, true
+}
+
+// SetMethod sets field value
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) SetMethod(v string) {
+	o.Method = v
+}
+
+// GetTransientPayload returns the TransientPayload field value if set, zero value otherwise.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetTransientPayload() map[string]interface{} {
+	if o == nil || o.TransientPayload == nil {
+		var ret map[string]interface{}
+		return ret
+	}
+	return o.TransientPayload
+}
+
+// GetTransientPayloadOk returns a tuple with the TransientPayload field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetTransientPayloadOk() (map[string]interface{}, bool) {
+	if o == nil || o.TransientPayload == nil {
+		return nil, false
+	}
+	return o.TransientPayload, true
+}
+
+// HasTransientPayload returns a boolean if a field has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) HasTransientPayload() bool {
+	if o != nil && o.TransientPayload != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetTransientPayload gets a reference to the given map[string]interface{} and assigns it to the TransientPayload field.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) SetTransientPayload(v map[string]interface{}) {
+	o.TransientPayload = v
+}
+
+func (o UpdateLoginFlowWithIdentifierFirstMethod) MarshalJSON() ([]byte, error) {
+	toSerialize := map[string]interface{}{}
+	if o.CsrfToken != nil {
+		toSerialize["csrf_token"] = o.CsrfToken
+	}
+	if true {
+		toSerialize["identifier"] = o.Identifier
+	}
+	if true {
+		toSerialize["method"] = o.Method
+	}
+	if o.TransientPayload != nil {
+		toSerialize["transient_payload"] = o.TransientPayload
+	}
+	return json.Marshal(toSerialize)
+}
+
+type NullableUpdateLoginFlowWithIdentifierFirstMethod struct {
+	value *UpdateLoginFlowWithIdentifierFirstMethod
+	isSet bool
+}
+
+func (v NullableUpdateLoginFlowWithIdentifierFirstMethod) Get() *UpdateLoginFlowWithIdentifierFirstMethod {
+	return v.value
+}
+
+func (v *NullableUpdateLoginFlowWithIdentifierFirstMethod) Set(val *UpdateLoginFlowWithIdentifierFirstMethod) {
+	v.value = val
+	v.isSet = true
+}
+
+func (v NullableUpdateLoginFlowWithIdentifierFirstMethod) IsSet() bool {
+	return v.isSet
+}
+
+func (v *NullableUpdateLoginFlowWithIdentifierFirstMethod) Unset() {
+	v.value = nil
+	v.isSet = false
+}
+
+func NewNullableUpdateLoginFlowWithIdentifierFirstMethod(val *UpdateLoginFlowWithIdentifierFirstMethod) *NullableUpdateLoginFlowWithIdentifierFirstMethod {
+	return &NullableUpdateLoginFlowWithIdentifierFirstMethod{value: val, isSet: true}
+}
+
+func (v NullableUpdateLoginFlowWithIdentifierFirstMethod) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.value)
+}
+
+func (v *NullableUpdateLoginFlowWithIdentifierFirstMethod) UnmarshalJSON(src []byte) error {
+	v.isSet = true
+	return json.Unmarshal(src, &v.value)
+}
diff --git a/internal/client-go/model_update_login_flow_with_oidc_method.go b/internal/client-go/model_update_login_flow_with_oidc_method.go
index 8f4a7348b13a..cdd5c665bdc5 100644
--- a/internal/client-go/model_update_login_flow_with_oidc_method.go
+++ b/internal/client-go/model_update_login_flow_with_oidc_method.go
@@ -19,7 +19,7 @@ import (
 type UpdateLoginFlowWithOidcMethod struct {
 	// The CSRF Token
 	CsrfToken *string `json:"csrf_token,omitempty"`
-	// IDToken is an optional id token provided by an OIDC provider  If submitted, it is verified using the OIDC provider's public key set and the claims are used to populate the OIDC credentials of the identity. If the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use the `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.  Supported providers are Apple
+	// IDToken is an optional id token provided by an OIDC provider  If submitted, it is verified using the OIDC provider's public key set and the claims are used to populate the OIDC credentials of the identity. If the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use the `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.  Supported providers are Apple Google
 	IdToken *string `json:"id_token,omitempty"`
 	// IDTokenNonce is the nonce, used when generating the IDToken. If the provider supports nonce validation, the nonce will be validated against this value and required.
 	IdTokenNonce *string `json:"id_token_nonce,omitempty"`
diff --git a/internal/client-go/model_update_registration_flow_body.go b/internal/client-go/model_update_registration_flow_body.go
index 64374c620f8f..82a578cfc4d3 100644
--- a/internal/client-go/model_update_registration_flow_body.go
+++ b/internal/client-go/model_update_registration_flow_body.go
@@ -22,6 +22,7 @@ type UpdateRegistrationFlowBody struct {
 	UpdateRegistrationFlowWithOidcMethod     *UpdateRegistrationFlowWithOidcMethod
 	UpdateRegistrationFlowWithPasskeyMethod  *UpdateRegistrationFlowWithPasskeyMethod
 	UpdateRegistrationFlowWithPasswordMethod *UpdateRegistrationFlowWithPasswordMethod
+	UpdateRegistrationFlowWithProfileMethod  *UpdateRegistrationFlowWithProfileMethod
 	UpdateRegistrationFlowWithWebAuthnMethod *UpdateRegistrationFlowWithWebAuthnMethod
 }
 
@@ -53,6 +54,13 @@ func UpdateRegistrationFlowWithPasswordMethodAsUpdateRegistrationFlowBody(v *Upd
 	}
 }
 
+// UpdateRegistrationFlowWithProfileMethodAsUpdateRegistrationFlowBody is a convenience function that returns UpdateRegistrationFlowWithProfileMethod wrapped in UpdateRegistrationFlowBody
+func UpdateRegistrationFlowWithProfileMethodAsUpdateRegistrationFlowBody(v *UpdateRegistrationFlowWithProfileMethod) UpdateRegistrationFlowBody {
+	return UpdateRegistrationFlowBody{
+		UpdateRegistrationFlowWithProfileMethod: v,
+	}
+}
+
 // UpdateRegistrationFlowWithWebAuthnMethodAsUpdateRegistrationFlowBody is a convenience function that returns UpdateRegistrationFlowWithWebAuthnMethod wrapped in UpdateRegistrationFlowBody
 func UpdateRegistrationFlowWithWebAuthnMethodAsUpdateRegistrationFlowBody(v *UpdateRegistrationFlowWithWebAuthnMethod) UpdateRegistrationFlowBody {
 	return UpdateRegistrationFlowBody{
@@ -94,8 +102,8 @@ func (dst *UpdateRegistrationFlowBody) UnmarshalJSON(data []byte) error {
 		}
 	}
 
-	// check if the discriminator value is 'passKey'
-	if jsonDict["method"] == "passKey" {
+	// check if the discriminator value is 'passkey'
+	if jsonDict["method"] == "passkey" {
 		// try to unmarshal JSON data into UpdateRegistrationFlowWithPasskeyMethod
 		err = json.Unmarshal(data, &dst.UpdateRegistrationFlowWithPasskeyMethod)
 		if err == nil {
@@ -118,6 +126,18 @@ func (dst *UpdateRegistrationFlowBody) UnmarshalJSON(data []byte) error {
 		}
 	}
 
+	// check if the discriminator value is 'profile'
+	if jsonDict["method"] == "profile" {
+		// try to unmarshal JSON data into UpdateRegistrationFlowWithProfileMethod
+		err = json.Unmarshal(data, &dst.UpdateRegistrationFlowWithProfileMethod)
+		if err == nil {
+			return nil // data stored in dst.UpdateRegistrationFlowWithProfileMethod, return on the first match
+		} else {
+			dst.UpdateRegistrationFlowWithProfileMethod = nil
+			return fmt.Errorf("Failed to unmarshal UpdateRegistrationFlowBody as UpdateRegistrationFlowWithProfileMethod: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'webauthn'
 	if jsonDict["method"] == "webauthn" {
 		// try to unmarshal JSON data into UpdateRegistrationFlowWithWebAuthnMethod
@@ -178,6 +198,18 @@ func (dst *UpdateRegistrationFlowBody) UnmarshalJSON(data []byte) error {
 		}
 	}
 
+	// check if the discriminator value is 'updateRegistrationFlowWithProfileMethod'
+	if jsonDict["method"] == "updateRegistrationFlowWithProfileMethod" {
+		// try to unmarshal JSON data into UpdateRegistrationFlowWithProfileMethod
+		err = json.Unmarshal(data, &dst.UpdateRegistrationFlowWithProfileMethod)
+		if err == nil {
+			return nil // data stored in dst.UpdateRegistrationFlowWithProfileMethod, return on the first match
+		} else {
+			dst.UpdateRegistrationFlowWithProfileMethod = nil
+			return fmt.Errorf("Failed to unmarshal UpdateRegistrationFlowBody as UpdateRegistrationFlowWithProfileMethod: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'updateRegistrationFlowWithWebAuthnMethod'
 	if jsonDict["method"] == "updateRegistrationFlowWithWebAuthnMethod" {
 		// try to unmarshal JSON data into UpdateRegistrationFlowWithWebAuthnMethod
@@ -211,6 +243,10 @@ func (src UpdateRegistrationFlowBody) MarshalJSON() ([]byte, error) {
 		return json.Marshal(&src.UpdateRegistrationFlowWithPasswordMethod)
 	}
 
+	if src.UpdateRegistrationFlowWithProfileMethod != nil {
+		return json.Marshal(&src.UpdateRegistrationFlowWithProfileMethod)
+	}
+
 	if src.UpdateRegistrationFlowWithWebAuthnMethod != nil {
 		return json.Marshal(&src.UpdateRegistrationFlowWithWebAuthnMethod)
 	}
@@ -239,6 +275,10 @@ func (obj *UpdateRegistrationFlowBody) GetActualInstance() interface{} {
 		return obj.UpdateRegistrationFlowWithPasswordMethod
 	}
 
+	if obj.UpdateRegistrationFlowWithProfileMethod != nil {
+		return obj.UpdateRegistrationFlowWithProfileMethod
+	}
+
 	if obj.UpdateRegistrationFlowWithWebAuthnMethod != nil {
 		return obj.UpdateRegistrationFlowWithWebAuthnMethod
 	}
diff --git a/internal/client-go/model_update_registration_flow_with_oidc_method.go b/internal/client-go/model_update_registration_flow_with_oidc_method.go
index 509e978a0627..2ee32605fee6 100644
--- a/internal/client-go/model_update_registration_flow_with_oidc_method.go
+++ b/internal/client-go/model_update_registration_flow_with_oidc_method.go
@@ -19,7 +19,7 @@ import (
 type UpdateRegistrationFlowWithOidcMethod struct {
 	// The CSRF Token
 	CsrfToken *string `json:"csrf_token,omitempty"`
-	// IDToken is an optional id token provided by an OIDC provider  If submitted, it is verified using the OIDC provider's public key set and the claims are used to populate the OIDC credentials of the identity. If the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use the `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.  Supported providers are Apple
+	// IDToken is an optional id token provided by an OIDC provider  If submitted, it is verified using the OIDC provider's public key set and the claims are used to populate the OIDC credentials of the identity. If the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use the `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.  Supported providers are Apple Google
 	IdToken *string `json:"id_token,omitempty"`
 	// IDTokenNonce is the nonce, used when generating the IDToken. If the provider supports nonce validation, the nonce will be validated against this value and is required.
 	IdTokenNonce *string `json:"id_token_nonce,omitempty"`
diff --git a/internal/client-go/model_update_registration_flow_with_profile_method.go b/internal/client-go/model_update_registration_flow_with_profile_method.go
index 221e5ea82ada..8cdbb2eab764 100644
--- a/internal/client-go/model_update_registration_flow_with_profile_method.go
+++ b/internal/client-go/model_update_registration_flow_with_profile_method.go
@@ -21,7 +21,7 @@ type UpdateRegistrationFlowWithProfileMethod struct {
 	CsrfToken *string `json:"csrf_token,omitempty"`
 	// Method  Should be set to profile when trying to update a profile.
 	Method string `json:"method"`
-	// Screen requests navigation to a previous screen.  This must be set to credential-selection to go back to the credential selection screen.
+	// Screen requests navigation to a previous screen.  This must be set to credential-selection to go back to the credential selection screen. credential-selection RegistrationScreenCredentialSelection nolint:gosec // not a credential previous RegistrationScreenPrevious
 	Screen *string `json:"screen,omitempty"`
 	// Traits  The identity's traits.
 	Traits map[string]interface{} `json:"traits"`
diff --git a/internal/client-go/model_verification_flow_state.go b/internal/client-go/model_verification_flow_state.go
index bea74568c94d..56b65e0c0a5b 100644
--- a/internal/client-go/model_verification_flow_state.go
+++ b/internal/client-go/model_verification_flow_state.go
@@ -16,7 +16,7 @@ import (
 	"fmt"
 )
 
-// VerificationFlowState The state represents the state of the verification flow.  choose_method: ask the user to choose a method (e.g. recover account via email) sent_email: the email has been sent to the user passed_challenge: the request was successful and the recovery challenge was passed.
+// VerificationFlowState The experimental state represents the state of a verification flow. This field is EXPERIMENTAL and subject to change!
 type VerificationFlowState string
 
 // List of verificationFlowState
diff --git a/internal/driver.go b/internal/driver.go
index b95b2dc7c0a9..0e7e514ce5e5 100644
--- a/internal/driver.go
+++ b/internal/driver.go
@@ -12,6 +12,7 @@ import (
 	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
 
 	"github.com/ory/x/contextx"
+	"github.com/ory/x/randx"
 
 	"github.com/sirupsen/logrus"
 
@@ -53,6 +54,7 @@ func NewConfigurationWithDefaults(t testing.TB, opts ...configx.OptionModifier)
 			config.ViperKeyCourierSMTPURL:                    "smtp://foo:bar@baz.com/",
 			config.ViperKeySelfServiceBrowserDefaultReturnTo: "https://www.ory.sh/redirect-not-set",
 			config.ViperKeySecretsCipher:                     []string{"secret-thirty-two-character-long"},
+			config.ViperKeySelfServiceLoginFlowStyle:         "unified",
 		}),
 		configx.SkipValidation(),
 	}, opts...)
@@ -85,10 +87,14 @@ func NewFastRegistryWithMocks(t *testing.T, opts ...configx.OptionModifier) (*co
 // NewRegistryDefaultWithDSN returns a more standard registry without mocks. Good for e2e and advanced integration testing!
 func NewRegistryDefaultWithDSN(t testing.TB, dsn string, opts ...configx.OptionModifier) (*config.Config, *driver.RegistryDefault) {
 	ctx := context.Background()
-	c := NewConfigurationWithDefaults(t, append(opts, configx.WithValues(map[string]interface{}{
-		config.ViperKeyDSN: stringsx.Coalesce(dsn, dbal.NewSQLiteTestDatabase(t)+"&lock=false&max_conns=1"),
-		"dev":              true,
-	}))...)
+	c := NewConfigurationWithDefaults(t, append([]configx.OptionModifier{configx.WithValues(map[string]interface{}{
+		config.ViperKeyDSN:             stringsx.Coalesce(dsn, dbal.NewSQLiteTestDatabase(t)+"&lock=false&max_conns=1"),
+		"dev":                          true,
+		config.ViperKeySecretsCipher:   []string{randx.MustString(32, randx.AlphaNum)},
+		config.ViperKeySecretsCookie:   []string{randx.MustString(32, randx.AlphaNum)},
+		config.ViperKeySecretsDefault:  []string{randx.MustString(32, randx.AlphaNum)},
+		config.ViperKeyCipherAlgorithm: "xchacha20-poly1305",
+	})}, opts...)...)
 	reg, err := driver.NewRegistryFromDSN(ctx, c, logrusx.New("", "", logrusx.ForceLevel(logrus.ErrorLevel)))
 	require.NoError(t, err)
 	pool := jsonnetsecure.NewProcessPool(runtime.GOMAXPROCS(0))
diff --git a/internal/httpclient/.openapi-generator/FILES b/internal/httpclient/.openapi-generator/FILES
index fdf34c5e1507..118cf9b06463 100644
--- a/internal/httpclient/.openapi-generator/FILES
+++ b/internal/httpclient/.openapi-generator/FILES
@@ -15,12 +15,13 @@ docs/ConsistencyRequestParameters.md
 docs/ContinueWith.md
 docs/ContinueWithRecoveryUi.md
 docs/ContinueWithRecoveryUiFlow.md
+docs/ContinueWithRedirectBrowserTo.md
 docs/ContinueWithSetOrySessionToken.md
 docs/ContinueWithSettingsUi.md
 docs/ContinueWithSettingsUiFlow.md
 docs/ContinueWithVerificationUi.md
 docs/ContinueWithVerificationUiFlow.md
-docs/CourierApi.md
+docs/CourierAPI.md
 docs/CourierMessageStatus.md
 docs/CourierMessageType.md
 docs/CreateIdentityBody.md
@@ -32,15 +33,16 @@ docs/ErrorBrowserLocationChangeRequired.md
 docs/ErrorFlowReplaced.md
 docs/ErrorGeneric.md
 docs/FlowError.md
-docs/FrontendApi.md
+docs/FrontendAPI.md
 docs/GenericError.md
 docs/GetVersion200Response.md
 docs/HealthNotReadyStatus.md
 docs/HealthStatus.md
 docs/Identity.md
-docs/IdentityApi.md
+docs/IdentityAPI.md
 docs/IdentityCredentials.md
 docs/IdentityCredentialsCode.md
+docs/IdentityCredentialsCodeAddress.md
 docs/IdentityCredentialsOidc.md
 docs/IdentityCredentialsOidcProvider.md
 docs/IdentityCredentialsPassword.md
@@ -61,7 +63,7 @@ docs/LoginFlowState.md
 docs/LogoutFlow.md
 docs/Message.md
 docs/MessageDispatch.md
-docs/MetadataApi.md
+docs/MetadataAPI.md
 docs/NeedsPrivilegedSessionError.md
 docs/OAuth2Client.md
 docs/OAuth2ConsentRequestOpenIDConnectContext.md
@@ -99,6 +101,7 @@ docs/UiText.md
 docs/UpdateIdentityBody.md
 docs/UpdateLoginFlowBody.md
 docs/UpdateLoginFlowWithCodeMethod.md
+docs/UpdateLoginFlowWithIdentifierFirstMethod.md
 docs/UpdateLoginFlowWithLookupSecretMethod.md
 docs/UpdateLoginFlowWithOidcMethod.md
 docs/UpdateLoginFlowWithPasskeyMethod.md
@@ -139,6 +142,7 @@ model_consistency_request_parameters.go
 model_continue_with.go
 model_continue_with_recovery_ui.go
 model_continue_with_recovery_ui_flow.go
+model_continue_with_redirect_browser_to.go
 model_continue_with_set_ory_session_token.go
 model_continue_with_settings_ui.go
 model_continue_with_settings_ui_flow.go
@@ -162,6 +166,7 @@ model_health_status.go
 model_identity.go
 model_identity_credentials.go
 model_identity_credentials_code.go
+model_identity_credentials_code_address.go
 model_identity_credentials_oidc.go
 model_identity_credentials_oidc_provider.go
 model_identity_credentials_password.go
@@ -219,6 +224,7 @@ model_ui_text.go
 model_update_identity_body.go
 model_update_login_flow_body.go
 model_update_login_flow_with_code_method.go
+model_update_login_flow_with_identifier_first_method.go
 model_update_login_flow_with_lookup_secret_method.go
 model_update_login_flow_with_oidc_method.go
 model_update_login_flow_with_passkey_method.go
diff --git a/internal/httpclient/README.md b/internal/httpclient/README.md
index 04dd61ab7d1e..97593523117a 100644
--- a/internal/httpclient/README.md
+++ b/internal/httpclient/README.md
@@ -79,59 +79,59 @@ All URIs are relative to *http://localhost*
 
 Class | Method | HTTP request | Description
 ------------ | ------------- | ------------- | -------------
-*CourierApi* | [**GetCourierMessage**](docs/CourierApi.md#getcouriermessage) | **Get** /admin/courier/messages/{id} | Get a Message
-*CourierApi* | [**ListCourierMessages**](docs/CourierApi.md#listcouriermessages) | **Get** /admin/courier/messages | List Messages
-*FrontendApi* | [**CreateBrowserLoginFlow**](docs/FrontendApi.md#createbrowserloginflow) | **Get** /self-service/login/browser | Create Login Flow for Browsers
-*FrontendApi* | [**CreateBrowserLogoutFlow**](docs/FrontendApi.md#createbrowserlogoutflow) | **Get** /self-service/logout/browser | Create a Logout URL for Browsers
-*FrontendApi* | [**CreateBrowserRecoveryFlow**](docs/FrontendApi.md#createbrowserrecoveryflow) | **Get** /self-service/recovery/browser | Create Recovery Flow for Browsers
-*FrontendApi* | [**CreateBrowserRegistrationFlow**](docs/FrontendApi.md#createbrowserregistrationflow) | **Get** /self-service/registration/browser | Create Registration Flow for Browsers
-*FrontendApi* | [**CreateBrowserSettingsFlow**](docs/FrontendApi.md#createbrowsersettingsflow) | **Get** /self-service/settings/browser | Create Settings Flow for Browsers
-*FrontendApi* | [**CreateBrowserVerificationFlow**](docs/FrontendApi.md#createbrowserverificationflow) | **Get** /self-service/verification/browser | Create Verification Flow for Browser Clients
-*FrontendApi* | [**CreateNativeLoginFlow**](docs/FrontendApi.md#createnativeloginflow) | **Get** /self-service/login/api | Create Login Flow for Native Apps
-*FrontendApi* | [**CreateNativeRecoveryFlow**](docs/FrontendApi.md#createnativerecoveryflow) | **Get** /self-service/recovery/api | Create Recovery Flow for Native Apps
-*FrontendApi* | [**CreateNativeRegistrationFlow**](docs/FrontendApi.md#createnativeregistrationflow) | **Get** /self-service/registration/api | Create Registration Flow for Native Apps
-*FrontendApi* | [**CreateNativeSettingsFlow**](docs/FrontendApi.md#createnativesettingsflow) | **Get** /self-service/settings/api | Create Settings Flow for Native Apps
-*FrontendApi* | [**CreateNativeVerificationFlow**](docs/FrontendApi.md#createnativeverificationflow) | **Get** /self-service/verification/api | Create Verification Flow for Native Apps
-*FrontendApi* | [**DisableMyOtherSessions**](docs/FrontendApi.md#disablemyothersessions) | **Delete** /sessions | Disable my other sessions
-*FrontendApi* | [**DisableMySession**](docs/FrontendApi.md#disablemysession) | **Delete** /sessions/{id} | Disable one of my sessions
-*FrontendApi* | [**ExchangeSessionToken**](docs/FrontendApi.md#exchangesessiontoken) | **Get** /sessions/token-exchange | Exchange Session Token
-*FrontendApi* | [**GetFlowError**](docs/FrontendApi.md#getflowerror) | **Get** /self-service/errors | Get User-Flow Errors
-*FrontendApi* | [**GetLoginFlow**](docs/FrontendApi.md#getloginflow) | **Get** /self-service/login/flows | Get Login Flow
-*FrontendApi* | [**GetRecoveryFlow**](docs/FrontendApi.md#getrecoveryflow) | **Get** /self-service/recovery/flows | Get Recovery Flow
-*FrontendApi* | [**GetRegistrationFlow**](docs/FrontendApi.md#getregistrationflow) | **Get** /self-service/registration/flows | Get Registration Flow
-*FrontendApi* | [**GetSettingsFlow**](docs/FrontendApi.md#getsettingsflow) | **Get** /self-service/settings/flows | Get Settings Flow
-*FrontendApi* | [**GetVerificationFlow**](docs/FrontendApi.md#getverificationflow) | **Get** /self-service/verification/flows | Get Verification Flow
-*FrontendApi* | [**GetWebAuthnJavaScript**](docs/FrontendApi.md#getwebauthnjavascript) | **Get** /.well-known/ory/webauthn.js | Get WebAuthn JavaScript
-*FrontendApi* | [**ListMySessions**](docs/FrontendApi.md#listmysessions) | **Get** /sessions | Get My Active Sessions
-*FrontendApi* | [**PerformNativeLogout**](docs/FrontendApi.md#performnativelogout) | **Delete** /self-service/logout/api | Perform Logout for Native Apps
-*FrontendApi* | [**ToSession**](docs/FrontendApi.md#tosession) | **Get** /sessions/whoami | Check Who the Current HTTP Session Belongs To
-*FrontendApi* | [**UpdateLoginFlow**](docs/FrontendApi.md#updateloginflow) | **Post** /self-service/login | Submit a Login Flow
-*FrontendApi* | [**UpdateLogoutFlow**](docs/FrontendApi.md#updatelogoutflow) | **Get** /self-service/logout | Update Logout Flow
-*FrontendApi* | [**UpdateRecoveryFlow**](docs/FrontendApi.md#updaterecoveryflow) | **Post** /self-service/recovery | Update Recovery Flow
-*FrontendApi* | [**UpdateRegistrationFlow**](docs/FrontendApi.md#updateregistrationflow) | **Post** /self-service/registration | Update Registration Flow
-*FrontendApi* | [**UpdateSettingsFlow**](docs/FrontendApi.md#updatesettingsflow) | **Post** /self-service/settings | Complete Settings Flow
-*FrontendApi* | [**UpdateVerificationFlow**](docs/FrontendApi.md#updateverificationflow) | **Post** /self-service/verification | Complete Verification Flow
-*IdentityApi* | [**BatchPatchIdentities**](docs/IdentityApi.md#batchpatchidentities) | **Patch** /admin/identities | Create multiple identities
-*IdentityApi* | [**CreateIdentity**](docs/IdentityApi.md#createidentity) | **Post** /admin/identities | Create an Identity
-*IdentityApi* | [**CreateRecoveryCodeForIdentity**](docs/IdentityApi.md#createrecoverycodeforidentity) | **Post** /admin/recovery/code | Create a Recovery Code
-*IdentityApi* | [**CreateRecoveryLinkForIdentity**](docs/IdentityApi.md#createrecoverylinkforidentity) | **Post** /admin/recovery/link | Create a Recovery Link
-*IdentityApi* | [**DeleteIdentity**](docs/IdentityApi.md#deleteidentity) | **Delete** /admin/identities/{id} | Delete an Identity
-*IdentityApi* | [**DeleteIdentityCredentials**](docs/IdentityApi.md#deleteidentitycredentials) | **Delete** /admin/identities/{id}/credentials/{type} | Delete a credential for a specific identity
-*IdentityApi* | [**DeleteIdentitySessions**](docs/IdentityApi.md#deleteidentitysessions) | **Delete** /admin/identities/{id}/sessions | Delete &amp; Invalidate an Identity&#39;s Sessions
-*IdentityApi* | [**DisableSession**](docs/IdentityApi.md#disablesession) | **Delete** /admin/sessions/{id} | Deactivate a Session
-*IdentityApi* | [**ExtendSession**](docs/IdentityApi.md#extendsession) | **Patch** /admin/sessions/{id}/extend | Extend a Session
-*IdentityApi* | [**GetIdentity**](docs/IdentityApi.md#getidentity) | **Get** /admin/identities/{id} | Get an Identity
-*IdentityApi* | [**GetIdentitySchema**](docs/IdentityApi.md#getidentityschema) | **Get** /schemas/{id} | Get Identity JSON Schema
-*IdentityApi* | [**GetSession**](docs/IdentityApi.md#getsession) | **Get** /admin/sessions/{id} | Get Session
-*IdentityApi* | [**ListIdentities**](docs/IdentityApi.md#listidentities) | **Get** /admin/identities | List Identities
-*IdentityApi* | [**ListIdentitySchemas**](docs/IdentityApi.md#listidentityschemas) | **Get** /schemas | Get all Identity Schemas
-*IdentityApi* | [**ListIdentitySessions**](docs/IdentityApi.md#listidentitysessions) | **Get** /admin/identities/{id}/sessions | List an Identity&#39;s Sessions
-*IdentityApi* | [**ListSessions**](docs/IdentityApi.md#listsessions) | **Get** /admin/sessions | List All Sessions
-*IdentityApi* | [**PatchIdentity**](docs/IdentityApi.md#patchidentity) | **Patch** /admin/identities/{id} | Patch an Identity
-*IdentityApi* | [**UpdateIdentity**](docs/IdentityApi.md#updateidentity) | **Put** /admin/identities/{id} | Update an Identity
-*MetadataApi* | [**GetVersion**](docs/MetadataApi.md#getversion) | **Get** /version | Return Running Software Version.
-*MetadataApi* | [**IsAlive**](docs/MetadataApi.md#isalive) | **Get** /health/alive | Check HTTP Server Status
-*MetadataApi* | [**IsReady**](docs/MetadataApi.md#isready) | **Get** /health/ready | Check HTTP Server and Database Status
+*CourierAPI* | [**GetCourierMessage**](docs/CourierAPI.md#getcouriermessage) | **Get** /admin/courier/messages/{id} | Get a Message
+*CourierAPI* | [**ListCourierMessages**](docs/CourierAPI.md#listcouriermessages) | **Get** /admin/courier/messages | List Messages
+*FrontendAPI* | [**CreateBrowserLoginFlow**](docs/FrontendAPI.md#createbrowserloginflow) | **Get** /self-service/login/browser | Create Login Flow for Browsers
+*FrontendAPI* | [**CreateBrowserLogoutFlow**](docs/FrontendAPI.md#createbrowserlogoutflow) | **Get** /self-service/logout/browser | Create a Logout URL for Browsers
+*FrontendAPI* | [**CreateBrowserRecoveryFlow**](docs/FrontendAPI.md#createbrowserrecoveryflow) | **Get** /self-service/recovery/browser | Create Recovery Flow for Browsers
+*FrontendAPI* | [**CreateBrowserRegistrationFlow**](docs/FrontendAPI.md#createbrowserregistrationflow) | **Get** /self-service/registration/browser | Create Registration Flow for Browsers
+*FrontendAPI* | [**CreateBrowserSettingsFlow**](docs/FrontendAPI.md#createbrowsersettingsflow) | **Get** /self-service/settings/browser | Create Settings Flow for Browsers
+*FrontendAPI* | [**CreateBrowserVerificationFlow**](docs/FrontendAPI.md#createbrowserverificationflow) | **Get** /self-service/verification/browser | Create Verification Flow for Browser Clients
+*FrontendAPI* | [**CreateNativeLoginFlow**](docs/FrontendAPI.md#createnativeloginflow) | **Get** /self-service/login/api | Create Login Flow for Native Apps
+*FrontendAPI* | [**CreateNativeRecoveryFlow**](docs/FrontendAPI.md#createnativerecoveryflow) | **Get** /self-service/recovery/api | Create Recovery Flow for Native Apps
+*FrontendAPI* | [**CreateNativeRegistrationFlow**](docs/FrontendAPI.md#createnativeregistrationflow) | **Get** /self-service/registration/api | Create Registration Flow for Native Apps
+*FrontendAPI* | [**CreateNativeSettingsFlow**](docs/FrontendAPI.md#createnativesettingsflow) | **Get** /self-service/settings/api | Create Settings Flow for Native Apps
+*FrontendAPI* | [**CreateNativeVerificationFlow**](docs/FrontendAPI.md#createnativeverificationflow) | **Get** /self-service/verification/api | Create Verification Flow for Native Apps
+*FrontendAPI* | [**DisableMyOtherSessions**](docs/FrontendAPI.md#disablemyothersessions) | **Delete** /sessions | Disable my other sessions
+*FrontendAPI* | [**DisableMySession**](docs/FrontendAPI.md#disablemysession) | **Delete** /sessions/{id} | Disable one of my sessions
+*FrontendAPI* | [**ExchangeSessionToken**](docs/FrontendAPI.md#exchangesessiontoken) | **Get** /sessions/token-exchange | Exchange Session Token
+*FrontendAPI* | [**GetFlowError**](docs/FrontendAPI.md#getflowerror) | **Get** /self-service/errors | Get User-Flow Errors
+*FrontendAPI* | [**GetLoginFlow**](docs/FrontendAPI.md#getloginflow) | **Get** /self-service/login/flows | Get Login Flow
+*FrontendAPI* | [**GetRecoveryFlow**](docs/FrontendAPI.md#getrecoveryflow) | **Get** /self-service/recovery/flows | Get Recovery Flow
+*FrontendAPI* | [**GetRegistrationFlow**](docs/FrontendAPI.md#getregistrationflow) | **Get** /self-service/registration/flows | Get Registration Flow
+*FrontendAPI* | [**GetSettingsFlow**](docs/FrontendAPI.md#getsettingsflow) | **Get** /self-service/settings/flows | Get Settings Flow
+*FrontendAPI* | [**GetVerificationFlow**](docs/FrontendAPI.md#getverificationflow) | **Get** /self-service/verification/flows | Get Verification Flow
+*FrontendAPI* | [**GetWebAuthnJavaScript**](docs/FrontendAPI.md#getwebauthnjavascript) | **Get** /.well-known/ory/webauthn.js | Get WebAuthn JavaScript
+*FrontendAPI* | [**ListMySessions**](docs/FrontendAPI.md#listmysessions) | **Get** /sessions | Get My Active Sessions
+*FrontendAPI* | [**PerformNativeLogout**](docs/FrontendAPI.md#performnativelogout) | **Delete** /self-service/logout/api | Perform Logout for Native Apps
+*FrontendAPI* | [**ToSession**](docs/FrontendAPI.md#tosession) | **Get** /sessions/whoami | Check Who the Current HTTP Session Belongs To
+*FrontendAPI* | [**UpdateLoginFlow**](docs/FrontendAPI.md#updateloginflow) | **Post** /self-service/login | Submit a Login Flow
+*FrontendAPI* | [**UpdateLogoutFlow**](docs/FrontendAPI.md#updatelogoutflow) | **Get** /self-service/logout | Update Logout Flow
+*FrontendAPI* | [**UpdateRecoveryFlow**](docs/FrontendAPI.md#updaterecoveryflow) | **Post** /self-service/recovery | Update Recovery Flow
+*FrontendAPI* | [**UpdateRegistrationFlow**](docs/FrontendAPI.md#updateregistrationflow) | **Post** /self-service/registration | Update Registration Flow
+*FrontendAPI* | [**UpdateSettingsFlow**](docs/FrontendAPI.md#updatesettingsflow) | **Post** /self-service/settings | Complete Settings Flow
+*FrontendAPI* | [**UpdateVerificationFlow**](docs/FrontendAPI.md#updateverificationflow) | **Post** /self-service/verification | Complete Verification Flow
+*IdentityAPI* | [**BatchPatchIdentities**](docs/IdentityAPI.md#batchpatchidentities) | **Patch** /admin/identities | Create multiple identities
+*IdentityAPI* | [**CreateIdentity**](docs/IdentityAPI.md#createidentity) | **Post** /admin/identities | Create an Identity
+*IdentityAPI* | [**CreateRecoveryCodeForIdentity**](docs/IdentityAPI.md#createrecoverycodeforidentity) | **Post** /admin/recovery/code | Create a Recovery Code
+*IdentityAPI* | [**CreateRecoveryLinkForIdentity**](docs/IdentityAPI.md#createrecoverylinkforidentity) | **Post** /admin/recovery/link | Create a Recovery Link
+*IdentityAPI* | [**DeleteIdentity**](docs/IdentityAPI.md#deleteidentity) | **Delete** /admin/identities/{id} | Delete an Identity
+*IdentityAPI* | [**DeleteIdentityCredentials**](docs/IdentityAPI.md#deleteidentitycredentials) | **Delete** /admin/identities/{id}/credentials/{type} | Delete a credential for a specific identity
+*IdentityAPI* | [**DeleteIdentitySessions**](docs/IdentityAPI.md#deleteidentitysessions) | **Delete** /admin/identities/{id}/sessions | Delete &amp; Invalidate an Identity&#39;s Sessions
+*IdentityAPI* | [**DisableSession**](docs/IdentityAPI.md#disablesession) | **Delete** /admin/sessions/{id} | Deactivate a Session
+*IdentityAPI* | [**ExtendSession**](docs/IdentityAPI.md#extendsession) | **Patch** /admin/sessions/{id}/extend | Extend a Session
+*IdentityAPI* | [**GetIdentity**](docs/IdentityAPI.md#getidentity) | **Get** /admin/identities/{id} | Get an Identity
+*IdentityAPI* | [**GetIdentitySchema**](docs/IdentityAPI.md#getidentityschema) | **Get** /schemas/{id} | Get Identity JSON Schema
+*IdentityAPI* | [**GetSession**](docs/IdentityAPI.md#getsession) | **Get** /admin/sessions/{id} | Get Session
+*IdentityAPI* | [**ListIdentities**](docs/IdentityAPI.md#listidentities) | **Get** /admin/identities | List Identities
+*IdentityAPI* | [**ListIdentitySchemas**](docs/IdentityAPI.md#listidentityschemas) | **Get** /schemas | Get all Identity Schemas
+*IdentityAPI* | [**ListIdentitySessions**](docs/IdentityAPI.md#listidentitysessions) | **Get** /admin/identities/{id}/sessions | List an Identity&#39;s Sessions
+*IdentityAPI* | [**ListSessions**](docs/IdentityAPI.md#listsessions) | **Get** /admin/sessions | List All Sessions
+*IdentityAPI* | [**PatchIdentity**](docs/IdentityAPI.md#patchidentity) | **Patch** /admin/identities/{id} | Patch an Identity
+*IdentityAPI* | [**UpdateIdentity**](docs/IdentityAPI.md#updateidentity) | **Put** /admin/identities/{id} | Update an Identity
+*MetadataAPI* | [**GetVersion**](docs/MetadataAPI.md#getversion) | **Get** /version | Return Running Software Version.
+*MetadataAPI* | [**IsAlive**](docs/MetadataAPI.md#isalive) | **Get** /health/alive | Check HTTP Server Status
+*MetadataAPI* | [**IsReady**](docs/MetadataAPI.md#isready) | **Get** /health/ready | Check HTTP Server and Database Status
 
 
 ## Documentation For Models
@@ -142,6 +142,7 @@ Class | Method | HTTP request | Description
  - [ContinueWith](docs/ContinueWith.md)
  - [ContinueWithRecoveryUi](docs/ContinueWithRecoveryUi.md)
  - [ContinueWithRecoveryUiFlow](docs/ContinueWithRecoveryUiFlow.md)
+ - [ContinueWithRedirectBrowserTo](docs/ContinueWithRedirectBrowserTo.md)
  - [ContinueWithSetOrySessionToken](docs/ContinueWithSetOrySessionToken.md)
  - [ContinueWithSettingsUi](docs/ContinueWithSettingsUi.md)
  - [ContinueWithSettingsUiFlow](docs/ContinueWithSettingsUiFlow.md)
@@ -165,6 +166,7 @@ Class | Method | HTTP request | Description
  - [Identity](docs/Identity.md)
  - [IdentityCredentials](docs/IdentityCredentials.md)
  - [IdentityCredentialsCode](docs/IdentityCredentialsCode.md)
+ - [IdentityCredentialsCodeAddress](docs/IdentityCredentialsCodeAddress.md)
  - [IdentityCredentialsOidc](docs/IdentityCredentialsOidc.md)
  - [IdentityCredentialsOidcProvider](docs/IdentityCredentialsOidcProvider.md)
  - [IdentityCredentialsPassword](docs/IdentityCredentialsPassword.md)
@@ -222,6 +224,7 @@ Class | Method | HTTP request | Description
  - [UpdateIdentityBody](docs/UpdateIdentityBody.md)
  - [UpdateLoginFlowBody](docs/UpdateLoginFlowBody.md)
  - [UpdateLoginFlowWithCodeMethod](docs/UpdateLoginFlowWithCodeMethod.md)
+ - [UpdateLoginFlowWithIdentifierFirstMethod](docs/UpdateLoginFlowWithIdentifierFirstMethod.md)
  - [UpdateLoginFlowWithLookupSecretMethod](docs/UpdateLoginFlowWithLookupSecretMethod.md)
  - [UpdateLoginFlowWithOidcMethod](docs/UpdateLoginFlowWithOidcMethod.md)
  - [UpdateLoginFlowWithPasskeyMethod](docs/UpdateLoginFlowWithPasskeyMethod.md)
diff --git a/internal/httpclient/api_courier.go b/internal/httpclient/api_courier.go
index 91bcc08025eb..36f10d0a6281 100644
--- a/internal/httpclient/api_courier.go
+++ b/internal/httpclient/api_courier.go
@@ -25,48 +25,48 @@ var (
 	_ context.Context
 )
 
-type CourierApi interface {
+type CourierAPI interface {
 
 	/*
 	 * GetCourierMessage Get a Message
 	 * Gets a specific messages by the given ID.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 	 * @param id MessageID is the ID of the message.
-	 * @return CourierApiApiGetCourierMessageRequest
+	 * @return CourierAPIApiGetCourierMessageRequest
 	 */
-	GetCourierMessage(ctx context.Context, id string) CourierApiApiGetCourierMessageRequest
+	GetCourierMessage(ctx context.Context, id string) CourierAPIApiGetCourierMessageRequest
 
 	/*
 	 * GetCourierMessageExecute executes the request
 	 * @return Message
 	 */
-	GetCourierMessageExecute(r CourierApiApiGetCourierMessageRequest) (*Message, *http.Response, error)
+	GetCourierMessageExecute(r CourierAPIApiGetCourierMessageRequest) (*Message, *http.Response, error)
 
 	/*
 	 * ListCourierMessages List Messages
 	 * Lists all messages by given status and recipient.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-	 * @return CourierApiApiListCourierMessagesRequest
+	 * @return CourierAPIApiListCourierMessagesRequest
 	 */
-	ListCourierMessages(ctx context.Context) CourierApiApiListCourierMessagesRequest
+	ListCourierMessages(ctx context.Context) CourierAPIApiListCourierMessagesRequest
 
 	/*
 	 * ListCourierMessagesExecute executes the request
 	 * @return []Message
 	 */
-	ListCourierMessagesExecute(r CourierApiApiListCourierMessagesRequest) ([]Message, *http.Response, error)
+	ListCourierMessagesExecute(r CourierAPIApiListCourierMessagesRequest) ([]Message, *http.Response, error)
 }
 
-// CourierApiService CourierApi service
-type CourierApiService service
+// CourierAPIService CourierAPI service
+type CourierAPIService service
 
-type CourierApiApiGetCourierMessageRequest struct {
+type CourierAPIApiGetCourierMessageRequest struct {
 	ctx        context.Context
-	ApiService CourierApi
+	ApiService CourierAPI
 	id         string
 }
 
-func (r CourierApiApiGetCourierMessageRequest) Execute() (*Message, *http.Response, error) {
+func (r CourierAPIApiGetCourierMessageRequest) Execute() (*Message, *http.Response, error) {
 	return r.ApiService.GetCourierMessageExecute(r)
 }
 
@@ -75,10 +75,10 @@ func (r CourierApiApiGetCourierMessageRequest) Execute() (*Message, *http.Respon
  * Gets a specific messages by the given ID.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
  * @param id MessageID is the ID of the message.
- * @return CourierApiApiGetCourierMessageRequest
+ * @return CourierAPIApiGetCourierMessageRequest
  */
-func (a *CourierApiService) GetCourierMessage(ctx context.Context, id string) CourierApiApiGetCourierMessageRequest {
-	return CourierApiApiGetCourierMessageRequest{
+func (a *CourierAPIService) GetCourierMessage(ctx context.Context, id string) CourierAPIApiGetCourierMessageRequest {
+	return CourierAPIApiGetCourierMessageRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -89,7 +89,7 @@ func (a *CourierApiService) GetCourierMessage(ctx context.Context, id string) Co
  * Execute executes the request
  * @return Message
  */
-func (a *CourierApiService) GetCourierMessageExecute(r CourierApiApiGetCourierMessageRequest) (*Message, *http.Response, error) {
+func (a *CourierAPIService) GetCourierMessageExecute(r CourierAPIApiGetCourierMessageRequest) (*Message, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -99,7 +99,7 @@ func (a *CourierApiService) GetCourierMessageExecute(r CourierApiApiGetCourierMe
 		localVarReturnValue  *Message
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "CourierApiService.GetCourierMessage")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "CourierAPIService.GetCourierMessage")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -196,33 +196,33 @@ func (a *CourierApiService) GetCourierMessageExecute(r CourierApiApiGetCourierMe
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type CourierApiApiListCourierMessagesRequest struct {
+type CourierAPIApiListCourierMessagesRequest struct {
 	ctx        context.Context
-	ApiService CourierApi
+	ApiService CourierAPI
 	pageSize   *int64
 	pageToken  *string
 	status     *CourierMessageStatus
 	recipient  *string
 }
 
-func (r CourierApiApiListCourierMessagesRequest) PageSize(pageSize int64) CourierApiApiListCourierMessagesRequest {
+func (r CourierAPIApiListCourierMessagesRequest) PageSize(pageSize int64) CourierAPIApiListCourierMessagesRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r CourierApiApiListCourierMessagesRequest) PageToken(pageToken string) CourierApiApiListCourierMessagesRequest {
+func (r CourierAPIApiListCourierMessagesRequest) PageToken(pageToken string) CourierAPIApiListCourierMessagesRequest {
 	r.pageToken = &pageToken
 	return r
 }
-func (r CourierApiApiListCourierMessagesRequest) Status(status CourierMessageStatus) CourierApiApiListCourierMessagesRequest {
+func (r CourierAPIApiListCourierMessagesRequest) Status(status CourierMessageStatus) CourierAPIApiListCourierMessagesRequest {
 	r.status = &status
 	return r
 }
-func (r CourierApiApiListCourierMessagesRequest) Recipient(recipient string) CourierApiApiListCourierMessagesRequest {
+func (r CourierAPIApiListCourierMessagesRequest) Recipient(recipient string) CourierAPIApiListCourierMessagesRequest {
 	r.recipient = &recipient
 	return r
 }
 
-func (r CourierApiApiListCourierMessagesRequest) Execute() ([]Message, *http.Response, error) {
+func (r CourierAPIApiListCourierMessagesRequest) Execute() ([]Message, *http.Response, error) {
 	return r.ApiService.ListCourierMessagesExecute(r)
 }
 
@@ -230,10 +230,10 @@ func (r CourierApiApiListCourierMessagesRequest) Execute() ([]Message, *http.Res
  * ListCourierMessages List Messages
  * Lists all messages by given status and recipient.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- * @return CourierApiApiListCourierMessagesRequest
+ * @return CourierAPIApiListCourierMessagesRequest
  */
-func (a *CourierApiService) ListCourierMessages(ctx context.Context) CourierApiApiListCourierMessagesRequest {
-	return CourierApiApiListCourierMessagesRequest{
+func (a *CourierAPIService) ListCourierMessages(ctx context.Context) CourierAPIApiListCourierMessagesRequest {
+	return CourierAPIApiListCourierMessagesRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -243,7 +243,7 @@ func (a *CourierApiService) ListCourierMessages(ctx context.Context) CourierApiA
  * Execute executes the request
  * @return []Message
  */
-func (a *CourierApiService) ListCourierMessagesExecute(r CourierApiApiListCourierMessagesRequest) ([]Message, *http.Response, error) {
+func (a *CourierAPIService) ListCourierMessagesExecute(r CourierAPIApiListCourierMessagesRequest) ([]Message, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -253,7 +253,7 @@ func (a *CourierApiService) ListCourierMessagesExecute(r CourierApiApiListCourie
 		localVarReturnValue  []Message
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "CourierApiService.ListCourierMessages")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "CourierAPIService.ListCourierMessages")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
diff --git a/internal/httpclient/api_frontend.go b/internal/httpclient/api_frontend.go
index cfb87b55902a..97266e9c4c94 100644
--- a/internal/httpclient/api_frontend.go
+++ b/internal/httpclient/api_frontend.go
@@ -25,7 +25,7 @@ var (
 	_ context.Context
 )
 
-type FrontendApi interface {
+type FrontendAPI interface {
 
 	/*
 			 * CreateBrowserLoginFlow Create Login Flow for Browsers
@@ -53,15 +53,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserLoginFlowRequest
+			 * @return FrontendAPIApiCreateBrowserLoginFlowRequest
 	*/
-	CreateBrowserLoginFlow(ctx context.Context) FrontendApiApiCreateBrowserLoginFlowRequest
+	CreateBrowserLoginFlow(ctx context.Context) FrontendAPIApiCreateBrowserLoginFlowRequest
 
 	/*
 	 * CreateBrowserLoginFlowExecute executes the request
 	 * @return LoginFlow
 	 */
-	CreateBrowserLoginFlowExecute(r FrontendApiApiCreateBrowserLoginFlowRequest) (*LoginFlow, *http.Response, error)
+	CreateBrowserLoginFlowExecute(r FrontendAPIApiCreateBrowserLoginFlowRequest) (*LoginFlow, *http.Response, error)
 
 	/*
 			 * CreateBrowserLogoutFlow Create a Logout URL for Browsers
@@ -76,15 +76,15 @@ type FrontendApi interface {
 
 		When calling this endpoint from a backend, please ensure to properly forward the HTTP cookies.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserLogoutFlowRequest
+			 * @return FrontendAPIApiCreateBrowserLogoutFlowRequest
 	*/
-	CreateBrowserLogoutFlow(ctx context.Context) FrontendApiApiCreateBrowserLogoutFlowRequest
+	CreateBrowserLogoutFlow(ctx context.Context) FrontendAPIApiCreateBrowserLogoutFlowRequest
 
 	/*
 	 * CreateBrowserLogoutFlowExecute executes the request
 	 * @return LogoutFlow
 	 */
-	CreateBrowserLogoutFlowExecute(r FrontendApiApiCreateBrowserLogoutFlowRequest) (*LogoutFlow, *http.Response, error)
+	CreateBrowserLogoutFlowExecute(r FrontendAPIApiCreateBrowserLogoutFlowRequest) (*LogoutFlow, *http.Response, error)
 
 	/*
 			 * CreateBrowserRecoveryFlow Create Recovery Flow for Browsers
@@ -99,15 +99,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserRecoveryFlowRequest
+			 * @return FrontendAPIApiCreateBrowserRecoveryFlowRequest
 	*/
-	CreateBrowserRecoveryFlow(ctx context.Context) FrontendApiApiCreateBrowserRecoveryFlowRequest
+	CreateBrowserRecoveryFlow(ctx context.Context) FrontendAPIApiCreateBrowserRecoveryFlowRequest
 
 	/*
 	 * CreateBrowserRecoveryFlowExecute executes the request
 	 * @return RecoveryFlow
 	 */
-	CreateBrowserRecoveryFlowExecute(r FrontendApiApiCreateBrowserRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
+	CreateBrowserRecoveryFlowExecute(r FrontendAPIApiCreateBrowserRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
 
 	/*
 			 * CreateBrowserRegistrationFlow Create Registration Flow for Browsers
@@ -131,15 +131,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserRegistrationFlowRequest
+			 * @return FrontendAPIApiCreateBrowserRegistrationFlowRequest
 	*/
-	CreateBrowserRegistrationFlow(ctx context.Context) FrontendApiApiCreateBrowserRegistrationFlowRequest
+	CreateBrowserRegistrationFlow(ctx context.Context) FrontendAPIApiCreateBrowserRegistrationFlowRequest
 
 	/*
 	 * CreateBrowserRegistrationFlowExecute executes the request
 	 * @return RegistrationFlow
 	 */
-	CreateBrowserRegistrationFlowExecute(r FrontendApiApiCreateBrowserRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
+	CreateBrowserRegistrationFlowExecute(r FrontendAPIApiCreateBrowserRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
 
 	/*
 			 * CreateBrowserSettingsFlow Create Settings Flow for Browsers
@@ -170,15 +170,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserSettingsFlowRequest
+			 * @return FrontendAPIApiCreateBrowserSettingsFlowRequest
 	*/
-	CreateBrowserSettingsFlow(ctx context.Context) FrontendApiApiCreateBrowserSettingsFlowRequest
+	CreateBrowserSettingsFlow(ctx context.Context) FrontendAPIApiCreateBrowserSettingsFlowRequest
 
 	/*
 	 * CreateBrowserSettingsFlowExecute executes the request
 	 * @return SettingsFlow
 	 */
-	CreateBrowserSettingsFlowExecute(r FrontendApiApiCreateBrowserSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
+	CreateBrowserSettingsFlowExecute(r FrontendAPIApiCreateBrowserSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
 
 	/*
 			 * CreateBrowserVerificationFlow Create Verification Flow for Browser Clients
@@ -191,15 +191,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateBrowserVerificationFlowRequest
+			 * @return FrontendAPIApiCreateBrowserVerificationFlowRequest
 	*/
-	CreateBrowserVerificationFlow(ctx context.Context) FrontendApiApiCreateBrowserVerificationFlowRequest
+	CreateBrowserVerificationFlow(ctx context.Context) FrontendAPIApiCreateBrowserVerificationFlowRequest
 
 	/*
 	 * CreateBrowserVerificationFlowExecute executes the request
 	 * @return VerificationFlow
 	 */
-	CreateBrowserVerificationFlowExecute(r FrontendApiApiCreateBrowserVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
+	CreateBrowserVerificationFlowExecute(r FrontendAPIApiCreateBrowserVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
 
 	/*
 			 * CreateNativeLoginFlow Create Login Flow for Native Apps
@@ -224,15 +224,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateNativeLoginFlowRequest
+			 * @return FrontendAPIApiCreateNativeLoginFlowRequest
 	*/
-	CreateNativeLoginFlow(ctx context.Context) FrontendApiApiCreateNativeLoginFlowRequest
+	CreateNativeLoginFlow(ctx context.Context) FrontendAPIApiCreateNativeLoginFlowRequest
 
 	/*
 	 * CreateNativeLoginFlowExecute executes the request
 	 * @return LoginFlow
 	 */
-	CreateNativeLoginFlowExecute(r FrontendApiApiCreateNativeLoginFlowRequest) (*LoginFlow, *http.Response, error)
+	CreateNativeLoginFlowExecute(r FrontendAPIApiCreateNativeLoginFlowRequest) (*LoginFlow, *http.Response, error)
 
 	/*
 			 * CreateNativeRecoveryFlow Create Recovery Flow for Native Apps
@@ -250,15 +250,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateNativeRecoveryFlowRequest
+			 * @return FrontendAPIApiCreateNativeRecoveryFlowRequest
 	*/
-	CreateNativeRecoveryFlow(ctx context.Context) FrontendApiApiCreateNativeRecoveryFlowRequest
+	CreateNativeRecoveryFlow(ctx context.Context) FrontendAPIApiCreateNativeRecoveryFlowRequest
 
 	/*
 	 * CreateNativeRecoveryFlowExecute executes the request
 	 * @return RecoveryFlow
 	 */
-	CreateNativeRecoveryFlowExecute(r FrontendApiApiCreateNativeRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
+	CreateNativeRecoveryFlowExecute(r FrontendAPIApiCreateNativeRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
 
 	/*
 			 * CreateNativeRegistrationFlow Create Registration Flow for Native Apps
@@ -282,15 +282,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateNativeRegistrationFlowRequest
+			 * @return FrontendAPIApiCreateNativeRegistrationFlowRequest
 	*/
-	CreateNativeRegistrationFlow(ctx context.Context) FrontendApiApiCreateNativeRegistrationFlowRequest
+	CreateNativeRegistrationFlow(ctx context.Context) FrontendAPIApiCreateNativeRegistrationFlowRequest
 
 	/*
 	 * CreateNativeRegistrationFlowExecute executes the request
 	 * @return RegistrationFlow
 	 */
-	CreateNativeRegistrationFlowExecute(r FrontendApiApiCreateNativeRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
+	CreateNativeRegistrationFlowExecute(r FrontendAPIApiCreateNativeRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
 
 	/*
 			 * CreateNativeSettingsFlow Create Settings Flow for Native Apps
@@ -317,15 +317,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateNativeSettingsFlowRequest
+			 * @return FrontendAPIApiCreateNativeSettingsFlowRequest
 	*/
-	CreateNativeSettingsFlow(ctx context.Context) FrontendApiApiCreateNativeSettingsFlowRequest
+	CreateNativeSettingsFlow(ctx context.Context) FrontendAPIApiCreateNativeSettingsFlowRequest
 
 	/*
 	 * CreateNativeSettingsFlowExecute executes the request
 	 * @return SettingsFlow
 	 */
-	CreateNativeSettingsFlowExecute(r FrontendApiApiCreateNativeSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
+	CreateNativeSettingsFlowExecute(r FrontendAPIApiCreateNativeSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
 
 	/*
 			 * CreateNativeVerificationFlow Create Verification Flow for Native Apps
@@ -341,30 +341,30 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiCreateNativeVerificationFlowRequest
+			 * @return FrontendAPIApiCreateNativeVerificationFlowRequest
 	*/
-	CreateNativeVerificationFlow(ctx context.Context) FrontendApiApiCreateNativeVerificationFlowRequest
+	CreateNativeVerificationFlow(ctx context.Context) FrontendAPIApiCreateNativeVerificationFlowRequest
 
 	/*
 	 * CreateNativeVerificationFlowExecute executes the request
 	 * @return VerificationFlow
 	 */
-	CreateNativeVerificationFlowExecute(r FrontendApiApiCreateNativeVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
+	CreateNativeVerificationFlowExecute(r FrontendAPIApiCreateNativeVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
 
 	/*
 			 * DisableMyOtherSessions Disable my other sessions
 			 * Calling this endpoint invalidates all except the current session that belong to the logged-in user.
 		Session data are not deleted.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiDisableMyOtherSessionsRequest
+			 * @return FrontendAPIApiDisableMyOtherSessionsRequest
 	*/
-	DisableMyOtherSessions(ctx context.Context) FrontendApiApiDisableMyOtherSessionsRequest
+	DisableMyOtherSessions(ctx context.Context) FrontendAPIApiDisableMyOtherSessionsRequest
 
 	/*
 	 * DisableMyOtherSessionsExecute executes the request
 	 * @return DeleteMySessionsCount
 	 */
-	DisableMyOtherSessionsExecute(r FrontendApiApiDisableMyOtherSessionsRequest) (*DeleteMySessionsCount, *http.Response, error)
+	DisableMyOtherSessionsExecute(r FrontendAPIApiDisableMyOtherSessionsRequest) (*DeleteMySessionsCount, *http.Response, error)
 
 	/*
 			 * DisableMySession Disable one of my sessions
@@ -372,27 +372,27 @@ type FrontendApi interface {
 		Session data are not deleted.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID is the session's ID.
-			 * @return FrontendApiApiDisableMySessionRequest
+			 * @return FrontendAPIApiDisableMySessionRequest
 	*/
-	DisableMySession(ctx context.Context, id string) FrontendApiApiDisableMySessionRequest
+	DisableMySession(ctx context.Context, id string) FrontendAPIApiDisableMySessionRequest
 
 	/*
 	 * DisableMySessionExecute executes the request
 	 */
-	DisableMySessionExecute(r FrontendApiApiDisableMySessionRequest) (*http.Response, error)
+	DisableMySessionExecute(r FrontendAPIApiDisableMySessionRequest) (*http.Response, error)
 
 	/*
 	 * ExchangeSessionToken Exchange Session Token
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-	 * @return FrontendApiApiExchangeSessionTokenRequest
+	 * @return FrontendAPIApiExchangeSessionTokenRequest
 	 */
-	ExchangeSessionToken(ctx context.Context) FrontendApiApiExchangeSessionTokenRequest
+	ExchangeSessionToken(ctx context.Context) FrontendAPIApiExchangeSessionTokenRequest
 
 	/*
 	 * ExchangeSessionTokenExecute executes the request
 	 * @return SuccessfulNativeLogin
 	 */
-	ExchangeSessionTokenExecute(r FrontendApiApiExchangeSessionTokenRequest) (*SuccessfulNativeLogin, *http.Response, error)
+	ExchangeSessionTokenExecute(r FrontendAPIApiExchangeSessionTokenRequest) (*SuccessfulNativeLogin, *http.Response, error)
 
 	/*
 			 * GetFlowError Get User-Flow Errors
@@ -404,15 +404,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User User Facing Error Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-facing-errors).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetFlowErrorRequest
+			 * @return FrontendAPIApiGetFlowErrorRequest
 	*/
-	GetFlowError(ctx context.Context) FrontendApiApiGetFlowErrorRequest
+	GetFlowError(ctx context.Context) FrontendAPIApiGetFlowErrorRequest
 
 	/*
 	 * GetFlowErrorExecute executes the request
 	 * @return FlowError
 	 */
-	GetFlowErrorExecute(r FrontendApiApiGetFlowErrorRequest) (*FlowError, *http.Response, error)
+	GetFlowErrorExecute(r FrontendAPIApiGetFlowErrorRequest) (*FlowError, *http.Response, error)
 
 	/*
 			 * GetLoginFlow Get Login Flow
@@ -440,15 +440,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetLoginFlowRequest
+			 * @return FrontendAPIApiGetLoginFlowRequest
 	*/
-	GetLoginFlow(ctx context.Context) FrontendApiApiGetLoginFlowRequest
+	GetLoginFlow(ctx context.Context) FrontendAPIApiGetLoginFlowRequest
 
 	/*
 	 * GetLoginFlowExecute executes the request
 	 * @return LoginFlow
 	 */
-	GetLoginFlowExecute(r FrontendApiApiGetLoginFlowRequest) (*LoginFlow, *http.Response, error)
+	GetLoginFlowExecute(r FrontendAPIApiGetLoginFlowRequest) (*LoginFlow, *http.Response, error)
 
 	/*
 			 * GetRecoveryFlow Get Recovery Flow
@@ -471,15 +471,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetRecoveryFlowRequest
+			 * @return FrontendAPIApiGetRecoveryFlowRequest
 	*/
-	GetRecoveryFlow(ctx context.Context) FrontendApiApiGetRecoveryFlowRequest
+	GetRecoveryFlow(ctx context.Context) FrontendAPIApiGetRecoveryFlowRequest
 
 	/*
 	 * GetRecoveryFlowExecute executes the request
 	 * @return RecoveryFlow
 	 */
-	GetRecoveryFlowExecute(r FrontendApiApiGetRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
+	GetRecoveryFlowExecute(r FrontendAPIApiGetRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
 
 	/*
 			 * GetRegistrationFlow Get Registration Flow
@@ -507,15 +507,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetRegistrationFlowRequest
+			 * @return FrontendAPIApiGetRegistrationFlowRequest
 	*/
-	GetRegistrationFlow(ctx context.Context) FrontendApiApiGetRegistrationFlowRequest
+	GetRegistrationFlow(ctx context.Context) FrontendAPIApiGetRegistrationFlowRequest
 
 	/*
 	 * GetRegistrationFlowExecute executes the request
 	 * @return RegistrationFlow
 	 */
-	GetRegistrationFlowExecute(r FrontendApiApiGetRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
+	GetRegistrationFlowExecute(r FrontendAPIApiGetRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error)
 
 	/*
 			 * GetSettingsFlow Get Settings Flow
@@ -539,15 +539,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetSettingsFlowRequest
+			 * @return FrontendAPIApiGetSettingsFlowRequest
 	*/
-	GetSettingsFlow(ctx context.Context) FrontendApiApiGetSettingsFlowRequest
+	GetSettingsFlow(ctx context.Context) FrontendAPIApiGetSettingsFlowRequest
 
 	/*
 	 * GetSettingsFlowExecute executes the request
 	 * @return SettingsFlow
 	 */
-	GetSettingsFlowExecute(r FrontendApiApiGetSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
+	GetSettingsFlowExecute(r FrontendAPIApiGetSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
 
 	/*
 			 * GetVerificationFlow Get Verification Flow
@@ -570,15 +570,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetVerificationFlowRequest
+			 * @return FrontendAPIApiGetVerificationFlowRequest
 	*/
-	GetVerificationFlow(ctx context.Context) FrontendApiApiGetVerificationFlowRequest
+	GetVerificationFlow(ctx context.Context) FrontendAPIApiGetVerificationFlowRequest
 
 	/*
 	 * GetVerificationFlowExecute executes the request
 	 * @return VerificationFlow
 	 */
-	GetVerificationFlowExecute(r FrontendApiApiGetVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
+	GetVerificationFlowExecute(r FrontendAPIApiGetVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
 
 	/*
 			 * GetWebAuthnJavaScript Get WebAuthn JavaScript
@@ -592,30 +592,30 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiGetWebAuthnJavaScriptRequest
+			 * @return FrontendAPIApiGetWebAuthnJavaScriptRequest
 	*/
-	GetWebAuthnJavaScript(ctx context.Context) FrontendApiApiGetWebAuthnJavaScriptRequest
+	GetWebAuthnJavaScript(ctx context.Context) FrontendAPIApiGetWebAuthnJavaScriptRequest
 
 	/*
 	 * GetWebAuthnJavaScriptExecute executes the request
 	 * @return string
 	 */
-	GetWebAuthnJavaScriptExecute(r FrontendApiApiGetWebAuthnJavaScriptRequest) (string, *http.Response, error)
+	GetWebAuthnJavaScriptExecute(r FrontendAPIApiGetWebAuthnJavaScriptRequest) (string, *http.Response, error)
 
 	/*
 			 * ListMySessions Get My Active Sessions
 			 * This endpoints returns all other active sessions that belong to the logged-in user.
 		The current session can be retrieved by calling the `/sessions/whoami` endpoint.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiListMySessionsRequest
+			 * @return FrontendAPIApiListMySessionsRequest
 	*/
-	ListMySessions(ctx context.Context) FrontendApiApiListMySessionsRequest
+	ListMySessions(ctx context.Context) FrontendAPIApiListMySessionsRequest
 
 	/*
 	 * ListMySessionsExecute executes the request
 	 * @return []Session
 	 */
-	ListMySessionsExecute(r FrontendApiApiListMySessionsRequest) ([]Session, *http.Response, error)
+	ListMySessionsExecute(r FrontendAPIApiListMySessionsRequest) ([]Session, *http.Response, error)
 
 	/*
 			 * PerformNativeLogout Perform Logout for Native Apps
@@ -628,14 +628,14 @@ type FrontendApi interface {
 		This endpoint does not remove any HTTP
 		Cookies - use the Browser-Based Self-Service Logout Flow instead.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiPerformNativeLogoutRequest
+			 * @return FrontendAPIApiPerformNativeLogoutRequest
 	*/
-	PerformNativeLogout(ctx context.Context) FrontendApiApiPerformNativeLogoutRequest
+	PerformNativeLogout(ctx context.Context) FrontendAPIApiPerformNativeLogoutRequest
 
 	/*
 	 * PerformNativeLogoutExecute executes the request
 	 */
-	PerformNativeLogoutExecute(r FrontendApiApiPerformNativeLogoutRequest) (*http.Response, error)
+	PerformNativeLogoutExecute(r FrontendAPIApiPerformNativeLogoutRequest) (*http.Response, error)
 
 	/*
 			 * ToSession Check Who the Current HTTP Session Belongs To
@@ -699,15 +699,15 @@ type FrontendApi interface {
 		`session_inactive`: No active session was found in the request (e.g. no Ory Session Cookie / Ory Session Token).
 		`session_aal2_required`: An active session was found but it does not fulfil the Authenticator Assurance Level, implying that the session must (e.g.) authenticate the second factor.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiToSessionRequest
+			 * @return FrontendAPIApiToSessionRequest
 	*/
-	ToSession(ctx context.Context) FrontendApiApiToSessionRequest
+	ToSession(ctx context.Context) FrontendAPIApiToSessionRequest
 
 	/*
 	 * ToSessionExecute executes the request
 	 * @return Session
 	 */
-	ToSessionExecute(r FrontendApiApiToSessionRequest) (*Session, *http.Response, error)
+	ToSessionExecute(r FrontendAPIApiToSessionRequest) (*Session, *http.Response, error)
 
 	/*
 			 * UpdateLoginFlow Submit a Login Flow
@@ -739,15 +739,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateLoginFlowRequest
+			 * @return FrontendAPIApiUpdateLoginFlowRequest
 	*/
-	UpdateLoginFlow(ctx context.Context) FrontendApiApiUpdateLoginFlowRequest
+	UpdateLoginFlow(ctx context.Context) FrontendAPIApiUpdateLoginFlowRequest
 
 	/*
 	 * UpdateLoginFlowExecute executes the request
 	 * @return SuccessfulNativeLogin
 	 */
-	UpdateLoginFlowExecute(r FrontendApiApiUpdateLoginFlowRequest) (*SuccessfulNativeLogin, *http.Response, error)
+	UpdateLoginFlowExecute(r FrontendAPIApiUpdateLoginFlowRequest) (*SuccessfulNativeLogin, *http.Response, error)
 
 	/*
 			 * UpdateLogoutFlow Update Logout Flow
@@ -765,14 +765,14 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Logout Documentation](https://www.ory.sh/docs/next/kratos/self-service/flows/user-logout).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateLogoutFlowRequest
+			 * @return FrontendAPIApiUpdateLogoutFlowRequest
 	*/
-	UpdateLogoutFlow(ctx context.Context) FrontendApiApiUpdateLogoutFlowRequest
+	UpdateLogoutFlow(ctx context.Context) FrontendAPIApiUpdateLogoutFlowRequest
 
 	/*
 	 * UpdateLogoutFlowExecute executes the request
 	 */
-	UpdateLogoutFlowExecute(r FrontendApiApiUpdateLogoutFlowRequest) (*http.Response, error)
+	UpdateLogoutFlowExecute(r FrontendAPIApiUpdateLogoutFlowRequest) (*http.Response, error)
 
 	/*
 			 * UpdateRecoveryFlow Update Recovery Flow
@@ -793,15 +793,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateRecoveryFlowRequest
+			 * @return FrontendAPIApiUpdateRecoveryFlowRequest
 	*/
-	UpdateRecoveryFlow(ctx context.Context) FrontendApiApiUpdateRecoveryFlowRequest
+	UpdateRecoveryFlow(ctx context.Context) FrontendAPIApiUpdateRecoveryFlowRequest
 
 	/*
 	 * UpdateRecoveryFlowExecute executes the request
 	 * @return RecoveryFlow
 	 */
-	UpdateRecoveryFlowExecute(r FrontendApiApiUpdateRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
+	UpdateRecoveryFlowExecute(r FrontendAPIApiUpdateRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error)
 
 	/*
 			 * UpdateRegistrationFlow Update Registration Flow
@@ -834,15 +834,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateRegistrationFlowRequest
+			 * @return FrontendAPIApiUpdateRegistrationFlowRequest
 	*/
-	UpdateRegistrationFlow(ctx context.Context) FrontendApiApiUpdateRegistrationFlowRequest
+	UpdateRegistrationFlow(ctx context.Context) FrontendAPIApiUpdateRegistrationFlowRequest
 
 	/*
 	 * UpdateRegistrationFlowExecute executes the request
 	 * @return SuccessfulNativeRegistration
 	 */
-	UpdateRegistrationFlowExecute(r FrontendApiApiUpdateRegistrationFlowRequest) (*SuccessfulNativeRegistration, *http.Response, error)
+	UpdateRegistrationFlowExecute(r FrontendAPIApiUpdateRegistrationFlowRequest) (*SuccessfulNativeRegistration, *http.Response, error)
 
 	/*
 			 * UpdateSettingsFlow Complete Settings Flow
@@ -890,15 +890,15 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateSettingsFlowRequest
+			 * @return FrontendAPIApiUpdateSettingsFlowRequest
 	*/
-	UpdateSettingsFlow(ctx context.Context) FrontendApiApiUpdateSettingsFlowRequest
+	UpdateSettingsFlow(ctx context.Context) FrontendAPIApiUpdateSettingsFlowRequest
 
 	/*
 	 * UpdateSettingsFlowExecute executes the request
 	 * @return SettingsFlow
 	 */
-	UpdateSettingsFlowExecute(r FrontendApiApiUpdateSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
+	UpdateSettingsFlowExecute(r FrontendAPIApiUpdateSettingsFlowRequest) (*SettingsFlow, *http.Response, error)
 
 	/*
 			 * UpdateVerificationFlow Complete Verification Flow
@@ -919,23 +919,23 @@ type FrontendApi interface {
 
 		More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return FrontendApiApiUpdateVerificationFlowRequest
+			 * @return FrontendAPIApiUpdateVerificationFlowRequest
 	*/
-	UpdateVerificationFlow(ctx context.Context) FrontendApiApiUpdateVerificationFlowRequest
+	UpdateVerificationFlow(ctx context.Context) FrontendAPIApiUpdateVerificationFlowRequest
 
 	/*
 	 * UpdateVerificationFlowExecute executes the request
 	 * @return VerificationFlow
 	 */
-	UpdateVerificationFlowExecute(r FrontendApiApiUpdateVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
+	UpdateVerificationFlowExecute(r FrontendAPIApiUpdateVerificationFlowRequest) (*VerificationFlow, *http.Response, error)
 }
 
-// FrontendApiService FrontendApi service
-type FrontendApiService service
+// FrontendAPIService FrontendAPI service
+type FrontendAPIService service
 
-type FrontendApiApiCreateBrowserLoginFlowRequest struct {
+type FrontendAPIApiCreateBrowserLoginFlowRequest struct {
 	ctx            context.Context
-	ApiService     FrontendApi
+	ApiService     FrontendAPI
 	refresh        *bool
 	aal            *string
 	returnTo       *string
@@ -945,36 +945,36 @@ type FrontendApiApiCreateBrowserLoginFlowRequest struct {
 	via            *string
 }
 
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Refresh(refresh bool) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Refresh(refresh bool) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.refresh = &refresh
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Aal(aal string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Aal(aal string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.aal = &aal
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Cookie(cookie string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Cookie(cookie string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.cookie = &cookie
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) LoginChallenge(loginChallenge string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) LoginChallenge(loginChallenge string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.loginChallenge = &loginChallenge
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Organization(organization string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Organization(organization string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.organization = &organization
 	return r
 }
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Via(via string) FrontendApiApiCreateBrowserLoginFlowRequest {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Via(via string) FrontendAPIApiCreateBrowserLoginFlowRequest {
 	r.via = &via
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserLoginFlowExecute(r)
 }
 
@@ -1005,10 +1005,10 @@ This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Fi
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserLoginFlowRequest
+  - @return FrontendAPIApiCreateBrowserLoginFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserLoginFlow(ctx context.Context) FrontendApiApiCreateBrowserLoginFlowRequest {
-	return FrontendApiApiCreateBrowserLoginFlowRequest{
+func (a *FrontendAPIService) CreateBrowserLoginFlow(ctx context.Context) FrontendAPIApiCreateBrowserLoginFlowRequest {
+	return FrontendAPIApiCreateBrowserLoginFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1018,7 +1018,7 @@ func (a *FrontendApiService) CreateBrowserLoginFlow(ctx context.Context) Fronten
  * Execute executes the request
  * @return LoginFlow
  */
-func (a *FrontendApiService) CreateBrowserLoginFlowExecute(r FrontendApiApiCreateBrowserLoginFlowRequest) (*LoginFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserLoginFlowExecute(r FrontendAPIApiCreateBrowserLoginFlowRequest) (*LoginFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1028,7 +1028,7 @@ func (a *FrontendApiService) CreateBrowserLoginFlowExecute(r FrontendApiApiCreat
 		localVarReturnValue  *LoginFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserLoginFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserLoginFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1131,23 +1131,23 @@ func (a *FrontendApiService) CreateBrowserLoginFlowExecute(r FrontendApiApiCreat
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateBrowserLogoutFlowRequest struct {
+type FrontendAPIApiCreateBrowserLogoutFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	cookie     *string
 	returnTo   *string
 }
 
-func (r FrontendApiApiCreateBrowserLogoutFlowRequest) Cookie(cookie string) FrontendApiApiCreateBrowserLogoutFlowRequest {
+func (r FrontendAPIApiCreateBrowserLogoutFlowRequest) Cookie(cookie string) FrontendAPIApiCreateBrowserLogoutFlowRequest {
 	r.cookie = &cookie
 	return r
 }
-func (r FrontendApiApiCreateBrowserLogoutFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserLogoutFlowRequest {
+func (r FrontendAPIApiCreateBrowserLogoutFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserLogoutFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserLogoutFlowRequest) Execute() (*LogoutFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserLogoutFlowRequest) Execute() (*LogoutFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserLogoutFlowExecute(r)
 }
 
@@ -1164,10 +1164,10 @@ a 401 error.
 
 When calling this endpoint from a backend, please ensure to properly forward the HTTP cookies.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserLogoutFlowRequest
+  - @return FrontendAPIApiCreateBrowserLogoutFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserLogoutFlow(ctx context.Context) FrontendApiApiCreateBrowserLogoutFlowRequest {
-	return FrontendApiApiCreateBrowserLogoutFlowRequest{
+func (a *FrontendAPIService) CreateBrowserLogoutFlow(ctx context.Context) FrontendAPIApiCreateBrowserLogoutFlowRequest {
+	return FrontendAPIApiCreateBrowserLogoutFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1177,7 +1177,7 @@ func (a *FrontendApiService) CreateBrowserLogoutFlow(ctx context.Context) Fronte
  * Execute executes the request
  * @return LogoutFlow
  */
-func (a *FrontendApiService) CreateBrowserLogoutFlowExecute(r FrontendApiApiCreateBrowserLogoutFlowRequest) (*LogoutFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserLogoutFlowExecute(r FrontendAPIApiCreateBrowserLogoutFlowRequest) (*LogoutFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1187,7 +1187,7 @@ func (a *FrontendApiService) CreateBrowserLogoutFlowExecute(r FrontendApiApiCrea
 		localVarReturnValue  *LogoutFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserLogoutFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserLogoutFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1287,18 +1287,18 @@ func (a *FrontendApiService) CreateBrowserLogoutFlowExecute(r FrontendApiApiCrea
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateBrowserRecoveryFlowRequest struct {
+type FrontendAPIApiCreateBrowserRecoveryFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	returnTo   *string
 }
 
-func (r FrontendApiApiCreateBrowserRecoveryFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserRecoveryFlowRequest {
+func (r FrontendAPIApiCreateBrowserRecoveryFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserRecoveryFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserRecoveryFlowExecute(r)
 }
 
@@ -1316,10 +1316,10 @@ This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Fi
 
 More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserRecoveryFlowRequest
+  - @return FrontendAPIApiCreateBrowserRecoveryFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserRecoveryFlow(ctx context.Context) FrontendApiApiCreateBrowserRecoveryFlowRequest {
-	return FrontendApiApiCreateBrowserRecoveryFlowRequest{
+func (a *FrontendAPIService) CreateBrowserRecoveryFlow(ctx context.Context) FrontendAPIApiCreateBrowserRecoveryFlowRequest {
+	return FrontendAPIApiCreateBrowserRecoveryFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1329,7 +1329,7 @@ func (a *FrontendApiService) CreateBrowserRecoveryFlow(ctx context.Context) Fron
  * Execute executes the request
  * @return RecoveryFlow
  */
-func (a *FrontendApiService) CreateBrowserRecoveryFlowExecute(r FrontendApiApiCreateBrowserRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserRecoveryFlowExecute(r FrontendAPIApiCreateBrowserRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1339,7 +1339,7 @@ func (a *FrontendApiService) CreateBrowserRecoveryFlowExecute(r FrontendApiApiCr
 		localVarReturnValue  *RecoveryFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserRecoveryFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserRecoveryFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1424,33 +1424,33 @@ func (a *FrontendApiService) CreateBrowserRecoveryFlowExecute(r FrontendApiApiCr
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateBrowserRegistrationFlowRequest struct {
+type FrontendAPIApiCreateBrowserRegistrationFlowRequest struct {
 	ctx                       context.Context
-	ApiService                FrontendApi
+	ApiService                FrontendAPI
 	returnTo                  *string
 	loginChallenge            *string
 	afterVerificationReturnTo *string
 	organization              *string
 }
 
-func (r FrontendApiApiCreateBrowserRegistrationFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserRegistrationFlowRequest {
+func (r FrontendAPIApiCreateBrowserRegistrationFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserRegistrationFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r FrontendApiApiCreateBrowserRegistrationFlowRequest) LoginChallenge(loginChallenge string) FrontendApiApiCreateBrowserRegistrationFlowRequest {
+func (r FrontendAPIApiCreateBrowserRegistrationFlowRequest) LoginChallenge(loginChallenge string) FrontendAPIApiCreateBrowserRegistrationFlowRequest {
 	r.loginChallenge = &loginChallenge
 	return r
 }
-func (r FrontendApiApiCreateBrowserRegistrationFlowRequest) AfterVerificationReturnTo(afterVerificationReturnTo string) FrontendApiApiCreateBrowserRegistrationFlowRequest {
+func (r FrontendAPIApiCreateBrowserRegistrationFlowRequest) AfterVerificationReturnTo(afterVerificationReturnTo string) FrontendAPIApiCreateBrowserRegistrationFlowRequest {
 	r.afterVerificationReturnTo = &afterVerificationReturnTo
 	return r
 }
-func (r FrontendApiApiCreateBrowserRegistrationFlowRequest) Organization(organization string) FrontendApiApiCreateBrowserRegistrationFlowRequest {
+func (r FrontendAPIApiCreateBrowserRegistrationFlowRequest) Organization(organization string) FrontendAPIApiCreateBrowserRegistrationFlowRequest {
 	r.organization = &organization
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserRegistrationFlowExecute(r)
 }
 
@@ -1477,10 +1477,10 @@ This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Fi
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserRegistrationFlowRequest
+  - @return FrontendAPIApiCreateBrowserRegistrationFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserRegistrationFlow(ctx context.Context) FrontendApiApiCreateBrowserRegistrationFlowRequest {
-	return FrontendApiApiCreateBrowserRegistrationFlowRequest{
+func (a *FrontendAPIService) CreateBrowserRegistrationFlow(ctx context.Context) FrontendAPIApiCreateBrowserRegistrationFlowRequest {
+	return FrontendAPIApiCreateBrowserRegistrationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1490,7 +1490,7 @@ func (a *FrontendApiService) CreateBrowserRegistrationFlow(ctx context.Context)
  * Execute executes the request
  * @return RegistrationFlow
  */
-func (a *FrontendApiService) CreateBrowserRegistrationFlowExecute(r FrontendApiApiCreateBrowserRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserRegistrationFlowExecute(r FrontendAPIApiCreateBrowserRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1500,7 +1500,7 @@ func (a *FrontendApiService) CreateBrowserRegistrationFlowExecute(r FrontendApiA
 		localVarReturnValue  *RegistrationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserRegistrationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserRegistrationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1584,23 +1584,23 @@ func (a *FrontendApiService) CreateBrowserRegistrationFlowExecute(r FrontendApiA
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateBrowserSettingsFlowRequest struct {
+type FrontendAPIApiCreateBrowserSettingsFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	returnTo   *string
 	cookie     *string
 }
 
-func (r FrontendApiApiCreateBrowserSettingsFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserSettingsFlowRequest {
+func (r FrontendAPIApiCreateBrowserSettingsFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserSettingsFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r FrontendApiApiCreateBrowserSettingsFlowRequest) Cookie(cookie string) FrontendApiApiCreateBrowserSettingsFlowRequest {
+func (r FrontendAPIApiCreateBrowserSettingsFlowRequest) Cookie(cookie string) FrontendAPIApiCreateBrowserSettingsFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserSettingsFlowExecute(r)
 }
 
@@ -1634,10 +1634,10 @@ This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Fi
 
 More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserSettingsFlowRequest
+  - @return FrontendAPIApiCreateBrowserSettingsFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserSettingsFlow(ctx context.Context) FrontendApiApiCreateBrowserSettingsFlowRequest {
-	return FrontendApiApiCreateBrowserSettingsFlowRequest{
+func (a *FrontendAPIService) CreateBrowserSettingsFlow(ctx context.Context) FrontendAPIApiCreateBrowserSettingsFlowRequest {
+	return FrontendAPIApiCreateBrowserSettingsFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1647,7 +1647,7 @@ func (a *FrontendApiService) CreateBrowserSettingsFlow(ctx context.Context) Fron
  * Execute executes the request
  * @return SettingsFlow
  */
-func (a *FrontendApiService) CreateBrowserSettingsFlowExecute(r FrontendApiApiCreateBrowserSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserSettingsFlowExecute(r FrontendAPIApiCreateBrowserSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1657,7 +1657,7 @@ func (a *FrontendApiService) CreateBrowserSettingsFlowExecute(r FrontendApiApiCr
 		localVarReturnValue  *SettingsFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserSettingsFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserSettingsFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1765,18 +1765,18 @@ func (a *FrontendApiService) CreateBrowserSettingsFlowExecute(r FrontendApiApiCr
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateBrowserVerificationFlowRequest struct {
+type FrontendAPIApiCreateBrowserVerificationFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	returnTo   *string
 }
 
-func (r FrontendApiApiCreateBrowserVerificationFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateBrowserVerificationFlowRequest {
+func (r FrontendAPIApiCreateBrowserVerificationFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateBrowserVerificationFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
 
-func (r FrontendApiApiCreateBrowserVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateBrowserVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
 	return r.ApiService.CreateBrowserVerificationFlowExecute(r)
 }
 
@@ -1792,10 +1792,10 @@ This endpoint is NOT INTENDED for API clients and only works with browsers (Chro
 
 More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateBrowserVerificationFlowRequest
+  - @return FrontendAPIApiCreateBrowserVerificationFlowRequest
 */
-func (a *FrontendApiService) CreateBrowserVerificationFlow(ctx context.Context) FrontendApiApiCreateBrowserVerificationFlowRequest {
-	return FrontendApiApiCreateBrowserVerificationFlowRequest{
+func (a *FrontendAPIService) CreateBrowserVerificationFlow(ctx context.Context) FrontendAPIApiCreateBrowserVerificationFlowRequest {
+	return FrontendAPIApiCreateBrowserVerificationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1805,7 +1805,7 @@ func (a *FrontendApiService) CreateBrowserVerificationFlow(ctx context.Context)
  * Execute executes the request
  * @return VerificationFlow
  */
-func (a *FrontendApiService) CreateBrowserVerificationFlowExecute(r FrontendApiApiCreateBrowserVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateBrowserVerificationFlowExecute(r FrontendAPIApiCreateBrowserVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1815,7 +1815,7 @@ func (a *FrontendApiService) CreateBrowserVerificationFlowExecute(r FrontendApiA
 		localVarReturnValue  *VerificationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateBrowserVerificationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateBrowserVerificationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1890,43 +1890,48 @@ func (a *FrontendApiService) CreateBrowserVerificationFlowExecute(r FrontendApiA
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateNativeLoginFlowRequest struct {
+type FrontendAPIApiCreateNativeLoginFlowRequest struct {
 	ctx                            context.Context
-	ApiService                     FrontendApi
+	ApiService                     FrontendAPI
 	refresh                        *bool
 	aal                            *string
 	xSessionToken                  *string
 	returnSessionTokenExchangeCode *bool
 	returnTo                       *string
+	organization                   *string
 	via                            *string
 }
 
-func (r FrontendApiApiCreateNativeLoginFlowRequest) Refresh(refresh bool) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) Refresh(refresh bool) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.refresh = &refresh
 	return r
 }
-func (r FrontendApiApiCreateNativeLoginFlowRequest) Aal(aal string) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) Aal(aal string) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.aal = &aal
 	return r
 }
-func (r FrontendApiApiCreateNativeLoginFlowRequest) XSessionToken(xSessionToken string) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) XSessionToken(xSessionToken string) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiCreateNativeLoginFlowRequest) ReturnSessionTokenExchangeCode(returnSessionTokenExchangeCode bool) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) ReturnSessionTokenExchangeCode(returnSessionTokenExchangeCode bool) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.returnSessionTokenExchangeCode = &returnSessionTokenExchangeCode
 	return r
 }
-func (r FrontendApiApiCreateNativeLoginFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r FrontendApiApiCreateNativeLoginFlowRequest) Via(via string) FrontendApiApiCreateNativeLoginFlowRequest {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) Organization(organization string) FrontendAPIApiCreateNativeLoginFlowRequest {
+	r.organization = &organization
+	return r
+}
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) Via(via string) FrontendAPIApiCreateNativeLoginFlowRequest {
 	r.via = &via
 	return r
 }
 
-func (r FrontendApiApiCreateNativeLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateNativeLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
 	return r.ApiService.CreateNativeLoginFlowExecute(r)
 }
 
@@ -1953,10 +1958,10 @@ This endpoint MUST ONLY be used in scenarios such as native mobile apps (React N
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateNativeLoginFlowRequest
+  - @return FrontendAPIApiCreateNativeLoginFlowRequest
 */
-func (a *FrontendApiService) CreateNativeLoginFlow(ctx context.Context) FrontendApiApiCreateNativeLoginFlowRequest {
-	return FrontendApiApiCreateNativeLoginFlowRequest{
+func (a *FrontendAPIService) CreateNativeLoginFlow(ctx context.Context) FrontendAPIApiCreateNativeLoginFlowRequest {
+	return FrontendAPIApiCreateNativeLoginFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -1966,7 +1971,7 @@ func (a *FrontendApiService) CreateNativeLoginFlow(ctx context.Context) Frontend
  * Execute executes the request
  * @return LoginFlow
  */
-func (a *FrontendApiService) CreateNativeLoginFlowExecute(r FrontendApiApiCreateNativeLoginFlowRequest) (*LoginFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateNativeLoginFlowExecute(r FrontendAPIApiCreateNativeLoginFlowRequest) (*LoginFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1976,7 +1981,7 @@ func (a *FrontendApiService) CreateNativeLoginFlowExecute(r FrontendApiApiCreate
 		localVarReturnValue  *LoginFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateNativeLoginFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateNativeLoginFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1999,6 +2004,9 @@ func (a *FrontendApiService) CreateNativeLoginFlowExecute(r FrontendApiApiCreate
 	if r.returnTo != nil {
 		localVarQueryParams.Add("return_to", parameterToString(*r.returnTo, ""))
 	}
+	if r.organization != nil {
+		localVarQueryParams.Add("organization", parameterToString(*r.organization, ""))
+	}
 	if r.via != nil {
 		localVarQueryParams.Add("via", parameterToString(*r.via, ""))
 	}
@@ -2076,12 +2084,12 @@ func (a *FrontendApiService) CreateNativeLoginFlowExecute(r FrontendApiApiCreate
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateNativeRecoveryFlowRequest struct {
+type FrontendAPIApiCreateNativeRecoveryFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 }
 
-func (r FrontendApiApiCreateNativeRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateNativeRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
 	return r.ApiService.CreateNativeRecoveryFlowExecute(r)
 }
 
@@ -2101,10 +2109,10 @@ This endpoint MUST ONLY be used in scenarios such as native mobile apps (React N
 
 More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateNativeRecoveryFlowRequest
+  - @return FrontendAPIApiCreateNativeRecoveryFlowRequest
 */
-func (a *FrontendApiService) CreateNativeRecoveryFlow(ctx context.Context) FrontendApiApiCreateNativeRecoveryFlowRequest {
-	return FrontendApiApiCreateNativeRecoveryFlowRequest{
+func (a *FrontendAPIService) CreateNativeRecoveryFlow(ctx context.Context) FrontendAPIApiCreateNativeRecoveryFlowRequest {
+	return FrontendAPIApiCreateNativeRecoveryFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2114,7 +2122,7 @@ func (a *FrontendApiService) CreateNativeRecoveryFlow(ctx context.Context) Front
  * Execute executes the request
  * @return RecoveryFlow
  */
-func (a *FrontendApiService) CreateNativeRecoveryFlowExecute(r FrontendApiApiCreateNativeRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateNativeRecoveryFlowExecute(r FrontendAPIApiCreateNativeRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2124,7 +2132,7 @@ func (a *FrontendApiService) CreateNativeRecoveryFlowExecute(r FrontendApiApiCre
 		localVarReturnValue  *RecoveryFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateNativeRecoveryFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateNativeRecoveryFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2206,23 +2214,28 @@ func (a *FrontendApiService) CreateNativeRecoveryFlowExecute(r FrontendApiApiCre
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateNativeRegistrationFlowRequest struct {
+type FrontendAPIApiCreateNativeRegistrationFlowRequest struct {
 	ctx                            context.Context
-	ApiService                     FrontendApi
+	ApiService                     FrontendAPI
 	returnSessionTokenExchangeCode *bool
 	returnTo                       *string
+	organization                   *string
 }
 
-func (r FrontendApiApiCreateNativeRegistrationFlowRequest) ReturnSessionTokenExchangeCode(returnSessionTokenExchangeCode bool) FrontendApiApiCreateNativeRegistrationFlowRequest {
+func (r FrontendAPIApiCreateNativeRegistrationFlowRequest) ReturnSessionTokenExchangeCode(returnSessionTokenExchangeCode bool) FrontendAPIApiCreateNativeRegistrationFlowRequest {
 	r.returnSessionTokenExchangeCode = &returnSessionTokenExchangeCode
 	return r
 }
-func (r FrontendApiApiCreateNativeRegistrationFlowRequest) ReturnTo(returnTo string) FrontendApiApiCreateNativeRegistrationFlowRequest {
+func (r FrontendAPIApiCreateNativeRegistrationFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateNativeRegistrationFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
+func (r FrontendAPIApiCreateNativeRegistrationFlowRequest) Organization(organization string) FrontendAPIApiCreateNativeRegistrationFlowRequest {
+	r.organization = &organization
+	return r
+}
 
-func (r FrontendApiApiCreateNativeRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateNativeRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
 	return r.ApiService.CreateNativeRegistrationFlowExecute(r)
 }
 
@@ -2248,10 +2261,10 @@ This endpoint MUST ONLY be used in scenarios such as native mobile apps (React N
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateNativeRegistrationFlowRequest
+  - @return FrontendAPIApiCreateNativeRegistrationFlowRequest
 */
-func (a *FrontendApiService) CreateNativeRegistrationFlow(ctx context.Context) FrontendApiApiCreateNativeRegistrationFlowRequest {
-	return FrontendApiApiCreateNativeRegistrationFlowRequest{
+func (a *FrontendAPIService) CreateNativeRegistrationFlow(ctx context.Context) FrontendAPIApiCreateNativeRegistrationFlowRequest {
+	return FrontendAPIApiCreateNativeRegistrationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2261,7 +2274,7 @@ func (a *FrontendApiService) CreateNativeRegistrationFlow(ctx context.Context) F
  * Execute executes the request
  * @return RegistrationFlow
  */
-func (a *FrontendApiService) CreateNativeRegistrationFlowExecute(r FrontendApiApiCreateNativeRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateNativeRegistrationFlowExecute(r FrontendAPIApiCreateNativeRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2271,7 +2284,7 @@ func (a *FrontendApiService) CreateNativeRegistrationFlowExecute(r FrontendApiAp
 		localVarReturnValue  *RegistrationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateNativeRegistrationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateNativeRegistrationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2288,6 +2301,9 @@ func (a *FrontendApiService) CreateNativeRegistrationFlowExecute(r FrontendApiAp
 	if r.returnTo != nil {
 		localVarQueryParams.Add("return_to", parameterToString(*r.returnTo, ""))
 	}
+	if r.organization != nil {
+		localVarQueryParams.Add("organization", parameterToString(*r.organization, ""))
+	}
 	// to determine the Content-Type header
 	localVarHTTPContentTypes := []string{}
 
@@ -2359,18 +2375,18 @@ func (a *FrontendApiService) CreateNativeRegistrationFlowExecute(r FrontendApiAp
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateNativeSettingsFlowRequest struct {
+type FrontendAPIApiCreateNativeSettingsFlowRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	xSessionToken *string
 }
 
-func (r FrontendApiApiCreateNativeSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendApiApiCreateNativeSettingsFlowRequest {
+func (r FrontendAPIApiCreateNativeSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendAPIApiCreateNativeSettingsFlowRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
 
-func (r FrontendApiApiCreateNativeSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateNativeSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
 	return r.ApiService.CreateNativeSettingsFlowExecute(r)
 }
 
@@ -2400,10 +2416,10 @@ This endpoint MUST ONLY be used in scenarios such as native mobile apps (React N
 
 More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateNativeSettingsFlowRequest
+  - @return FrontendAPIApiCreateNativeSettingsFlowRequest
 */
-func (a *FrontendApiService) CreateNativeSettingsFlow(ctx context.Context) FrontendApiApiCreateNativeSettingsFlowRequest {
-	return FrontendApiApiCreateNativeSettingsFlowRequest{
+func (a *FrontendAPIService) CreateNativeSettingsFlow(ctx context.Context) FrontendAPIApiCreateNativeSettingsFlowRequest {
+	return FrontendAPIApiCreateNativeSettingsFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2413,7 +2429,7 @@ func (a *FrontendApiService) CreateNativeSettingsFlow(ctx context.Context) Front
  * Execute executes the request
  * @return SettingsFlow
  */
-func (a *FrontendApiService) CreateNativeSettingsFlowExecute(r FrontendApiApiCreateNativeSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateNativeSettingsFlowExecute(r FrontendAPIApiCreateNativeSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2423,7 +2439,7 @@ func (a *FrontendApiService) CreateNativeSettingsFlowExecute(r FrontendApiApiCre
 		localVarReturnValue  *SettingsFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateNativeSettingsFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateNativeSettingsFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2508,12 +2524,18 @@ func (a *FrontendApiService) CreateNativeSettingsFlowExecute(r FrontendApiApiCre
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiCreateNativeVerificationFlowRequest struct {
+type FrontendAPIApiCreateNativeVerificationFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
+	returnTo   *string
+}
+
+func (r FrontendAPIApiCreateNativeVerificationFlowRequest) ReturnTo(returnTo string) FrontendAPIApiCreateNativeVerificationFlowRequest {
+	r.returnTo = &returnTo
+	return r
 }
 
-func (r FrontendApiApiCreateNativeVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
+func (r FrontendAPIApiCreateNativeVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
 	return r.ApiService.CreateNativeVerificationFlowExecute(r)
 }
 
@@ -2531,10 +2553,10 @@ This endpoint MUST ONLY be used in scenarios such as native mobile apps (React N
 
 More information can be found at [Ory Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiCreateNativeVerificationFlowRequest
+  - @return FrontendAPIApiCreateNativeVerificationFlowRequest
 */
-func (a *FrontendApiService) CreateNativeVerificationFlow(ctx context.Context) FrontendApiApiCreateNativeVerificationFlowRequest {
-	return FrontendApiApiCreateNativeVerificationFlowRequest{
+func (a *FrontendAPIService) CreateNativeVerificationFlow(ctx context.Context) FrontendAPIApiCreateNativeVerificationFlowRequest {
+	return FrontendAPIApiCreateNativeVerificationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2544,7 +2566,7 @@ func (a *FrontendApiService) CreateNativeVerificationFlow(ctx context.Context) F
  * Execute executes the request
  * @return VerificationFlow
  */
-func (a *FrontendApiService) CreateNativeVerificationFlowExecute(r FrontendApiApiCreateNativeVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
+func (a *FrontendAPIService) CreateNativeVerificationFlowExecute(r FrontendAPIApiCreateNativeVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2554,7 +2576,7 @@ func (a *FrontendApiService) CreateNativeVerificationFlowExecute(r FrontendApiAp
 		localVarReturnValue  *VerificationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.CreateNativeVerificationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.CreateNativeVerificationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2565,6 +2587,9 @@ func (a *FrontendApiService) CreateNativeVerificationFlowExecute(r FrontendApiAp
 	localVarQueryParams := url.Values{}
 	localVarFormParams := url.Values{}
 
+	if r.returnTo != nil {
+		localVarQueryParams.Add("return_to", parameterToString(*r.returnTo, ""))
+	}
 	// to determine the Content-Type header
 	localVarHTTPContentTypes := []string{}
 
@@ -2636,23 +2661,23 @@ func (a *FrontendApiService) CreateNativeVerificationFlowExecute(r FrontendApiAp
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiDisableMyOtherSessionsRequest struct {
+type FrontendAPIApiDisableMyOtherSessionsRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	xSessionToken *string
 	cookie        *string
 }
 
-func (r FrontendApiApiDisableMyOtherSessionsRequest) XSessionToken(xSessionToken string) FrontendApiApiDisableMyOtherSessionsRequest {
+func (r FrontendAPIApiDisableMyOtherSessionsRequest) XSessionToken(xSessionToken string) FrontendAPIApiDisableMyOtherSessionsRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiDisableMyOtherSessionsRequest) Cookie(cookie string) FrontendApiApiDisableMyOtherSessionsRequest {
+func (r FrontendAPIApiDisableMyOtherSessionsRequest) Cookie(cookie string) FrontendAPIApiDisableMyOtherSessionsRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiDisableMyOtherSessionsRequest) Execute() (*DeleteMySessionsCount, *http.Response, error) {
+func (r FrontendAPIApiDisableMyOtherSessionsRequest) Execute() (*DeleteMySessionsCount, *http.Response, error) {
 	return r.ApiService.DisableMyOtherSessionsExecute(r)
 }
 
@@ -2662,10 +2687,10 @@ func (r FrontendApiApiDisableMyOtherSessionsRequest) Execute() (*DeleteMySession
 
 Session data are not deleted.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiDisableMyOtherSessionsRequest
+  - @return FrontendAPIApiDisableMyOtherSessionsRequest
 */
-func (a *FrontendApiService) DisableMyOtherSessions(ctx context.Context) FrontendApiApiDisableMyOtherSessionsRequest {
-	return FrontendApiApiDisableMyOtherSessionsRequest{
+func (a *FrontendAPIService) DisableMyOtherSessions(ctx context.Context) FrontendAPIApiDisableMyOtherSessionsRequest {
+	return FrontendAPIApiDisableMyOtherSessionsRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2675,7 +2700,7 @@ func (a *FrontendApiService) DisableMyOtherSessions(ctx context.Context) Fronten
  * Execute executes the request
  * @return DeleteMySessionsCount
  */
-func (a *FrontendApiService) DisableMyOtherSessionsExecute(r FrontendApiApiDisableMyOtherSessionsRequest) (*DeleteMySessionsCount, *http.Response, error) {
+func (a *FrontendAPIService) DisableMyOtherSessionsExecute(r FrontendAPIApiDisableMyOtherSessionsRequest) (*DeleteMySessionsCount, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -2685,7 +2710,7 @@ func (a *FrontendApiService) DisableMyOtherSessionsExecute(r FrontendApiApiDisab
 		localVarReturnValue  *DeleteMySessionsCount
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.DisableMyOtherSessions")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.DisableMyOtherSessions")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2783,24 +2808,24 @@ func (a *FrontendApiService) DisableMyOtherSessionsExecute(r FrontendApiApiDisab
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiDisableMySessionRequest struct {
+type FrontendAPIApiDisableMySessionRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	id            string
 	xSessionToken *string
 	cookie        *string
 }
 
-func (r FrontendApiApiDisableMySessionRequest) XSessionToken(xSessionToken string) FrontendApiApiDisableMySessionRequest {
+func (r FrontendAPIApiDisableMySessionRequest) XSessionToken(xSessionToken string) FrontendAPIApiDisableMySessionRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiDisableMySessionRequest) Cookie(cookie string) FrontendApiApiDisableMySessionRequest {
+func (r FrontendAPIApiDisableMySessionRequest) Cookie(cookie string) FrontendAPIApiDisableMySessionRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiDisableMySessionRequest) Execute() (*http.Response, error) {
+func (r FrontendAPIApiDisableMySessionRequest) Execute() (*http.Response, error) {
 	return r.ApiService.DisableMySessionExecute(r)
 }
 
@@ -2811,10 +2836,10 @@ func (r FrontendApiApiDisableMySessionRequest) Execute() (*http.Response, error)
 Session data are not deleted.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID is the session's ID.
-  - @return FrontendApiApiDisableMySessionRequest
+  - @return FrontendAPIApiDisableMySessionRequest
 */
-func (a *FrontendApiService) DisableMySession(ctx context.Context, id string) FrontendApiApiDisableMySessionRequest {
-	return FrontendApiApiDisableMySessionRequest{
+func (a *FrontendAPIService) DisableMySession(ctx context.Context, id string) FrontendAPIApiDisableMySessionRequest {
+	return FrontendAPIApiDisableMySessionRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -2824,7 +2849,7 @@ func (a *FrontendApiService) DisableMySession(ctx context.Context, id string) Fr
 /*
  * Execute executes the request
  */
-func (a *FrontendApiService) DisableMySessionExecute(r FrontendApiApiDisableMySessionRequest) (*http.Response, error) {
+func (a *FrontendAPIService) DisableMySessionExecute(r FrontendAPIApiDisableMySessionRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -2833,7 +2858,7 @@ func (a *FrontendApiService) DisableMySessionExecute(r FrontendApiApiDisableMySe
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.DisableMySession")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.DisableMySession")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2923,33 +2948,33 @@ func (a *FrontendApiService) DisableMySessionExecute(r FrontendApiApiDisableMySe
 	return localVarHTTPResponse, nil
 }
 
-type FrontendApiApiExchangeSessionTokenRequest struct {
+type FrontendAPIApiExchangeSessionTokenRequest struct {
 	ctx          context.Context
-	ApiService   FrontendApi
+	ApiService   FrontendAPI
 	initCode     *string
 	returnToCode *string
 }
 
-func (r FrontendApiApiExchangeSessionTokenRequest) InitCode(initCode string) FrontendApiApiExchangeSessionTokenRequest {
+func (r FrontendAPIApiExchangeSessionTokenRequest) InitCode(initCode string) FrontendAPIApiExchangeSessionTokenRequest {
 	r.initCode = &initCode
 	return r
 }
-func (r FrontendApiApiExchangeSessionTokenRequest) ReturnToCode(returnToCode string) FrontendApiApiExchangeSessionTokenRequest {
+func (r FrontendAPIApiExchangeSessionTokenRequest) ReturnToCode(returnToCode string) FrontendAPIApiExchangeSessionTokenRequest {
 	r.returnToCode = &returnToCode
 	return r
 }
 
-func (r FrontendApiApiExchangeSessionTokenRequest) Execute() (*SuccessfulNativeLogin, *http.Response, error) {
+func (r FrontendAPIApiExchangeSessionTokenRequest) Execute() (*SuccessfulNativeLogin, *http.Response, error) {
 	return r.ApiService.ExchangeSessionTokenExecute(r)
 }
 
 /*
  * ExchangeSessionToken Exchange Session Token
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- * @return FrontendApiApiExchangeSessionTokenRequest
+ * @return FrontendAPIApiExchangeSessionTokenRequest
  */
-func (a *FrontendApiService) ExchangeSessionToken(ctx context.Context) FrontendApiApiExchangeSessionTokenRequest {
-	return FrontendApiApiExchangeSessionTokenRequest{
+func (a *FrontendAPIService) ExchangeSessionToken(ctx context.Context) FrontendAPIApiExchangeSessionTokenRequest {
+	return FrontendAPIApiExchangeSessionTokenRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2959,7 +2984,7 @@ func (a *FrontendApiService) ExchangeSessionToken(ctx context.Context) FrontendA
  * Execute executes the request
  * @return SuccessfulNativeLogin
  */
-func (a *FrontendApiService) ExchangeSessionTokenExecute(r FrontendApiApiExchangeSessionTokenRequest) (*SuccessfulNativeLogin, *http.Response, error) {
+func (a *FrontendAPIService) ExchangeSessionTokenExecute(r FrontendAPIApiExchangeSessionTokenRequest) (*SuccessfulNativeLogin, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2969,7 +2994,7 @@ func (a *FrontendApiService) ExchangeSessionTokenExecute(r FrontendApiApiExchang
 		localVarReturnValue  *SuccessfulNativeLogin
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.ExchangeSessionToken")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.ExchangeSessionToken")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3079,18 +3104,18 @@ func (a *FrontendApiService) ExchangeSessionTokenExecute(r FrontendApiApiExchang
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetFlowErrorRequest struct {
+type FrontendAPIApiGetFlowErrorRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	id         *string
 }
 
-func (r FrontendApiApiGetFlowErrorRequest) Id(id string) FrontendApiApiGetFlowErrorRequest {
+func (r FrontendAPIApiGetFlowErrorRequest) Id(id string) FrontendAPIApiGetFlowErrorRequest {
 	r.id = &id
 	return r
 }
 
-func (r FrontendApiApiGetFlowErrorRequest) Execute() (*FlowError, *http.Response, error) {
+func (r FrontendAPIApiGetFlowErrorRequest) Execute() (*FlowError, *http.Response, error) {
 	return r.ApiService.GetFlowErrorExecute(r)
 }
 
@@ -3104,10 +3129,10 @@ This endpoint supports stub values to help you implement the error UI:
 
 More information can be found at [Ory Kratos User User Facing Error Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-facing-errors).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetFlowErrorRequest
+  - @return FrontendAPIApiGetFlowErrorRequest
 */
-func (a *FrontendApiService) GetFlowError(ctx context.Context) FrontendApiApiGetFlowErrorRequest {
-	return FrontendApiApiGetFlowErrorRequest{
+func (a *FrontendAPIService) GetFlowError(ctx context.Context) FrontendAPIApiGetFlowErrorRequest {
+	return FrontendAPIApiGetFlowErrorRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3117,7 +3142,7 @@ func (a *FrontendApiService) GetFlowError(ctx context.Context) FrontendApiApiGet
  * Execute executes the request
  * @return FlowError
  */
-func (a *FrontendApiService) GetFlowErrorExecute(r FrontendApiApiGetFlowErrorRequest) (*FlowError, *http.Response, error) {
+func (a *FrontendAPIService) GetFlowErrorExecute(r FrontendAPIApiGetFlowErrorRequest) (*FlowError, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -3127,7 +3152,7 @@ func (a *FrontendApiService) GetFlowErrorExecute(r FrontendApiApiGetFlowErrorReq
 		localVarReturnValue  *FlowError
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetFlowError")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetFlowError")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3225,23 +3250,23 @@ func (a *FrontendApiService) GetFlowErrorExecute(r FrontendApiApiGetFlowErrorReq
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetLoginFlowRequest struct {
+type FrontendAPIApiGetLoginFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	id         *string
 	cookie     *string
 }
 
-func (r FrontendApiApiGetLoginFlowRequest) Id(id string) FrontendApiApiGetLoginFlowRequest {
+func (r FrontendAPIApiGetLoginFlowRequest) Id(id string) FrontendAPIApiGetLoginFlowRequest {
 	r.id = &id
 	return r
 }
-func (r FrontendApiApiGetLoginFlowRequest) Cookie(cookie string) FrontendApiApiGetLoginFlowRequest {
+func (r FrontendAPIApiGetLoginFlowRequest) Cookie(cookie string) FrontendAPIApiGetLoginFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiGetLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
+func (r FrontendAPIApiGetLoginFlowRequest) Execute() (*LoginFlow, *http.Response, error) {
 	return r.ApiService.GetLoginFlowExecute(r)
 }
 
@@ -3271,10 +3296,10 @@ This request may fail due to several reasons. The `error.id` can be one of:
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetLoginFlowRequest
+  - @return FrontendAPIApiGetLoginFlowRequest
 */
-func (a *FrontendApiService) GetLoginFlow(ctx context.Context) FrontendApiApiGetLoginFlowRequest {
-	return FrontendApiApiGetLoginFlowRequest{
+func (a *FrontendAPIService) GetLoginFlow(ctx context.Context) FrontendAPIApiGetLoginFlowRequest {
+	return FrontendAPIApiGetLoginFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3284,7 +3309,7 @@ func (a *FrontendApiService) GetLoginFlow(ctx context.Context) FrontendApiApiGet
  * Execute executes the request
  * @return LoginFlow
  */
-func (a *FrontendApiService) GetLoginFlowExecute(r FrontendApiApiGetLoginFlowRequest) (*LoginFlow, *http.Response, error) {
+func (a *FrontendAPIService) GetLoginFlowExecute(r FrontendAPIApiGetLoginFlowRequest) (*LoginFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -3294,7 +3319,7 @@ func (a *FrontendApiService) GetLoginFlowExecute(r FrontendApiApiGetLoginFlowReq
 		localVarReturnValue  *LoginFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetLoginFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetLoginFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3403,23 +3428,23 @@ func (a *FrontendApiService) GetLoginFlowExecute(r FrontendApiApiGetLoginFlowReq
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetRecoveryFlowRequest struct {
+type FrontendAPIApiGetRecoveryFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	id         *string
 	cookie     *string
 }
 
-func (r FrontendApiApiGetRecoveryFlowRequest) Id(id string) FrontendApiApiGetRecoveryFlowRequest {
+func (r FrontendAPIApiGetRecoveryFlowRequest) Id(id string) FrontendAPIApiGetRecoveryFlowRequest {
 	r.id = &id
 	return r
 }
-func (r FrontendApiApiGetRecoveryFlowRequest) Cookie(cookie string) FrontendApiApiGetRecoveryFlowRequest {
+func (r FrontendAPIApiGetRecoveryFlowRequest) Cookie(cookie string) FrontendAPIApiGetRecoveryFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiGetRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
+func (r FrontendAPIApiGetRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
 	return r.ApiService.GetRecoveryFlowExecute(r)
 }
 
@@ -3444,10 +3469,10 @@ res.render('recovery', flow)
 
 More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetRecoveryFlowRequest
+  - @return FrontendAPIApiGetRecoveryFlowRequest
 */
-func (a *FrontendApiService) GetRecoveryFlow(ctx context.Context) FrontendApiApiGetRecoveryFlowRequest {
-	return FrontendApiApiGetRecoveryFlowRequest{
+func (a *FrontendAPIService) GetRecoveryFlow(ctx context.Context) FrontendAPIApiGetRecoveryFlowRequest {
+	return FrontendAPIApiGetRecoveryFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3457,7 +3482,7 @@ func (a *FrontendApiService) GetRecoveryFlow(ctx context.Context) FrontendApiApi
  * Execute executes the request
  * @return RecoveryFlow
  */
-func (a *FrontendApiService) GetRecoveryFlowExecute(r FrontendApiApiGetRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
+func (a *FrontendAPIService) GetRecoveryFlowExecute(r FrontendAPIApiGetRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -3467,7 +3492,7 @@ func (a *FrontendApiService) GetRecoveryFlowExecute(r FrontendApiApiGetRecoveryF
 		localVarReturnValue  *RecoveryFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetRecoveryFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetRecoveryFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3566,23 +3591,23 @@ func (a *FrontendApiService) GetRecoveryFlowExecute(r FrontendApiApiGetRecoveryF
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetRegistrationFlowRequest struct {
+type FrontendAPIApiGetRegistrationFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	id         *string
 	cookie     *string
 }
 
-func (r FrontendApiApiGetRegistrationFlowRequest) Id(id string) FrontendApiApiGetRegistrationFlowRequest {
+func (r FrontendAPIApiGetRegistrationFlowRequest) Id(id string) FrontendAPIApiGetRegistrationFlowRequest {
 	r.id = &id
 	return r
 }
-func (r FrontendApiApiGetRegistrationFlowRequest) Cookie(cookie string) FrontendApiApiGetRegistrationFlowRequest {
+func (r FrontendAPIApiGetRegistrationFlowRequest) Cookie(cookie string) FrontendAPIApiGetRegistrationFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiGetRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
+func (r FrontendAPIApiGetRegistrationFlowRequest) Execute() (*RegistrationFlow, *http.Response, error) {
 	return r.ApiService.GetRegistrationFlowExecute(r)
 }
 
@@ -3612,10 +3637,10 @@ This request may fail due to several reasons. The `error.id` can be one of:
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetRegistrationFlowRequest
+  - @return FrontendAPIApiGetRegistrationFlowRequest
 */
-func (a *FrontendApiService) GetRegistrationFlow(ctx context.Context) FrontendApiApiGetRegistrationFlowRequest {
-	return FrontendApiApiGetRegistrationFlowRequest{
+func (a *FrontendAPIService) GetRegistrationFlow(ctx context.Context) FrontendAPIApiGetRegistrationFlowRequest {
+	return FrontendAPIApiGetRegistrationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3625,7 +3650,7 @@ func (a *FrontendApiService) GetRegistrationFlow(ctx context.Context) FrontendAp
  * Execute executes the request
  * @return RegistrationFlow
  */
-func (a *FrontendApiService) GetRegistrationFlowExecute(r FrontendApiApiGetRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
+func (a *FrontendAPIService) GetRegistrationFlowExecute(r FrontendAPIApiGetRegistrationFlowRequest) (*RegistrationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -3635,7 +3660,7 @@ func (a *FrontendApiService) GetRegistrationFlowExecute(r FrontendApiApiGetRegis
 		localVarReturnValue  *RegistrationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetRegistrationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetRegistrationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3744,28 +3769,28 @@ func (a *FrontendApiService) GetRegistrationFlowExecute(r FrontendApiApiGetRegis
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetSettingsFlowRequest struct {
+type FrontendAPIApiGetSettingsFlowRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	id            *string
 	xSessionToken *string
 	cookie        *string
 }
 
-func (r FrontendApiApiGetSettingsFlowRequest) Id(id string) FrontendApiApiGetSettingsFlowRequest {
+func (r FrontendAPIApiGetSettingsFlowRequest) Id(id string) FrontendAPIApiGetSettingsFlowRequest {
 	r.id = &id
 	return r
 }
-func (r FrontendApiApiGetSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendApiApiGetSettingsFlowRequest {
+func (r FrontendAPIApiGetSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendAPIApiGetSettingsFlowRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiGetSettingsFlowRequest) Cookie(cookie string) FrontendApiApiGetSettingsFlowRequest {
+func (r FrontendAPIApiGetSettingsFlowRequest) Cookie(cookie string) FrontendAPIApiGetSettingsFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiGetSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
+func (r FrontendAPIApiGetSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
 	return r.ApiService.GetSettingsFlowExecute(r)
 }
 
@@ -3792,10 +3817,10 @@ identity logged in instead.
 
 More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetSettingsFlowRequest
+  - @return FrontendAPIApiGetSettingsFlowRequest
 */
-func (a *FrontendApiService) GetSettingsFlow(ctx context.Context) FrontendApiApiGetSettingsFlowRequest {
-	return FrontendApiApiGetSettingsFlowRequest{
+func (a *FrontendAPIService) GetSettingsFlow(ctx context.Context) FrontendAPIApiGetSettingsFlowRequest {
+	return FrontendAPIApiGetSettingsFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3805,7 +3830,7 @@ func (a *FrontendApiService) GetSettingsFlow(ctx context.Context) FrontendApiApi
  * Execute executes the request
  * @return SettingsFlow
  */
-func (a *FrontendApiService) GetSettingsFlowExecute(r FrontendApiApiGetSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
+func (a *FrontendAPIService) GetSettingsFlowExecute(r FrontendAPIApiGetSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -3815,7 +3840,7 @@ func (a *FrontendApiService) GetSettingsFlowExecute(r FrontendApiApiGetSettingsF
 		localVarReturnValue  *SettingsFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetSettingsFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetSettingsFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -3937,23 +3962,23 @@ func (a *FrontendApiService) GetSettingsFlowExecute(r FrontendApiApiGetSettingsF
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetVerificationFlowRequest struct {
+type FrontendAPIApiGetVerificationFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	id         *string
 	cookie     *string
 }
 
-func (r FrontendApiApiGetVerificationFlowRequest) Id(id string) FrontendApiApiGetVerificationFlowRequest {
+func (r FrontendAPIApiGetVerificationFlowRequest) Id(id string) FrontendAPIApiGetVerificationFlowRequest {
 	r.id = &id
 	return r
 }
-func (r FrontendApiApiGetVerificationFlowRequest) Cookie(cookie string) FrontendApiApiGetVerificationFlowRequest {
+func (r FrontendAPIApiGetVerificationFlowRequest) Cookie(cookie string) FrontendAPIApiGetVerificationFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiGetVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
+func (r FrontendAPIApiGetVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
 	return r.ApiService.GetVerificationFlowExecute(r)
 }
 
@@ -3978,10 +4003,10 @@ res.render('verification', flow)
 
 More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetVerificationFlowRequest
+  - @return FrontendAPIApiGetVerificationFlowRequest
 */
-func (a *FrontendApiService) GetVerificationFlow(ctx context.Context) FrontendApiApiGetVerificationFlowRequest {
-	return FrontendApiApiGetVerificationFlowRequest{
+func (a *FrontendAPIService) GetVerificationFlow(ctx context.Context) FrontendAPIApiGetVerificationFlowRequest {
+	return FrontendAPIApiGetVerificationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -3991,7 +4016,7 @@ func (a *FrontendApiService) GetVerificationFlow(ctx context.Context) FrontendAp
  * Execute executes the request
  * @return VerificationFlow
  */
-func (a *FrontendApiService) GetVerificationFlowExecute(r FrontendApiApiGetVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
+func (a *FrontendAPIService) GetVerificationFlowExecute(r FrontendAPIApiGetVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -4001,7 +4026,7 @@ func (a *FrontendApiService) GetVerificationFlowExecute(r FrontendApiApiGetVerif
 		localVarReturnValue  *VerificationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetVerificationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetVerificationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4100,12 +4125,12 @@ func (a *FrontendApiService) GetVerificationFlowExecute(r FrontendApiApiGetVerif
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiGetWebAuthnJavaScriptRequest struct {
+type FrontendAPIApiGetWebAuthnJavaScriptRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 }
 
-func (r FrontendApiApiGetWebAuthnJavaScriptRequest) Execute() (string, *http.Response, error) {
+func (r FrontendAPIApiGetWebAuthnJavaScriptRequest) Execute() (string, *http.Response, error) {
 	return r.ApiService.GetWebAuthnJavaScriptExecute(r)
 }
 
@@ -4121,10 +4146,10 @@ If you are building a JavaScript Browser App (e.g. in ReactJS or AngularJS) you
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiGetWebAuthnJavaScriptRequest
+  - @return FrontendAPIApiGetWebAuthnJavaScriptRequest
 */
-func (a *FrontendApiService) GetWebAuthnJavaScript(ctx context.Context) FrontendApiApiGetWebAuthnJavaScriptRequest {
-	return FrontendApiApiGetWebAuthnJavaScriptRequest{
+func (a *FrontendAPIService) GetWebAuthnJavaScript(ctx context.Context) FrontendAPIApiGetWebAuthnJavaScriptRequest {
+	return FrontendAPIApiGetWebAuthnJavaScriptRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4134,7 +4159,7 @@ func (a *FrontendApiService) GetWebAuthnJavaScript(ctx context.Context) Frontend
  * Execute executes the request
  * @return string
  */
-func (a *FrontendApiService) GetWebAuthnJavaScriptExecute(r FrontendApiApiGetWebAuthnJavaScriptRequest) (string, *http.Response, error) {
+func (a *FrontendAPIService) GetWebAuthnJavaScriptExecute(r FrontendAPIApiGetWebAuthnJavaScriptRequest) (string, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -4144,7 +4169,7 @@ func (a *FrontendApiService) GetWebAuthnJavaScriptExecute(r FrontendApiApiGetWeb
 		localVarReturnValue  string
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.GetWebAuthnJavaScript")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.GetWebAuthnJavaScript")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4209,9 +4234,9 @@ func (a *FrontendApiService) GetWebAuthnJavaScriptExecute(r FrontendApiApiGetWeb
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiListMySessionsRequest struct {
+type FrontendAPIApiListMySessionsRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	perPage       *int64
 	page          *int64
 	pageSize      *int64
@@ -4220,32 +4245,32 @@ type FrontendApiApiListMySessionsRequest struct {
 	cookie        *string
 }
 
-func (r FrontendApiApiListMySessionsRequest) PerPage(perPage int64) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) PerPage(perPage int64) FrontendAPIApiListMySessionsRequest {
 	r.perPage = &perPage
 	return r
 }
-func (r FrontendApiApiListMySessionsRequest) Page(page int64) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) Page(page int64) FrontendAPIApiListMySessionsRequest {
 	r.page = &page
 	return r
 }
-func (r FrontendApiApiListMySessionsRequest) PageSize(pageSize int64) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) PageSize(pageSize int64) FrontendAPIApiListMySessionsRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r FrontendApiApiListMySessionsRequest) PageToken(pageToken string) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) PageToken(pageToken string) FrontendAPIApiListMySessionsRequest {
 	r.pageToken = &pageToken
 	return r
 }
-func (r FrontendApiApiListMySessionsRequest) XSessionToken(xSessionToken string) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) XSessionToken(xSessionToken string) FrontendAPIApiListMySessionsRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiListMySessionsRequest) Cookie(cookie string) FrontendApiApiListMySessionsRequest {
+func (r FrontendAPIApiListMySessionsRequest) Cookie(cookie string) FrontendAPIApiListMySessionsRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiListMySessionsRequest) Execute() ([]Session, *http.Response, error) {
+func (r FrontendAPIApiListMySessionsRequest) Execute() ([]Session, *http.Response, error) {
 	return r.ApiService.ListMySessionsExecute(r)
 }
 
@@ -4255,10 +4280,10 @@ func (r FrontendApiApiListMySessionsRequest) Execute() ([]Session, *http.Respons
 
 The current session can be retrieved by calling the `/sessions/whoami` endpoint.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiListMySessionsRequest
+  - @return FrontendAPIApiListMySessionsRequest
 */
-func (a *FrontendApiService) ListMySessions(ctx context.Context) FrontendApiApiListMySessionsRequest {
-	return FrontendApiApiListMySessionsRequest{
+func (a *FrontendAPIService) ListMySessions(ctx context.Context) FrontendAPIApiListMySessionsRequest {
+	return FrontendAPIApiListMySessionsRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4268,7 +4293,7 @@ func (a *FrontendApiService) ListMySessions(ctx context.Context) FrontendApiApiL
  * Execute executes the request
  * @return []Session
  */
-func (a *FrontendApiService) ListMySessionsExecute(r FrontendApiApiListMySessionsRequest) ([]Session, *http.Response, error) {
+func (a *FrontendAPIService) ListMySessionsExecute(r FrontendAPIApiListMySessionsRequest) ([]Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -4278,7 +4303,7 @@ func (a *FrontendApiService) ListMySessionsExecute(r FrontendApiApiListMySession
 		localVarReturnValue  []Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.ListMySessions")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.ListMySessions")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4388,18 +4413,18 @@ func (a *FrontendApiService) ListMySessionsExecute(r FrontendApiApiListMySession
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiPerformNativeLogoutRequest struct {
+type FrontendAPIApiPerformNativeLogoutRequest struct {
 	ctx                     context.Context
-	ApiService              FrontendApi
+	ApiService              FrontendAPI
 	performNativeLogoutBody *PerformNativeLogoutBody
 }
 
-func (r FrontendApiApiPerformNativeLogoutRequest) PerformNativeLogoutBody(performNativeLogoutBody PerformNativeLogoutBody) FrontendApiApiPerformNativeLogoutRequest {
+func (r FrontendAPIApiPerformNativeLogoutRequest) PerformNativeLogoutBody(performNativeLogoutBody PerformNativeLogoutBody) FrontendAPIApiPerformNativeLogoutRequest {
 	r.performNativeLogoutBody = &performNativeLogoutBody
 	return r
 }
 
-func (r FrontendApiApiPerformNativeLogoutRequest) Execute() (*http.Response, error) {
+func (r FrontendAPIApiPerformNativeLogoutRequest) Execute() (*http.Response, error) {
 	return r.ApiService.PerformNativeLogoutExecute(r)
 }
 
@@ -4415,10 +4440,10 @@ If the Ory Session Token is malformed or does not exist a 403 Forbidden response
 This endpoint does not remove any HTTP
 Cookies - use the Browser-Based Self-Service Logout Flow instead.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiPerformNativeLogoutRequest
+  - @return FrontendAPIApiPerformNativeLogoutRequest
 */
-func (a *FrontendApiService) PerformNativeLogout(ctx context.Context) FrontendApiApiPerformNativeLogoutRequest {
-	return FrontendApiApiPerformNativeLogoutRequest{
+func (a *FrontendAPIService) PerformNativeLogout(ctx context.Context) FrontendAPIApiPerformNativeLogoutRequest {
+	return FrontendAPIApiPerformNativeLogoutRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4427,7 +4452,7 @@ func (a *FrontendApiService) PerformNativeLogout(ctx context.Context) FrontendAp
 /*
  * Execute executes the request
  */
-func (a *FrontendApiService) PerformNativeLogoutExecute(r FrontendApiApiPerformNativeLogoutRequest) (*http.Response, error) {
+func (a *FrontendAPIService) PerformNativeLogoutExecute(r FrontendAPIApiPerformNativeLogoutRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -4436,7 +4461,7 @@ func (a *FrontendApiService) PerformNativeLogoutExecute(r FrontendApiApiPerformN
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.PerformNativeLogout")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.PerformNativeLogout")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4514,28 +4539,28 @@ func (a *FrontendApiService) PerformNativeLogoutExecute(r FrontendApiApiPerformN
 	return localVarHTTPResponse, nil
 }
 
-type FrontendApiApiToSessionRequest struct {
+type FrontendAPIApiToSessionRequest struct {
 	ctx           context.Context
-	ApiService    FrontendApi
+	ApiService    FrontendAPI
 	xSessionToken *string
 	cookie        *string
 	tokenizeAs    *string
 }
 
-func (r FrontendApiApiToSessionRequest) XSessionToken(xSessionToken string) FrontendApiApiToSessionRequest {
+func (r FrontendAPIApiToSessionRequest) XSessionToken(xSessionToken string) FrontendAPIApiToSessionRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiToSessionRequest) Cookie(cookie string) FrontendApiApiToSessionRequest {
+func (r FrontendAPIApiToSessionRequest) Cookie(cookie string) FrontendAPIApiToSessionRequest {
 	r.cookie = &cookie
 	return r
 }
-func (r FrontendApiApiToSessionRequest) TokenizeAs(tokenizeAs string) FrontendApiApiToSessionRequest {
+func (r FrontendAPIApiToSessionRequest) TokenizeAs(tokenizeAs string) FrontendAPIApiToSessionRequest {
 	r.tokenizeAs = &tokenizeAs
 	return r
 }
 
-func (r FrontendApiApiToSessionRequest) Execute() (*Session, *http.Response, error) {
+func (r FrontendAPIApiToSessionRequest) Execute() (*Session, *http.Response, error) {
 	return r.ApiService.ToSessionExecute(r)
 }
 
@@ -4602,10 +4627,10 @@ As explained above, this request may fail due to several reasons. The `error.id`
 `session_inactive`: No active session was found in the request (e.g. no Ory Session Cookie / Ory Session Token).
 `session_aal2_required`: An active session was found but it does not fulfil the Authenticator Assurance Level, implying that the session must (e.g.) authenticate the second factor.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiToSessionRequest
+  - @return FrontendAPIApiToSessionRequest
 */
-func (a *FrontendApiService) ToSession(ctx context.Context) FrontendApiApiToSessionRequest {
-	return FrontendApiApiToSessionRequest{
+func (a *FrontendAPIService) ToSession(ctx context.Context) FrontendAPIApiToSessionRequest {
+	return FrontendAPIApiToSessionRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4615,7 +4640,7 @@ func (a *FrontendApiService) ToSession(ctx context.Context) FrontendApiApiToSess
  * Execute executes the request
  * @return Session
  */
-func (a *FrontendApiService) ToSessionExecute(r FrontendApiApiToSessionRequest) (*Session, *http.Response, error) {
+func (a *FrontendAPIService) ToSessionExecute(r FrontendAPIApiToSessionRequest) (*Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -4625,7 +4650,7 @@ func (a *FrontendApiService) ToSessionExecute(r FrontendApiApiToSessionRequest)
 		localVarReturnValue  *Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.ToSession")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.ToSession")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4726,33 +4751,33 @@ func (a *FrontendApiService) ToSessionExecute(r FrontendApiApiToSessionRequest)
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateLoginFlowRequest struct {
+type FrontendAPIApiUpdateLoginFlowRequest struct {
 	ctx                 context.Context
-	ApiService          FrontendApi
+	ApiService          FrontendAPI
 	flow                *string
 	updateLoginFlowBody *UpdateLoginFlowBody
 	xSessionToken       *string
 	cookie              *string
 }
 
-func (r FrontendApiApiUpdateLoginFlowRequest) Flow(flow string) FrontendApiApiUpdateLoginFlowRequest {
+func (r FrontendAPIApiUpdateLoginFlowRequest) Flow(flow string) FrontendAPIApiUpdateLoginFlowRequest {
 	r.flow = &flow
 	return r
 }
-func (r FrontendApiApiUpdateLoginFlowRequest) UpdateLoginFlowBody(updateLoginFlowBody UpdateLoginFlowBody) FrontendApiApiUpdateLoginFlowRequest {
+func (r FrontendAPIApiUpdateLoginFlowRequest) UpdateLoginFlowBody(updateLoginFlowBody UpdateLoginFlowBody) FrontendAPIApiUpdateLoginFlowRequest {
 	r.updateLoginFlowBody = &updateLoginFlowBody
 	return r
 }
-func (r FrontendApiApiUpdateLoginFlowRequest) XSessionToken(xSessionToken string) FrontendApiApiUpdateLoginFlowRequest {
+func (r FrontendAPIApiUpdateLoginFlowRequest) XSessionToken(xSessionToken string) FrontendAPIApiUpdateLoginFlowRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiUpdateLoginFlowRequest) Cookie(cookie string) FrontendApiApiUpdateLoginFlowRequest {
+func (r FrontendAPIApiUpdateLoginFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateLoginFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateLoginFlowRequest) Execute() (*SuccessfulNativeLogin, *http.Response, error) {
+func (r FrontendAPIApiUpdateLoginFlowRequest) Execute() (*SuccessfulNativeLogin, *http.Response, error) {
 	return r.ApiService.UpdateLoginFlowExecute(r)
 }
 
@@ -4787,10 +4812,10 @@ Most likely used in Social Sign In flows.
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateLoginFlowRequest
+  - @return FrontendAPIApiUpdateLoginFlowRequest
 */
-func (a *FrontendApiService) UpdateLoginFlow(ctx context.Context) FrontendApiApiUpdateLoginFlowRequest {
-	return FrontendApiApiUpdateLoginFlowRequest{
+func (a *FrontendAPIService) UpdateLoginFlow(ctx context.Context) FrontendAPIApiUpdateLoginFlowRequest {
+	return FrontendAPIApiUpdateLoginFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4800,7 +4825,7 @@ func (a *FrontendApiService) UpdateLoginFlow(ctx context.Context) FrontendApiApi
  * Execute executes the request
  * @return SuccessfulNativeLogin
  */
-func (a *FrontendApiService) UpdateLoginFlowExecute(r FrontendApiApiUpdateLoginFlowRequest) (*SuccessfulNativeLogin, *http.Response, error) {
+func (a *FrontendAPIService) UpdateLoginFlowExecute(r FrontendAPIApiUpdateLoginFlowRequest) (*SuccessfulNativeLogin, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -4810,7 +4835,7 @@ func (a *FrontendApiService) UpdateLoginFlowExecute(r FrontendApiApiUpdateLoginF
 		localVarReturnValue  *SuccessfulNativeLogin
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateLoginFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateLoginFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -4927,28 +4952,28 @@ func (a *FrontendApiService) UpdateLoginFlowExecute(r FrontendApiApiUpdateLoginF
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateLogoutFlowRequest struct {
+type FrontendAPIApiUpdateLogoutFlowRequest struct {
 	ctx        context.Context
-	ApiService FrontendApi
+	ApiService FrontendAPI
 	token      *string
 	returnTo   *string
 	cookie     *string
 }
 
-func (r FrontendApiApiUpdateLogoutFlowRequest) Token(token string) FrontendApiApiUpdateLogoutFlowRequest {
+func (r FrontendAPIApiUpdateLogoutFlowRequest) Token(token string) FrontendAPIApiUpdateLogoutFlowRequest {
 	r.token = &token
 	return r
 }
-func (r FrontendApiApiUpdateLogoutFlowRequest) ReturnTo(returnTo string) FrontendApiApiUpdateLogoutFlowRequest {
+func (r FrontendAPIApiUpdateLogoutFlowRequest) ReturnTo(returnTo string) FrontendAPIApiUpdateLogoutFlowRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r FrontendApiApiUpdateLogoutFlowRequest) Cookie(cookie string) FrontendApiApiUpdateLogoutFlowRequest {
+func (r FrontendAPIApiUpdateLogoutFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateLogoutFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateLogoutFlowRequest) Execute() (*http.Response, error) {
+func (r FrontendAPIApiUpdateLogoutFlowRequest) Execute() (*http.Response, error) {
 	return r.ApiService.UpdateLogoutFlowExecute(r)
 }
 
@@ -4968,10 +4993,10 @@ call the `/self-service/logout/api` URL directly with the Ory Session Token.
 
 More information can be found at [Ory Kratos User Logout Documentation](https://www.ory.sh/docs/next/kratos/self-service/flows/user-logout).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateLogoutFlowRequest
+  - @return FrontendAPIApiUpdateLogoutFlowRequest
 */
-func (a *FrontendApiService) UpdateLogoutFlow(ctx context.Context) FrontendApiApiUpdateLogoutFlowRequest {
-	return FrontendApiApiUpdateLogoutFlowRequest{
+func (a *FrontendAPIService) UpdateLogoutFlow(ctx context.Context) FrontendAPIApiUpdateLogoutFlowRequest {
+	return FrontendAPIApiUpdateLogoutFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -4980,7 +5005,7 @@ func (a *FrontendApiService) UpdateLogoutFlow(ctx context.Context) FrontendApiAp
 /*
  * Execute executes the request
  */
-func (a *FrontendApiService) UpdateLogoutFlowExecute(r FrontendApiApiUpdateLogoutFlowRequest) (*http.Response, error) {
+func (a *FrontendAPIService) UpdateLogoutFlowExecute(r FrontendAPIApiUpdateLogoutFlowRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -4989,7 +5014,7 @@ func (a *FrontendApiService) UpdateLogoutFlowExecute(r FrontendApiApiUpdateLogou
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateLogoutFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateLogoutFlow")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -5061,33 +5086,33 @@ func (a *FrontendApiService) UpdateLogoutFlowExecute(r FrontendApiApiUpdateLogou
 	return localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateRecoveryFlowRequest struct {
+type FrontendAPIApiUpdateRecoveryFlowRequest struct {
 	ctx                    context.Context
-	ApiService             FrontendApi
+	ApiService             FrontendAPI
 	flow                   *string
 	updateRecoveryFlowBody *UpdateRecoveryFlowBody
 	token                  *string
 	cookie                 *string
 }
 
-func (r FrontendApiApiUpdateRecoveryFlowRequest) Flow(flow string) FrontendApiApiUpdateRecoveryFlowRequest {
+func (r FrontendAPIApiUpdateRecoveryFlowRequest) Flow(flow string) FrontendAPIApiUpdateRecoveryFlowRequest {
 	r.flow = &flow
 	return r
 }
-func (r FrontendApiApiUpdateRecoveryFlowRequest) UpdateRecoveryFlowBody(updateRecoveryFlowBody UpdateRecoveryFlowBody) FrontendApiApiUpdateRecoveryFlowRequest {
+func (r FrontendAPIApiUpdateRecoveryFlowRequest) UpdateRecoveryFlowBody(updateRecoveryFlowBody UpdateRecoveryFlowBody) FrontendAPIApiUpdateRecoveryFlowRequest {
 	r.updateRecoveryFlowBody = &updateRecoveryFlowBody
 	return r
 }
-func (r FrontendApiApiUpdateRecoveryFlowRequest) Token(token string) FrontendApiApiUpdateRecoveryFlowRequest {
+func (r FrontendAPIApiUpdateRecoveryFlowRequest) Token(token string) FrontendAPIApiUpdateRecoveryFlowRequest {
 	r.token = &token
 	return r
 }
-func (r FrontendApiApiUpdateRecoveryFlowRequest) Cookie(cookie string) FrontendApiApiUpdateRecoveryFlowRequest {
+func (r FrontendAPIApiUpdateRecoveryFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateRecoveryFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
+func (r FrontendAPIApiUpdateRecoveryFlowRequest) Execute() (*RecoveryFlow, *http.Response, error) {
 	return r.ApiService.UpdateRecoveryFlowExecute(r)
 }
 
@@ -5111,10 +5136,10 @@ a new Recovery Flow ID which contains an error message that the recovery link wa
 
 More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateRecoveryFlowRequest
+  - @return FrontendAPIApiUpdateRecoveryFlowRequest
 */
-func (a *FrontendApiService) UpdateRecoveryFlow(ctx context.Context) FrontendApiApiUpdateRecoveryFlowRequest {
-	return FrontendApiApiUpdateRecoveryFlowRequest{
+func (a *FrontendAPIService) UpdateRecoveryFlow(ctx context.Context) FrontendAPIApiUpdateRecoveryFlowRequest {
+	return FrontendAPIApiUpdateRecoveryFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -5124,7 +5149,7 @@ func (a *FrontendApiService) UpdateRecoveryFlow(ctx context.Context) FrontendApi
  * Execute executes the request
  * @return RecoveryFlow
  */
-func (a *FrontendApiService) UpdateRecoveryFlowExecute(r FrontendApiApiUpdateRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
+func (a *FrontendAPIService) UpdateRecoveryFlowExecute(r FrontendAPIApiUpdateRecoveryFlowRequest) (*RecoveryFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -5134,7 +5159,7 @@ func (a *FrontendApiService) UpdateRecoveryFlowExecute(r FrontendApiApiUpdateRec
 		localVarReturnValue  *RecoveryFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateRecoveryFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateRecoveryFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -5251,28 +5276,28 @@ func (a *FrontendApiService) UpdateRecoveryFlowExecute(r FrontendApiApiUpdateRec
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateRegistrationFlowRequest struct {
+type FrontendAPIApiUpdateRegistrationFlowRequest struct {
 	ctx                        context.Context
-	ApiService                 FrontendApi
+	ApiService                 FrontendAPI
 	flow                       *string
 	updateRegistrationFlowBody *UpdateRegistrationFlowBody
 	cookie                     *string
 }
 
-func (r FrontendApiApiUpdateRegistrationFlowRequest) Flow(flow string) FrontendApiApiUpdateRegistrationFlowRequest {
+func (r FrontendAPIApiUpdateRegistrationFlowRequest) Flow(flow string) FrontendAPIApiUpdateRegistrationFlowRequest {
 	r.flow = &flow
 	return r
 }
-func (r FrontendApiApiUpdateRegistrationFlowRequest) UpdateRegistrationFlowBody(updateRegistrationFlowBody UpdateRegistrationFlowBody) FrontendApiApiUpdateRegistrationFlowRequest {
+func (r FrontendAPIApiUpdateRegistrationFlowRequest) UpdateRegistrationFlowBody(updateRegistrationFlowBody UpdateRegistrationFlowBody) FrontendAPIApiUpdateRegistrationFlowRequest {
 	r.updateRegistrationFlowBody = &updateRegistrationFlowBody
 	return r
 }
-func (r FrontendApiApiUpdateRegistrationFlowRequest) Cookie(cookie string) FrontendApiApiUpdateRegistrationFlowRequest {
+func (r FrontendAPIApiUpdateRegistrationFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateRegistrationFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateRegistrationFlowRequest) Execute() (*SuccessfulNativeRegistration, *http.Response, error) {
+func (r FrontendAPIApiUpdateRegistrationFlowRequest) Execute() (*SuccessfulNativeRegistration, *http.Response, error) {
 	return r.ApiService.UpdateRegistrationFlowExecute(r)
 }
 
@@ -5308,10 +5333,10 @@ Most likely used in Social Sign In flows.
 
 More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateRegistrationFlowRequest
+  - @return FrontendAPIApiUpdateRegistrationFlowRequest
 */
-func (a *FrontendApiService) UpdateRegistrationFlow(ctx context.Context) FrontendApiApiUpdateRegistrationFlowRequest {
-	return FrontendApiApiUpdateRegistrationFlowRequest{
+func (a *FrontendAPIService) UpdateRegistrationFlow(ctx context.Context) FrontendAPIApiUpdateRegistrationFlowRequest {
+	return FrontendAPIApiUpdateRegistrationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -5321,7 +5346,7 @@ func (a *FrontendApiService) UpdateRegistrationFlow(ctx context.Context) Fronten
  * Execute executes the request
  * @return SuccessfulNativeRegistration
  */
-func (a *FrontendApiService) UpdateRegistrationFlowExecute(r FrontendApiApiUpdateRegistrationFlowRequest) (*SuccessfulNativeRegistration, *http.Response, error) {
+func (a *FrontendAPIService) UpdateRegistrationFlowExecute(r FrontendAPIApiUpdateRegistrationFlowRequest) (*SuccessfulNativeRegistration, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -5331,7 +5356,7 @@ func (a *FrontendApiService) UpdateRegistrationFlowExecute(r FrontendApiApiUpdat
 		localVarReturnValue  *SuccessfulNativeRegistration
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateRegistrationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateRegistrationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -5445,33 +5470,33 @@ func (a *FrontendApiService) UpdateRegistrationFlowExecute(r FrontendApiApiUpdat
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateSettingsFlowRequest struct {
+type FrontendAPIApiUpdateSettingsFlowRequest struct {
 	ctx                    context.Context
-	ApiService             FrontendApi
+	ApiService             FrontendAPI
 	flow                   *string
 	updateSettingsFlowBody *UpdateSettingsFlowBody
 	xSessionToken          *string
 	cookie                 *string
 }
 
-func (r FrontendApiApiUpdateSettingsFlowRequest) Flow(flow string) FrontendApiApiUpdateSettingsFlowRequest {
+func (r FrontendAPIApiUpdateSettingsFlowRequest) Flow(flow string) FrontendAPIApiUpdateSettingsFlowRequest {
 	r.flow = &flow
 	return r
 }
-func (r FrontendApiApiUpdateSettingsFlowRequest) UpdateSettingsFlowBody(updateSettingsFlowBody UpdateSettingsFlowBody) FrontendApiApiUpdateSettingsFlowRequest {
+func (r FrontendAPIApiUpdateSettingsFlowRequest) UpdateSettingsFlowBody(updateSettingsFlowBody UpdateSettingsFlowBody) FrontendAPIApiUpdateSettingsFlowRequest {
 	r.updateSettingsFlowBody = &updateSettingsFlowBody
 	return r
 }
-func (r FrontendApiApiUpdateSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendApiApiUpdateSettingsFlowRequest {
+func (r FrontendAPIApiUpdateSettingsFlowRequest) XSessionToken(xSessionToken string) FrontendAPIApiUpdateSettingsFlowRequest {
 	r.xSessionToken = &xSessionToken
 	return r
 }
-func (r FrontendApiApiUpdateSettingsFlowRequest) Cookie(cookie string) FrontendApiApiUpdateSettingsFlowRequest {
+func (r FrontendAPIApiUpdateSettingsFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateSettingsFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
+func (r FrontendAPIApiUpdateSettingsFlowRequest) Execute() (*SettingsFlow, *http.Response, error) {
 	return r.ApiService.UpdateSettingsFlowExecute(r)
 }
 
@@ -5522,10 +5547,10 @@ Most likely used in Social Sign In flows.
 
 More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateSettingsFlowRequest
+  - @return FrontendAPIApiUpdateSettingsFlowRequest
 */
-func (a *FrontendApiService) UpdateSettingsFlow(ctx context.Context) FrontendApiApiUpdateSettingsFlowRequest {
-	return FrontendApiApiUpdateSettingsFlowRequest{
+func (a *FrontendAPIService) UpdateSettingsFlow(ctx context.Context) FrontendAPIApiUpdateSettingsFlowRequest {
+	return FrontendAPIApiUpdateSettingsFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -5535,7 +5560,7 @@ func (a *FrontendApiService) UpdateSettingsFlow(ctx context.Context) FrontendApi
  * Execute executes the request
  * @return SettingsFlow
  */
-func (a *FrontendApiService) UpdateSettingsFlowExecute(r FrontendApiApiUpdateSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
+func (a *FrontendAPIService) UpdateSettingsFlowExecute(r FrontendAPIApiUpdateSettingsFlowRequest) (*SettingsFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -5545,7 +5570,7 @@ func (a *FrontendApiService) UpdateSettingsFlowExecute(r FrontendApiApiUpdateSet
 		localVarReturnValue  *SettingsFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateSettingsFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateSettingsFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -5682,33 +5707,33 @@ func (a *FrontendApiService) UpdateSettingsFlowExecute(r FrontendApiApiUpdateSet
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type FrontendApiApiUpdateVerificationFlowRequest struct {
+type FrontendAPIApiUpdateVerificationFlowRequest struct {
 	ctx                        context.Context
-	ApiService                 FrontendApi
+	ApiService                 FrontendAPI
 	flow                       *string
 	updateVerificationFlowBody *UpdateVerificationFlowBody
 	token                      *string
 	cookie                     *string
 }
 
-func (r FrontendApiApiUpdateVerificationFlowRequest) Flow(flow string) FrontendApiApiUpdateVerificationFlowRequest {
+func (r FrontendAPIApiUpdateVerificationFlowRequest) Flow(flow string) FrontendAPIApiUpdateVerificationFlowRequest {
 	r.flow = &flow
 	return r
 }
-func (r FrontendApiApiUpdateVerificationFlowRequest) UpdateVerificationFlowBody(updateVerificationFlowBody UpdateVerificationFlowBody) FrontendApiApiUpdateVerificationFlowRequest {
+func (r FrontendAPIApiUpdateVerificationFlowRequest) UpdateVerificationFlowBody(updateVerificationFlowBody UpdateVerificationFlowBody) FrontendAPIApiUpdateVerificationFlowRequest {
 	r.updateVerificationFlowBody = &updateVerificationFlowBody
 	return r
 }
-func (r FrontendApiApiUpdateVerificationFlowRequest) Token(token string) FrontendApiApiUpdateVerificationFlowRequest {
+func (r FrontendAPIApiUpdateVerificationFlowRequest) Token(token string) FrontendAPIApiUpdateVerificationFlowRequest {
 	r.token = &token
 	return r
 }
-func (r FrontendApiApiUpdateVerificationFlowRequest) Cookie(cookie string) FrontendApiApiUpdateVerificationFlowRequest {
+func (r FrontendAPIApiUpdateVerificationFlowRequest) Cookie(cookie string) FrontendAPIApiUpdateVerificationFlowRequest {
 	r.cookie = &cookie
 	return r
 }
 
-func (r FrontendApiApiUpdateVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
+func (r FrontendAPIApiUpdateVerificationFlowRequest) Execute() (*VerificationFlow, *http.Response, error) {
 	return r.ApiService.UpdateVerificationFlowExecute(r)
 }
 
@@ -5732,10 +5757,10 @@ a new Verification Flow ID which contains an error message that the verification
 
 More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return FrontendApiApiUpdateVerificationFlowRequest
+  - @return FrontendAPIApiUpdateVerificationFlowRequest
 */
-func (a *FrontendApiService) UpdateVerificationFlow(ctx context.Context) FrontendApiApiUpdateVerificationFlowRequest {
-	return FrontendApiApiUpdateVerificationFlowRequest{
+func (a *FrontendAPIService) UpdateVerificationFlow(ctx context.Context) FrontendAPIApiUpdateVerificationFlowRequest {
+	return FrontendAPIApiUpdateVerificationFlowRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -5745,7 +5770,7 @@ func (a *FrontendApiService) UpdateVerificationFlow(ctx context.Context) Fronten
  * Execute executes the request
  * @return VerificationFlow
  */
-func (a *FrontendApiService) UpdateVerificationFlowExecute(r FrontendApiApiUpdateVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
+func (a *FrontendAPIService) UpdateVerificationFlowExecute(r FrontendAPIApiUpdateVerificationFlowRequest) (*VerificationFlow, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -5755,7 +5780,7 @@ func (a *FrontendApiService) UpdateVerificationFlowExecute(r FrontendApiApiUpdat
 		localVarReturnValue  *VerificationFlow
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendApiService.UpdateVerificationFlow")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "FrontendAPIService.UpdateVerificationFlow")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
diff --git a/internal/httpclient/api_identity.go b/internal/httpclient/api_identity.go
index b48819525a13..2daa8d8d4971 100644
--- a/internal/httpclient/api_identity.go
+++ b/internal/httpclient/api_identity.go
@@ -26,7 +26,7 @@ var (
 	_ context.Context
 )
 
-type IdentityApi interface {
+type IdentityAPI interface {
 
 	/*
 			 * BatchPatchIdentities Create multiple identities
@@ -36,15 +36,15 @@ type IdentityApi interface {
 		credentials](https://www.ory.sh/docs/kratos/manage-identities/import-user-accounts-identities)
 		for instance passwords, social sign in configurations or multifactor methods.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return IdentityApiApiBatchPatchIdentitiesRequest
+			 * @return IdentityAPIApiBatchPatchIdentitiesRequest
 	*/
-	BatchPatchIdentities(ctx context.Context) IdentityApiApiBatchPatchIdentitiesRequest
+	BatchPatchIdentities(ctx context.Context) IdentityAPIApiBatchPatchIdentitiesRequest
 
 	/*
 	 * BatchPatchIdentitiesExecute executes the request
 	 * @return BatchPatchIdentitiesResponse
 	 */
-	BatchPatchIdentitiesExecute(r IdentityApiApiBatchPatchIdentitiesRequest) (*BatchPatchIdentitiesResponse, *http.Response, error)
+	BatchPatchIdentitiesExecute(r IdentityAPIApiBatchPatchIdentitiesRequest) (*BatchPatchIdentitiesResponse, *http.Response, error)
 
 	/*
 			 * CreateIdentity Create an Identity
@@ -52,45 +52,45 @@ type IdentityApi interface {
 		[import credentials](https://www.ory.sh/docs/kratos/manage-identities/import-user-accounts-identities)
 		for instance passwords, social sign in configurations or multifactor methods.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return IdentityApiApiCreateIdentityRequest
+			 * @return IdentityAPIApiCreateIdentityRequest
 	*/
-	CreateIdentity(ctx context.Context) IdentityApiApiCreateIdentityRequest
+	CreateIdentity(ctx context.Context) IdentityAPIApiCreateIdentityRequest
 
 	/*
 	 * CreateIdentityExecute executes the request
 	 * @return Identity
 	 */
-	CreateIdentityExecute(r IdentityApiApiCreateIdentityRequest) (*Identity, *http.Response, error)
+	CreateIdentityExecute(r IdentityAPIApiCreateIdentityRequest) (*Identity, *http.Response, error)
 
 	/*
 			 * CreateRecoveryCodeForIdentity Create a Recovery Code
 			 * This endpoint creates a recovery code which should be given to the user in order for them to recover
 		(or activate) their account.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return IdentityApiApiCreateRecoveryCodeForIdentityRequest
+			 * @return IdentityAPIApiCreateRecoveryCodeForIdentityRequest
 	*/
-	CreateRecoveryCodeForIdentity(ctx context.Context) IdentityApiApiCreateRecoveryCodeForIdentityRequest
+	CreateRecoveryCodeForIdentity(ctx context.Context) IdentityAPIApiCreateRecoveryCodeForIdentityRequest
 
 	/*
 	 * CreateRecoveryCodeForIdentityExecute executes the request
 	 * @return RecoveryCodeForIdentity
 	 */
-	CreateRecoveryCodeForIdentityExecute(r IdentityApiApiCreateRecoveryCodeForIdentityRequest) (*RecoveryCodeForIdentity, *http.Response, error)
+	CreateRecoveryCodeForIdentityExecute(r IdentityAPIApiCreateRecoveryCodeForIdentityRequest) (*RecoveryCodeForIdentity, *http.Response, error)
 
 	/*
 			 * CreateRecoveryLinkForIdentity Create a Recovery Link
 			 * This endpoint creates a recovery link which should be given to the user in order for them to recover
 		(or activate) their account.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return IdentityApiApiCreateRecoveryLinkForIdentityRequest
+			 * @return IdentityAPIApiCreateRecoveryLinkForIdentityRequest
 	*/
-	CreateRecoveryLinkForIdentity(ctx context.Context) IdentityApiApiCreateRecoveryLinkForIdentityRequest
+	CreateRecoveryLinkForIdentity(ctx context.Context) IdentityAPIApiCreateRecoveryLinkForIdentityRequest
 
 	/*
 	 * CreateRecoveryLinkForIdentityExecute executes the request
 	 * @return RecoveryLinkForIdentity
 	 */
-	CreateRecoveryLinkForIdentityExecute(r IdentityApiApiCreateRecoveryLinkForIdentityRequest) (*RecoveryLinkForIdentity, *http.Response, error)
+	CreateRecoveryLinkForIdentityExecute(r IdentityAPIApiCreateRecoveryLinkForIdentityRequest) (*RecoveryLinkForIdentity, *http.Response, error)
 
 	/*
 			 * DeleteIdentity Delete an Identity
@@ -99,14 +99,14 @@ type IdentityApi interface {
 		assumed that is has been deleted already.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID is the identity's ID.
-			 * @return IdentityApiApiDeleteIdentityRequest
+			 * @return IdentityAPIApiDeleteIdentityRequest
 	*/
-	DeleteIdentity(ctx context.Context, id string) IdentityApiApiDeleteIdentityRequest
+	DeleteIdentity(ctx context.Context, id string) IdentityAPIApiDeleteIdentityRequest
 
 	/*
 	 * DeleteIdentityExecute executes the request
 	 */
-	DeleteIdentityExecute(r IdentityApiApiDeleteIdentityRequest) (*http.Response, error)
+	DeleteIdentityExecute(r IdentityAPIApiDeleteIdentityRequest) (*http.Response, error)
 
 	/*
 			 * DeleteIdentityCredentials Delete a credential for a specific identity
@@ -114,43 +114,43 @@ type IdentityApi interface {
 		You cannot delete password or code auth credentials through this API.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID is the identity's ID.
-			 * @param type_ Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
-			 * @return IdentityApiApiDeleteIdentityCredentialsRequest
+			 * @param type_ Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+			 * @return IdentityAPIApiDeleteIdentityCredentialsRequest
 	*/
-	DeleteIdentityCredentials(ctx context.Context, id string, type_ string) IdentityApiApiDeleteIdentityCredentialsRequest
+	DeleteIdentityCredentials(ctx context.Context, id string, type_ string) IdentityAPIApiDeleteIdentityCredentialsRequest
 
 	/*
 	 * DeleteIdentityCredentialsExecute executes the request
 	 */
-	DeleteIdentityCredentialsExecute(r IdentityApiApiDeleteIdentityCredentialsRequest) (*http.Response, error)
+	DeleteIdentityCredentialsExecute(r IdentityAPIApiDeleteIdentityCredentialsRequest) (*http.Response, error)
 
 	/*
 	 * DeleteIdentitySessions Delete & Invalidate an Identity's Sessions
 	 * Calling this endpoint irrecoverably and permanently deletes and invalidates all sessions that belong to the given Identity.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 	 * @param id ID is the identity's ID.
-	 * @return IdentityApiApiDeleteIdentitySessionsRequest
+	 * @return IdentityAPIApiDeleteIdentitySessionsRequest
 	 */
-	DeleteIdentitySessions(ctx context.Context, id string) IdentityApiApiDeleteIdentitySessionsRequest
+	DeleteIdentitySessions(ctx context.Context, id string) IdentityAPIApiDeleteIdentitySessionsRequest
 
 	/*
 	 * DeleteIdentitySessionsExecute executes the request
 	 */
-	DeleteIdentitySessionsExecute(r IdentityApiApiDeleteIdentitySessionsRequest) (*http.Response, error)
+	DeleteIdentitySessionsExecute(r IdentityAPIApiDeleteIdentitySessionsRequest) (*http.Response, error)
 
 	/*
 	 * DisableSession Deactivate a Session
 	 * Calling this endpoint deactivates the specified session. Session data is not deleted.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 	 * @param id ID is the session's ID.
-	 * @return IdentityApiApiDisableSessionRequest
+	 * @return IdentityAPIApiDisableSessionRequest
 	 */
-	DisableSession(ctx context.Context, id string) IdentityApiApiDisableSessionRequest
+	DisableSession(ctx context.Context, id string) IdentityAPIApiDisableSessionRequest
 
 	/*
 	 * DisableSessionExecute executes the request
 	 */
-	DisableSessionExecute(r IdentityApiApiDisableSessionRequest) (*http.Response, error)
+	DisableSessionExecute(r IdentityAPIApiDisableSessionRequest) (*http.Response, error)
 
 	/*
 			 * ExtendSession Extend a Session
@@ -167,15 +167,15 @@ type IdentityApi interface {
 		Retrieve the session ID from the `/sessions/whoami` endpoint / `toSession` SDK method.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID is the session's ID.
-			 * @return IdentityApiApiExtendSessionRequest
+			 * @return IdentityAPIApiExtendSessionRequest
 	*/
-	ExtendSession(ctx context.Context, id string) IdentityApiApiExtendSessionRequest
+	ExtendSession(ctx context.Context, id string) IdentityAPIApiExtendSessionRequest
 
 	/*
 	 * ExtendSessionExecute executes the request
 	 * @return Session
 	 */
-	ExtendSessionExecute(r IdentityApiApiExtendSessionRequest) (*Session, *http.Response, error)
+	ExtendSessionExecute(r IdentityAPIApiExtendSessionRequest) (*Session, *http.Response, error)
 
 	/*
 			 * GetIdentity Get an Identity
@@ -183,30 +183,30 @@ type IdentityApi interface {
 		include credentials (e.g. social sign in connections) in the response by using the `include_credential` query parameter.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID must be set to the ID of identity you want to get
-			 * @return IdentityApiApiGetIdentityRequest
+			 * @return IdentityAPIApiGetIdentityRequest
 	*/
-	GetIdentity(ctx context.Context, id string) IdentityApiApiGetIdentityRequest
+	GetIdentity(ctx context.Context, id string) IdentityAPIApiGetIdentityRequest
 
 	/*
 	 * GetIdentityExecute executes the request
 	 * @return Identity
 	 */
-	GetIdentityExecute(r IdentityApiApiGetIdentityRequest) (*Identity, *http.Response, error)
+	GetIdentityExecute(r IdentityAPIApiGetIdentityRequest) (*Identity, *http.Response, error)
 
 	/*
 	 * GetIdentitySchema Get Identity JSON Schema
 	 * Return a specific identity schema.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 	 * @param id ID must be set to the ID of schema you want to get
-	 * @return IdentityApiApiGetIdentitySchemaRequest
+	 * @return IdentityAPIApiGetIdentitySchemaRequest
 	 */
-	GetIdentitySchema(ctx context.Context, id string) IdentityApiApiGetIdentitySchemaRequest
+	GetIdentitySchema(ctx context.Context, id string) IdentityAPIApiGetIdentitySchemaRequest
 
 	/*
 	 * GetIdentitySchemaExecute executes the request
 	 * @return map[string]interface{}
 	 */
-	GetIdentitySchemaExecute(r IdentityApiApiGetIdentitySchemaRequest) (map[string]interface{}, *http.Response, error)
+	GetIdentitySchemaExecute(r IdentityAPIApiGetIdentitySchemaRequest) (map[string]interface{}, *http.Response, error)
 
 	/*
 			 * GetSession Get Session
@@ -215,72 +215,72 @@ type IdentityApi interface {
 		Getting a session object with all specified expandables that exist in an administrative context.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID is the session's ID.
-			 * @return IdentityApiApiGetSessionRequest
+			 * @return IdentityAPIApiGetSessionRequest
 	*/
-	GetSession(ctx context.Context, id string) IdentityApiApiGetSessionRequest
+	GetSession(ctx context.Context, id string) IdentityAPIApiGetSessionRequest
 
 	/*
 	 * GetSessionExecute executes the request
 	 * @return Session
 	 */
-	GetSessionExecute(r IdentityApiApiGetSessionRequest) (*Session, *http.Response, error)
+	GetSessionExecute(r IdentityAPIApiGetSessionRequest) (*Session, *http.Response, error)
 
 	/*
 	 * ListIdentities List Identities
-	 * Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system.
+	 * Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system. Note: filters cannot be combined.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-	 * @return IdentityApiApiListIdentitiesRequest
+	 * @return IdentityAPIApiListIdentitiesRequest
 	 */
-	ListIdentities(ctx context.Context) IdentityApiApiListIdentitiesRequest
+	ListIdentities(ctx context.Context) IdentityAPIApiListIdentitiesRequest
 
 	/*
 	 * ListIdentitiesExecute executes the request
 	 * @return []Identity
 	 */
-	ListIdentitiesExecute(r IdentityApiApiListIdentitiesRequest) ([]Identity, *http.Response, error)
+	ListIdentitiesExecute(r IdentityAPIApiListIdentitiesRequest) ([]Identity, *http.Response, error)
 
 	/*
 	 * ListIdentitySchemas Get all Identity Schemas
 	 * Returns a list of all identity schemas currently in use.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-	 * @return IdentityApiApiListIdentitySchemasRequest
+	 * @return IdentityAPIApiListIdentitySchemasRequest
 	 */
-	ListIdentitySchemas(ctx context.Context) IdentityApiApiListIdentitySchemasRequest
+	ListIdentitySchemas(ctx context.Context) IdentityAPIApiListIdentitySchemasRequest
 
 	/*
 	 * ListIdentitySchemasExecute executes the request
 	 * @return []IdentitySchemaContainer
 	 */
-	ListIdentitySchemasExecute(r IdentityApiApiListIdentitySchemasRequest) ([]IdentitySchemaContainer, *http.Response, error)
+	ListIdentitySchemasExecute(r IdentityAPIApiListIdentitySchemasRequest) ([]IdentitySchemaContainer, *http.Response, error)
 
 	/*
 	 * ListIdentitySessions List an Identity's Sessions
 	 * This endpoint returns all sessions that belong to the given Identity.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 	 * @param id ID is the identity's ID.
-	 * @return IdentityApiApiListIdentitySessionsRequest
+	 * @return IdentityAPIApiListIdentitySessionsRequest
 	 */
-	ListIdentitySessions(ctx context.Context, id string) IdentityApiApiListIdentitySessionsRequest
+	ListIdentitySessions(ctx context.Context, id string) IdentityAPIApiListIdentitySessionsRequest
 
 	/*
 	 * ListIdentitySessionsExecute executes the request
 	 * @return []Session
 	 */
-	ListIdentitySessionsExecute(r IdentityApiApiListIdentitySessionsRequest) ([]Session, *http.Response, error)
+	ListIdentitySessionsExecute(r IdentityAPIApiListIdentitySessionsRequest) ([]Session, *http.Response, error)
 
 	/*
 	 * ListSessions List All Sessions
 	 * Listing all sessions that exist.
 	 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-	 * @return IdentityApiApiListSessionsRequest
+	 * @return IdentityAPIApiListSessionsRequest
 	 */
-	ListSessions(ctx context.Context) IdentityApiApiListSessionsRequest
+	ListSessions(ctx context.Context) IdentityAPIApiListSessionsRequest
 
 	/*
 	 * ListSessionsExecute executes the request
 	 * @return []Session
 	 */
-	ListSessionsExecute(r IdentityApiApiListSessionsRequest) ([]Session, *http.Response, error)
+	ListSessionsExecute(r IdentityAPIApiListSessionsRequest) ([]Session, *http.Response, error)
 
 	/*
 			 * PatchIdentity Patch an Identity
@@ -288,15 +288,15 @@ type IdentityApi interface {
 		The fields `id`, `stateChangedAt` and `credentials` can not be updated using this method.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID must be set to the ID of identity you want to update
-			 * @return IdentityApiApiPatchIdentityRequest
+			 * @return IdentityAPIApiPatchIdentityRequest
 	*/
-	PatchIdentity(ctx context.Context, id string) IdentityApiApiPatchIdentityRequest
+	PatchIdentity(ctx context.Context, id string) IdentityAPIApiPatchIdentityRequest
 
 	/*
 	 * PatchIdentityExecute executes the request
 	 * @return Identity
 	 */
-	PatchIdentityExecute(r IdentityApiApiPatchIdentityRequest) (*Identity, *http.Response, error)
+	PatchIdentityExecute(r IdentityAPIApiPatchIdentityRequest) (*Identity, *http.Response, error)
 
 	/*
 			 * UpdateIdentity Update an Identity
@@ -304,32 +304,32 @@ type IdentityApi interface {
 		payload (except credentials) is expected. It is possible to update the identity's credentials as well.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
 			 * @param id ID must be set to the ID of identity you want to update
-			 * @return IdentityApiApiUpdateIdentityRequest
+			 * @return IdentityAPIApiUpdateIdentityRequest
 	*/
-	UpdateIdentity(ctx context.Context, id string) IdentityApiApiUpdateIdentityRequest
+	UpdateIdentity(ctx context.Context, id string) IdentityAPIApiUpdateIdentityRequest
 
 	/*
 	 * UpdateIdentityExecute executes the request
 	 * @return Identity
 	 */
-	UpdateIdentityExecute(r IdentityApiApiUpdateIdentityRequest) (*Identity, *http.Response, error)
+	UpdateIdentityExecute(r IdentityAPIApiUpdateIdentityRequest) (*Identity, *http.Response, error)
 }
 
-// IdentityApiService IdentityApi service
-type IdentityApiService service
+// IdentityAPIService IdentityAPI service
+type IdentityAPIService service
 
-type IdentityApiApiBatchPatchIdentitiesRequest struct {
+type IdentityAPIApiBatchPatchIdentitiesRequest struct {
 	ctx                 context.Context
-	ApiService          IdentityApi
+	ApiService          IdentityAPI
 	patchIdentitiesBody *PatchIdentitiesBody
 }
 
-func (r IdentityApiApiBatchPatchIdentitiesRequest) PatchIdentitiesBody(patchIdentitiesBody PatchIdentitiesBody) IdentityApiApiBatchPatchIdentitiesRequest {
+func (r IdentityAPIApiBatchPatchIdentitiesRequest) PatchIdentitiesBody(patchIdentitiesBody PatchIdentitiesBody) IdentityAPIApiBatchPatchIdentitiesRequest {
 	r.patchIdentitiesBody = &patchIdentitiesBody
 	return r
 }
 
-func (r IdentityApiApiBatchPatchIdentitiesRequest) Execute() (*BatchPatchIdentitiesResponse, *http.Response, error) {
+func (r IdentityAPIApiBatchPatchIdentitiesRequest) Execute() (*BatchPatchIdentitiesResponse, *http.Response, error) {
 	return r.ApiService.BatchPatchIdentitiesExecute(r)
 }
 
@@ -342,10 +342,10 @@ This endpoint can also be used to [import
 credentials](https://www.ory.sh/docs/kratos/manage-identities/import-user-accounts-identities)
 for instance passwords, social sign in configurations or multifactor methods.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return IdentityApiApiBatchPatchIdentitiesRequest
+  - @return IdentityAPIApiBatchPatchIdentitiesRequest
 */
-func (a *IdentityApiService) BatchPatchIdentities(ctx context.Context) IdentityApiApiBatchPatchIdentitiesRequest {
-	return IdentityApiApiBatchPatchIdentitiesRequest{
+func (a *IdentityAPIService) BatchPatchIdentities(ctx context.Context) IdentityAPIApiBatchPatchIdentitiesRequest {
+	return IdentityAPIApiBatchPatchIdentitiesRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -355,7 +355,7 @@ func (a *IdentityApiService) BatchPatchIdentities(ctx context.Context) IdentityA
  * Execute executes the request
  * @return BatchPatchIdentitiesResponse
  */
-func (a *IdentityApiService) BatchPatchIdentitiesExecute(r IdentityApiApiBatchPatchIdentitiesRequest) (*BatchPatchIdentitiesResponse, *http.Response, error) {
+func (a *IdentityAPIService) BatchPatchIdentitiesExecute(r IdentityAPIApiBatchPatchIdentitiesRequest) (*BatchPatchIdentitiesResponse, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPatch
 		localVarPostBody     interface{}
@@ -365,7 +365,7 @@ func (a *IdentityApiService) BatchPatchIdentitiesExecute(r IdentityApiApiBatchPa
 		localVarReturnValue  *BatchPatchIdentitiesResponse
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.BatchPatchIdentities")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.BatchPatchIdentities")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -473,18 +473,18 @@ func (a *IdentityApiService) BatchPatchIdentitiesExecute(r IdentityApiApiBatchPa
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiCreateIdentityRequest struct {
+type IdentityAPIApiCreateIdentityRequest struct {
 	ctx                context.Context
-	ApiService         IdentityApi
+	ApiService         IdentityAPI
 	createIdentityBody *CreateIdentityBody
 }
 
-func (r IdentityApiApiCreateIdentityRequest) CreateIdentityBody(createIdentityBody CreateIdentityBody) IdentityApiApiCreateIdentityRequest {
+func (r IdentityAPIApiCreateIdentityRequest) CreateIdentityBody(createIdentityBody CreateIdentityBody) IdentityAPIApiCreateIdentityRequest {
 	r.createIdentityBody = &createIdentityBody
 	return r
 }
 
-func (r IdentityApiApiCreateIdentityRequest) Execute() (*Identity, *http.Response, error) {
+func (r IdentityAPIApiCreateIdentityRequest) Execute() (*Identity, *http.Response, error) {
 	return r.ApiService.CreateIdentityExecute(r)
 }
 
@@ -495,10 +495,10 @@ func (r IdentityApiApiCreateIdentityRequest) Execute() (*Identity, *http.Respons
 [import credentials](https://www.ory.sh/docs/kratos/manage-identities/import-user-accounts-identities)
 for instance passwords, social sign in configurations or multifactor methods.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return IdentityApiApiCreateIdentityRequest
+  - @return IdentityAPIApiCreateIdentityRequest
 */
-func (a *IdentityApiService) CreateIdentity(ctx context.Context) IdentityApiApiCreateIdentityRequest {
-	return IdentityApiApiCreateIdentityRequest{
+func (a *IdentityAPIService) CreateIdentity(ctx context.Context) IdentityAPIApiCreateIdentityRequest {
+	return IdentityAPIApiCreateIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -508,7 +508,7 @@ func (a *IdentityApiService) CreateIdentity(ctx context.Context) IdentityApiApiC
  * Execute executes the request
  * @return Identity
  */
-func (a *IdentityApiService) CreateIdentityExecute(r IdentityApiApiCreateIdentityRequest) (*Identity, *http.Response, error) {
+func (a *IdentityAPIService) CreateIdentityExecute(r IdentityAPIApiCreateIdentityRequest) (*Identity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -518,7 +518,7 @@ func (a *IdentityApiService) CreateIdentityExecute(r IdentityApiApiCreateIdentit
 		localVarReturnValue  *Identity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.CreateIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.CreateIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -626,18 +626,18 @@ func (a *IdentityApiService) CreateIdentityExecute(r IdentityApiApiCreateIdentit
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiCreateRecoveryCodeForIdentityRequest struct {
+type IdentityAPIApiCreateRecoveryCodeForIdentityRequest struct {
 	ctx                               context.Context
-	ApiService                        IdentityApi
+	ApiService                        IdentityAPI
 	createRecoveryCodeForIdentityBody *CreateRecoveryCodeForIdentityBody
 }
 
-func (r IdentityApiApiCreateRecoveryCodeForIdentityRequest) CreateRecoveryCodeForIdentityBody(createRecoveryCodeForIdentityBody CreateRecoveryCodeForIdentityBody) IdentityApiApiCreateRecoveryCodeForIdentityRequest {
+func (r IdentityAPIApiCreateRecoveryCodeForIdentityRequest) CreateRecoveryCodeForIdentityBody(createRecoveryCodeForIdentityBody CreateRecoveryCodeForIdentityBody) IdentityAPIApiCreateRecoveryCodeForIdentityRequest {
 	r.createRecoveryCodeForIdentityBody = &createRecoveryCodeForIdentityBody
 	return r
 }
 
-func (r IdentityApiApiCreateRecoveryCodeForIdentityRequest) Execute() (*RecoveryCodeForIdentity, *http.Response, error) {
+func (r IdentityAPIApiCreateRecoveryCodeForIdentityRequest) Execute() (*RecoveryCodeForIdentity, *http.Response, error) {
 	return r.ApiService.CreateRecoveryCodeForIdentityExecute(r)
 }
 
@@ -647,10 +647,10 @@ func (r IdentityApiApiCreateRecoveryCodeForIdentityRequest) Execute() (*Recovery
 
 (or activate) their account.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return IdentityApiApiCreateRecoveryCodeForIdentityRequest
+  - @return IdentityAPIApiCreateRecoveryCodeForIdentityRequest
 */
-func (a *IdentityApiService) CreateRecoveryCodeForIdentity(ctx context.Context) IdentityApiApiCreateRecoveryCodeForIdentityRequest {
-	return IdentityApiApiCreateRecoveryCodeForIdentityRequest{
+func (a *IdentityAPIService) CreateRecoveryCodeForIdentity(ctx context.Context) IdentityAPIApiCreateRecoveryCodeForIdentityRequest {
+	return IdentityAPIApiCreateRecoveryCodeForIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -660,7 +660,7 @@ func (a *IdentityApiService) CreateRecoveryCodeForIdentity(ctx context.Context)
  * Execute executes the request
  * @return RecoveryCodeForIdentity
  */
-func (a *IdentityApiService) CreateRecoveryCodeForIdentityExecute(r IdentityApiApiCreateRecoveryCodeForIdentityRequest) (*RecoveryCodeForIdentity, *http.Response, error) {
+func (a *IdentityAPIService) CreateRecoveryCodeForIdentityExecute(r IdentityAPIApiCreateRecoveryCodeForIdentityRequest) (*RecoveryCodeForIdentity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -670,7 +670,7 @@ func (a *IdentityApiService) CreateRecoveryCodeForIdentityExecute(r IdentityApiA
 		localVarReturnValue  *RecoveryCodeForIdentity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.CreateRecoveryCodeForIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.CreateRecoveryCodeForIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -778,23 +778,23 @@ func (a *IdentityApiService) CreateRecoveryCodeForIdentityExecute(r IdentityApiA
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiCreateRecoveryLinkForIdentityRequest struct {
+type IdentityAPIApiCreateRecoveryLinkForIdentityRequest struct {
 	ctx                               context.Context
-	ApiService                        IdentityApi
+	ApiService                        IdentityAPI
 	returnTo                          *string
 	createRecoveryLinkForIdentityBody *CreateRecoveryLinkForIdentityBody
 }
 
-func (r IdentityApiApiCreateRecoveryLinkForIdentityRequest) ReturnTo(returnTo string) IdentityApiApiCreateRecoveryLinkForIdentityRequest {
+func (r IdentityAPIApiCreateRecoveryLinkForIdentityRequest) ReturnTo(returnTo string) IdentityAPIApiCreateRecoveryLinkForIdentityRequest {
 	r.returnTo = &returnTo
 	return r
 }
-func (r IdentityApiApiCreateRecoveryLinkForIdentityRequest) CreateRecoveryLinkForIdentityBody(createRecoveryLinkForIdentityBody CreateRecoveryLinkForIdentityBody) IdentityApiApiCreateRecoveryLinkForIdentityRequest {
+func (r IdentityAPIApiCreateRecoveryLinkForIdentityRequest) CreateRecoveryLinkForIdentityBody(createRecoveryLinkForIdentityBody CreateRecoveryLinkForIdentityBody) IdentityAPIApiCreateRecoveryLinkForIdentityRequest {
 	r.createRecoveryLinkForIdentityBody = &createRecoveryLinkForIdentityBody
 	return r
 }
 
-func (r IdentityApiApiCreateRecoveryLinkForIdentityRequest) Execute() (*RecoveryLinkForIdentity, *http.Response, error) {
+func (r IdentityAPIApiCreateRecoveryLinkForIdentityRequest) Execute() (*RecoveryLinkForIdentity, *http.Response, error) {
 	return r.ApiService.CreateRecoveryLinkForIdentityExecute(r)
 }
 
@@ -804,10 +804,10 @@ func (r IdentityApiApiCreateRecoveryLinkForIdentityRequest) Execute() (*Recovery
 
 (or activate) their account.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return IdentityApiApiCreateRecoveryLinkForIdentityRequest
+  - @return IdentityAPIApiCreateRecoveryLinkForIdentityRequest
 */
-func (a *IdentityApiService) CreateRecoveryLinkForIdentity(ctx context.Context) IdentityApiApiCreateRecoveryLinkForIdentityRequest {
-	return IdentityApiApiCreateRecoveryLinkForIdentityRequest{
+func (a *IdentityAPIService) CreateRecoveryLinkForIdentity(ctx context.Context) IdentityAPIApiCreateRecoveryLinkForIdentityRequest {
+	return IdentityAPIApiCreateRecoveryLinkForIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -817,7 +817,7 @@ func (a *IdentityApiService) CreateRecoveryLinkForIdentity(ctx context.Context)
  * Execute executes the request
  * @return RecoveryLinkForIdentity
  */
-func (a *IdentityApiService) CreateRecoveryLinkForIdentityExecute(r IdentityApiApiCreateRecoveryLinkForIdentityRequest) (*RecoveryLinkForIdentity, *http.Response, error) {
+func (a *IdentityAPIService) CreateRecoveryLinkForIdentityExecute(r IdentityAPIApiCreateRecoveryLinkForIdentityRequest) (*RecoveryLinkForIdentity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPost
 		localVarPostBody     interface{}
@@ -827,7 +827,7 @@ func (a *IdentityApiService) CreateRecoveryLinkForIdentityExecute(r IdentityApiA
 		localVarReturnValue  *RecoveryLinkForIdentity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.CreateRecoveryLinkForIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.CreateRecoveryLinkForIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -938,13 +938,13 @@ func (a *IdentityApiService) CreateRecoveryLinkForIdentityExecute(r IdentityApiA
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiDeleteIdentityRequest struct {
+type IdentityAPIApiDeleteIdentityRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 }
 
-func (r IdentityApiApiDeleteIdentityRequest) Execute() (*http.Response, error) {
+func (r IdentityAPIApiDeleteIdentityRequest) Execute() (*http.Response, error) {
 	return r.ApiService.DeleteIdentityExecute(r)
 }
 
@@ -956,10 +956,10 @@ This endpoint returns 204 when the identity was deleted or when the identity was
 assumed that is has been deleted already.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID is the identity's ID.
-  - @return IdentityApiApiDeleteIdentityRequest
+  - @return IdentityAPIApiDeleteIdentityRequest
 */
-func (a *IdentityApiService) DeleteIdentity(ctx context.Context, id string) IdentityApiApiDeleteIdentityRequest {
-	return IdentityApiApiDeleteIdentityRequest{
+func (a *IdentityAPIService) DeleteIdentity(ctx context.Context, id string) IdentityAPIApiDeleteIdentityRequest {
+	return IdentityAPIApiDeleteIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -969,7 +969,7 @@ func (a *IdentityApiService) DeleteIdentity(ctx context.Context, id string) Iden
 /*
  * Execute executes the request
  */
-func (a *IdentityApiService) DeleteIdentityExecute(r IdentityApiApiDeleteIdentityRequest) (*http.Response, error) {
+func (a *IdentityAPIService) DeleteIdentityExecute(r IdentityAPIApiDeleteIdentityRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -978,7 +978,7 @@ func (a *IdentityApiService) DeleteIdentityExecute(r IdentityApiApiDeleteIdentit
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.DeleteIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.DeleteIdentity")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1066,20 +1066,20 @@ func (a *IdentityApiService) DeleteIdentityExecute(r IdentityApiApiDeleteIdentit
 	return localVarHTTPResponse, nil
 }
 
-type IdentityApiApiDeleteIdentityCredentialsRequest struct {
+type IdentityAPIApiDeleteIdentityCredentialsRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 	type_      string
 	identifier *string
 }
 
-func (r IdentityApiApiDeleteIdentityCredentialsRequest) Identifier(identifier string) IdentityApiApiDeleteIdentityCredentialsRequest {
+func (r IdentityAPIApiDeleteIdentityCredentialsRequest) Identifier(identifier string) IdentityAPIApiDeleteIdentityCredentialsRequest {
 	r.identifier = &identifier
 	return r
 }
 
-func (r IdentityApiApiDeleteIdentityCredentialsRequest) Execute() (*http.Response, error) {
+func (r IdentityAPIApiDeleteIdentityCredentialsRequest) Execute() (*http.Response, error) {
 	return r.ApiService.DeleteIdentityCredentialsExecute(r)
 }
 
@@ -1090,11 +1090,11 @@ func (r IdentityApiApiDeleteIdentityCredentialsRequest) Execute() (*http.Respons
 You cannot delete password or code auth credentials through this API.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID is the identity's ID.
-  - @param type_ Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
-  - @return IdentityApiApiDeleteIdentityCredentialsRequest
+  - @param type_ Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+  - @return IdentityAPIApiDeleteIdentityCredentialsRequest
 */
-func (a *IdentityApiService) DeleteIdentityCredentials(ctx context.Context, id string, type_ string) IdentityApiApiDeleteIdentityCredentialsRequest {
-	return IdentityApiApiDeleteIdentityCredentialsRequest{
+func (a *IdentityAPIService) DeleteIdentityCredentials(ctx context.Context, id string, type_ string) IdentityAPIApiDeleteIdentityCredentialsRequest {
+	return IdentityAPIApiDeleteIdentityCredentialsRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1105,7 +1105,7 @@ func (a *IdentityApiService) DeleteIdentityCredentials(ctx context.Context, id s
 /*
  * Execute executes the request
  */
-func (a *IdentityApiService) DeleteIdentityCredentialsExecute(r IdentityApiApiDeleteIdentityCredentialsRequest) (*http.Response, error) {
+func (a *IdentityAPIService) DeleteIdentityCredentialsExecute(r IdentityAPIApiDeleteIdentityCredentialsRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -1114,7 +1114,7 @@ func (a *IdentityApiService) DeleteIdentityCredentialsExecute(r IdentityApiApiDe
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.DeleteIdentityCredentials")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.DeleteIdentityCredentials")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1206,13 +1206,13 @@ func (a *IdentityApiService) DeleteIdentityCredentialsExecute(r IdentityApiApiDe
 	return localVarHTTPResponse, nil
 }
 
-type IdentityApiApiDeleteIdentitySessionsRequest struct {
+type IdentityAPIApiDeleteIdentitySessionsRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 }
 
-func (r IdentityApiApiDeleteIdentitySessionsRequest) Execute() (*http.Response, error) {
+func (r IdentityAPIApiDeleteIdentitySessionsRequest) Execute() (*http.Response, error) {
 	return r.ApiService.DeleteIdentitySessionsExecute(r)
 }
 
@@ -1221,10 +1221,10 @@ func (r IdentityApiApiDeleteIdentitySessionsRequest) Execute() (*http.Response,
  * Calling this endpoint irrecoverably and permanently deletes and invalidates all sessions that belong to the given Identity.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
  * @param id ID is the identity's ID.
- * @return IdentityApiApiDeleteIdentitySessionsRequest
+ * @return IdentityAPIApiDeleteIdentitySessionsRequest
  */
-func (a *IdentityApiService) DeleteIdentitySessions(ctx context.Context, id string) IdentityApiApiDeleteIdentitySessionsRequest {
-	return IdentityApiApiDeleteIdentitySessionsRequest{
+func (a *IdentityAPIService) DeleteIdentitySessions(ctx context.Context, id string) IdentityAPIApiDeleteIdentitySessionsRequest {
+	return IdentityAPIApiDeleteIdentitySessionsRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1234,7 +1234,7 @@ func (a *IdentityApiService) DeleteIdentitySessions(ctx context.Context, id stri
 /*
  * Execute executes the request
  */
-func (a *IdentityApiService) DeleteIdentitySessionsExecute(r IdentityApiApiDeleteIdentitySessionsRequest) (*http.Response, error) {
+func (a *IdentityAPIService) DeleteIdentitySessionsExecute(r IdentityAPIApiDeleteIdentitySessionsRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -1243,7 +1243,7 @@ func (a *IdentityApiService) DeleteIdentitySessionsExecute(r IdentityApiApiDelet
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.DeleteIdentitySessions")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.DeleteIdentitySessions")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1351,13 +1351,13 @@ func (a *IdentityApiService) DeleteIdentitySessionsExecute(r IdentityApiApiDelet
 	return localVarHTTPResponse, nil
 }
 
-type IdentityApiApiDisableSessionRequest struct {
+type IdentityAPIApiDisableSessionRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 }
 
-func (r IdentityApiApiDisableSessionRequest) Execute() (*http.Response, error) {
+func (r IdentityAPIApiDisableSessionRequest) Execute() (*http.Response, error) {
 	return r.ApiService.DisableSessionExecute(r)
 }
 
@@ -1366,10 +1366,10 @@ func (r IdentityApiApiDisableSessionRequest) Execute() (*http.Response, error) {
  * Calling this endpoint deactivates the specified session. Session data is not deleted.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
  * @param id ID is the session's ID.
- * @return IdentityApiApiDisableSessionRequest
+ * @return IdentityAPIApiDisableSessionRequest
  */
-func (a *IdentityApiService) DisableSession(ctx context.Context, id string) IdentityApiApiDisableSessionRequest {
-	return IdentityApiApiDisableSessionRequest{
+func (a *IdentityAPIService) DisableSession(ctx context.Context, id string) IdentityAPIApiDisableSessionRequest {
+	return IdentityAPIApiDisableSessionRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1379,7 +1379,7 @@ func (a *IdentityApiService) DisableSession(ctx context.Context, id string) Iden
 /*
  * Execute executes the request
  */
-func (a *IdentityApiService) DisableSessionExecute(r IdentityApiApiDisableSessionRequest) (*http.Response, error) {
+func (a *IdentityAPIService) DisableSessionExecute(r IdentityAPIApiDisableSessionRequest) (*http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodDelete
 		localVarPostBody     interface{}
@@ -1388,7 +1388,7 @@ func (a *IdentityApiService) DisableSessionExecute(r IdentityApiApiDisableSessio
 		localVarFileBytes    []byte
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.DisableSession")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.DisableSession")
 	if err != nil {
 		return nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1486,13 +1486,13 @@ func (a *IdentityApiService) DisableSessionExecute(r IdentityApiApiDisableSessio
 	return localVarHTTPResponse, nil
 }
 
-type IdentityApiApiExtendSessionRequest struct {
+type IdentityAPIApiExtendSessionRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 }
 
-func (r IdentityApiApiExtendSessionRequest) Execute() (*Session, *http.Response, error) {
+func (r IdentityAPIApiExtendSessionRequest) Execute() (*Session, *http.Response, error) {
 	return r.ApiService.ExtendSessionExecute(r)
 }
 
@@ -1512,10 +1512,10 @@ scenarios. This endpoint also returns 404 errors if the session does not exist.
 Retrieve the session ID from the `/sessions/whoami` endpoint / `toSession` SDK method.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID is the session's ID.
-  - @return IdentityApiApiExtendSessionRequest
+  - @return IdentityAPIApiExtendSessionRequest
 */
-func (a *IdentityApiService) ExtendSession(ctx context.Context, id string) IdentityApiApiExtendSessionRequest {
-	return IdentityApiApiExtendSessionRequest{
+func (a *IdentityAPIService) ExtendSession(ctx context.Context, id string) IdentityAPIApiExtendSessionRequest {
+	return IdentityAPIApiExtendSessionRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1526,7 +1526,7 @@ func (a *IdentityApiService) ExtendSession(ctx context.Context, id string) Ident
  * Execute executes the request
  * @return Session
  */
-func (a *IdentityApiService) ExtendSessionExecute(r IdentityApiApiExtendSessionRequest) (*Session, *http.Response, error) {
+func (a *IdentityAPIService) ExtendSessionExecute(r IdentityAPIApiExtendSessionRequest) (*Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPatch
 		localVarPostBody     interface{}
@@ -1536,7 +1536,7 @@ func (a *IdentityApiService) ExtendSessionExecute(r IdentityApiApiExtendSessionR
 		localVarReturnValue  *Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.ExtendSession")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.ExtendSession")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1643,19 +1643,19 @@ func (a *IdentityApiService) ExtendSessionExecute(r IdentityApiApiExtendSessionR
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiGetIdentityRequest struct {
+type IdentityAPIApiGetIdentityRequest struct {
 	ctx               context.Context
-	ApiService        IdentityApi
+	ApiService        IdentityAPI
 	id                string
 	includeCredential *[]string
 }
 
-func (r IdentityApiApiGetIdentityRequest) IncludeCredential(includeCredential []string) IdentityApiApiGetIdentityRequest {
+func (r IdentityAPIApiGetIdentityRequest) IncludeCredential(includeCredential []string) IdentityAPIApiGetIdentityRequest {
 	r.includeCredential = &includeCredential
 	return r
 }
 
-func (r IdentityApiApiGetIdentityRequest) Execute() (*Identity, *http.Response, error) {
+func (r IdentityAPIApiGetIdentityRequest) Execute() (*Identity, *http.Response, error) {
 	return r.ApiService.GetIdentityExecute(r)
 }
 
@@ -1666,10 +1666,10 @@ func (r IdentityApiApiGetIdentityRequest) Execute() (*Identity, *http.Response,
 include credentials (e.g. social sign in connections) in the response by using the `include_credential` query parameter.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID must be set to the ID of identity you want to get
-  - @return IdentityApiApiGetIdentityRequest
+  - @return IdentityAPIApiGetIdentityRequest
 */
-func (a *IdentityApiService) GetIdentity(ctx context.Context, id string) IdentityApiApiGetIdentityRequest {
-	return IdentityApiApiGetIdentityRequest{
+func (a *IdentityAPIService) GetIdentity(ctx context.Context, id string) IdentityAPIApiGetIdentityRequest {
+	return IdentityAPIApiGetIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1680,7 +1680,7 @@ func (a *IdentityApiService) GetIdentity(ctx context.Context, id string) Identit
  * Execute executes the request
  * @return Identity
  */
-func (a *IdentityApiService) GetIdentityExecute(r IdentityApiApiGetIdentityRequest) (*Identity, *http.Response, error) {
+func (a *IdentityAPIService) GetIdentityExecute(r IdentityAPIApiGetIdentityRequest) (*Identity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1690,7 +1690,7 @@ func (a *IdentityApiService) GetIdentityExecute(r IdentityApiApiGetIdentityReque
 		localVarReturnValue  *Identity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.GetIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.GetIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1798,13 +1798,13 @@ func (a *IdentityApiService) GetIdentityExecute(r IdentityApiApiGetIdentityReque
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiGetIdentitySchemaRequest struct {
+type IdentityAPIApiGetIdentitySchemaRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 }
 
-func (r IdentityApiApiGetIdentitySchemaRequest) Execute() (map[string]interface{}, *http.Response, error) {
+func (r IdentityAPIApiGetIdentitySchemaRequest) Execute() (map[string]interface{}, *http.Response, error) {
 	return r.ApiService.GetIdentitySchemaExecute(r)
 }
 
@@ -1813,10 +1813,10 @@ func (r IdentityApiApiGetIdentitySchemaRequest) Execute() (map[string]interface{
  * Return a specific identity schema.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
  * @param id ID must be set to the ID of schema you want to get
- * @return IdentityApiApiGetIdentitySchemaRequest
+ * @return IdentityAPIApiGetIdentitySchemaRequest
  */
-func (a *IdentityApiService) GetIdentitySchema(ctx context.Context, id string) IdentityApiApiGetIdentitySchemaRequest {
-	return IdentityApiApiGetIdentitySchemaRequest{
+func (a *IdentityAPIService) GetIdentitySchema(ctx context.Context, id string) IdentityAPIApiGetIdentitySchemaRequest {
+	return IdentityAPIApiGetIdentitySchemaRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1827,7 +1827,7 @@ func (a *IdentityApiService) GetIdentitySchema(ctx context.Context, id string) I
  * Execute executes the request
  * @return map[string]interface{}
  */
-func (a *IdentityApiService) GetIdentitySchemaExecute(r IdentityApiApiGetIdentitySchemaRequest) (map[string]interface{}, *http.Response, error) {
+func (a *IdentityAPIService) GetIdentitySchemaExecute(r IdentityAPIApiGetIdentitySchemaRequest) (map[string]interface{}, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1837,7 +1837,7 @@ func (a *IdentityApiService) GetIdentitySchemaExecute(r IdentityApiApiGetIdentit
 		localVarReturnValue  map[string]interface{}
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.GetIdentitySchema")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.GetIdentitySchema")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -1920,19 +1920,19 @@ func (a *IdentityApiService) GetIdentitySchemaExecute(r IdentityApiApiGetIdentit
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiGetSessionRequest struct {
+type IdentityAPIApiGetSessionRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 	expand     *[]string
 }
 
-func (r IdentityApiApiGetSessionRequest) Expand(expand []string) IdentityApiApiGetSessionRequest {
+func (r IdentityAPIApiGetSessionRequest) Expand(expand []string) IdentityAPIApiGetSessionRequest {
 	r.expand = &expand
 	return r
 }
 
-func (r IdentityApiApiGetSessionRequest) Execute() (*Session, *http.Response, error) {
+func (r IdentityAPIApiGetSessionRequest) Execute() (*Session, *http.Response, error) {
 	return r.ApiService.GetSessionExecute(r)
 }
 
@@ -1943,10 +1943,10 @@ func (r IdentityApiApiGetSessionRequest) Execute() (*Session, *http.Response, er
 Getting a session object with all specified expandables that exist in an administrative context.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID is the session's ID.
-  - @return IdentityApiApiGetSessionRequest
+  - @return IdentityAPIApiGetSessionRequest
 */
-func (a *IdentityApiService) GetSession(ctx context.Context, id string) IdentityApiApiGetSessionRequest {
-	return IdentityApiApiGetSessionRequest{
+func (a *IdentityAPIService) GetSession(ctx context.Context, id string) IdentityAPIApiGetSessionRequest {
+	return IdentityAPIApiGetSessionRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -1957,7 +1957,7 @@ func (a *IdentityApiService) GetSession(ctx context.Context, id string) Identity
  * Execute executes the request
  * @return Session
  */
-func (a *IdentityApiService) GetSessionExecute(r IdentityApiApiGetSessionRequest) (*Session, *http.Response, error) {
+func (a *IdentityAPIService) GetSessionExecute(r IdentityAPIApiGetSessionRequest) (*Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -1967,7 +1967,7 @@ func (a *IdentityApiService) GetSessionExecute(r IdentityApiApiGetSessionRequest
 		localVarReturnValue  *Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.GetSession")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.GetSession")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2075,9 +2075,9 @@ func (a *IdentityApiService) GetSessionExecute(r IdentityApiApiGetSessionRequest
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiListIdentitiesRequest struct {
+type IdentityAPIApiListIdentitiesRequest struct {
 	ctx                                 context.Context
-	ApiService                          IdentityApi
+	ApiService                          IdentityAPI
 	perPage                             *int64
 	page                                *int64
 	pageSize                            *int64
@@ -2087,57 +2087,62 @@ type IdentityApiApiListIdentitiesRequest struct {
 	credentialsIdentifier               *string
 	previewCredentialsIdentifierSimilar *string
 	includeCredential                   *[]string
+	organizationId                      *string
 }
 
-func (r IdentityApiApiListIdentitiesRequest) PerPage(perPage int64) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) PerPage(perPage int64) IdentityAPIApiListIdentitiesRequest {
 	r.perPage = &perPage
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) Page(page int64) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) Page(page int64) IdentityAPIApiListIdentitiesRequest {
 	r.page = &page
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) PageSize(pageSize int64) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) PageSize(pageSize int64) IdentityAPIApiListIdentitiesRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) PageToken(pageToken string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) PageToken(pageToken string) IdentityAPIApiListIdentitiesRequest {
 	r.pageToken = &pageToken
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) Consistency(consistency string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) Consistency(consistency string) IdentityAPIApiListIdentitiesRequest {
 	r.consistency = &consistency
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) Ids(ids []string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) Ids(ids []string) IdentityAPIApiListIdentitiesRequest {
 	r.ids = &ids
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) CredentialsIdentifier(credentialsIdentifier string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) CredentialsIdentifier(credentialsIdentifier string) IdentityAPIApiListIdentitiesRequest {
 	r.credentialsIdentifier = &credentialsIdentifier
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) PreviewCredentialsIdentifierSimilar(previewCredentialsIdentifierSimilar string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) PreviewCredentialsIdentifierSimilar(previewCredentialsIdentifierSimilar string) IdentityAPIApiListIdentitiesRequest {
 	r.previewCredentialsIdentifierSimilar = &previewCredentialsIdentifierSimilar
 	return r
 }
-func (r IdentityApiApiListIdentitiesRequest) IncludeCredential(includeCredential []string) IdentityApiApiListIdentitiesRequest {
+func (r IdentityAPIApiListIdentitiesRequest) IncludeCredential(includeCredential []string) IdentityAPIApiListIdentitiesRequest {
 	r.includeCredential = &includeCredential
 	return r
 }
+func (r IdentityAPIApiListIdentitiesRequest) OrganizationId(organizationId string) IdentityAPIApiListIdentitiesRequest {
+	r.organizationId = &organizationId
+	return r
+}
 
-func (r IdentityApiApiListIdentitiesRequest) Execute() ([]Identity, *http.Response, error) {
+func (r IdentityAPIApiListIdentitiesRequest) Execute() ([]Identity, *http.Response, error) {
 	return r.ApiService.ListIdentitiesExecute(r)
 }
 
 /*
  * ListIdentities List Identities
- * Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system.
+ * Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system. Note: filters cannot be combined.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- * @return IdentityApiApiListIdentitiesRequest
+ * @return IdentityAPIApiListIdentitiesRequest
  */
-func (a *IdentityApiService) ListIdentities(ctx context.Context) IdentityApiApiListIdentitiesRequest {
-	return IdentityApiApiListIdentitiesRequest{
+func (a *IdentityAPIService) ListIdentities(ctx context.Context) IdentityAPIApiListIdentitiesRequest {
+	return IdentityAPIApiListIdentitiesRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2147,7 +2152,7 @@ func (a *IdentityApiService) ListIdentities(ctx context.Context) IdentityApiApiL
  * Execute executes the request
  * @return []Identity
  */
-func (a *IdentityApiService) ListIdentitiesExecute(r IdentityApiApiListIdentitiesRequest) ([]Identity, *http.Response, error) {
+func (a *IdentityAPIService) ListIdentitiesExecute(r IdentityAPIApiListIdentitiesRequest) ([]Identity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2157,7 +2162,7 @@ func (a *IdentityApiService) ListIdentitiesExecute(r IdentityApiApiListIdentitie
 		localVarReturnValue  []Identity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.ListIdentities")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.ListIdentities")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2211,6 +2216,9 @@ func (a *IdentityApiService) ListIdentitiesExecute(r IdentityApiApiListIdentitie
 			localVarQueryParams.Add("include_credential", parameterToString(t, "multi"))
 		}
 	}
+	if r.organizationId != nil {
+		localVarQueryParams.Add("organization_id", parameterToString(*r.organizationId, ""))
+	}
 	// to determine the Content-Type header
 	localVarHTTPContentTypes := []string{}
 
@@ -2286,33 +2294,33 @@ func (a *IdentityApiService) ListIdentitiesExecute(r IdentityApiApiListIdentitie
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiListIdentitySchemasRequest struct {
+type IdentityAPIApiListIdentitySchemasRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	perPage    *int64
 	page       *int64
 	pageSize   *int64
 	pageToken  *string
 }
 
-func (r IdentityApiApiListIdentitySchemasRequest) PerPage(perPage int64) IdentityApiApiListIdentitySchemasRequest {
+func (r IdentityAPIApiListIdentitySchemasRequest) PerPage(perPage int64) IdentityAPIApiListIdentitySchemasRequest {
 	r.perPage = &perPage
 	return r
 }
-func (r IdentityApiApiListIdentitySchemasRequest) Page(page int64) IdentityApiApiListIdentitySchemasRequest {
+func (r IdentityAPIApiListIdentitySchemasRequest) Page(page int64) IdentityAPIApiListIdentitySchemasRequest {
 	r.page = &page
 	return r
 }
-func (r IdentityApiApiListIdentitySchemasRequest) PageSize(pageSize int64) IdentityApiApiListIdentitySchemasRequest {
+func (r IdentityAPIApiListIdentitySchemasRequest) PageSize(pageSize int64) IdentityAPIApiListIdentitySchemasRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r IdentityApiApiListIdentitySchemasRequest) PageToken(pageToken string) IdentityApiApiListIdentitySchemasRequest {
+func (r IdentityAPIApiListIdentitySchemasRequest) PageToken(pageToken string) IdentityAPIApiListIdentitySchemasRequest {
 	r.pageToken = &pageToken
 	return r
 }
 
-func (r IdentityApiApiListIdentitySchemasRequest) Execute() ([]IdentitySchemaContainer, *http.Response, error) {
+func (r IdentityAPIApiListIdentitySchemasRequest) Execute() ([]IdentitySchemaContainer, *http.Response, error) {
 	return r.ApiService.ListIdentitySchemasExecute(r)
 }
 
@@ -2320,10 +2328,10 @@ func (r IdentityApiApiListIdentitySchemasRequest) Execute() ([]IdentitySchemaCon
  * ListIdentitySchemas Get all Identity Schemas
  * Returns a list of all identity schemas currently in use.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- * @return IdentityApiApiListIdentitySchemasRequest
+ * @return IdentityAPIApiListIdentitySchemasRequest
  */
-func (a *IdentityApiService) ListIdentitySchemas(ctx context.Context) IdentityApiApiListIdentitySchemasRequest {
-	return IdentityApiApiListIdentitySchemasRequest{
+func (a *IdentityAPIService) ListIdentitySchemas(ctx context.Context) IdentityAPIApiListIdentitySchemasRequest {
+	return IdentityAPIApiListIdentitySchemasRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2333,7 +2341,7 @@ func (a *IdentityApiService) ListIdentitySchemas(ctx context.Context) IdentityAp
  * Execute executes the request
  * @return []IdentitySchemaContainer
  */
-func (a *IdentityApiService) ListIdentitySchemasExecute(r IdentityApiApiListIdentitySchemasRequest) ([]IdentitySchemaContainer, *http.Response, error) {
+func (a *IdentityAPIService) ListIdentitySchemasExecute(r IdentityAPIApiListIdentitySchemasRequest) ([]IdentitySchemaContainer, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2343,7 +2351,7 @@ func (a *IdentityApiService) ListIdentitySchemasExecute(r IdentityApiApiListIden
 		localVarReturnValue  []IdentitySchemaContainer
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.ListIdentitySchemas")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.ListIdentitySchemas")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2427,9 +2435,9 @@ func (a *IdentityApiService) ListIdentitySchemasExecute(r IdentityApiApiListIden
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiListIdentitySessionsRequest struct {
+type IdentityAPIApiListIdentitySessionsRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 	perPage    *int64
 	page       *int64
@@ -2438,28 +2446,28 @@ type IdentityApiApiListIdentitySessionsRequest struct {
 	active     *bool
 }
 
-func (r IdentityApiApiListIdentitySessionsRequest) PerPage(perPage int64) IdentityApiApiListIdentitySessionsRequest {
+func (r IdentityAPIApiListIdentitySessionsRequest) PerPage(perPage int64) IdentityAPIApiListIdentitySessionsRequest {
 	r.perPage = &perPage
 	return r
 }
-func (r IdentityApiApiListIdentitySessionsRequest) Page(page int64) IdentityApiApiListIdentitySessionsRequest {
+func (r IdentityAPIApiListIdentitySessionsRequest) Page(page int64) IdentityAPIApiListIdentitySessionsRequest {
 	r.page = &page
 	return r
 }
-func (r IdentityApiApiListIdentitySessionsRequest) PageSize(pageSize int64) IdentityApiApiListIdentitySessionsRequest {
+func (r IdentityAPIApiListIdentitySessionsRequest) PageSize(pageSize int64) IdentityAPIApiListIdentitySessionsRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r IdentityApiApiListIdentitySessionsRequest) PageToken(pageToken string) IdentityApiApiListIdentitySessionsRequest {
+func (r IdentityAPIApiListIdentitySessionsRequest) PageToken(pageToken string) IdentityAPIApiListIdentitySessionsRequest {
 	r.pageToken = &pageToken
 	return r
 }
-func (r IdentityApiApiListIdentitySessionsRequest) Active(active bool) IdentityApiApiListIdentitySessionsRequest {
+func (r IdentityAPIApiListIdentitySessionsRequest) Active(active bool) IdentityAPIApiListIdentitySessionsRequest {
 	r.active = &active
 	return r
 }
 
-func (r IdentityApiApiListIdentitySessionsRequest) Execute() ([]Session, *http.Response, error) {
+func (r IdentityAPIApiListIdentitySessionsRequest) Execute() ([]Session, *http.Response, error) {
 	return r.ApiService.ListIdentitySessionsExecute(r)
 }
 
@@ -2468,10 +2476,10 @@ func (r IdentityApiApiListIdentitySessionsRequest) Execute() ([]Session, *http.R
  * This endpoint returns all sessions that belong to the given Identity.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
  * @param id ID is the identity's ID.
- * @return IdentityApiApiListIdentitySessionsRequest
+ * @return IdentityAPIApiListIdentitySessionsRequest
  */
-func (a *IdentityApiService) ListIdentitySessions(ctx context.Context, id string) IdentityApiApiListIdentitySessionsRequest {
-	return IdentityApiApiListIdentitySessionsRequest{
+func (a *IdentityAPIService) ListIdentitySessions(ctx context.Context, id string) IdentityAPIApiListIdentitySessionsRequest {
+	return IdentityAPIApiListIdentitySessionsRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -2482,7 +2490,7 @@ func (a *IdentityApiService) ListIdentitySessions(ctx context.Context, id string
  * Execute executes the request
  * @return []Session
  */
-func (a *IdentityApiService) ListIdentitySessionsExecute(r IdentityApiApiListIdentitySessionsRequest) ([]Session, *http.Response, error) {
+func (a *IdentityAPIService) ListIdentitySessionsExecute(r IdentityAPIApiListIdentitySessionsRequest) ([]Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2492,7 +2500,7 @@ func (a *IdentityApiService) ListIdentitySessionsExecute(r IdentityApiApiListIde
 		localVarReturnValue  []Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.ListIdentitySessions")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.ListIdentitySessions")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2614,33 +2622,33 @@ func (a *IdentityApiService) ListIdentitySessionsExecute(r IdentityApiApiListIde
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiListSessionsRequest struct {
+type IdentityAPIApiListSessionsRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	pageSize   *int64
 	pageToken  *string
 	active     *bool
 	expand     *[]string
 }
 
-func (r IdentityApiApiListSessionsRequest) PageSize(pageSize int64) IdentityApiApiListSessionsRequest {
+func (r IdentityAPIApiListSessionsRequest) PageSize(pageSize int64) IdentityAPIApiListSessionsRequest {
 	r.pageSize = &pageSize
 	return r
 }
-func (r IdentityApiApiListSessionsRequest) PageToken(pageToken string) IdentityApiApiListSessionsRequest {
+func (r IdentityAPIApiListSessionsRequest) PageToken(pageToken string) IdentityAPIApiListSessionsRequest {
 	r.pageToken = &pageToken
 	return r
 }
-func (r IdentityApiApiListSessionsRequest) Active(active bool) IdentityApiApiListSessionsRequest {
+func (r IdentityAPIApiListSessionsRequest) Active(active bool) IdentityAPIApiListSessionsRequest {
 	r.active = &active
 	return r
 }
-func (r IdentityApiApiListSessionsRequest) Expand(expand []string) IdentityApiApiListSessionsRequest {
+func (r IdentityAPIApiListSessionsRequest) Expand(expand []string) IdentityAPIApiListSessionsRequest {
 	r.expand = &expand
 	return r
 }
 
-func (r IdentityApiApiListSessionsRequest) Execute() ([]Session, *http.Response, error) {
+func (r IdentityAPIApiListSessionsRequest) Execute() ([]Session, *http.Response, error) {
 	return r.ApiService.ListSessionsExecute(r)
 }
 
@@ -2648,10 +2656,10 @@ func (r IdentityApiApiListSessionsRequest) Execute() ([]Session, *http.Response,
  * ListSessions List All Sessions
  * Listing all sessions that exist.
  * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- * @return IdentityApiApiListSessionsRequest
+ * @return IdentityAPIApiListSessionsRequest
  */
-func (a *IdentityApiService) ListSessions(ctx context.Context) IdentityApiApiListSessionsRequest {
-	return IdentityApiApiListSessionsRequest{
+func (a *IdentityAPIService) ListSessions(ctx context.Context) IdentityAPIApiListSessionsRequest {
+	return IdentityAPIApiListSessionsRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -2661,7 +2669,7 @@ func (a *IdentityApiService) ListSessions(ctx context.Context) IdentityApiApiLis
  * Execute executes the request
  * @return []Session
  */
-func (a *IdentityApiService) ListSessionsExecute(r IdentityApiApiListSessionsRequest) ([]Session, *http.Response, error) {
+func (a *IdentityAPIService) ListSessionsExecute(r IdentityAPIApiListSessionsRequest) ([]Session, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -2671,7 +2679,7 @@ func (a *IdentityApiService) ListSessionsExecute(r IdentityApiApiListSessionsReq
 		localVarReturnValue  []Session
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.ListSessions")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.ListSessions")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2787,19 +2795,19 @@ func (a *IdentityApiService) ListSessionsExecute(r IdentityApiApiListSessionsReq
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiPatchIdentityRequest struct {
+type IdentityAPIApiPatchIdentityRequest struct {
 	ctx        context.Context
-	ApiService IdentityApi
+	ApiService IdentityAPI
 	id         string
 	jsonPatch  *[]JsonPatch
 }
 
-func (r IdentityApiApiPatchIdentityRequest) JsonPatch(jsonPatch []JsonPatch) IdentityApiApiPatchIdentityRequest {
+func (r IdentityAPIApiPatchIdentityRequest) JsonPatch(jsonPatch []JsonPatch) IdentityAPIApiPatchIdentityRequest {
 	r.jsonPatch = &jsonPatch
 	return r
 }
 
-func (r IdentityApiApiPatchIdentityRequest) Execute() (*Identity, *http.Response, error) {
+func (r IdentityAPIApiPatchIdentityRequest) Execute() (*Identity, *http.Response, error) {
 	return r.ApiService.PatchIdentityExecute(r)
 }
 
@@ -2810,10 +2818,10 @@ func (r IdentityApiApiPatchIdentityRequest) Execute() (*Identity, *http.Response
 The fields `id`, `stateChangedAt` and `credentials` can not be updated using this method.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID must be set to the ID of identity you want to update
-  - @return IdentityApiApiPatchIdentityRequest
+  - @return IdentityAPIApiPatchIdentityRequest
 */
-func (a *IdentityApiService) PatchIdentity(ctx context.Context, id string) IdentityApiApiPatchIdentityRequest {
-	return IdentityApiApiPatchIdentityRequest{
+func (a *IdentityAPIService) PatchIdentity(ctx context.Context, id string) IdentityAPIApiPatchIdentityRequest {
+	return IdentityAPIApiPatchIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -2824,7 +2832,7 @@ func (a *IdentityApiService) PatchIdentity(ctx context.Context, id string) Ident
  * Execute executes the request
  * @return Identity
  */
-func (a *IdentityApiService) PatchIdentityExecute(r IdentityApiApiPatchIdentityRequest) (*Identity, *http.Response, error) {
+func (a *IdentityAPIService) PatchIdentityExecute(r IdentityAPIApiPatchIdentityRequest) (*Identity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPatch
 		localVarPostBody     interface{}
@@ -2834,7 +2842,7 @@ func (a *IdentityApiService) PatchIdentityExecute(r IdentityApiApiPatchIdentityR
 		localVarReturnValue  *Identity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.PatchIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.PatchIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -2953,19 +2961,19 @@ func (a *IdentityApiService) PatchIdentityExecute(r IdentityApiApiPatchIdentityR
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type IdentityApiApiUpdateIdentityRequest struct {
+type IdentityAPIApiUpdateIdentityRequest struct {
 	ctx                context.Context
-	ApiService         IdentityApi
+	ApiService         IdentityAPI
 	id                 string
 	updateIdentityBody *UpdateIdentityBody
 }
 
-func (r IdentityApiApiUpdateIdentityRequest) UpdateIdentityBody(updateIdentityBody UpdateIdentityBody) IdentityApiApiUpdateIdentityRequest {
+func (r IdentityAPIApiUpdateIdentityRequest) UpdateIdentityBody(updateIdentityBody UpdateIdentityBody) IdentityAPIApiUpdateIdentityRequest {
 	r.updateIdentityBody = &updateIdentityBody
 	return r
 }
 
-func (r IdentityApiApiUpdateIdentityRequest) Execute() (*Identity, *http.Response, error) {
+func (r IdentityAPIApiUpdateIdentityRequest) Execute() (*Identity, *http.Response, error) {
 	return r.ApiService.UpdateIdentityExecute(r)
 }
 
@@ -2976,10 +2984,10 @@ func (r IdentityApiApiUpdateIdentityRequest) Execute() (*Identity, *http.Respons
 payload (except credentials) is expected. It is possible to update the identity's credentials as well.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
   - @param id ID must be set to the ID of identity you want to update
-  - @return IdentityApiApiUpdateIdentityRequest
+  - @return IdentityAPIApiUpdateIdentityRequest
 */
-func (a *IdentityApiService) UpdateIdentity(ctx context.Context, id string) IdentityApiApiUpdateIdentityRequest {
-	return IdentityApiApiUpdateIdentityRequest{
+func (a *IdentityAPIService) UpdateIdentity(ctx context.Context, id string) IdentityAPIApiUpdateIdentityRequest {
+	return IdentityAPIApiUpdateIdentityRequest{
 		ApiService: a,
 		ctx:        ctx,
 		id:         id,
@@ -2990,7 +2998,7 @@ func (a *IdentityApiService) UpdateIdentity(ctx context.Context, id string) Iden
  * Execute executes the request
  * @return Identity
  */
-func (a *IdentityApiService) UpdateIdentityExecute(r IdentityApiApiUpdateIdentityRequest) (*Identity, *http.Response, error) {
+func (a *IdentityAPIService) UpdateIdentityExecute(r IdentityAPIApiUpdateIdentityRequest) (*Identity, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodPut
 		localVarPostBody     interface{}
@@ -3000,7 +3008,7 @@ func (a *IdentityApiService) UpdateIdentityExecute(r IdentityApiApiUpdateIdentit
 		localVarReturnValue  *Identity
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityApiService.UpdateIdentity")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "IdentityAPIService.UpdateIdentity")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
diff --git a/internal/httpclient/api_metadata.go b/internal/httpclient/api_metadata.go
index e5ac1a854d5d..4bef0d5cb6ca 100644
--- a/internal/httpclient/api_metadata.go
+++ b/internal/httpclient/api_metadata.go
@@ -24,7 +24,7 @@ var (
 	_ context.Context
 )
 
-type MetadataApi interface {
+type MetadataAPI interface {
 
 	/*
 			 * GetVersion Return Running Software Version.
@@ -36,15 +36,15 @@ type MetadataApi interface {
 		Be aware that if you are running multiple nodes of this service, the version will never
 		refer to the cluster state, only to a single instance.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return MetadataApiApiGetVersionRequest
+			 * @return MetadataAPIApiGetVersionRequest
 	*/
-	GetVersion(ctx context.Context) MetadataApiApiGetVersionRequest
+	GetVersion(ctx context.Context) MetadataAPIApiGetVersionRequest
 
 	/*
 	 * GetVersionExecute executes the request
 	 * @return GetVersion200Response
 	 */
-	GetVersionExecute(r MetadataApiApiGetVersionRequest) (*GetVersion200Response, *http.Response, error)
+	GetVersionExecute(r MetadataAPIApiGetVersionRequest) (*GetVersion200Response, *http.Response, error)
 
 	/*
 			 * IsAlive Check HTTP Server Status
@@ -57,15 +57,15 @@ type MetadataApi interface {
 		Be aware that if you are running multiple nodes of this service, the health status will never
 		refer to the cluster state, only to a single instance.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return MetadataApiApiIsAliveRequest
+			 * @return MetadataAPIApiIsAliveRequest
 	*/
-	IsAlive(ctx context.Context) MetadataApiApiIsAliveRequest
+	IsAlive(ctx context.Context) MetadataAPIApiIsAliveRequest
 
 	/*
 	 * IsAliveExecute executes the request
 	 * @return IsAlive200Response
 	 */
-	IsAliveExecute(r MetadataApiApiIsAliveRequest) (*IsAlive200Response, *http.Response, error)
+	IsAliveExecute(r MetadataAPIApiIsAliveRequest) (*IsAlive200Response, *http.Response, error)
 
 	/*
 			 * IsReady Check HTTP Server and Database Status
@@ -78,26 +78,26 @@ type MetadataApi interface {
 		Be aware that if you are running multiple nodes of Ory Kratos, the health status will never
 		refer to the cluster state, only to a single instance.
 			 * @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-			 * @return MetadataApiApiIsReadyRequest
+			 * @return MetadataAPIApiIsReadyRequest
 	*/
-	IsReady(ctx context.Context) MetadataApiApiIsReadyRequest
+	IsReady(ctx context.Context) MetadataAPIApiIsReadyRequest
 
 	/*
 	 * IsReadyExecute executes the request
 	 * @return IsAlive200Response
 	 */
-	IsReadyExecute(r MetadataApiApiIsReadyRequest) (*IsAlive200Response, *http.Response, error)
+	IsReadyExecute(r MetadataAPIApiIsReadyRequest) (*IsAlive200Response, *http.Response, error)
 }
 
-// MetadataApiService MetadataApi service
-type MetadataApiService service
+// MetadataAPIService MetadataAPI service
+type MetadataAPIService service
 
-type MetadataApiApiGetVersionRequest struct {
+type MetadataAPIApiGetVersionRequest struct {
 	ctx        context.Context
-	ApiService MetadataApi
+	ApiService MetadataAPI
 }
 
-func (r MetadataApiApiGetVersionRequest) Execute() (*GetVersion200Response, *http.Response, error) {
+func (r MetadataAPIApiGetVersionRequest) Execute() (*GetVersion200Response, *http.Response, error) {
 	return r.ApiService.GetVersionExecute(r)
 }
 
@@ -111,10 +111,10 @@ If the service supports TLS Edge Termination, this endpoint does not require the
 Be aware that if you are running multiple nodes of this service, the version will never
 refer to the cluster state, only to a single instance.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return MetadataApiApiGetVersionRequest
+  - @return MetadataAPIApiGetVersionRequest
 */
-func (a *MetadataApiService) GetVersion(ctx context.Context) MetadataApiApiGetVersionRequest {
-	return MetadataApiApiGetVersionRequest{
+func (a *MetadataAPIService) GetVersion(ctx context.Context) MetadataAPIApiGetVersionRequest {
+	return MetadataAPIApiGetVersionRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -124,7 +124,7 @@ func (a *MetadataApiService) GetVersion(ctx context.Context) MetadataApiApiGetVe
  * Execute executes the request
  * @return GetVersion200Response
  */
-func (a *MetadataApiService) GetVersionExecute(r MetadataApiApiGetVersionRequest) (*GetVersion200Response, *http.Response, error) {
+func (a *MetadataAPIService) GetVersionExecute(r MetadataAPIApiGetVersionRequest) (*GetVersion200Response, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -134,7 +134,7 @@ func (a *MetadataApiService) GetVersionExecute(r MetadataApiApiGetVersionRequest
 		localVarReturnValue  *GetVersion200Response
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataApiService.GetVersion")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataAPIService.GetVersion")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -199,12 +199,12 @@ func (a *MetadataApiService) GetVersionExecute(r MetadataApiApiGetVersionRequest
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type MetadataApiApiIsAliveRequest struct {
+type MetadataAPIApiIsAliveRequest struct {
 	ctx        context.Context
-	ApiService MetadataApi
+	ApiService MetadataAPI
 }
 
-func (r MetadataApiApiIsAliveRequest) Execute() (*IsAlive200Response, *http.Response, error) {
+func (r MetadataAPIApiIsAliveRequest) Execute() (*IsAlive200Response, *http.Response, error) {
 	return r.ApiService.IsAliveExecute(r)
 }
 
@@ -220,10 +220,10 @@ If the service supports TLS Edge Termination, this endpoint does not require the
 Be aware that if you are running multiple nodes of this service, the health status will never
 refer to the cluster state, only to a single instance.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return MetadataApiApiIsAliveRequest
+  - @return MetadataAPIApiIsAliveRequest
 */
-func (a *MetadataApiService) IsAlive(ctx context.Context) MetadataApiApiIsAliveRequest {
-	return MetadataApiApiIsAliveRequest{
+func (a *MetadataAPIService) IsAlive(ctx context.Context) MetadataAPIApiIsAliveRequest {
+	return MetadataAPIApiIsAliveRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -233,7 +233,7 @@ func (a *MetadataApiService) IsAlive(ctx context.Context) MetadataApiApiIsAliveR
  * Execute executes the request
  * @return IsAlive200Response
  */
-func (a *MetadataApiService) IsAliveExecute(r MetadataApiApiIsAliveRequest) (*IsAlive200Response, *http.Response, error) {
+func (a *MetadataAPIService) IsAliveExecute(r MetadataAPIApiIsAliveRequest) (*IsAlive200Response, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -243,7 +243,7 @@ func (a *MetadataApiService) IsAliveExecute(r MetadataApiApiIsAliveRequest) (*Is
 		localVarReturnValue  *IsAlive200Response
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataApiService.IsAlive")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataAPIService.IsAlive")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
@@ -315,12 +315,12 @@ func (a *MetadataApiService) IsAliveExecute(r MetadataApiApiIsAliveRequest) (*Is
 	return localVarReturnValue, localVarHTTPResponse, nil
 }
 
-type MetadataApiApiIsReadyRequest struct {
+type MetadataAPIApiIsReadyRequest struct {
 	ctx        context.Context
-	ApiService MetadataApi
+	ApiService MetadataAPI
 }
 
-func (r MetadataApiApiIsReadyRequest) Execute() (*IsAlive200Response, *http.Response, error) {
+func (r MetadataAPIApiIsReadyRequest) Execute() (*IsAlive200Response, *http.Response, error) {
 	return r.ApiService.IsReadyExecute(r)
 }
 
@@ -336,10 +336,10 @@ If the service supports TLS Edge Termination, this endpoint does not require the
 Be aware that if you are running multiple nodes of Ory Kratos, the health status will never
 refer to the cluster state, only to a single instance.
   - @param ctx context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
-  - @return MetadataApiApiIsReadyRequest
+  - @return MetadataAPIApiIsReadyRequest
 */
-func (a *MetadataApiService) IsReady(ctx context.Context) MetadataApiApiIsReadyRequest {
-	return MetadataApiApiIsReadyRequest{
+func (a *MetadataAPIService) IsReady(ctx context.Context) MetadataAPIApiIsReadyRequest {
+	return MetadataAPIApiIsReadyRequest{
 		ApiService: a,
 		ctx:        ctx,
 	}
@@ -349,7 +349,7 @@ func (a *MetadataApiService) IsReady(ctx context.Context) MetadataApiApiIsReadyR
  * Execute executes the request
  * @return IsAlive200Response
  */
-func (a *MetadataApiService) IsReadyExecute(r MetadataApiApiIsReadyRequest) (*IsAlive200Response, *http.Response, error) {
+func (a *MetadataAPIService) IsReadyExecute(r MetadataAPIApiIsReadyRequest) (*IsAlive200Response, *http.Response, error) {
 	var (
 		localVarHTTPMethod   = http.MethodGet
 		localVarPostBody     interface{}
@@ -359,7 +359,7 @@ func (a *MetadataApiService) IsReadyExecute(r MetadataApiApiIsReadyRequest) (*Is
 		localVarReturnValue  *IsAlive200Response
 	)
 
-	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataApiService.IsReady")
+	localBasePath, err := a.client.cfg.ServerURLWithContext(r.ctx, "MetadataAPIService.IsReady")
 	if err != nil {
 		return localVarReturnValue, nil, &GenericOpenAPIError{error: err.Error()}
 	}
diff --git a/internal/httpclient/client.go b/internal/httpclient/client.go
index 949a0e51ab35..14ee5d7619a6 100644
--- a/internal/httpclient/client.go
+++ b/internal/httpclient/client.go
@@ -49,13 +49,13 @@ type APIClient struct {
 
 	// API Services
 
-	CourierApi CourierApi
+	CourierAPI CourierAPI
 
-	FrontendApi FrontendApi
+	FrontendAPI FrontendAPI
 
-	IdentityApi IdentityApi
+	IdentityAPI IdentityAPI
 
-	MetadataApi MetadataApi
+	MetadataAPI MetadataAPI
 }
 
 type service struct {
@@ -74,10 +74,10 @@ func NewAPIClient(cfg *Configuration) *APIClient {
 	c.common.client = c
 
 	// API Services
-	c.CourierApi = (*CourierApiService)(&c.common)
-	c.FrontendApi = (*FrontendApiService)(&c.common)
-	c.IdentityApi = (*IdentityApiService)(&c.common)
-	c.MetadataApi = (*MetadataApiService)(&c.common)
+	c.CourierAPI = (*CourierAPIService)(&c.common)
+	c.FrontendAPI = (*FrontendAPIService)(&c.common)
+	c.IdentityAPI = (*IdentityAPIService)(&c.common)
+	c.MetadataAPI = (*MetadataAPIService)(&c.common)
 
 	return c
 }
diff --git a/internal/httpclient/model_continue_with.go b/internal/httpclient/model_continue_with.go
index 9e97dbf479e7..6fb1056836e6 100644
--- a/internal/httpclient/model_continue_with.go
+++ b/internal/httpclient/model_continue_with.go
@@ -19,6 +19,7 @@ import (
 // ContinueWith - struct for ContinueWith
 type ContinueWith struct {
 	ContinueWithRecoveryUi         *ContinueWithRecoveryUi
+	ContinueWithRedirectBrowserTo  *ContinueWithRedirectBrowserTo
 	ContinueWithSetOrySessionToken *ContinueWithSetOrySessionToken
 	ContinueWithSettingsUi         *ContinueWithSettingsUi
 	ContinueWithVerificationUi     *ContinueWithVerificationUi
@@ -31,6 +32,13 @@ func ContinueWithRecoveryUiAsContinueWith(v *ContinueWithRecoveryUi) ContinueWit
 	}
 }
 
+// ContinueWithRedirectBrowserToAsContinueWith is a convenience function that returns ContinueWithRedirectBrowserTo wrapped in ContinueWith
+func ContinueWithRedirectBrowserToAsContinueWith(v *ContinueWithRedirectBrowserTo) ContinueWith {
+	return ContinueWith{
+		ContinueWithRedirectBrowserTo: v,
+	}
+}
+
 // ContinueWithSetOrySessionTokenAsContinueWith is a convenience function that returns ContinueWithSetOrySessionToken wrapped in ContinueWith
 func ContinueWithSetOrySessionTokenAsContinueWith(v *ContinueWithSetOrySessionToken) ContinueWith {
 	return ContinueWith{
@@ -62,6 +70,18 @@ func (dst *ContinueWith) UnmarshalJSON(data []byte) error {
 		return fmt.Errorf("Failed to unmarshal JSON into map for the discrimintor lookup.")
 	}
 
+	// check if the discriminator value is 'redirect_browser_to'
+	if jsonDict["action"] == "redirect_browser_to" {
+		// try to unmarshal JSON data into ContinueWithRedirectBrowserTo
+		err = json.Unmarshal(data, &dst.ContinueWithRedirectBrowserTo)
+		if err == nil {
+			return nil // data stored in dst.ContinueWithRedirectBrowserTo, return on the first match
+		} else {
+			dst.ContinueWithRedirectBrowserTo = nil
+			return fmt.Errorf("Failed to unmarshal ContinueWith as ContinueWithRedirectBrowserTo: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'set_ory_session_token'
 	if jsonDict["action"] == "set_ory_session_token" {
 		// try to unmarshal JSON data into ContinueWithSetOrySessionToken
@@ -122,6 +142,18 @@ func (dst *ContinueWith) UnmarshalJSON(data []byte) error {
 		}
 	}
 
+	// check if the discriminator value is 'continueWithRedirectBrowserTo'
+	if jsonDict["action"] == "continueWithRedirectBrowserTo" {
+		// try to unmarshal JSON data into ContinueWithRedirectBrowserTo
+		err = json.Unmarshal(data, &dst.ContinueWithRedirectBrowserTo)
+		if err == nil {
+			return nil // data stored in dst.ContinueWithRedirectBrowserTo, return on the first match
+		} else {
+			dst.ContinueWithRedirectBrowserTo = nil
+			return fmt.Errorf("Failed to unmarshal ContinueWith as ContinueWithRedirectBrowserTo: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'continueWithSetOrySessionToken'
 	if jsonDict["action"] == "continueWithSetOrySessionToken" {
 		// try to unmarshal JSON data into ContinueWithSetOrySessionToken
@@ -167,6 +199,10 @@ func (src ContinueWith) MarshalJSON() ([]byte, error) {
 		return json.Marshal(&src.ContinueWithRecoveryUi)
 	}
 
+	if src.ContinueWithRedirectBrowserTo != nil {
+		return json.Marshal(&src.ContinueWithRedirectBrowserTo)
+	}
+
 	if src.ContinueWithSetOrySessionToken != nil {
 		return json.Marshal(&src.ContinueWithSetOrySessionToken)
 	}
@@ -191,6 +227,10 @@ func (obj *ContinueWith) GetActualInstance() interface{} {
 		return obj.ContinueWithRecoveryUi
 	}
 
+	if obj.ContinueWithRedirectBrowserTo != nil {
+		return obj.ContinueWithRedirectBrowserTo
+	}
+
 	if obj.ContinueWithSetOrySessionToken != nil {
 		return obj.ContinueWithSetOrySessionToken
 	}
diff --git a/internal/httpclient/model_continue_with_recovery_ui_flow.go b/internal/httpclient/model_continue_with_recovery_ui_flow.go
index 3fde7e717ef2..251725a73c3b 100644
--- a/internal/httpclient/model_continue_with_recovery_ui_flow.go
+++ b/internal/httpclient/model_continue_with_recovery_ui_flow.go
@@ -19,7 +19,7 @@ import (
 type ContinueWithRecoveryUiFlow struct {
 	// The ID of the recovery flow
 	Id string `json:"id"`
-	// The URL of the recovery flow
+	// The URL of the recovery flow  If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
 	Url *string `json:"url,omitempty"`
 }
 
diff --git a/internal/httpclient/model_continue_with_redirect_browser_to.go b/internal/httpclient/model_continue_with_redirect_browser_to.go
new file mode 100644
index 000000000000..20c3e4f3c562
--- /dev/null
+++ b/internal/httpclient/model_continue_with_redirect_browser_to.go
@@ -0,0 +1,138 @@
+/*
+ * Ory Identities API
+ *
+ * This is the API specification for Ory Identities with features such as registration, login, recovery, account verification, profile settings, password reset, identity management, session management, email and sms delivery, and more.
+ *
+ * API version:
+ * Contact: office@ory.sh
+ */
+
+// Code generated by OpenAPI Generator (https://openapi-generator.tech); DO NOT EDIT.
+
+package client
+
+import (
+	"encoding/json"
+)
+
+// ContinueWithRedirectBrowserTo Indicates, that the UI flow could be continued by showing a recovery ui
+type ContinueWithRedirectBrowserTo struct {
+	// Action will always be `redirect_browser_to` redirect_browser_to ContinueWithActionRedirectBrowserToString
+	Action string `json:"action"`
+	// The URL to redirect the browser to
+	RedirectBrowserTo string `json:"redirect_browser_to"`
+}
+
+// NewContinueWithRedirectBrowserTo instantiates a new ContinueWithRedirectBrowserTo object
+// This constructor will assign default values to properties that have it defined,
+// and makes sure properties required by API are set, but the set of arguments
+// will change when the set of required properties is changed
+func NewContinueWithRedirectBrowserTo(action string, redirectBrowserTo string) *ContinueWithRedirectBrowserTo {
+	this := ContinueWithRedirectBrowserTo{}
+	this.Action = action
+	this.RedirectBrowserTo = redirectBrowserTo
+	return &this
+}
+
+// NewContinueWithRedirectBrowserToWithDefaults instantiates a new ContinueWithRedirectBrowserTo object
+// This constructor will only assign default values to properties that have it defined,
+// but it doesn't guarantee that properties required by API are set
+func NewContinueWithRedirectBrowserToWithDefaults() *ContinueWithRedirectBrowserTo {
+	this := ContinueWithRedirectBrowserTo{}
+	return &this
+}
+
+// GetAction returns the Action field value
+func (o *ContinueWithRedirectBrowserTo) GetAction() string {
+	if o == nil {
+		var ret string
+		return ret
+	}
+
+	return o.Action
+}
+
+// GetActionOk returns a tuple with the Action field value
+// and a boolean to check if the value has been set.
+func (o *ContinueWithRedirectBrowserTo) GetActionOk() (*string, bool) {
+	if o == nil {
+		return nil, false
+	}
+	return &o.Action, true
+}
+
+// SetAction sets field value
+func (o *ContinueWithRedirectBrowserTo) SetAction(v string) {
+	o.Action = v
+}
+
+// GetRedirectBrowserTo returns the RedirectBrowserTo field value
+func (o *ContinueWithRedirectBrowserTo) GetRedirectBrowserTo() string {
+	if o == nil {
+		var ret string
+		return ret
+	}
+
+	return o.RedirectBrowserTo
+}
+
+// GetRedirectBrowserToOk returns a tuple with the RedirectBrowserTo field value
+// and a boolean to check if the value has been set.
+func (o *ContinueWithRedirectBrowserTo) GetRedirectBrowserToOk() (*string, bool) {
+	if o == nil {
+		return nil, false
+	}
+	return &o.RedirectBrowserTo, true
+}
+
+// SetRedirectBrowserTo sets field value
+func (o *ContinueWithRedirectBrowserTo) SetRedirectBrowserTo(v string) {
+	o.RedirectBrowserTo = v
+}
+
+func (o ContinueWithRedirectBrowserTo) MarshalJSON() ([]byte, error) {
+	toSerialize := map[string]interface{}{}
+	if true {
+		toSerialize["action"] = o.Action
+	}
+	if true {
+		toSerialize["redirect_browser_to"] = o.RedirectBrowserTo
+	}
+	return json.Marshal(toSerialize)
+}
+
+type NullableContinueWithRedirectBrowserTo struct {
+	value *ContinueWithRedirectBrowserTo
+	isSet bool
+}
+
+func (v NullableContinueWithRedirectBrowserTo) Get() *ContinueWithRedirectBrowserTo {
+	return v.value
+}
+
+func (v *NullableContinueWithRedirectBrowserTo) Set(val *ContinueWithRedirectBrowserTo) {
+	v.value = val
+	v.isSet = true
+}
+
+func (v NullableContinueWithRedirectBrowserTo) IsSet() bool {
+	return v.isSet
+}
+
+func (v *NullableContinueWithRedirectBrowserTo) Unset() {
+	v.value = nil
+	v.isSet = false
+}
+
+func NewNullableContinueWithRedirectBrowserTo(val *ContinueWithRedirectBrowserTo) *NullableContinueWithRedirectBrowserTo {
+	return &NullableContinueWithRedirectBrowserTo{value: val, isSet: true}
+}
+
+func (v NullableContinueWithRedirectBrowserTo) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.value)
+}
+
+func (v *NullableContinueWithRedirectBrowserTo) UnmarshalJSON(src []byte) error {
+	v.isSet = true
+	return json.Unmarshal(src, &v.value)
+}
diff --git a/internal/httpclient/model_continue_with_settings_ui_flow.go b/internal/httpclient/model_continue_with_settings_ui_flow.go
index 4ccaf74ef1b8..d6e9b9441f99 100644
--- a/internal/httpclient/model_continue_with_settings_ui_flow.go
+++ b/internal/httpclient/model_continue_with_settings_ui_flow.go
@@ -19,6 +19,8 @@ import (
 type ContinueWithSettingsUiFlow struct {
 	// The ID of the settings flow
 	Id string `json:"id"`
+	// The URL of the settings flow  If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
+	Url *string `json:"url,omitempty"`
 }
 
 // NewContinueWithSettingsUiFlow instantiates a new ContinueWithSettingsUiFlow object
@@ -63,11 +65,46 @@ func (o *ContinueWithSettingsUiFlow) SetId(v string) {
 	o.Id = v
 }
 
+// GetUrl returns the Url field value if set, zero value otherwise.
+func (o *ContinueWithSettingsUiFlow) GetUrl() string {
+	if o == nil || o.Url == nil {
+		var ret string
+		return ret
+	}
+	return *o.Url
+}
+
+// GetUrlOk returns a tuple with the Url field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *ContinueWithSettingsUiFlow) GetUrlOk() (*string, bool) {
+	if o == nil || o.Url == nil {
+		return nil, false
+	}
+	return o.Url, true
+}
+
+// HasUrl returns a boolean if a field has been set.
+func (o *ContinueWithSettingsUiFlow) HasUrl() bool {
+	if o != nil && o.Url != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetUrl gets a reference to the given string and assigns it to the Url field.
+func (o *ContinueWithSettingsUiFlow) SetUrl(v string) {
+	o.Url = &v
+}
+
 func (o ContinueWithSettingsUiFlow) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
 	if true {
 		toSerialize["id"] = o.Id
 	}
+	if o.Url != nil {
+		toSerialize["url"] = o.Url
+	}
 	return json.Marshal(toSerialize)
 }
 
diff --git a/internal/httpclient/model_continue_with_verification_ui_flow.go b/internal/httpclient/model_continue_with_verification_ui_flow.go
index 8fdd4609cf93..3c73a0761339 100644
--- a/internal/httpclient/model_continue_with_verification_ui_flow.go
+++ b/internal/httpclient/model_continue_with_verification_ui_flow.go
@@ -19,7 +19,7 @@ import (
 type ContinueWithVerificationUiFlow struct {
 	// The ID of the verification flow
 	Id string `json:"id"`
-	// The URL of the verification flow
+	// The URL of the verification flow  If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
 	Url *string `json:"url,omitempty"`
 	// The address that should be verified in this flow
 	VerifiableAddress string `json:"verifiable_address"`
diff --git a/internal/httpclient/model_identity_credentials.go b/internal/httpclient/model_identity_credentials.go
index 7ee96800df4b..de087e64e09f 100644
--- a/internal/httpclient/model_identity_credentials.go
+++ b/internal/httpclient/model_identity_credentials.go
@@ -23,7 +23,7 @@ type IdentityCredentials struct {
 	CreatedAt *time.Time `json:"created_at,omitempty"`
 	// Identifiers represents a list of unique identifiers this credential type matches.
 	Identifiers []string `json:"identifiers,omitempty"`
-	// Type discriminates between different types of credentials. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+	// Type discriminates between different types of credentials. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
 	Type *string `json:"type,omitempty"`
 	// UpdatedAt is a helper struct field for gobuffalo.pop.
 	UpdatedAt *time.Time `json:"updated_at,omitempty"`
diff --git a/internal/httpclient/model_identity_credentials_code.go b/internal/httpclient/model_identity_credentials_code.go
index 75857f31c272..53fefb6719eb 100644
--- a/internal/httpclient/model_identity_credentials_code.go
+++ b/internal/httpclient/model_identity_credentials_code.go
@@ -13,14 +13,11 @@ package client
 
 import (
 	"encoding/json"
-	"time"
 )
 
 // IdentityCredentialsCode CredentialsCode represents a one time login/registration code
 type IdentityCredentialsCode struct {
-	// The type of the address for this code
-	AddressType *string      `json:"address_type,omitempty"`
-	UsedAt      NullableTime `json:"used_at,omitempty"`
+	Addresses []IdentityCredentialsCodeAddress `json:"addresses,omitempty"`
 }
 
 // NewIdentityCredentialsCode instantiates a new IdentityCredentialsCode object
@@ -40,88 +37,42 @@ func NewIdentityCredentialsCodeWithDefaults() *IdentityCredentialsCode {
 	return &this
 }
 
-// GetAddressType returns the AddressType field value if set, zero value otherwise.
-func (o *IdentityCredentialsCode) GetAddressType() string {
-	if o == nil || o.AddressType == nil {
-		var ret string
+// GetAddresses returns the Addresses field value if set, zero value otherwise.
+func (o *IdentityCredentialsCode) GetAddresses() []IdentityCredentialsCodeAddress {
+	if o == nil || o.Addresses == nil {
+		var ret []IdentityCredentialsCodeAddress
 		return ret
 	}
-	return *o.AddressType
+	return o.Addresses
 }
 
-// GetAddressTypeOk returns a tuple with the AddressType field value if set, nil otherwise
+// GetAddressesOk returns a tuple with the Addresses field value if set, nil otherwise
 // and a boolean to check if the value has been set.
-func (o *IdentityCredentialsCode) GetAddressTypeOk() (*string, bool) {
-	if o == nil || o.AddressType == nil {
+func (o *IdentityCredentialsCode) GetAddressesOk() ([]IdentityCredentialsCodeAddress, bool) {
+	if o == nil || o.Addresses == nil {
 		return nil, false
 	}
-	return o.AddressType, true
+	return o.Addresses, true
 }
 
-// HasAddressType returns a boolean if a field has been set.
-func (o *IdentityCredentialsCode) HasAddressType() bool {
-	if o != nil && o.AddressType != nil {
+// HasAddresses returns a boolean if a field has been set.
+func (o *IdentityCredentialsCode) HasAddresses() bool {
+	if o != nil && o.Addresses != nil {
 		return true
 	}
 
 	return false
 }
 
-// SetAddressType gets a reference to the given string and assigns it to the AddressType field.
-func (o *IdentityCredentialsCode) SetAddressType(v string) {
-	o.AddressType = &v
-}
-
-// GetUsedAt returns the UsedAt field value if set, zero value otherwise (both if not set or set to explicit null).
-func (o *IdentityCredentialsCode) GetUsedAt() time.Time {
-	if o == nil || o.UsedAt.Get() == nil {
-		var ret time.Time
-		return ret
-	}
-	return *o.UsedAt.Get()
-}
-
-// GetUsedAtOk returns a tuple with the UsedAt field value if set, nil otherwise
-// and a boolean to check if the value has been set.
-// NOTE: If the value is an explicit nil, `nil, true` will be returned
-func (o *IdentityCredentialsCode) GetUsedAtOk() (*time.Time, bool) {
-	if o == nil {
-		return nil, false
-	}
-	return o.UsedAt.Get(), o.UsedAt.IsSet()
-}
-
-// HasUsedAt returns a boolean if a field has been set.
-func (o *IdentityCredentialsCode) HasUsedAt() bool {
-	if o != nil && o.UsedAt.IsSet() {
-		return true
-	}
-
-	return false
-}
-
-// SetUsedAt gets a reference to the given NullableTime and assigns it to the UsedAt field.
-func (o *IdentityCredentialsCode) SetUsedAt(v time.Time) {
-	o.UsedAt.Set(&v)
-}
-
-// SetUsedAtNil sets the value for UsedAt to be an explicit nil
-func (o *IdentityCredentialsCode) SetUsedAtNil() {
-	o.UsedAt.Set(nil)
-}
-
-// UnsetUsedAt ensures that no value is present for UsedAt, not even an explicit nil
-func (o *IdentityCredentialsCode) UnsetUsedAt() {
-	o.UsedAt.Unset()
+// SetAddresses gets a reference to the given []IdentityCredentialsCodeAddress and assigns it to the Addresses field.
+func (o *IdentityCredentialsCode) SetAddresses(v []IdentityCredentialsCodeAddress) {
+	o.Addresses = v
 }
 
 func (o IdentityCredentialsCode) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
-	if o.AddressType != nil {
-		toSerialize["address_type"] = o.AddressType
-	}
-	if o.UsedAt.IsSet() {
-		toSerialize["used_at"] = o.UsedAt.Get()
+	if o.Addresses != nil {
+		toSerialize["addresses"] = o.Addresses
 	}
 	return json.Marshal(toSerialize)
 }
diff --git a/internal/httpclient/model_identity_credentials_code_address.go b/internal/httpclient/model_identity_credentials_code_address.go
new file mode 100644
index 000000000000..c739045e79e0
--- /dev/null
+++ b/internal/httpclient/model_identity_credentials_code_address.go
@@ -0,0 +1,151 @@
+/*
+ * Ory Identities API
+ *
+ * This is the API specification for Ory Identities with features such as registration, login, recovery, account verification, profile settings, password reset, identity management, session management, email and sms delivery, and more.
+ *
+ * API version:
+ * Contact: office@ory.sh
+ */
+
+// Code generated by OpenAPI Generator (https://openapi-generator.tech); DO NOT EDIT.
+
+package client
+
+import (
+	"encoding/json"
+)
+
+// IdentityCredentialsCodeAddress struct for IdentityCredentialsCodeAddress
+type IdentityCredentialsCodeAddress struct {
+	// The address for this code
+	Address *string `json:"address,omitempty"`
+	Channel *string `json:"channel,omitempty"`
+}
+
+// NewIdentityCredentialsCodeAddress instantiates a new IdentityCredentialsCodeAddress object
+// This constructor will assign default values to properties that have it defined,
+// and makes sure properties required by API are set, but the set of arguments
+// will change when the set of required properties is changed
+func NewIdentityCredentialsCodeAddress() *IdentityCredentialsCodeAddress {
+	this := IdentityCredentialsCodeAddress{}
+	return &this
+}
+
+// NewIdentityCredentialsCodeAddressWithDefaults instantiates a new IdentityCredentialsCodeAddress object
+// This constructor will only assign default values to properties that have it defined,
+// but it doesn't guarantee that properties required by API are set
+func NewIdentityCredentialsCodeAddressWithDefaults() *IdentityCredentialsCodeAddress {
+	this := IdentityCredentialsCodeAddress{}
+	return &this
+}
+
+// GetAddress returns the Address field value if set, zero value otherwise.
+func (o *IdentityCredentialsCodeAddress) GetAddress() string {
+	if o == nil || o.Address == nil {
+		var ret string
+		return ret
+	}
+	return *o.Address
+}
+
+// GetAddressOk returns a tuple with the Address field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *IdentityCredentialsCodeAddress) GetAddressOk() (*string, bool) {
+	if o == nil || o.Address == nil {
+		return nil, false
+	}
+	return o.Address, true
+}
+
+// HasAddress returns a boolean if a field has been set.
+func (o *IdentityCredentialsCodeAddress) HasAddress() bool {
+	if o != nil && o.Address != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetAddress gets a reference to the given string and assigns it to the Address field.
+func (o *IdentityCredentialsCodeAddress) SetAddress(v string) {
+	o.Address = &v
+}
+
+// GetChannel returns the Channel field value if set, zero value otherwise.
+func (o *IdentityCredentialsCodeAddress) GetChannel() string {
+	if o == nil || o.Channel == nil {
+		var ret string
+		return ret
+	}
+	return *o.Channel
+}
+
+// GetChannelOk returns a tuple with the Channel field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *IdentityCredentialsCodeAddress) GetChannelOk() (*string, bool) {
+	if o == nil || o.Channel == nil {
+		return nil, false
+	}
+	return o.Channel, true
+}
+
+// HasChannel returns a boolean if a field has been set.
+func (o *IdentityCredentialsCodeAddress) HasChannel() bool {
+	if o != nil && o.Channel != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetChannel gets a reference to the given string and assigns it to the Channel field.
+func (o *IdentityCredentialsCodeAddress) SetChannel(v string) {
+	o.Channel = &v
+}
+
+func (o IdentityCredentialsCodeAddress) MarshalJSON() ([]byte, error) {
+	toSerialize := map[string]interface{}{}
+	if o.Address != nil {
+		toSerialize["address"] = o.Address
+	}
+	if o.Channel != nil {
+		toSerialize["channel"] = o.Channel
+	}
+	return json.Marshal(toSerialize)
+}
+
+type NullableIdentityCredentialsCodeAddress struct {
+	value *IdentityCredentialsCodeAddress
+	isSet bool
+}
+
+func (v NullableIdentityCredentialsCodeAddress) Get() *IdentityCredentialsCodeAddress {
+	return v.value
+}
+
+func (v *NullableIdentityCredentialsCodeAddress) Set(val *IdentityCredentialsCodeAddress) {
+	v.value = val
+	v.isSet = true
+}
+
+func (v NullableIdentityCredentialsCodeAddress) IsSet() bool {
+	return v.isSet
+}
+
+func (v *NullableIdentityCredentialsCodeAddress) Unset() {
+	v.value = nil
+	v.isSet = false
+}
+
+func NewNullableIdentityCredentialsCodeAddress(val *IdentityCredentialsCodeAddress) *NullableIdentityCredentialsCodeAddress {
+	return &NullableIdentityCredentialsCodeAddress{value: val, isSet: true}
+}
+
+func (v NullableIdentityCredentialsCodeAddress) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.value)
+}
+
+func (v *NullableIdentityCredentialsCodeAddress) UnmarshalJSON(src []byte) error {
+	v.isSet = true
+	return json.Unmarshal(src, &v.value)
+}
diff --git a/internal/httpclient/model_identity_credentials_password.go b/internal/httpclient/model_identity_credentials_password.go
index 85f942fb6852..df1900568bb3 100644
--- a/internal/httpclient/model_identity_credentials_password.go
+++ b/internal/httpclient/model_identity_credentials_password.go
@@ -19,6 +19,8 @@ import (
 type IdentityCredentialsPassword struct {
 	// HashedPassword is a hash-representation of the password.
 	HashedPassword *string `json:"hashed_password,omitempty"`
+	// UsePasswordMigrationHook is set to true if the password should be migrated using the password migration hook. If set, and the HashedPassword is empty, a webhook will be called during login to migrate the password.
+	UsePasswordMigrationHook *bool `json:"use_password_migration_hook,omitempty"`
 }
 
 // NewIdentityCredentialsPassword instantiates a new IdentityCredentialsPassword object
@@ -70,11 +72,46 @@ func (o *IdentityCredentialsPassword) SetHashedPassword(v string) {
 	o.HashedPassword = &v
 }
 
+// GetUsePasswordMigrationHook returns the UsePasswordMigrationHook field value if set, zero value otherwise.
+func (o *IdentityCredentialsPassword) GetUsePasswordMigrationHook() bool {
+	if o == nil || o.UsePasswordMigrationHook == nil {
+		var ret bool
+		return ret
+	}
+	return *o.UsePasswordMigrationHook
+}
+
+// GetUsePasswordMigrationHookOk returns a tuple with the UsePasswordMigrationHook field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *IdentityCredentialsPassword) GetUsePasswordMigrationHookOk() (*bool, bool) {
+	if o == nil || o.UsePasswordMigrationHook == nil {
+		return nil, false
+	}
+	return o.UsePasswordMigrationHook, true
+}
+
+// HasUsePasswordMigrationHook returns a boolean if a field has been set.
+func (o *IdentityCredentialsPassword) HasUsePasswordMigrationHook() bool {
+	if o != nil && o.UsePasswordMigrationHook != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetUsePasswordMigrationHook gets a reference to the given bool and assigns it to the UsePasswordMigrationHook field.
+func (o *IdentityCredentialsPassword) SetUsePasswordMigrationHook(v bool) {
+	o.UsePasswordMigrationHook = &v
+}
+
 func (o IdentityCredentialsPassword) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
 	if o.HashedPassword != nil {
 		toSerialize["hashed_password"] = o.HashedPassword
 	}
+	if o.UsePasswordMigrationHook != nil {
+		toSerialize["use_password_migration_hook"] = o.UsePasswordMigrationHook
+	}
 	return json.Marshal(toSerialize)
 }
 
diff --git a/internal/httpclient/model_identity_patch_response.go b/internal/httpclient/model_identity_patch_response.go
index 2ee305f7da81..f67224edad01 100644
--- a/internal/httpclient/model_identity_patch_response.go
+++ b/internal/httpclient/model_identity_patch_response.go
@@ -17,8 +17,9 @@ import (
 
 // IdentityPatchResponse Response for a single identity patch
 type IdentityPatchResponse struct {
-	// The action for this specific patch create ActionCreate  Create this identity.
-	Action *string `json:"action,omitempty"`
+	// The action for this specific patch create ActionCreate  Create this identity. error ActionError  Error indicates that the patch failed.
+	Action *string     `json:"action,omitempty"`
+	Error  interface{} `json:"error,omitempty"`
 	// The identity ID payload of this patch
 	Identity *string `json:"identity,omitempty"`
 	// The ID of this patch response, if an ID was specified in the patch.
@@ -74,6 +75,39 @@ func (o *IdentityPatchResponse) SetAction(v string) {
 	o.Action = &v
 }
 
+// GetError returns the Error field value if set, zero value otherwise (both if not set or set to explicit null).
+func (o *IdentityPatchResponse) GetError() interface{} {
+	if o == nil {
+		var ret interface{}
+		return ret
+	}
+	return o.Error
+}
+
+// GetErrorOk returns a tuple with the Error field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+// NOTE: If the value is an explicit nil, `nil, true` will be returned
+func (o *IdentityPatchResponse) GetErrorOk() (*interface{}, bool) {
+	if o == nil || o.Error == nil {
+		return nil, false
+	}
+	return &o.Error, true
+}
+
+// HasError returns a boolean if a field has been set.
+func (o *IdentityPatchResponse) HasError() bool {
+	if o != nil && o.Error != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetError gets a reference to the given interface{} and assigns it to the Error field.
+func (o *IdentityPatchResponse) SetError(v interface{}) {
+	o.Error = v
+}
+
 // GetIdentity returns the Identity field value if set, zero value otherwise.
 func (o *IdentityPatchResponse) GetIdentity() string {
 	if o == nil || o.Identity == nil {
@@ -143,6 +177,9 @@ func (o IdentityPatchResponse) MarshalJSON() ([]byte, error) {
 	if o.Action != nil {
 		toSerialize["action"] = o.Action
 	}
+	if o.Error != nil {
+		toSerialize["error"] = o.Error
+	}
 	if o.Identity != nil {
 		toSerialize["identity"] = o.Identity
 	}
diff --git a/internal/httpclient/model_identity_with_credentials_password_config.go b/internal/httpclient/model_identity_with_credentials_password_config.go
index 754d59460f83..34f09ae58232 100644
--- a/internal/httpclient/model_identity_with_credentials_password_config.go
+++ b/internal/httpclient/model_identity_with_credentials_password_config.go
@@ -21,6 +21,8 @@ type IdentityWithCredentialsPasswordConfig struct {
 	HashedPassword *string `json:"hashed_password,omitempty"`
 	// The password in plain text if no hash is available.
 	Password *string `json:"password,omitempty"`
+	// If set to true, the password will be migrated using the password migration hook.
+	UsePasswordMigrationHook *bool `json:"use_password_migration_hook,omitempty"`
 }
 
 // NewIdentityWithCredentialsPasswordConfig instantiates a new IdentityWithCredentialsPasswordConfig object
@@ -104,6 +106,38 @@ func (o *IdentityWithCredentialsPasswordConfig) SetPassword(v string) {
 	o.Password = &v
 }
 
+// GetUsePasswordMigrationHook returns the UsePasswordMigrationHook field value if set, zero value otherwise.
+func (o *IdentityWithCredentialsPasswordConfig) GetUsePasswordMigrationHook() bool {
+	if o == nil || o.UsePasswordMigrationHook == nil {
+		var ret bool
+		return ret
+	}
+	return *o.UsePasswordMigrationHook
+}
+
+// GetUsePasswordMigrationHookOk returns a tuple with the UsePasswordMigrationHook field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *IdentityWithCredentialsPasswordConfig) GetUsePasswordMigrationHookOk() (*bool, bool) {
+	if o == nil || o.UsePasswordMigrationHook == nil {
+		return nil, false
+	}
+	return o.UsePasswordMigrationHook, true
+}
+
+// HasUsePasswordMigrationHook returns a boolean if a field has been set.
+func (o *IdentityWithCredentialsPasswordConfig) HasUsePasswordMigrationHook() bool {
+	if o != nil && o.UsePasswordMigrationHook != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetUsePasswordMigrationHook gets a reference to the given bool and assigns it to the UsePasswordMigrationHook field.
+func (o *IdentityWithCredentialsPasswordConfig) SetUsePasswordMigrationHook(v bool) {
+	o.UsePasswordMigrationHook = &v
+}
+
 func (o IdentityWithCredentialsPasswordConfig) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
 	if o.HashedPassword != nil {
@@ -112,6 +146,9 @@ func (o IdentityWithCredentialsPasswordConfig) MarshalJSON() ([]byte, error) {
 	if o.Password != nil {
 		toSerialize["password"] = o.Password
 	}
+	if o.UsePasswordMigrationHook != nil {
+		toSerialize["use_password_migration_hook"] = o.UsePasswordMigrationHook
+	}
 	return json.Marshal(toSerialize)
 }
 
diff --git a/internal/httpclient/model_login_flow.go b/internal/httpclient/model_login_flow.go
index 2794adee0b83..5fc35379ea48 100644
--- a/internal/httpclient/model_login_flow.go
+++ b/internal/httpclient/model_login_flow.go
@@ -18,7 +18,7 @@ import (
 
 // LoginFlow This object represents a login flow. A login flow is initiated at the \"Initiate Login API / Browser Flow\" endpoint by a client.  Once a login flow is completed successfully, a session cookie or session token will be issued.
 type LoginFlow struct {
-	// The active login method  If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+	// The active login method  If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
 	Active *string `json:"active,omitempty"`
 	// CreatedAt is a helper struct field for gobuffalo.pop.
 	CreatedAt *time.Time `json:"created_at,omitempty"`
diff --git a/internal/httpclient/model_login_flow_state.go b/internal/httpclient/model_login_flow_state.go
index ce5570b79032..58af057c612f 100644
--- a/internal/httpclient/model_login_flow_state.go
+++ b/internal/httpclient/model_login_flow_state.go
@@ -16,7 +16,7 @@ import (
 	"fmt"
 )
 
-// LoginFlowState The state represents the state of the login flow.  choose_method: ask the user to choose a method (e.g. login account via email) sent_email: the email has been sent to the user passed_challenge: the request was successful and the login challenge was passed.
+// LoginFlowState The experimental state represents the state of a login flow. This field is EXPERIMENTAL and subject to change!
 type LoginFlowState string
 
 // List of loginFlowState
diff --git a/internal/httpclient/model_recovery_flow_state.go b/internal/httpclient/model_recovery_flow_state.go
index 1c660ba043b9..d1fa3618882a 100644
--- a/internal/httpclient/model_recovery_flow_state.go
+++ b/internal/httpclient/model_recovery_flow_state.go
@@ -16,7 +16,7 @@ import (
 	"fmt"
 )
 
-// RecoveryFlowState The state represents the state of the recovery flow.  choose_method: ask the user to choose a method (e.g. recover account via email) sent_email: the email has been sent to the user passed_challenge: the request was successful and the recovery challenge was passed.
+// RecoveryFlowState The experimental state represents the state of a recovery flow. This field is EXPERIMENTAL and subject to change!
 type RecoveryFlowState string
 
 // List of recoveryFlowState
diff --git a/internal/httpclient/model_registration_flow.go b/internal/httpclient/model_registration_flow.go
index c0ba64843d3f..4eb2d78f6052 100644
--- a/internal/httpclient/model_registration_flow.go
+++ b/internal/httpclient/model_registration_flow.go
@@ -18,7 +18,7 @@ import (
 
 // RegistrationFlow struct for RegistrationFlow
 type RegistrationFlow struct {
-	// Active, if set, contains the registration method that is being used. It is initially not set. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+	// Active, if set, contains the registration method that is being used. It is initially not set. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
 	Active *string `json:"active,omitempty"`
 	// ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated.
 	ExpiresAt time.Time `json:"expires_at"`
diff --git a/internal/httpclient/model_registration_flow_state.go b/internal/httpclient/model_registration_flow_state.go
index 86f3fd38cff0..15fd9f532d4b 100644
--- a/internal/httpclient/model_registration_flow_state.go
+++ b/internal/httpclient/model_registration_flow_state.go
@@ -16,7 +16,7 @@ import (
 	"fmt"
 )
 
-// RegistrationFlowState choose_method: ask the user to choose a method (e.g. registration with email) sent_email: the email has been sent to the user passed_challenge: the request was successful and the registration challenge was passed.
+// RegistrationFlowState The experimental state represents the state of a registration flow. This field is EXPERIMENTAL and subject to change!
 type RegistrationFlowState string
 
 // List of registrationFlowState
diff --git a/internal/httpclient/model_settings_flow_state.go b/internal/httpclient/model_settings_flow_state.go
index f994c786a2d8..70093c9c4a03 100644
--- a/internal/httpclient/model_settings_flow_state.go
+++ b/internal/httpclient/model_settings_flow_state.go
@@ -16,7 +16,7 @@ import (
 	"fmt"
 )
 
-// SettingsFlowState show_form: No user data has been collected, or it is invalid, and thus the form should be shown. success: Indicates that the settings flow has been updated successfully with the provided data. Done will stay true when repeatedly checking. If set to true, done will revert back to false only when a flow with invalid (e.g. \"please use a valid phone number\") data was sent.
+// SettingsFlowState The experimental state represents the state of a settings flow. This field is EXPERIMENTAL and subject to change!
 type SettingsFlowState string
 
 // List of settingsFlowState
diff --git a/internal/httpclient/model_ui_node.go b/internal/httpclient/model_ui_node.go
index e73f3c5e37d8..3582d9e85f67 100644
--- a/internal/httpclient/model_ui_node.go
+++ b/internal/httpclient/model_ui_node.go
@@ -18,7 +18,7 @@ import (
 // UiNode Nodes are represented as HTML elements or their native UI equivalents. For example, a node can be an `<img>` tag, or an `<input element>` but also `some plain text`.
 type UiNode struct {
 	Attributes UiNodeAttributes `json:"attributes"`
-	// Group specifies which group (e.g. password authenticator) this node belongs to. default DefaultGroup password PasswordGroup oidc OpenIDConnectGroup profile ProfileGroup link LinkGroup code CodeGroup totp TOTPGroup lookup_secret LookupGroup webauthn WebAuthnGroup passkey PasskeyGroup
+	// Group specifies which group (e.g. password authenticator) this node belongs to. default DefaultGroup password PasswordGroup oidc OpenIDConnectGroup profile ProfileGroup link LinkGroup code CodeGroup totp TOTPGroup lookup_secret LookupGroup webauthn WebAuthnGroup passkey PasskeyGroup identifier_first IdentifierFirstGroup
 	Group    string     `json:"group"`
 	Messages []UiText   `json:"messages"`
 	Meta     UiNodeMeta `json:"meta"`
diff --git a/internal/httpclient/model_ui_node_input_attributes.go b/internal/httpclient/model_ui_node_input_attributes.go
index b373dda7ccfd..f8deff5d5417 100644
--- a/internal/httpclient/model_ui_node_input_attributes.go
+++ b/internal/httpclient/model_ui_node_input_attributes.go
@@ -22,14 +22,20 @@ type UiNodeInputAttributes struct {
 	// Sets the input's disabled field to true or false.
 	Disabled bool    `json:"disabled"`
 	Label    *UiText `json:"label,omitempty"`
+	// MaxLength may contain the input's maximum length.
+	Maxlength *int64 `json:"maxlength,omitempty"`
 	// The input's element name.
 	Name string `json:"name"`
 	// NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0.  In this struct it technically always is \"input\". text Text input Input img Image a Anchor script Script
 	NodeType string `json:"node_type"`
-	// OnClick may contain javascript which should be executed on click. This is primarily used for WebAuthn.
+	// OnClick may contain javascript which should be executed on click. This is primarily used for WebAuthn.  Deprecated: Using OnClick requires the use of eval() which is a security risk. Use OnClickTrigger instead.
 	Onclick *string `json:"onclick,omitempty"`
-	// OnLoad may contain javascript which should be executed on load. This is primarily used for WebAuthn.
+	// OnClickTrigger may contain a WebAuthn trigger which should be executed on click.  The trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login. oryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration oryWebAuthnLogin WebAuthnTriggersWebAuthnLogin oryPasskeyLogin WebAuthnTriggersPasskeyLogin oryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit oryPasskeyRegistration WebAuthnTriggersPasskeyRegistration oryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration
+	OnclickTrigger *string `json:"onclickTrigger,omitempty"`
+	// OnLoad may contain javascript which should be executed on load. This is primarily used for WebAuthn.  Deprecated: Using OnLoad requires the use of eval() which is a security risk. Use OnLoadTrigger instead.
 	Onload *string `json:"onload,omitempty"`
+	// OnLoadTrigger may contain a WebAuthn trigger which should be executed on load.  The trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login. oryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration oryWebAuthnLogin WebAuthnTriggersWebAuthnLogin oryPasskeyLogin WebAuthnTriggersPasskeyLogin oryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit oryPasskeyRegistration WebAuthnTriggersPasskeyRegistration oryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration
+	OnloadTrigger *string `json:"onloadTrigger,omitempty"`
 	// The input's pattern.
 	Pattern *string `json:"pattern,omitempty"`
 	// Mark this input field as required.
@@ -149,6 +155,38 @@ func (o *UiNodeInputAttributes) SetLabel(v UiText) {
 	o.Label = &v
 }
 
+// GetMaxlength returns the Maxlength field value if set, zero value otherwise.
+func (o *UiNodeInputAttributes) GetMaxlength() int64 {
+	if o == nil || o.Maxlength == nil {
+		var ret int64
+		return ret
+	}
+	return *o.Maxlength
+}
+
+// GetMaxlengthOk returns a tuple with the Maxlength field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UiNodeInputAttributes) GetMaxlengthOk() (*int64, bool) {
+	if o == nil || o.Maxlength == nil {
+		return nil, false
+	}
+	return o.Maxlength, true
+}
+
+// HasMaxlength returns a boolean if a field has been set.
+func (o *UiNodeInputAttributes) HasMaxlength() bool {
+	if o != nil && o.Maxlength != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetMaxlength gets a reference to the given int64 and assigns it to the Maxlength field.
+func (o *UiNodeInputAttributes) SetMaxlength(v int64) {
+	o.Maxlength = &v
+}
+
 // GetName returns the Name field value
 func (o *UiNodeInputAttributes) GetName() string {
 	if o == nil {
@@ -229,6 +267,38 @@ func (o *UiNodeInputAttributes) SetOnclick(v string) {
 	o.Onclick = &v
 }
 
+// GetOnclickTrigger returns the OnclickTrigger field value if set, zero value otherwise.
+func (o *UiNodeInputAttributes) GetOnclickTrigger() string {
+	if o == nil || o.OnclickTrigger == nil {
+		var ret string
+		return ret
+	}
+	return *o.OnclickTrigger
+}
+
+// GetOnclickTriggerOk returns a tuple with the OnclickTrigger field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UiNodeInputAttributes) GetOnclickTriggerOk() (*string, bool) {
+	if o == nil || o.OnclickTrigger == nil {
+		return nil, false
+	}
+	return o.OnclickTrigger, true
+}
+
+// HasOnclickTrigger returns a boolean if a field has been set.
+func (o *UiNodeInputAttributes) HasOnclickTrigger() bool {
+	if o != nil && o.OnclickTrigger != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetOnclickTrigger gets a reference to the given string and assigns it to the OnclickTrigger field.
+func (o *UiNodeInputAttributes) SetOnclickTrigger(v string) {
+	o.OnclickTrigger = &v
+}
+
 // GetOnload returns the Onload field value if set, zero value otherwise.
 func (o *UiNodeInputAttributes) GetOnload() string {
 	if o == nil || o.Onload == nil {
@@ -261,6 +331,38 @@ func (o *UiNodeInputAttributes) SetOnload(v string) {
 	o.Onload = &v
 }
 
+// GetOnloadTrigger returns the OnloadTrigger field value if set, zero value otherwise.
+func (o *UiNodeInputAttributes) GetOnloadTrigger() string {
+	if o == nil || o.OnloadTrigger == nil {
+		var ret string
+		return ret
+	}
+	return *o.OnloadTrigger
+}
+
+// GetOnloadTriggerOk returns a tuple with the OnloadTrigger field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UiNodeInputAttributes) GetOnloadTriggerOk() (*string, bool) {
+	if o == nil || o.OnloadTrigger == nil {
+		return nil, false
+	}
+	return o.OnloadTrigger, true
+}
+
+// HasOnloadTrigger returns a boolean if a field has been set.
+func (o *UiNodeInputAttributes) HasOnloadTrigger() bool {
+	if o != nil && o.OnloadTrigger != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetOnloadTrigger gets a reference to the given string and assigns it to the OnloadTrigger field.
+func (o *UiNodeInputAttributes) SetOnloadTrigger(v string) {
+	o.OnloadTrigger = &v
+}
+
 // GetPattern returns the Pattern field value if set, zero value otherwise.
 func (o *UiNodeInputAttributes) GetPattern() string {
 	if o == nil || o.Pattern == nil {
@@ -393,6 +495,9 @@ func (o UiNodeInputAttributes) MarshalJSON() ([]byte, error) {
 	if o.Label != nil {
 		toSerialize["label"] = o.Label
 	}
+	if o.Maxlength != nil {
+		toSerialize["maxlength"] = o.Maxlength
+	}
 	if true {
 		toSerialize["name"] = o.Name
 	}
@@ -402,9 +507,15 @@ func (o UiNodeInputAttributes) MarshalJSON() ([]byte, error) {
 	if o.Onclick != nil {
 		toSerialize["onclick"] = o.Onclick
 	}
+	if o.OnclickTrigger != nil {
+		toSerialize["onclickTrigger"] = o.OnclickTrigger
+	}
 	if o.Onload != nil {
 		toSerialize["onload"] = o.Onload
 	}
+	if o.OnloadTrigger != nil {
+		toSerialize["onloadTrigger"] = o.OnloadTrigger
+	}
 	if o.Pattern != nil {
 		toSerialize["pattern"] = o.Pattern
 	}
diff --git a/internal/httpclient/model_update_login_flow_body.go b/internal/httpclient/model_update_login_flow_body.go
index b8bb05734e3c..f0d79322c54f 100644
--- a/internal/httpclient/model_update_login_flow_body.go
+++ b/internal/httpclient/model_update_login_flow_body.go
@@ -18,13 +18,14 @@ import (
 
 // UpdateLoginFlowBody - struct for UpdateLoginFlowBody
 type UpdateLoginFlowBody struct {
-	UpdateLoginFlowWithCodeMethod         *UpdateLoginFlowWithCodeMethod
-	UpdateLoginFlowWithLookupSecretMethod *UpdateLoginFlowWithLookupSecretMethod
-	UpdateLoginFlowWithOidcMethod         *UpdateLoginFlowWithOidcMethod
-	UpdateLoginFlowWithPasskeyMethod      *UpdateLoginFlowWithPasskeyMethod
-	UpdateLoginFlowWithPasswordMethod     *UpdateLoginFlowWithPasswordMethod
-	UpdateLoginFlowWithTotpMethod         *UpdateLoginFlowWithTotpMethod
-	UpdateLoginFlowWithWebAuthnMethod     *UpdateLoginFlowWithWebAuthnMethod
+	UpdateLoginFlowWithCodeMethod            *UpdateLoginFlowWithCodeMethod
+	UpdateLoginFlowWithIdentifierFirstMethod *UpdateLoginFlowWithIdentifierFirstMethod
+	UpdateLoginFlowWithLookupSecretMethod    *UpdateLoginFlowWithLookupSecretMethod
+	UpdateLoginFlowWithOidcMethod            *UpdateLoginFlowWithOidcMethod
+	UpdateLoginFlowWithPasskeyMethod         *UpdateLoginFlowWithPasskeyMethod
+	UpdateLoginFlowWithPasswordMethod        *UpdateLoginFlowWithPasswordMethod
+	UpdateLoginFlowWithTotpMethod            *UpdateLoginFlowWithTotpMethod
+	UpdateLoginFlowWithWebAuthnMethod        *UpdateLoginFlowWithWebAuthnMethod
 }
 
 // UpdateLoginFlowWithCodeMethodAsUpdateLoginFlowBody is a convenience function that returns UpdateLoginFlowWithCodeMethod wrapped in UpdateLoginFlowBody
@@ -34,6 +35,13 @@ func UpdateLoginFlowWithCodeMethodAsUpdateLoginFlowBody(v *UpdateLoginFlowWithCo
 	}
 }
 
+// UpdateLoginFlowWithIdentifierFirstMethodAsUpdateLoginFlowBody is a convenience function that returns UpdateLoginFlowWithIdentifierFirstMethod wrapped in UpdateLoginFlowBody
+func UpdateLoginFlowWithIdentifierFirstMethodAsUpdateLoginFlowBody(v *UpdateLoginFlowWithIdentifierFirstMethod) UpdateLoginFlowBody {
+	return UpdateLoginFlowBody{
+		UpdateLoginFlowWithIdentifierFirstMethod: v,
+	}
+}
+
 // UpdateLoginFlowWithLookupSecretMethodAsUpdateLoginFlowBody is a convenience function that returns UpdateLoginFlowWithLookupSecretMethod wrapped in UpdateLoginFlowBody
 func UpdateLoginFlowWithLookupSecretMethodAsUpdateLoginFlowBody(v *UpdateLoginFlowWithLookupSecretMethod) UpdateLoginFlowBody {
 	return UpdateLoginFlowBody{
@@ -98,6 +106,18 @@ func (dst *UpdateLoginFlowBody) UnmarshalJSON(data []byte) error {
 		}
 	}
 
+	// check if the discriminator value is 'identifier_first'
+	if jsonDict["method"] == "identifier_first" {
+		// try to unmarshal JSON data into UpdateLoginFlowWithIdentifierFirstMethod
+		err = json.Unmarshal(data, &dst.UpdateLoginFlowWithIdentifierFirstMethod)
+		if err == nil {
+			return nil // data stored in dst.UpdateLoginFlowWithIdentifierFirstMethod, return on the first match
+		} else {
+			dst.UpdateLoginFlowWithIdentifierFirstMethod = nil
+			return fmt.Errorf("Failed to unmarshal UpdateLoginFlowBody as UpdateLoginFlowWithIdentifierFirstMethod: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'lookup_secret'
 	if jsonDict["method"] == "lookup_secret" {
 		// try to unmarshal JSON data into UpdateLoginFlowWithLookupSecretMethod
@@ -182,6 +202,18 @@ func (dst *UpdateLoginFlowBody) UnmarshalJSON(data []byte) error {
 		}
 	}
 
+	// check if the discriminator value is 'updateLoginFlowWithIdentifierFirstMethod'
+	if jsonDict["method"] == "updateLoginFlowWithIdentifierFirstMethod" {
+		// try to unmarshal JSON data into UpdateLoginFlowWithIdentifierFirstMethod
+		err = json.Unmarshal(data, &dst.UpdateLoginFlowWithIdentifierFirstMethod)
+		if err == nil {
+			return nil // data stored in dst.UpdateLoginFlowWithIdentifierFirstMethod, return on the first match
+		} else {
+			dst.UpdateLoginFlowWithIdentifierFirstMethod = nil
+			return fmt.Errorf("Failed to unmarshal UpdateLoginFlowBody as UpdateLoginFlowWithIdentifierFirstMethod: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'updateLoginFlowWithLookupSecretMethod'
 	if jsonDict["method"] == "updateLoginFlowWithLookupSecretMethod" {
 		// try to unmarshal JSON data into UpdateLoginFlowWithLookupSecretMethod
@@ -263,6 +295,10 @@ func (src UpdateLoginFlowBody) MarshalJSON() ([]byte, error) {
 		return json.Marshal(&src.UpdateLoginFlowWithCodeMethod)
 	}
 
+	if src.UpdateLoginFlowWithIdentifierFirstMethod != nil {
+		return json.Marshal(&src.UpdateLoginFlowWithIdentifierFirstMethod)
+	}
+
 	if src.UpdateLoginFlowWithLookupSecretMethod != nil {
 		return json.Marshal(&src.UpdateLoginFlowWithLookupSecretMethod)
 	}
@@ -299,6 +335,10 @@ func (obj *UpdateLoginFlowBody) GetActualInstance() interface{} {
 		return obj.UpdateLoginFlowWithCodeMethod
 	}
 
+	if obj.UpdateLoginFlowWithIdentifierFirstMethod != nil {
+		return obj.UpdateLoginFlowWithIdentifierFirstMethod
+	}
+
 	if obj.UpdateLoginFlowWithLookupSecretMethod != nil {
 		return obj.UpdateLoginFlowWithLookupSecretMethod
 	}
diff --git a/internal/httpclient/model_update_login_flow_with_code_method.go b/internal/httpclient/model_update_login_flow_with_code_method.go
index 5833200a3ce9..06272618da90 100644
--- a/internal/httpclient/model_update_login_flow_with_code_method.go
+++ b/internal/httpclient/model_update_login_flow_with_code_method.go
@@ -17,6 +17,8 @@ import (
 
 // UpdateLoginFlowWithCodeMethod Update Login flow using the code method
 type UpdateLoginFlowWithCodeMethod struct {
+	// Address is the address to send the code to, in case that there are multiple addresses. This field is only used in two-factor flows and is ineffective for passwordless flows.
+	Address *string `json:"address,omitempty"`
 	// Code is the 6 digits code sent to the user
 	Code *string `json:"code,omitempty"`
 	// CSRFToken is the anti-CSRF token
@@ -50,6 +52,38 @@ func NewUpdateLoginFlowWithCodeMethodWithDefaults() *UpdateLoginFlowWithCodeMeth
 	return &this
 }
 
+// GetAddress returns the Address field value if set, zero value otherwise.
+func (o *UpdateLoginFlowWithCodeMethod) GetAddress() string {
+	if o == nil || o.Address == nil {
+		var ret string
+		return ret
+	}
+	return *o.Address
+}
+
+// GetAddressOk returns a tuple with the Address field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UpdateLoginFlowWithCodeMethod) GetAddressOk() (*string, bool) {
+	if o == nil || o.Address == nil {
+		return nil, false
+	}
+	return o.Address, true
+}
+
+// HasAddress returns a boolean if a field has been set.
+func (o *UpdateLoginFlowWithCodeMethod) HasAddress() bool {
+	if o != nil && o.Address != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetAddress gets a reference to the given string and assigns it to the Address field.
+func (o *UpdateLoginFlowWithCodeMethod) SetAddress(v string) {
+	o.Address = &v
+}
+
 // GetCode returns the Code field value if set, zero value otherwise.
 func (o *UpdateLoginFlowWithCodeMethod) GetCode() string {
 	if o == nil || o.Code == nil {
@@ -228,6 +262,9 @@ func (o *UpdateLoginFlowWithCodeMethod) SetTransientPayload(v map[string]interfa
 
 func (o UpdateLoginFlowWithCodeMethod) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
+	if o.Address != nil {
+		toSerialize["address"] = o.Address
+	}
 	if o.Code != nil {
 		toSerialize["code"] = o.Code
 	}
diff --git a/internal/httpclient/model_update_login_flow_with_identifier_first_method.go b/internal/httpclient/model_update_login_flow_with_identifier_first_method.go
new file mode 100644
index 000000000000..70cf8002990d
--- /dev/null
+++ b/internal/httpclient/model_update_login_flow_with_identifier_first_method.go
@@ -0,0 +1,212 @@
+/*
+ * Ory Identities API
+ *
+ * This is the API specification for Ory Identities with features such as registration, login, recovery, account verification, profile settings, password reset, identity management, session management, email and sms delivery, and more.
+ *
+ * API version:
+ * Contact: office@ory.sh
+ */
+
+// Code generated by OpenAPI Generator (https://openapi-generator.tech); DO NOT EDIT.
+
+package client
+
+import (
+	"encoding/json"
+)
+
+// UpdateLoginFlowWithIdentifierFirstMethod Update Login Flow with Multi-Step Method
+type UpdateLoginFlowWithIdentifierFirstMethod struct {
+	// Sending the anti-csrf token is only required for browser login flows.
+	CsrfToken *string `json:"csrf_token,omitempty"`
+	// Identifier is the email or username of the user trying to log in.
+	Identifier string `json:"identifier"`
+	// Method should be set to \"password\" when logging in using the identifier and password strategy.
+	Method string `json:"method"`
+	// Transient data to pass along to any webhooks
+	TransientPayload map[string]interface{} `json:"transient_payload,omitempty"`
+}
+
+// NewUpdateLoginFlowWithIdentifierFirstMethod instantiates a new UpdateLoginFlowWithIdentifierFirstMethod object
+// This constructor will assign default values to properties that have it defined,
+// and makes sure properties required by API are set, but the set of arguments
+// will change when the set of required properties is changed
+func NewUpdateLoginFlowWithIdentifierFirstMethod(identifier string, method string) *UpdateLoginFlowWithIdentifierFirstMethod {
+	this := UpdateLoginFlowWithIdentifierFirstMethod{}
+	this.Identifier = identifier
+	this.Method = method
+	return &this
+}
+
+// NewUpdateLoginFlowWithIdentifierFirstMethodWithDefaults instantiates a new UpdateLoginFlowWithIdentifierFirstMethod object
+// This constructor will only assign default values to properties that have it defined,
+// but it doesn't guarantee that properties required by API are set
+func NewUpdateLoginFlowWithIdentifierFirstMethodWithDefaults() *UpdateLoginFlowWithIdentifierFirstMethod {
+	this := UpdateLoginFlowWithIdentifierFirstMethod{}
+	return &this
+}
+
+// GetCsrfToken returns the CsrfToken field value if set, zero value otherwise.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetCsrfToken() string {
+	if o == nil || o.CsrfToken == nil {
+		var ret string
+		return ret
+	}
+	return *o.CsrfToken
+}
+
+// GetCsrfTokenOk returns a tuple with the CsrfToken field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetCsrfTokenOk() (*string, bool) {
+	if o == nil || o.CsrfToken == nil {
+		return nil, false
+	}
+	return o.CsrfToken, true
+}
+
+// HasCsrfToken returns a boolean if a field has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) HasCsrfToken() bool {
+	if o != nil && o.CsrfToken != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetCsrfToken gets a reference to the given string and assigns it to the CsrfToken field.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) SetCsrfToken(v string) {
+	o.CsrfToken = &v
+}
+
+// GetIdentifier returns the Identifier field value
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetIdentifier() string {
+	if o == nil {
+		var ret string
+		return ret
+	}
+
+	return o.Identifier
+}
+
+// GetIdentifierOk returns a tuple with the Identifier field value
+// and a boolean to check if the value has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetIdentifierOk() (*string, bool) {
+	if o == nil {
+		return nil, false
+	}
+	return &o.Identifier, true
+}
+
+// SetIdentifier sets field value
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) SetIdentifier(v string) {
+	o.Identifier = v
+}
+
+// GetMethod returns the Method field value
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetMethod() string {
+	if o == nil {
+		var ret string
+		return ret
+	}
+
+	return o.Method
+}
+
+// GetMethodOk returns a tuple with the Method field value
+// and a boolean to check if the value has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetMethodOk() (*string, bool) {
+	if o == nil {
+		return nil, false
+	}
+	return &o.Method, true
+}
+
+// SetMethod sets field value
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) SetMethod(v string) {
+	o.Method = v
+}
+
+// GetTransientPayload returns the TransientPayload field value if set, zero value otherwise.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetTransientPayload() map[string]interface{} {
+	if o == nil || o.TransientPayload == nil {
+		var ret map[string]interface{}
+		return ret
+	}
+	return o.TransientPayload
+}
+
+// GetTransientPayloadOk returns a tuple with the TransientPayload field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) GetTransientPayloadOk() (map[string]interface{}, bool) {
+	if o == nil || o.TransientPayload == nil {
+		return nil, false
+	}
+	return o.TransientPayload, true
+}
+
+// HasTransientPayload returns a boolean if a field has been set.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) HasTransientPayload() bool {
+	if o != nil && o.TransientPayload != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetTransientPayload gets a reference to the given map[string]interface{} and assigns it to the TransientPayload field.
+func (o *UpdateLoginFlowWithIdentifierFirstMethod) SetTransientPayload(v map[string]interface{}) {
+	o.TransientPayload = v
+}
+
+func (o UpdateLoginFlowWithIdentifierFirstMethod) MarshalJSON() ([]byte, error) {
+	toSerialize := map[string]interface{}{}
+	if o.CsrfToken != nil {
+		toSerialize["csrf_token"] = o.CsrfToken
+	}
+	if true {
+		toSerialize["identifier"] = o.Identifier
+	}
+	if true {
+		toSerialize["method"] = o.Method
+	}
+	if o.TransientPayload != nil {
+		toSerialize["transient_payload"] = o.TransientPayload
+	}
+	return json.Marshal(toSerialize)
+}
+
+type NullableUpdateLoginFlowWithIdentifierFirstMethod struct {
+	value *UpdateLoginFlowWithIdentifierFirstMethod
+	isSet bool
+}
+
+func (v NullableUpdateLoginFlowWithIdentifierFirstMethod) Get() *UpdateLoginFlowWithIdentifierFirstMethod {
+	return v.value
+}
+
+func (v *NullableUpdateLoginFlowWithIdentifierFirstMethod) Set(val *UpdateLoginFlowWithIdentifierFirstMethod) {
+	v.value = val
+	v.isSet = true
+}
+
+func (v NullableUpdateLoginFlowWithIdentifierFirstMethod) IsSet() bool {
+	return v.isSet
+}
+
+func (v *NullableUpdateLoginFlowWithIdentifierFirstMethod) Unset() {
+	v.value = nil
+	v.isSet = false
+}
+
+func NewNullableUpdateLoginFlowWithIdentifierFirstMethod(val *UpdateLoginFlowWithIdentifierFirstMethod) *NullableUpdateLoginFlowWithIdentifierFirstMethod {
+	return &NullableUpdateLoginFlowWithIdentifierFirstMethod{value: val, isSet: true}
+}
+
+func (v NullableUpdateLoginFlowWithIdentifierFirstMethod) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.value)
+}
+
+func (v *NullableUpdateLoginFlowWithIdentifierFirstMethod) UnmarshalJSON(src []byte) error {
+	v.isSet = true
+	return json.Unmarshal(src, &v.value)
+}
diff --git a/internal/httpclient/model_update_login_flow_with_oidc_method.go b/internal/httpclient/model_update_login_flow_with_oidc_method.go
index 8f4a7348b13a..cdd5c665bdc5 100644
--- a/internal/httpclient/model_update_login_flow_with_oidc_method.go
+++ b/internal/httpclient/model_update_login_flow_with_oidc_method.go
@@ -19,7 +19,7 @@ import (
 type UpdateLoginFlowWithOidcMethod struct {
 	// The CSRF Token
 	CsrfToken *string `json:"csrf_token,omitempty"`
-	// IDToken is an optional id token provided by an OIDC provider  If submitted, it is verified using the OIDC provider's public key set and the claims are used to populate the OIDC credentials of the identity. If the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use the `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.  Supported providers are Apple
+	// IDToken is an optional id token provided by an OIDC provider  If submitted, it is verified using the OIDC provider's public key set and the claims are used to populate the OIDC credentials of the identity. If the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use the `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.  Supported providers are Apple Google
 	IdToken *string `json:"id_token,omitempty"`
 	// IDTokenNonce is the nonce, used when generating the IDToken. If the provider supports nonce validation, the nonce will be validated against this value and required.
 	IdTokenNonce *string `json:"id_token_nonce,omitempty"`
diff --git a/internal/httpclient/model_update_registration_flow_body.go b/internal/httpclient/model_update_registration_flow_body.go
index 64374c620f8f..82a578cfc4d3 100644
--- a/internal/httpclient/model_update_registration_flow_body.go
+++ b/internal/httpclient/model_update_registration_flow_body.go
@@ -22,6 +22,7 @@ type UpdateRegistrationFlowBody struct {
 	UpdateRegistrationFlowWithOidcMethod     *UpdateRegistrationFlowWithOidcMethod
 	UpdateRegistrationFlowWithPasskeyMethod  *UpdateRegistrationFlowWithPasskeyMethod
 	UpdateRegistrationFlowWithPasswordMethod *UpdateRegistrationFlowWithPasswordMethod
+	UpdateRegistrationFlowWithProfileMethod  *UpdateRegistrationFlowWithProfileMethod
 	UpdateRegistrationFlowWithWebAuthnMethod *UpdateRegistrationFlowWithWebAuthnMethod
 }
 
@@ -53,6 +54,13 @@ func UpdateRegistrationFlowWithPasswordMethodAsUpdateRegistrationFlowBody(v *Upd
 	}
 }
 
+// UpdateRegistrationFlowWithProfileMethodAsUpdateRegistrationFlowBody is a convenience function that returns UpdateRegistrationFlowWithProfileMethod wrapped in UpdateRegistrationFlowBody
+func UpdateRegistrationFlowWithProfileMethodAsUpdateRegistrationFlowBody(v *UpdateRegistrationFlowWithProfileMethod) UpdateRegistrationFlowBody {
+	return UpdateRegistrationFlowBody{
+		UpdateRegistrationFlowWithProfileMethod: v,
+	}
+}
+
 // UpdateRegistrationFlowWithWebAuthnMethodAsUpdateRegistrationFlowBody is a convenience function that returns UpdateRegistrationFlowWithWebAuthnMethod wrapped in UpdateRegistrationFlowBody
 func UpdateRegistrationFlowWithWebAuthnMethodAsUpdateRegistrationFlowBody(v *UpdateRegistrationFlowWithWebAuthnMethod) UpdateRegistrationFlowBody {
 	return UpdateRegistrationFlowBody{
@@ -94,8 +102,8 @@ func (dst *UpdateRegistrationFlowBody) UnmarshalJSON(data []byte) error {
 		}
 	}
 
-	// check if the discriminator value is 'passKey'
-	if jsonDict["method"] == "passKey" {
+	// check if the discriminator value is 'passkey'
+	if jsonDict["method"] == "passkey" {
 		// try to unmarshal JSON data into UpdateRegistrationFlowWithPasskeyMethod
 		err = json.Unmarshal(data, &dst.UpdateRegistrationFlowWithPasskeyMethod)
 		if err == nil {
@@ -118,6 +126,18 @@ func (dst *UpdateRegistrationFlowBody) UnmarshalJSON(data []byte) error {
 		}
 	}
 
+	// check if the discriminator value is 'profile'
+	if jsonDict["method"] == "profile" {
+		// try to unmarshal JSON data into UpdateRegistrationFlowWithProfileMethod
+		err = json.Unmarshal(data, &dst.UpdateRegistrationFlowWithProfileMethod)
+		if err == nil {
+			return nil // data stored in dst.UpdateRegistrationFlowWithProfileMethod, return on the first match
+		} else {
+			dst.UpdateRegistrationFlowWithProfileMethod = nil
+			return fmt.Errorf("Failed to unmarshal UpdateRegistrationFlowBody as UpdateRegistrationFlowWithProfileMethod: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'webauthn'
 	if jsonDict["method"] == "webauthn" {
 		// try to unmarshal JSON data into UpdateRegistrationFlowWithWebAuthnMethod
@@ -178,6 +198,18 @@ func (dst *UpdateRegistrationFlowBody) UnmarshalJSON(data []byte) error {
 		}
 	}
 
+	// check if the discriminator value is 'updateRegistrationFlowWithProfileMethod'
+	if jsonDict["method"] == "updateRegistrationFlowWithProfileMethod" {
+		// try to unmarshal JSON data into UpdateRegistrationFlowWithProfileMethod
+		err = json.Unmarshal(data, &dst.UpdateRegistrationFlowWithProfileMethod)
+		if err == nil {
+			return nil // data stored in dst.UpdateRegistrationFlowWithProfileMethod, return on the first match
+		} else {
+			dst.UpdateRegistrationFlowWithProfileMethod = nil
+			return fmt.Errorf("Failed to unmarshal UpdateRegistrationFlowBody as UpdateRegistrationFlowWithProfileMethod: %s", err.Error())
+		}
+	}
+
 	// check if the discriminator value is 'updateRegistrationFlowWithWebAuthnMethod'
 	if jsonDict["method"] == "updateRegistrationFlowWithWebAuthnMethod" {
 		// try to unmarshal JSON data into UpdateRegistrationFlowWithWebAuthnMethod
@@ -211,6 +243,10 @@ func (src UpdateRegistrationFlowBody) MarshalJSON() ([]byte, error) {
 		return json.Marshal(&src.UpdateRegistrationFlowWithPasswordMethod)
 	}
 
+	if src.UpdateRegistrationFlowWithProfileMethod != nil {
+		return json.Marshal(&src.UpdateRegistrationFlowWithProfileMethod)
+	}
+
 	if src.UpdateRegistrationFlowWithWebAuthnMethod != nil {
 		return json.Marshal(&src.UpdateRegistrationFlowWithWebAuthnMethod)
 	}
@@ -239,6 +275,10 @@ func (obj *UpdateRegistrationFlowBody) GetActualInstance() interface{} {
 		return obj.UpdateRegistrationFlowWithPasswordMethod
 	}
 
+	if obj.UpdateRegistrationFlowWithProfileMethod != nil {
+		return obj.UpdateRegistrationFlowWithProfileMethod
+	}
+
 	if obj.UpdateRegistrationFlowWithWebAuthnMethod != nil {
 		return obj.UpdateRegistrationFlowWithWebAuthnMethod
 	}
diff --git a/internal/httpclient/model_update_registration_flow_with_oidc_method.go b/internal/httpclient/model_update_registration_flow_with_oidc_method.go
index 509e978a0627..2ee32605fee6 100644
--- a/internal/httpclient/model_update_registration_flow_with_oidc_method.go
+++ b/internal/httpclient/model_update_registration_flow_with_oidc_method.go
@@ -19,7 +19,7 @@ import (
 type UpdateRegistrationFlowWithOidcMethod struct {
 	// The CSRF Token
 	CsrfToken *string `json:"csrf_token,omitempty"`
-	// IDToken is an optional id token provided by an OIDC provider  If submitted, it is verified using the OIDC provider's public key set and the claims are used to populate the OIDC credentials of the identity. If the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use the `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.  Supported providers are Apple
+	// IDToken is an optional id token provided by an OIDC provider  If submitted, it is verified using the OIDC provider's public key set and the claims are used to populate the OIDC credentials of the identity. If the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use the `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.  Supported providers are Apple Google
 	IdToken *string `json:"id_token,omitempty"`
 	// IDTokenNonce is the nonce, used when generating the IDToken. If the provider supports nonce validation, the nonce will be validated against this value and is required.
 	IdTokenNonce *string `json:"id_token_nonce,omitempty"`
diff --git a/internal/httpclient/model_update_registration_flow_with_profile_method.go b/internal/httpclient/model_update_registration_flow_with_profile_method.go
index 221e5ea82ada..8cdbb2eab764 100644
--- a/internal/httpclient/model_update_registration_flow_with_profile_method.go
+++ b/internal/httpclient/model_update_registration_flow_with_profile_method.go
@@ -21,7 +21,7 @@ type UpdateRegistrationFlowWithProfileMethod struct {
 	CsrfToken *string `json:"csrf_token,omitempty"`
 	// Method  Should be set to profile when trying to update a profile.
 	Method string `json:"method"`
-	// Screen requests navigation to a previous screen.  This must be set to credential-selection to go back to the credential selection screen.
+	// Screen requests navigation to a previous screen.  This must be set to credential-selection to go back to the credential selection screen. credential-selection RegistrationScreenCredentialSelection nolint:gosec // not a credential previous RegistrationScreenPrevious
 	Screen *string `json:"screen,omitempty"`
 	// Traits  The identity's traits.
 	Traits map[string]interface{} `json:"traits"`
diff --git a/internal/httpclient/model_verification_flow_state.go b/internal/httpclient/model_verification_flow_state.go
index bea74568c94d..56b65e0c0a5b 100644
--- a/internal/httpclient/model_verification_flow_state.go
+++ b/internal/httpclient/model_verification_flow_state.go
@@ -16,7 +16,7 @@ import (
 	"fmt"
 )
 
-// VerificationFlowState The state represents the state of the verification flow.  choose_method: ask the user to choose a method (e.g. recover account via email) sent_email: the email has been sent to the user passed_challenge: the request was successful and the recovery challenge was passed.
+// VerificationFlowState The experimental state represents the state of a verification flow. This field is EXPERIMENTAL and subject to change!
 type VerificationFlowState string
 
 // List of verificationFlowState
diff --git a/internal/registrationhelpers/helpers.go b/internal/registrationhelpers/helpers.go
index 9fbf7f08211d..6fd76bd6ef1a 100644
--- a/internal/registrationhelpers/helpers.go
+++ b/internal/registrationhelpers/helpers.go
@@ -288,7 +288,7 @@ func AssertCommonErrorCases(t *testing.T, flows []string) {
 	t.Run("description=can call endpoints only without session", func(t *testing.T) {
 		values := url.Values{}
 		t.Run("type=browser", func(t *testing.T) {
-			res, err := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg).
+			res, err := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, ctx, reg).
 				Do(httpx.MustNewRequest("POST", publicTS.URL+registration.RouteSubmitFlow, strings.NewReader(values.Encode()), "application/x-www-form-urlencoded"))
 			require.NoError(t, err)
 			defer res.Body.Close()
@@ -297,7 +297,7 @@ func AssertCommonErrorCases(t *testing.T, flows []string) {
 		})
 
 		t.Run("type=api", func(t *testing.T) {
-			res, err := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, reg).
+			res, err := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, ctx, reg).
 				Do(httpx.MustNewRequest("POST", publicTS.URL+registration.RouteSubmitFlow, strings.NewReader(testhelpers.EncodeFormAsJSON(t, true, values)), "application/json"))
 			require.NoError(t, err)
 			assert.Len(t, res.Cookies(), 0)
@@ -337,7 +337,7 @@ func AssertCommonErrorCases(t *testing.T, flows []string) {
 		values := url.Values{}
 
 		t.Run("type=browser", func(t *testing.T) {
-			res, err := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg).
+			res, err := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, ctx, reg).
 				Do(httpx.MustNewRequest("POST", publicTS.URL+registration.RouteSubmitFlow, strings.NewReader(values.Encode()), "application/x-www-form-urlencoded"))
 			require.NoError(t, err)
 			defer res.Body.Close()
@@ -346,7 +346,7 @@ func AssertCommonErrorCases(t *testing.T, flows []string) {
 		})
 
 		t.Run("type=api", func(t *testing.T) {
-			res, err := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, reg).
+			res, err := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, ctx, reg).
 				Do(httpx.MustNewRequest("POST", publicTS.URL+registration.RouteSubmitFlow, strings.NewReader(testhelpers.EncodeFormAsJSON(t, true, values)), "application/json"))
 			require.NoError(t, err)
 			assert.Len(t, res.Cookies(), 0)
diff --git a/internal/testhelpers/courier.go b/internal/testhelpers/courier.go
index 796dac29989d..f4779adcd6d1 100644
--- a/internal/testhelpers/courier.go
+++ b/internal/testhelpers/courier.go
@@ -20,6 +20,7 @@ func CourierExpectMessage(ctx context.Context, t *testing.T, reg interface {
 	courier.PersistenceProvider
 }, recipient, subject string,
 ) *courier.Message {
+	t.Helper()
 	messages, total, _, err := reg.CourierPersister().ListMessages(ctx, courier.ListCourierMessagesParameters{
 		Recipient: recipient,
 	}, []keysetpagination.Option{})
@@ -31,7 +32,7 @@ func CourierExpectMessage(ctx context.Context, t *testing.T, reg interface {
 	})
 
 	for _, m := range messages {
-		if strings.EqualFold(m.Recipient, recipient) && strings.EqualFold(m.Subject, subject) {
+		if strings.EqualFold(m.Recipient, recipient) && (strings.Contains(m.Subject, subject) || strings.Contains(m.Body, subject)) {
 			return &m
 		}
 	}
diff --git a/internal/testhelpers/e2e_server.go b/internal/testhelpers/e2e_server.go
index 4c97303707b0..b4841d4d080c 100644
--- a/internal/testhelpers/e2e_server.go
+++ b/internal/testhelpers/e2e_server.go
@@ -216,6 +216,8 @@ func GenerateTLSCertificateFilesForTests(t *testing.T) (certPath, keyPath, certB
 	certOut := io.MultiWriter(enc, certFile)
 	err = pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})
 	require.NoError(t, err, "Failed to write data to %q: %v", certPath, err)
+	err = enc.Close()
+	require.NoError(t, err, "Error closing base64 encoder")
 	err = certFile.Close()
 	require.NoError(t, err, "Error closing %q: %v", certPath, err)
 	certBase64 = buf.String()
@@ -234,6 +236,8 @@ func GenerateTLSCertificateFilesForTests(t *testing.T) (certPath, keyPath, certB
 
 	err = pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
 	require.NoError(t, err, "Failed to write data to %q: %v", keyPath, err)
+	err = enc.Close()
+	require.NoError(t, err, "Error closing base64 encoder")
 	err = keyFile.Close()
 	require.NoError(t, err, "Error closing %q: %v", keyPath, err)
 	keyBase64 = buf.String()
diff --git a/internal/testhelpers/handler_mock.go b/internal/testhelpers/handler_mock.go
index bcc68a1e61c1..36a51edcc1eb 100644
--- a/internal/testhelpers/handler_mock.go
+++ b/internal/testhelpers/handler_mock.go
@@ -5,6 +5,7 @@ package testhelpers
 
 import (
 	"context"
+	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/cookiejar"
@@ -26,6 +27,7 @@ import (
 
 type mockDeps interface {
 	identity.PrivilegedPoolProvider
+	identity.ManagementProvider
 	session.ManagementProvider
 	session.PersistenceProvider
 	config.Provider
@@ -34,15 +36,24 @@ type mockDeps interface {
 func MockSetSession(t *testing.T, reg mockDeps, conf *config.Config) httprouter.Handle {
 	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
 		i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
-		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), i))
+		i.NID = uuid.Must(uuid.NewV4())
+		require.NoError(t, i.SetCredentialsWithConfig(
+			identity.CredentialsTypePassword,
+			identity.Credentials{
+				Type:        identity.CredentialsTypePassword,
+				Identifiers: []string{faker.Email()},
+			},
+			json.RawMessage(`{"hashed_password":"$"}`)))
+		require.NoError(t, reg.IdentityManager().Create(context.Background(), i))
 
 		MockSetSessionWithIdentity(t, reg, conf, i)(w, r, ps)
 	}
 }
 
-func MockSetSessionWithIdentity(t *testing.T, reg mockDeps, conf *config.Config, i *identity.Identity) httprouter.Handle {
+func MockSetSessionWithIdentity(t *testing.T, reg mockDeps, _ *config.Config, i *identity.Identity) httprouter.Handle {
 	return func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-		activeSession, _ := session.NewActiveSession(r, i, conf, time.Now().UTC(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+		activeSession, err := NewActiveSession(r, reg, i, time.Now().UTC(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+		require.NoError(t, err)
 		if aal := r.URL.Query().Get("set_aal"); len(aal) > 0 {
 			activeSession.AuthenticatorAssuranceLevel = identity.AuthenticatorAssuranceLevel(aal)
 		}
@@ -52,18 +63,6 @@ func MockSetSessionWithIdentity(t *testing.T, reg mockDeps, conf *config.Config,
 	}
 }
 
-func MockGetSession(t *testing.T, reg mockDeps) httprouter.Handle {
-	return func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-		_, err := reg.SessionManager().FetchFromRequest(r.Context(), r)
-		if r.URL.Query().Get("has") == "yes" {
-			require.NoError(t, err)
-		} else {
-			require.Error(t, err)
-		}
-		w.WriteHeader(http.StatusNoContent)
-	}
-}
-
 func MockMakeAuthenticatedRequest(t *testing.T, reg mockDeps, conf *config.Config, router *httprouter.Router, req *http.Request) ([]byte, *http.Response) {
 	return MockMakeAuthenticatedRequestWithClient(t, reg, conf, router, req, NewClientWithCookies(t))
 }
diff --git a/internal/testhelpers/http.go b/internal/testhelpers/http.go
index 5523de9d5368..f46c1cc62968 100644
--- a/internal/testhelpers/http.go
+++ b/internal/testhelpers/http.go
@@ -20,26 +20,34 @@ func NewDebugClient(t *testing.T) *http.Client {
 	return &http.Client{Transport: NewTransportWithLogger(http.DefaultTransport, t)}
 }
 
-func NewClientWithCookieJar(t *testing.T, jar *cookiejar.Jar, debugRedirects bool) *http.Client {
+func NewClientWithCookieJar(t *testing.T, jar *cookiejar.Jar, checkRedirect CheckRedirectFunc) *http.Client {
 	if jar == nil {
 		j, err := cookiejar.New(nil)
 		jar = j
 		require.NoError(t, err)
 	}
+	if checkRedirect == nil {
+		checkRedirect = DebugRedirects(t)
+	}
 	return &http.Client{
-		Jar: jar,
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			if debugRedirects {
-				t.Logf("Redirect: %s", req.URL.String())
-			}
-			if len(via) >= 20 {
-				for k, v := range via {
-					t.Logf("Failed with redirect (%d): %s", k, v.URL.String())
-				}
-				return errors.New("stopped after 20 redirects")
+		Jar:           jar,
+		CheckRedirect: checkRedirect,
+	}
+}
+
+type CheckRedirectFunc func(req *http.Request, via []*http.Request) error
+
+func DebugRedirects(t *testing.T) CheckRedirectFunc {
+	return func(req *http.Request, via []*http.Request) error {
+		t.Logf("Redirect: %s", req.URL.String())
+
+		if len(via) >= 20 {
+			for k, v := range via {
+				t.Logf("Failed with redirect (%d): %s", k, v.URL.String())
 			}
-			return nil
-		},
+			return errors.New("stopped after 20 redirects")
+		}
+		return nil
 	}
 }
 
diff --git a/internal/testhelpers/identity.go b/internal/testhelpers/identity.go
index 5c7cdd5be692..6bbc7c5da27b 100644
--- a/internal/testhelpers/identity.go
+++ b/internal/testhelpers/identity.go
@@ -19,7 +19,7 @@ func CreateSession(t *testing.T, reg driver.Registry) *session.Session {
 	req := NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
 	i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
 	require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(req.Context(), i))
-	sess, err := session.NewActiveSession(req, i, reg.Config(), time.Now().UTC(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+	sess, err := NewActiveSession(req, reg, i, time.Now().UTC(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 	require.NoError(t, err)
 	require.NoError(t, reg.SessionPersister().UpsertSession(req.Context(), sess))
 	return sess
diff --git a/internal/testhelpers/sdk.go b/internal/testhelpers/sdk.go
index 849f7a73304e..1e55cda04665 100644
--- a/internal/testhelpers/sdk.go
+++ b/internal/testhelpers/sdk.go
@@ -9,7 +9,6 @@ import (
 	"net/http/httptest"
 	"net/url"
 
-	"github.com/ory/kratos/text"
 	"github.com/ory/kratos/ui/node"
 
 	"github.com/ory/kratos/x"
@@ -88,26 +87,6 @@ func NewSDKEmailNode(group string) *kratos.UiNode {
 	}
 }
 
-func NewSDKOIDCNode(name, provider string) *kratos.UiNode {
-	t := text.NewInfoRegistrationWith(provider)
-	return &kratos.UiNode{
-		Group: node.OpenIDConnectGroup.String(),
-		Type:  "input",
-		Attributes: kratos.UiNodeInputAttributesAsUiNodeAttributes(&kratos.UiNodeInputAttributes{
-			Name:  name,
-			Type:  "submit",
-			Value: provider,
-		}),
-		Meta: kratos.UiNodeMeta{
-			Label: &kratos.UiText{
-				Id:   int64(t.ID),
-				Text: t.Text,
-				Type: string(t.Type),
-			},
-		},
-	}
-}
-
 func NewMethodSubmit(group, value string) *kratos.UiNode {
 	return &kratos.UiNode{
 		Type:  "input",
diff --git a/internal/testhelpers/selfservice.go b/internal/testhelpers/selfservice.go
index 8c7b4c588d78..56903b04ac79 100644
--- a/internal/testhelpers/selfservice.go
+++ b/internal/testhelpers/selfservice.go
@@ -11,6 +11,8 @@ import (
 	"net/url"
 	"testing"
 
+	"github.com/gofrs/uuid"
+
 	"github.com/go-faker/faker/v4"
 	"github.com/gobuffalo/httptest"
 	"github.com/stretchr/testify/assert"
@@ -90,6 +92,7 @@ func SelfServiceHookFakeIdentity(t *testing.T) *identity.Identity {
 	require.NoError(t, faker.FakeData(&i))
 	i.Traits = identity.Traits(`{}`)
 	i.State = identity.StateActive
+	i.NID = uuid.Must(uuid.NewV4())
 	return &i
 }
 
diff --git a/internal/testhelpers/selfservice_login.go b/internal/testhelpers/selfservice_login.go
index 2bd20f81dfd4..d8279ebfeca4 100644
--- a/internal/testhelpers/selfservice_login.go
+++ b/internal/testhelpers/selfservice_login.go
@@ -59,6 +59,18 @@ type initFlowOptions struct {
 	refresh              bool
 	oauth2LoginChallenge string
 	via                  string
+	ctx                  context.Context
+}
+
+func newInitFlowOptions(opts []InitFlowWithOption) *initFlowOptions {
+	return new(initFlowOptions).apply(opts)
+}
+
+func (o *initFlowOptions) Context() context.Context {
+	if o.ctx == nil {
+		return context.Background()
+	}
+	return o.ctx
 }
 
 func (o *initFlowOptions) apply(opts []InitFlowWithOption) *initFlowOptions {
@@ -116,6 +128,12 @@ func InitFlowWithRefresh() InitFlowWithOption {
 	}
 }
 
+func InitFlowWithContext(ctx context.Context) InitFlowWithOption {
+	return func(o *initFlowOptions) {
+		o.ctx = ctx
+	}
+}
+
 func InitFlowWithOAuth2LoginChallenge(hlc string) InitFlowWithOption {
 	return func(o *initFlowOptions) {
 		o.oauth2LoginChallenge = hlc
@@ -134,12 +152,13 @@ func InitializeLoginFlowViaBrowser(t *testing.T, client *http.Client, ts *httpte
 
 	req, err := http.NewRequest("GET", getURLFromInitOptions(ts, login.RouteInitBrowserFlow, forced, opts...), nil)
 	require.NoError(t, err)
+	o := newInitFlowOptions(opts)
 
 	if isSPA {
 		req.Header.Set("Accept", "application/json")
 	}
 
-	res, err := client.Do(req)
+	res, err := client.Do(req.WithContext(o.Context()))
 	require.NoError(t, err)
 	body := x.MustReadAll(res.Body)
 	require.NoError(t, res.Body.Close())
@@ -155,7 +174,7 @@ func InitializeLoginFlowViaBrowser(t *testing.T, client *http.Client, ts *httpte
 	}
 	require.NotEmpty(t, flowID)
 
-	rs, r, err := publicClient.FrontendApi.GetLoginFlow(context.Background()).Id(flowID).Execute()
+	rs, r, err := publicClient.FrontendAPI.GetLoginFlow(context.Background()).Id(flowID).Execute()
 	if expectGetError {
 		require.Error(t, err)
 		require.Nil(t, rs)
@@ -167,11 +186,11 @@ func InitializeLoginFlowViaBrowser(t *testing.T, client *http.Client, ts *httpte
 	return rs
 }
 
-func InitializeLoginFlowViaAPI(t *testing.T, client *http.Client, ts *httptest.Server, forced bool, opts ...InitFlowWithOption) *kratos.LoginFlow {
+func InitializeLoginFlowViaAPIWithContext(t *testing.T, ctx context.Context, client *http.Client, ts *httptest.Server, forced bool, opts ...InitFlowWithOption) *kratos.LoginFlow {
 	publicClient := NewSDKCustomClient(ts, client)
 
 	o := new(initFlowOptions).apply(opts)
-	req := publicClient.FrontendApi.CreateNativeLoginFlow(context.Background()).Refresh(forced)
+	req := publicClient.FrontendAPI.CreateNativeLoginFlow(ctx).Refresh(forced)
 	if o.aal != "" {
 		req = req.Aal(string(o.aal))
 	}
@@ -186,6 +205,10 @@ func InitializeLoginFlowViaAPI(t *testing.T, client *http.Client, ts *httptest.S
 	return rs
 }
 
+func InitializeLoginFlowViaAPI(t *testing.T, client *http.Client, ts *httptest.Server, forced bool, opts ...InitFlowWithOption) *kratos.LoginFlow {
+	return InitializeLoginFlowViaAPIWithContext(t, context.Background(), client, ts, forced, opts...)
+}
+
 func LoginMakeRequest(
 	t *testing.T,
 	isAPI bool,
@@ -193,6 +216,18 @@ func LoginMakeRequest(
 	f *kratos.LoginFlow,
 	hc *http.Client,
 	values string,
+) (string, *http.Response) {
+	return LoginMakeRequestWithContext(t, context.Background(), isAPI, isSPA, f, hc, values)
+}
+
+func LoginMakeRequestWithContext(
+	t *testing.T,
+	ctx context.Context,
+	isAPI bool,
+	isSPA bool,
+	f *kratos.LoginFlow,
+	hc *http.Client,
+	values string,
 ) (string, *http.Response) {
 	require.NotEmpty(t, f.Ui.Action)
 
@@ -201,7 +236,7 @@ func LoginMakeRequest(
 		req.Header.Set("Accept", "application/json")
 	}
 
-	res, err := hc.Do(req)
+	res, err := hc.Do(req.WithContext(ctx))
 	require.NoError(t, err, "action: %s", f.Ui.Action)
 	defer res.Body.Close()
 
@@ -210,7 +245,7 @@ func LoginMakeRequest(
 
 func GetLoginFlow(t *testing.T, client *http.Client, ts *httptest.Server, flowID string) *kratos.LoginFlow {
 	publicClient := NewSDKCustomClient(ts, client)
-	rs, _, err := publicClient.FrontendApi.GetLoginFlow(context.Background()).Id(flowID).Execute()
+	rs, _, err := publicClient.FrontendAPI.GetLoginFlow(context.Background()).Id(flowID).Execute()
 	require.NoError(t, err)
 	return rs
 }
diff --git a/internal/testhelpers/selfservice_recovery.go b/internal/testhelpers/selfservice_recovery.go
index c1ff66794553..eaed184ed8ca 100644
--- a/internal/testhelpers/selfservice_recovery.go
+++ b/internal/testhelpers/selfservice_recovery.go
@@ -43,7 +43,7 @@ func GetVerificationFlow(t *testing.T, client *http.Client, ts *httptest.Server)
 	require.NoError(t, err)
 	require.NoError(t, res.Body.Close())
 
-	rs, _, err := publicClient.FrontendApi.GetVerificationFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
+	rs, _, err := publicClient.FrontendAPI.GetVerificationFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
 	require.NoError(t, err, "%s", res.Request.URL.String())
 	assert.NotEmpty(t, rs.Active)
 
@@ -70,7 +70,7 @@ func InitializeVerificationFlowViaBrowser(t *testing.T, client *http.Client, isS
 		return &f
 	}
 
-	rs, _, err := publicClient.FrontendApi.GetVerificationFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
+	rs, _, err := publicClient.FrontendAPI.GetVerificationFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
 	require.NoError(t, err)
 	assert.NotEmpty(t, rs.Active)
 
@@ -80,7 +80,7 @@ func InitializeVerificationFlowViaBrowser(t *testing.T, client *http.Client, isS
 func InitializeVerificationFlowViaAPI(t *testing.T, client *http.Client, ts *httptest.Server) *kratos.VerificationFlow {
 	publicClient := NewSDKCustomClient(ts, client)
 
-	rs, _, err := publicClient.FrontendApi.CreateNativeVerificationFlow(context.Background()).Execute()
+	rs, _, err := publicClient.FrontendAPI.CreateNativeVerificationFlow(context.Background()).Execute()
 	require.NoError(t, err)
 	assert.NotEmpty(t, rs.Active)
 
diff --git a/internal/testhelpers/selfservice_registration.go b/internal/testhelpers/selfservice_registration.go
index 0cab8517e541..3f3f900a3000 100644
--- a/internal/testhelpers/selfservice_registration.go
+++ b/internal/testhelpers/selfservice_registration.go
@@ -65,7 +65,7 @@ func InitializeRegistrationFlowViaBrowser(t *testing.T, client *http.Client, ts
 		flowID = gjson.GetBytes(body, "id").String()
 	}
 
-	rs, _, err := NewSDKCustomClient(ts, client).FrontendApi.GetRegistrationFlow(context.Background()).Id(flowID).Execute()
+	rs, _, err := NewSDKCustomClient(ts, client).FrontendAPI.GetRegistrationFlow(context.Background()).Id(flowID).Execute()
 	if expectGetError {
 		require.Error(t, err)
 		require.Nil(t, rs)
@@ -77,14 +77,14 @@ func InitializeRegistrationFlowViaBrowser(t *testing.T, client *http.Client, ts
 }
 
 func InitializeRegistrationFlowViaAPI(t *testing.T, client *http.Client, ts *httptest.Server) *kratos.RegistrationFlow {
-	rs, _, err := NewSDKCustomClient(ts, client).FrontendApi.CreateNativeRegistrationFlow(context.Background()).Execute()
+	rs, _, err := NewSDKCustomClient(ts, client).FrontendAPI.CreateNativeRegistrationFlow(context.Background()).Execute()
 	require.NoError(t, err)
 	assert.Empty(t, rs.Active)
 	return rs
 }
 
 func GetRegistrationFlow(t *testing.T, client *http.Client, ts *httptest.Server, flowID string) *kratos.RegistrationFlow {
-	rs, _, err := NewSDKCustomClient(ts, client).FrontendApi.GetRegistrationFlow(context.Background()).Id(flowID).Execute()
+	rs, _, err := NewSDKCustomClient(ts, client).FrontendAPI.GetRegistrationFlow(context.Background()).Id(flowID).Execute()
 	require.NoError(t, err)
 	assert.Empty(t, rs.Active)
 	return rs
diff --git a/internal/testhelpers/selfservice_settings.go b/internal/testhelpers/selfservice_settings.go
index cf3cdad15866..c46c0eeb757d 100644
--- a/internal/testhelpers/selfservice_settings.go
+++ b/internal/testhelpers/selfservice_settings.go
@@ -67,7 +67,7 @@ func InitializeSettingsFlowViaBrowser(t *testing.T, client *http.Client, isSPA b
 
 	require.NoError(t, res.Body.Close())
 
-	rs, res, err := publicClient.FrontendApi.GetSettingsFlow(context.Background()).Id(flowID).Execute()
+	rs, res, err := publicClient.FrontendAPI.GetSettingsFlow(context.Background()).Id(flowID).Execute()
 	require.NoError(t, err, "%s", ioutilx.MustReadAll(res.Body))
 	assert.Empty(t, rs.Active)
 
@@ -77,7 +77,7 @@ func InitializeSettingsFlowViaBrowser(t *testing.T, client *http.Client, isSPA b
 func InitializeSettingsFlowViaAPI(t *testing.T, client *http.Client, ts *httptest.Server) *kratos.SettingsFlow {
 	publicClient := NewSDKCustomClient(ts, client)
 
-	rs, _, err := publicClient.FrontendApi.CreateNativeSettingsFlow(context.Background()).Execute()
+	rs, _, err := publicClient.FrontendAPI.CreateNativeSettingsFlow(context.Background()).Execute()
 	require.NoError(t, err)
 	assert.Empty(t, rs.Active)
 
@@ -158,7 +158,7 @@ func NewSettingsLoginAcceptAPIServer(t *testing.T, publicClient *kratos.APIClien
 
 		conf.MustSet(r.Context(), config.ViperKeySelfServiceSettingsPrivilegedAuthenticationAfter, "5m")
 
-		res, _, err := publicClient.FrontendApi.GetLoginFlow(context.Background()).Id(r.URL.Query().Get("flow")).Execute()
+		res, _, err := publicClient.FrontendAPI.GetLoginFlow(context.Background()).Id(r.URL.Query().Get("flow")).Execute()
 
 		require.NoError(t, err)
 		require.NotEmpty(t, res.RequestUrl)
diff --git a/internal/testhelpers/selfservice_verification.go b/internal/testhelpers/selfservice_verification.go
index 9786c8210e73..c1d8aa264687 100644
--- a/internal/testhelpers/selfservice_verification.go
+++ b/internal/testhelpers/selfservice_verification.go
@@ -37,7 +37,7 @@ func NewVerifyAfterHookWebHookTarget(ctx context.Context, t *testing.T, conf *co
 
 		assert(t, msg)
 	}))
-
+	before := conf.GetProvider(ctx).Get(config.ViperKeySelfServiceVerificationAfter + ".hooks")
 	// A hook to ensure that the verification hook is called with the correct data
 	conf.MustSet(ctx, config.ViperKeySelfServiceVerificationAfter+".hooks", []map[string]interface{}{
 		{
@@ -52,7 +52,33 @@ func NewVerifyAfterHookWebHookTarget(ctx context.Context, t *testing.T, conf *co
 
 	t.Cleanup(ts.Close)
 	t.Cleanup(func() {
-		conf.MustSet(ctx, config.ViperKeySelfServiceVerificationAfter+".hooks", []map[string]interface{}{})
+		conf.MustSet(ctx, config.ViperKeySelfServiceVerificationAfter+".hooks", before)
+	})
+}
+
+func NewRecoveryAfterHookWebHookTarget(ctx context.Context, t *testing.T, conf *config.Config, assert func(t *testing.T, body []byte)) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		msg, err := io.ReadAll(r.Body)
+		require.NoError(t, err)
+
+		assert(t, msg)
+	}))
+
+	// A hook to ensure that the recovery hook is called with the correct data
+	conf.MustSet(ctx, config.ViperKeySelfServiceRecoveryAfter+".hooks", []map[string]interface{}{
+		{
+			"hook": "web_hook",
+			"config": map[string]interface{}{
+				"url":    ts.URL,
+				"method": "POST",
+				"body":   "base64://ZnVuY3Rpb24oY3R4KSB7CiAgICBpZGVudGl0eTogY3R4LmlkZW50aXR5Cn0=",
+			},
+		},
+	})
+
+	t.Cleanup(ts.Close)
+	t.Cleanup(func() {
+		conf.MustSet(ctx, config.ViperKeySelfServiceRecoveryAfter+".hooks", []map[string]interface{}{})
 	})
 }
 
@@ -98,7 +124,7 @@ func GetRecoveryFlowForType(t *testing.T, client *http.Client, ts *httptest.Serv
 	}
 	require.NotEmpty(t, flowID, "expected to receive a flow id, got none. %s", ioutilx.MustReadAll(res.Body))
 
-	rs, _, err := publicClient.FrontendApi.GetRecoveryFlow(context.Background()).
+	rs, _, err := publicClient.FrontendAPI.GetRecoveryFlow(context.Background()).
 		Id(flowID).
 		Execute()
 	require.NoError(t, err, "expected no error when fetching recovery flow: %s", err)
@@ -136,7 +162,7 @@ func InitializeRecoveryFlowViaBrowser(t *testing.T, client *http.Client, isSPA b
 	}
 
 	require.NoError(t, res.Body.Close())
-	rs, _, err := publicClient.FrontendApi.GetRecoveryFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
+	rs, _, err := publicClient.FrontendAPI.GetRecoveryFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
 	require.NoError(t, err)
 	assert.NotEmpty(t, rs.Active)
 
@@ -146,7 +172,7 @@ func InitializeRecoveryFlowViaBrowser(t *testing.T, client *http.Client, isSPA b
 func InitializeRecoveryFlowViaAPI(t *testing.T, client *http.Client, ts *httptest.Server) *kratos.RecoveryFlow {
 	publicClient := NewSDKCustomClient(ts, client)
 
-	rs, _, err := publicClient.FrontendApi.CreateNativeRecoveryFlow(context.Background()).Execute()
+	rs, _, err := publicClient.FrontendAPI.CreateNativeRecoveryFlow(context.Background()).Execute()
 	require.NoError(t, err)
 	assert.NotEmpty(t, rs.Active)
 
diff --git a/internal/testhelpers/session.go b/internal/testhelpers/session.go
index 29e8997f3438..c614f1afe36d 100644
--- a/internal/testhelpers/session.go
+++ b/internal/testhelpers/session.go
@@ -10,6 +10,8 @@ import (
 	"testing"
 	"time"
 
+	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
+
 	"github.com/ory/nosurf"
 
 	"github.com/stretchr/testify/assert"
@@ -42,25 +44,25 @@ func NewSessionClient(t *testing.T, u string) *http.Client {
 	return c
 }
 
-func maybePersistSession(t *testing.T, reg *driver.RegistryDefault, sess *session.Session) {
-	id, err := reg.PrivilegedIdentityPool().GetIdentityConfidential(context.Background(), sess.Identity.ID)
+func maybePersistSession(t *testing.T, ctx context.Context, reg *driver.RegistryDefault, sess *session.Session) {
+	id, err := reg.PrivilegedIdentityPool().GetIdentityConfidential(ctx, sess.Identity.ID)
 	if err != nil {
-		require.NoError(t, sess.Identity.SetAvailableAAL(context.Background(), reg.IdentityManager()))
-		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), sess.Identity))
-		id, err = reg.PrivilegedIdentityPool().GetIdentityConfidential(context.Background(), sess.Identity.ID)
+		require.NoError(t, sess.Identity.SetAvailableAAL(ctx, reg.IdentityManager()))
+		require.NoError(t, reg.IdentityManager().Create(ctx, sess.Identity))
+		id, err = reg.PrivilegedIdentityPool().GetIdentityConfidential(ctx, sess.Identity.ID)
 		require.NoError(t, err)
 	}
 	sess.Identity = id
 	sess.IdentityID = id.ID
 
-	require.NoError(t, err, reg.SessionPersister().UpsertSession(context.Background(), sess))
+	require.NoError(t, err, reg.SessionPersister().UpsertSession(ctx, sess))
 }
 
-func NewHTTPClientWithSessionCookie(t *testing.T, reg *driver.RegistryDefault, sess *session.Session) *http.Client {
-	maybePersistSession(t, reg, sess)
+func NewHTTPClientWithSessionCookie(t *testing.T, ctx context.Context, reg *driver.RegistryDefault, sess *session.Session) *http.Client {
+	maybePersistSession(t, ctx, reg, sess)
 
 	var handler http.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.NoError(t, reg.SessionManager().IssueCookie(context.Background(), w, r, sess))
+		require.NoError(t, reg.SessionManager().IssueCookie(ctx, w, r, sess))
 	})
 
 	if _, ok := reg.CSRFHandler().(*nosurf.CSRFHandler); ok {
@@ -75,11 +77,11 @@ func NewHTTPClientWithSessionCookie(t *testing.T, reg *driver.RegistryDefault, s
 	return c
 }
 
-func NewHTTPClientWithSessionCookieLocalhost(t *testing.T, reg *driver.RegistryDefault, sess *session.Session) *http.Client {
-	maybePersistSession(t, reg, sess)
+func NewHTTPClientWithSessionCookieLocalhost(t *testing.T, ctx context.Context, reg *driver.RegistryDefault, sess *session.Session) *http.Client {
+	maybePersistSession(t, ctx, reg, sess)
 
 	var handler http.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.NoError(t, reg.SessionManager().IssueCookie(context.Background(), w, r, sess))
+		require.NoError(t, reg.SessionManager().IssueCookie(ctx, w, r, sess))
 	})
 
 	if _, ok := reg.CSRFHandler().(*nosurf.CSRFHandler); ok {
@@ -96,11 +98,11 @@ func NewHTTPClientWithSessionCookieLocalhost(t *testing.T, reg *driver.RegistryD
 	return c
 }
 
-func NewNoRedirectHTTPClientWithSessionCookie(t *testing.T, reg *driver.RegistryDefault, sess *session.Session) *http.Client {
-	maybePersistSession(t, reg, sess)
+func NewNoRedirectHTTPClientWithSessionCookie(t *testing.T, ctx context.Context, reg *driver.RegistryDefault, sess *session.Session) *http.Client {
+	maybePersistSession(t, ctx, reg, sess)
 
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.NoError(t, reg.SessionManager().IssueCookie(context.Background(), w, r, sess))
+		require.NoError(t, reg.SessionManager().IssueCookie(ctx, w, r, sess))
 	}))
 	defer ts.Close()
 
@@ -130,8 +132,8 @@ func (ct *TransportWithLogger) RoundTrip(req *http.Request) (*http.Response, err
 	return ct.RoundTripper.RoundTrip(req)
 }
 
-func NewHTTPClientWithSessionToken(t *testing.T, reg *driver.RegistryDefault, sess *session.Session) *http.Client {
-	maybePersistSession(t, reg, sess)
+func NewHTTPClientWithSessionToken(t *testing.T, ctx context.Context, reg *driver.RegistryDefault, sess *session.Session) *http.Client {
+	maybePersistSession(t, ctx, reg, sess)
 
 	return &http.Client{
 		Transport: NewTransportWithHeader(t, http.Header{
@@ -140,88 +142,97 @@ func NewHTTPClientWithSessionToken(t *testing.T, reg *driver.RegistryDefault, se
 	}
 }
 
-func NewHTTPClientWithArbitrarySessionToken(t *testing.T, reg *driver.RegistryDefault) *http.Client {
-	req := NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
-	s, err := session.NewActiveSession(req,
-		&identity.Identity{ID: x.NewUUID(), State: identity.StateActive},
-		NewSessionLifespanProvider(time.Hour),
+func NewHTTPClientWithArbitrarySessionToken(t *testing.T, ctx context.Context, reg *driver.RegistryDefault) *http.Client {
+	return NewHTTPClientWithArbitrarySessionTokenAndTraits(t, ctx, reg, nil)
+}
+
+func NewHTTPClientWithArbitrarySessionTokenAndTraits(t *testing.T, ctx context.Context, reg *driver.RegistryDefault, traits identity.Traits) *http.Client {
+	req := NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil).WithContext(confighelpers.WithConfigValue(ctx, "session.lifespan", time.Hour))
+	s, err := NewActiveSession(req, reg,
+		&identity.Identity{ID: x.NewUUID(), State: identity.StateActive, Traits: traits, NID: x.NewUUID(), SchemaID: "default"},
 		time.Now(),
 		identity.CredentialsTypePassword,
 		identity.AuthenticatorAssuranceLevel1,
 	)
 	require.NoError(t, err, "Could not initialize session from identity.")
 
-	return NewHTTPClientWithSessionToken(t, reg, s)
+	return NewHTTPClientWithSessionToken(t, ctx, reg, s)
 }
 
-func NewHTTPClientWithArbitrarySessionCookie(t *testing.T, reg *driver.RegistryDefault) *http.Client {
+func NewHTTPClientWithArbitrarySessionCookie(t *testing.T, ctx context.Context, reg *driver.RegistryDefault) *http.Client {
 	req := NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
-	s, err := session.NewActiveSession(req,
-		&identity.Identity{ID: x.NewUUID(), State: identity.StateActive, Traits: []byte("{}")},
-		NewSessionLifespanProvider(time.Hour),
+	req = req.WithContext(confighelpers.WithConfigValue(ctx, "session.lifespan", time.Hour))
+	id := x.NewUUID()
+	s, err := NewActiveSession(req, reg,
+		&identity.Identity{ID: id, State: identity.StateActive, Traits: []byte("{}"), Credentials: map[identity.CredentialsType]identity.Credentials{
+			identity.CredentialsTypePassword: {Type: "password", Identifiers: []string{id.String()}, Config: []byte(`{"hashed_password":"$2a$04$zvZz1zV"}`)},
+		}},
 		time.Now(),
 		identity.CredentialsTypePassword,
 		identity.AuthenticatorAssuranceLevel1,
 	)
 	require.NoError(t, err, "Could not initialize session from identity.")
 
-	return NewHTTPClientWithSessionCookie(t, reg, s)
+	return NewHTTPClientWithSessionCookie(t, ctx, reg, s)
 }
 
-func NewNoRedirectHTTPClientWithArbitrarySessionCookie(t *testing.T, reg *driver.RegistryDefault) *http.Client {
+func NewNoRedirectHTTPClientWithArbitrarySessionCookie(t *testing.T, ctx context.Context, reg *driver.RegistryDefault) *http.Client {
 	req := NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
-	s, err := session.NewActiveSession(req,
-		&identity.Identity{ID: x.NewUUID(), State: identity.StateActive},
-		NewSessionLifespanProvider(time.Hour),
+	req = req.WithContext(confighelpers.WithConfigValue(ctx, "session.lifespan", time.Hour))
+	id := x.NewUUID()
+	s, err := NewActiveSession(req, reg,
+		&identity.Identity{ID: id, State: identity.StateActive,
+			Credentials: map[identity.CredentialsType]identity.Credentials{
+				identity.CredentialsTypePassword: {Type: "password", Identifiers: []string{id.String()}, Config: []byte(`{"hashed_password":"$2a$04$zvZz1zV"}`)},
+			}},
 		time.Now(),
 		identity.CredentialsTypePassword,
 		identity.AuthenticatorAssuranceLevel1,
 	)
 	require.NoError(t, err, "Could not initialize session from identity.")
 
-	return NewNoRedirectHTTPClientWithSessionCookie(t, reg, s)
+	return NewNoRedirectHTTPClientWithSessionCookie(t, ctx, reg, s)
 }
 
-func NewHTTPClientWithIdentitySessionCookie(t *testing.T, reg *driver.RegistryDefault, id *identity.Identity) *http.Client {
+func NewHTTPClientWithIdentitySessionCookie(t *testing.T, ctx context.Context, reg *driver.RegistryDefault, id *identity.Identity) *http.Client {
 	req := NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
-	s, err := session.NewActiveSession(req,
+	req = req.WithContext(confighelpers.WithConfigValue(ctx, "session.lifespan", time.Hour))
+	s, err := NewActiveSession(req, reg,
 		id,
-		NewSessionLifespanProvider(time.Hour),
 		time.Now(),
 		identity.CredentialsTypePassword,
 		identity.AuthenticatorAssuranceLevel1,
 	)
 	require.NoError(t, err, "Could not initialize session from identity.")
 
-	return NewHTTPClientWithSessionCookie(t, reg, s)
+	return NewHTTPClientWithSessionCookie(t, ctx, reg, s)
 }
 
-func NewHTTPClientWithIdentitySessionCookieLocalhost(t *testing.T, reg *driver.RegistryDefault, id *identity.Identity) *http.Client {
+func NewHTTPClientWithIdentitySessionCookieLocalhost(t *testing.T, ctx context.Context, reg *driver.RegistryDefault, id *identity.Identity) *http.Client {
 	req := NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
-	s, err := session.NewActiveSession(req,
+	s, err := NewActiveSession(req, reg,
 		id,
-		NewSessionLifespanProvider(time.Hour),
 		time.Now(),
 		identity.CredentialsTypePassword,
 		identity.AuthenticatorAssuranceLevel1,
 	)
 	require.NoError(t, err, "Could not initialize session from identity.")
 
-	return NewHTTPClientWithSessionCookieLocalhost(t, reg, s)
+	return NewHTTPClientWithSessionCookieLocalhost(t, ctx, reg, s)
 }
 
-func NewHTTPClientWithIdentitySessionToken(t *testing.T, reg *driver.RegistryDefault, id *identity.Identity) *http.Client {
+func NewHTTPClientWithIdentitySessionToken(t *testing.T, ctx context.Context, reg *driver.RegistryDefault, id *identity.Identity) *http.Client {
 	req := NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
-	s, err := session.NewActiveSession(req,
+	req = req.WithContext(confighelpers.WithConfigValue(ctx, "session.lifespan", time.Hour))
+	s, err := NewActiveSession(req, reg,
 		id,
-		NewSessionLifespanProvider(time.Hour),
 		time.Now(),
 		identity.CredentialsTypePassword,
 		identity.AuthenticatorAssuranceLevel1,
 	)
 	require.NoError(t, err, "Could not initialize session from identity.")
 
-	return NewHTTPClientWithSessionToken(t, reg, s)
+	return NewHTTPClientWithSessionToken(t, ctx, reg, s)
 }
 
 func EnsureAAL(t *testing.T, c *http.Client, ts *httptest.Server, aal string, methods ...string) {
@@ -236,8 +247,8 @@ func EnsureAAL(t *testing.T, c *http.Client, ts *httptest.Server, aal string, me
 	assert.Len(t, gjson.GetBytes(sess, "authentication_methods").Array(), 1+len(methods))
 }
 
-func NewAuthorizedTransport(t *testing.T, reg *driver.RegistryDefault, sess *session.Session) *TransportWithHeader {
-	maybePersistSession(t, reg, sess)
+func NewAuthorizedTransport(t *testing.T, ctx context.Context, reg *driver.RegistryDefault, sess *session.Session) *TransportWithHeader {
+	maybePersistSession(t, ctx, reg, sess)
 
 	return NewTransportWithHeader(t, http.Header{
 		"Authorization": {"Bearer " + sess.Token},
@@ -259,6 +270,10 @@ type TransportWithHeader struct {
 	h http.Header
 }
 
+func (ct *TransportWithHeader) GetHeader() http.Header {
+	return ct.h
+}
+
 func (ct *TransportWithHeader) RoundTrip(req *http.Request) (*http.Response, error) {
 	for k := range ct.h {
 		req.Header.Set(k, ct.h.Get(k))
diff --git a/internal/testhelpers/session_active.go b/internal/testhelpers/session_active.go
new file mode 100644
index 000000000000..a245abce45e1
--- /dev/null
+++ b/internal/testhelpers/session_active.go
@@ -0,0 +1,23 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package testhelpers
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/session"
+)
+
+func NewActiveSession(r *http.Request, reg interface {
+	session.ManagementProvider
+}, i *identity.Identity, authenticatedAt time.Time, completedLoginFor identity.CredentialsType, completedLoginAAL identity.AuthenticatorAssuranceLevel) (*session.Session, error) {
+	s := session.NewInactiveSession()
+	s.CompletedLoginFor(completedLoginFor, completedLoginAAL)
+	if err := reg.SessionManager().ActivateSession(r, s, i, authenticatedAt); err != nil {
+		return nil, err
+	}
+	return s, nil
+}
diff --git a/persistence/reference.go b/persistence/reference.go
index 56a7ca1712df..35af9afdb29d 100644
--- a/persistence/reference.go
+++ b/persistence/reference.go
@@ -7,6 +7,8 @@ import (
 	"context"
 	"time"
 
+	"github.com/ory/kratos/x"
+
 	"github.com/ory/kratos/selfservice/sessiontokenexchange"
 	"github.com/ory/x/networkx"
 
@@ -56,14 +58,15 @@ type Persister interface {
 
 	CleanupDatabase(context.Context, time.Duration, time.Duration, int) error
 	Close(context.Context) error
-	Ping() error
-	MigrationStatus(c context.Context) (popx.MigrationStatuses, error)
-	MigrateDown(c context.Context, steps int) error
-	MigrateUp(c context.Context) error
+	Ping(context.Context) error
+	MigrationStatus(context.Context) (popx.MigrationStatuses, error)
+	MigrateDown(ctx context.Context, steps int) error
+	MigrateUp(context.Context) error
 	Migrator() *popx.Migrator
 	MigrationBox() *popx.MigrationBox
-	GetConnection(ctx context.Context) *pop.Connection
-	Transaction(ctx context.Context, callback func(ctx context.Context, connection *pop.Connection) error) error
+	GetConnection(context.Context) *pop.Connection
+	Connection(ctx context.Context) *pop.Connection
+	x.TransactionalPersister
 	Networker
 }
 
diff --git a/persistence/sql/batch/.snapshots/Test_buildInsertQueryValues-case=testModel-case=cockroach.json b/persistence/sql/batch/.snapshots/Test_buildInsertQueryValues-case=testModel-case=cockroach.json
index 9c8e755cacd5..04c9db394e80 100644
--- a/persistence/sql/batch/.snapshots/Test_buildInsertQueryValues-case=testModel-case=cockroach.json
+++ b/persistence/sql/batch/.snapshots/Test_buildInsertQueryValues-case=testModel-case=cockroach.json
@@ -1,6 +1,6 @@
 [
-  "0001-01-01T00:00:00Z",
-  "0001-01-01T00:00:00Z",
+  "2023-01-01T00:00:00Z",
+  "2023-01-01T00:00:00Z",
   "string",
   42,
   null,
diff --git a/persistence/sql/batch/create.go b/persistence/sql/batch/create.go
index 38254a3b2a80..30b3c9768a7a 100644
--- a/persistence/sql/batch/create.go
+++ b/persistence/sql/batch/create.go
@@ -8,23 +8,21 @@ import (
 	"database/sql"
 	"fmt"
 	"reflect"
+	"slices"
 	"sort"
 	"strings"
 	"time"
 
+	"github.com/gobuffalo/pop/v6"
+	"github.com/gofrs/uuid"
 	"github.com/jmoiron/sqlx/reflectx"
+	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/x/dbal"
-
-	"github.com/gobuffalo/pop/v6"
-	"github.com/gofrs/uuid"
-	"github.com/pkg/errors"
-
 	"github.com/ory/x/otelx"
 	"github.com/ory/x/sqlcon"
-
 	"github.com/ory/x/sqlxx"
 )
 
@@ -42,9 +40,32 @@ type (
 		Tracer     *otelx.Tracer
 		Connection *pop.Connection
 	}
+
+	// PartialConflictError represents a partial conflict during [Create]. It always
+	// wraps a [sqlcon.ErrUniqueViolation], so that the caller can either abort the
+	// whole transaction, or handle the partial success.
+	PartialConflictError[T any] struct {
+		Failed []*T
+	}
 )
 
-func buildInsertQueryArgs[T any](ctx context.Context, dialect string, mapper *reflectx.Mapper, quoter quoter, models []*T) insertQueryArgs {
+func (p *PartialConflictError[T]) Error() string {
+	return fmt.Sprintf("partial conflict error: %d models failed to insert", len(p.Failed))
+}
+func (p *PartialConflictError[T]) ErrOrNil() error {
+	if len(p.Failed) == 0 {
+		return nil
+	}
+	return p
+}
+func (p *PartialConflictError[T]) Unwrap() error {
+	if len(p.Failed) == 0 {
+		return nil
+	}
+	return sqlcon.ErrUniqueViolation
+}
+
+func buildInsertQueryArgs[T any](ctx context.Context, models []*T, opts *createOpts) insertQueryArgs {
 	var (
 		v     T
 		model = pop.NewModel(v, ctx)
@@ -64,7 +85,7 @@ func buildInsertQueryArgs[T any](ctx context.Context, dialect string, mapper *re
 	sort.Strings(columns)
 
 	for _, col := range columns {
-		quotedColumns = append(quotedColumns, quoter.Quote(col))
+		quotedColumns = append(quotedColumns, opts.quoter.Quote(col))
 	}
 
 	// We generate a list (for every row one) of VALUE statements here that
@@ -88,37 +109,36 @@ func buildInsertQueryArgs[T any](ctx context.Context, dialect string, mapper *re
 				continue
 			}
 
-			field := mapper.FieldByName(m, columns[k])
+			field := opts.mapper.FieldByName(m, columns[k])
 			val, ok := field.Interface().(uuid.UUID)
 			if !ok {
 				continue
 			}
 
-			if val == uuid.Nil && dialect == dbal.DriverCockroachDB {
+			if val == uuid.Nil && opts.dialect == dbal.DriverCockroachDB && !opts.partialInserts {
 				pl[k] = "gen_random_uuid()"
 				break
 			}
 		}
-
 		placeholders = append(placeholders, fmt.Sprintf("(%s)", strings.Join(pl, ", ")))
 	}
 
 	return insertQueryArgs{
-		TableName:    quoter.Quote(model.TableName()),
+		TableName:    opts.quoter.Quote(model.TableName()),
 		ColumnsDecl:  strings.Join(quotedColumns, ", "),
 		Columns:      columns,
 		Placeholders: strings.Join(placeholders, ",\n"),
 	}
 }
 
-func buildInsertQueryValues[T any](dialect string, mapper *reflectx.Mapper, columns []string, models []*T, nowFunc func() time.Time) (values []any, err error) {
+func buildInsertQueryValues[T any](columns []string, models []*T, opts *createOpts) (values []any, err error) {
 	for _, m := range models {
 		m := reflect.ValueOf(m)
 
-		now := nowFunc()
+		now := opts.now()
 		// Append model fields to args
 		for _, c := range columns {
-			field := mapper.FieldByName(m, c)
+			field := opts.mapper.FieldByName(m, c)
 
 			switch c {
 			case "created_at":
@@ -130,7 +150,7 @@ func buildInsertQueryValues[T any](dialect string, mapper *reflectx.Mapper, colu
 			case "id":
 				if field.Interface().(uuid.UUID) != uuid.Nil {
 					break // breaks switch, not for
-				} else if dialect == dbal.DriverCockroachDB {
+				} else if opts.dialect == dbal.DriverCockroachDB && !opts.partialInserts {
 					// This is a special case:
 					// 1. We're using cockroach
 					// 2. It's the primary key field ("ID")
@@ -167,9 +187,51 @@ func buildInsertQueryValues[T any](dialect string, mapper *reflectx.Mapper, colu
 	return values, nil
 }
 
-// Create batch-inserts the given models into the database using a single INSERT statement.
-// The models are either all created or none.
-func Create[T any](ctx context.Context, p *TracerConnection, models []*T) (err error) {
+type createOpts struct {
+	partialInserts bool
+	dialect        string
+	mapper         *reflectx.Mapper
+	quoter         quoter
+	now            func() time.Time
+}
+
+type CreateOpts func(*createOpts)
+
+// WithPartialInserts allows to insert only the models that do not conflict with
+// an existing record. WithPartialInserts will also generate the IDs for the
+// models before inserting them, so that the successful inserts can be correlated
+// with the input models.
+//
+// In particular, WithPartialInserts does not work with MySQL, because it does
+// not support the "RETURNING" clause.
+//
+// WithPartialInserts does not work with CockroachDB and gen_random_uuid(),
+// because then the successful inserts cannot be correlated with the input
+// models. Note: gen_random_uuid() will skip the UNIQUE constraint check, which
+// needs to hit all regions in a distributed setup. Therefore, WithPartialInserts
+// should not be used to insert models for only a single identity.
+var WithPartialInserts CreateOpts = func(o *createOpts) {
+	o.partialInserts = true
+}
+
+func newCreateOpts(conn *pop.Connection, opts ...CreateOpts) *createOpts {
+	o := new(createOpts)
+	o.dialect = conn.Dialect.Name()
+	o.mapper = conn.TX.Mapper
+	o.quoter = conn.Dialect.(quoter)
+	o.now = func() time.Time { return time.Now().UTC().Truncate(time.Microsecond) }
+	for _, f := range opts {
+		f(o)
+	}
+	return o
+}
+
+// Create batch-inserts the given models into the database using a single INSERT
+// statement. By default, the models are either all created or none. If
+// [WithPartialInserts] is passed as an option, partial inserts are supported,
+// and the models that could not be inserted are returned in an
+// [PartialConflictError].
+func Create[T any](ctx context.Context, p *TracerConnection, models []*T, opts ...CreateOpts) (err error) {
 	ctx, span := p.Tracer.Tracer().Start(ctx, "persistence.sql.batch.Create",
 		trace.WithAttributes(attribute.Int("count", len(models))))
 	defer otelx.End(span, &err)
@@ -182,13 +244,10 @@ func Create[T any](ctx context.Context, p *TracerConnection, models []*T) (err e
 	model := pop.NewModel(v, ctx)
 
 	conn := p.Connection
-	quoter, ok := conn.Dialect.(quoter)
-	if !ok {
-		return errors.Errorf("store is not a quoter: %T", conn.Store)
-	}
+	options := newCreateOpts(conn, opts...)
 
-	queryArgs := buildInsertQueryArgs(ctx, conn.Dialect.Name(), conn.TX.Mapper, quoter, models)
-	values, err := buildInsertQueryValues(conn.Dialect.Name(), conn.TX.Mapper, queryArgs.Columns, models, func() time.Time { return time.Now().UTC().Truncate(time.Microsecond) })
+	queryArgs := buildInsertQueryArgs(ctx, models, options)
+	values, err := buildInsertQueryValues(queryArgs.Columns, models, options)
 	if err != nil {
 		return err
 	}
@@ -196,7 +255,11 @@ func Create[T any](ctx context.Context, p *TracerConnection, models []*T) (err e
 	var returningClause string
 	if conn.Dialect.Name() != dbal.DriverMySQL {
 		// PostgreSQL, CockroachDB, SQLite support RETURNING.
-		returningClause = fmt.Sprintf("RETURNING %s", model.IDField())
+		if options.partialInserts {
+			returningClause = fmt.Sprintf("ON CONFLICT DO NOTHING RETURNING %s", model.IDField())
+		} else {
+			returningClause = fmt.Sprintf("RETURNING %s", model.IDField())
+		}
 	}
 
 	query := conn.Dialect.TranslateSQL(fmt.Sprintf(
@@ -213,66 +276,84 @@ func Create[T any](ctx context.Context, p *TracerConnection, models []*T) (err e
 	}
 	defer rows.Close()
 
+	// MySQL, which does not support RETURNING, also does not have ON CONFLICT DO
+	// NOTHING, meaning that MySQL will always fail the whole transaction on a single
+	// record conflict.
+	if conn.Dialect.Name() == dbal.DriverMySQL {
+		return nil
+	}
+
+	if options.partialInserts {
+		return handlePartialInserts(queryArgs, values, models, rows)
+	} else {
+		return handleFullInserts(models, rows)
+	}
+
+}
+
+func handleFullInserts[T any](models []*T, rows *sql.Rows) error {
 	// Hydrate the models from the RETURNING clause.
-	//
-	// Databases not supporting RETURNING will just return 0 rows.
-	count := 0
-	for rows.Next() {
-		if err := rows.Err(); err != nil {
-			return sqlcon.HandleError(err)
+	for i := 0; rows.Next(); i++ {
+		var id uuid.UUID
+		if err := rows.Scan(&id); err != nil {
+			return errors.WithStack(err)
 		}
-
-		if err := setModelID(rows, pop.NewModel(models[count], ctx)); err != nil {
+		if err := setModelID(id, models[i]); err != nil {
 			return err
 		}
-		count++
 	}
-
 	if err := rows.Err(); err != nil {
 		return sqlcon.HandleError(err)
 	}
 
-	if err := rows.Close(); err != nil {
-		return sqlcon.HandleError(err)
-	}
-
-	return sqlcon.HandleError(err)
+	return nil
 }
 
-// setModelID was copy & pasted from pop. It basically sets
-// the primary key to the given value read from the SQL row.
-func setModelID(row *sql.Rows, model *pop.Model) error {
-	el := reflect.ValueOf(model.Value).Elem()
-	fbn := el.FieldByName("ID")
-	if !fbn.IsValid() {
-		return errors.New("model does not have a field named id")
+func handlePartialInserts[T any](queryArgs insertQueryArgs, values []any, models []*T, rows *sql.Rows) error {
+	// Hydrate the models from the RETURNING clause.
+	idsInDB := make(map[uuid.UUID]struct{})
+	for rows.Next() {
+		var id uuid.UUID
+		if err := rows.Scan(&id); err != nil {
+			return errors.WithStack(err)
+		}
+		idsInDB[id] = struct{}{}
+	}
+	if err := rows.Err(); err != nil {
+		return sqlcon.HandleError(err)
 	}
 
-	pkt, err := model.PrimaryKeyType()
-	if err != nil {
-		return errors.WithStack(err)
+	idIdx := slices.Index(queryArgs.Columns, "id")
+	if idIdx == -1 {
+		return errors.New("id column not found")
+	}
+	var idValues []uuid.UUID
+	for i := idIdx; i < len(values); i += len(queryArgs.Columns) {
+		idValues = append(idValues, values[i].(uuid.UUID))
 	}
 
-	switch pkt {
-	case "UUID":
-		var id uuid.UUID
-		if err := row.Scan(&id); err != nil {
-			return errors.WithStack(err)
-		}
-		fbn.Set(reflect.ValueOf(id))
-	default:
-		var id interface{}
-		if err := row.Scan(&id); err != nil {
-			return errors.WithStack(err)
-		}
-		v := reflect.ValueOf(id)
-		switch fbn.Kind() {
-		case reflect.Int, reflect.Int64:
-			fbn.SetInt(v.Int())
-		default:
-			fbn.Set(reflect.ValueOf(id))
+	var partialConflictError PartialConflictError[T]
+	for i, id := range idValues {
+		if _, ok := idsInDB[id]; !ok {
+			partialConflictError.Failed = append(partialConflictError.Failed, models[i])
+		} else {
+			if err := setModelID(id, models[i]); err != nil {
+				return err
+			}
 		}
 	}
 
+	return partialConflictError.ErrOrNil()
+}
+
+// setModelID sets the id field of the model to the id.
+func setModelID(id uuid.UUID, model any) error {
+	el := reflect.ValueOf(model).Elem()
+	idField := el.FieldByName("ID")
+	if !idField.IsValid() {
+		return errors.New("model does not have a field named id")
+	}
+	idField.Set(reflect.ValueOf(id))
+
 	return nil
 }
diff --git a/persistence/sql/batch/create_test.go b/persistence/sql/batch/create_test.go
index f5c81664a486..131589478e6e 100644
--- a/persistence/sql/batch/create_test.go
+++ b/persistence/sql/batch/create_test.go
@@ -9,14 +9,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/ory/x/dbal"
-
 	"github.com/gofrs/uuid"
 	"github.com/jmoiron/sqlx/reflectx"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/ory/kratos/identity"
+	"github.com/ory/x/dbal"
 	"github.com/ory/x/snapshotx"
 	"github.com/ory/x/sqlxx"
 )
@@ -53,8 +52,11 @@ func Test_buildInsertQueryArgs(t *testing.T) {
 	ctx := context.Background()
 	t.Run("case=testModel", func(t *testing.T) {
 		models := makeModels[testModel]()
-		mapper := reflectx.NewMapper("db")
-		args := buildInsertQueryArgs(ctx, "other", mapper, testQuoter{}, models)
+		opts := &createOpts{
+			dialect: "other",
+			quoter:  testQuoter{},
+			mapper:  reflectx.NewMapper("db")}
+		args := buildInsertQueryArgs(ctx, models, opts)
 		snapshotx.SnapshotT(t, args)
 
 		query := fmt.Sprintf("INSERT INTO %s (%s) VALUES\n%s", args.TableName, args.ColumnsDecl, args.Placeholders)
@@ -73,22 +75,31 @@ func Test_buildInsertQueryArgs(t *testing.T) {
 
 	t.Run("case=Identities", func(t *testing.T) {
 		models := makeModels[identity.Identity]()
-		mapper := reflectx.NewMapper("db")
-		args := buildInsertQueryArgs(ctx, "other", mapper, testQuoter{}, models)
+		opts := &createOpts{
+			dialect: "other",
+			quoter:  testQuoter{},
+			mapper:  reflectx.NewMapper("db")}
+		args := buildInsertQueryArgs(ctx, models, opts)
 		snapshotx.SnapshotT(t, args)
 	})
 
 	t.Run("case=RecoveryAddress", func(t *testing.T) {
 		models := makeModels[identity.RecoveryAddress]()
-		mapper := reflectx.NewMapper("db")
-		args := buildInsertQueryArgs(ctx, "other", mapper, testQuoter{}, models)
+		opts := &createOpts{
+			dialect: "other",
+			quoter:  testQuoter{},
+			mapper:  reflectx.NewMapper("db")}
+		args := buildInsertQueryArgs(ctx, models, opts)
 		snapshotx.SnapshotT(t, args)
 	})
 
 	t.Run("case=RecoveryAddress", func(t *testing.T) {
 		models := makeModels[identity.RecoveryAddress]()
-		mapper := reflectx.NewMapper("db")
-		args := buildInsertQueryArgs(ctx, "other", mapper, testQuoter{}, models)
+		opts := &createOpts{
+			dialect: "other",
+			quoter:  testQuoter{},
+			mapper:  reflectx.NewMapper("db")}
+		args := buildInsertQueryArgs(ctx, models, opts)
 		snapshotx.SnapshotT(t, args)
 	})
 
@@ -99,8 +110,11 @@ func Test_buildInsertQueryArgs(t *testing.T) {
 				models[k].ID = uuid.FromStringOrNil(fmt.Sprintf("ae0125a9-2786-4ada-82d2-d169cf75047%d", k))
 			}
 		}
-		mapper := reflectx.NewMapper("db")
-		args := buildInsertQueryArgs(ctx, "cockroach", mapper, testQuoter{}, models)
+		opts := &createOpts{
+			dialect: dbal.DriverCockroachDB,
+			quoter:  testQuoter{},
+			mapper:  reflectx.NewMapper("db")}
+		args := buildInsertQueryArgs(ctx, models, opts)
 		snapshotx.SnapshotT(t, args)
 	})
 }
@@ -112,25 +126,38 @@ func Test_buildInsertQueryValues(t *testing.T) {
 			Int:    42,
 			Traits: []byte(`{"foo": "bar"}`),
 		}
-		mapper := reflectx.NewMapper("db")
 
-		nowFunc := func() time.Time {
-			return time.Time{}
+		frozenTime := time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC)
+		opts := &createOpts{
+			mapper: reflectx.NewMapper("db"),
+			quoter: testQuoter{},
+			now:    func() time.Time { return frozenTime },
 		}
+
 		t.Run("case=cockroach", func(t *testing.T) {
-			values, err := buildInsertQueryValues(dbal.DriverCockroachDB, mapper, []string{"created_at", "updated_at", "id", "string", "int", "null_time_ptr", "traits"}, []*testModel{model}, nowFunc)
+			opts.dialect = dbal.DriverCockroachDB
+			values, err := buildInsertQueryValues(
+				[]string{"created_at", "updated_at", "id", "string", "int", "null_time_ptr", "traits"},
+				[]*testModel{model},
+				opts,
+			)
 			require.NoError(t, err)
 			snapshotx.SnapshotT(t, values)
 		})
 
 		t.Run("case=others", func(t *testing.T) {
-			values, err := buildInsertQueryValues("other", mapper, []string{"created_at", "updated_at", "id", "string", "int", "null_time_ptr", "traits"}, []*testModel{model}, nowFunc)
+			opts.dialect = "other"
+			values, err := buildInsertQueryValues(
+				[]string{"created_at", "updated_at", "id", "string", "int", "null_time_ptr", "traits"},
+				[]*testModel{model},
+				opts,
+			)
 			require.NoError(t, err)
 
-			assert.NotNil(t, model.CreatedAt)
+			assert.Equal(t, frozenTime, model.CreatedAt)
 			assert.Equal(t, model.CreatedAt, values[0])
 
-			assert.NotNil(t, model.UpdatedAt)
+			assert.Equal(t, frozenTime, model.UpdatedAt)
 			assert.Equal(t, model.UpdatedAt, values[1])
 
 			assert.NotZero(t, model.ID)
diff --git a/persistence/sql/batch/test_persister.go b/persistence/sql/batch/test_persister.go
new file mode 100644
index 000000000000..be0e9ac7a4c5
--- /dev/null
+++ b/persistence/sql/batch/test_persister.go
@@ -0,0 +1,112 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package batch
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/gobuffalo/pop/v6"
+	"github.com/gofrs/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/persistence"
+	"github.com/ory/x/dbal"
+	"github.com/ory/x/otelx"
+	"github.com/ory/x/sqlcon"
+)
+
+func TestPersister(ctx context.Context, tracer *otelx.Tracer, p persistence.Persister) func(t *testing.T) {
+	return func(t *testing.T) {
+		t.Run("method=batch.Create", func(t *testing.T) {
+
+			ident1 := identity.NewIdentity("")
+			ident1.NID = p.NetworkID(ctx)
+			ident2 := identity.NewIdentity("")
+			ident2.NID = p.NetworkID(ctx)
+
+			// Create two identities
+			_ = p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
+				conn := &TracerConnection{
+					Tracer:     tracer,
+					Connection: tx,
+				}
+
+				err := Create(ctx, conn, []*identity.Identity{ident1, ident2})
+				require.NoError(t, err)
+
+				return nil
+			})
+
+			require.NotEqual(t, uuid.Nil, ident1.ID)
+			require.NotEqual(t, uuid.Nil, ident2.ID)
+
+			// Create conflicting verifiable addresses
+			addresses := []*identity.VerifiableAddress{{
+				Value:      "foo.1@bar.de",
+				IdentityID: ident1.ID,
+				NID:        ident1.NID,
+			}, {
+				Value:      "foo.2@bar.de",
+				IdentityID: ident1.ID,
+				NID:        ident1.NID,
+			}, {
+				Value:      "conflict@bar.de",
+				IdentityID: ident1.ID,
+				NID:        ident1.NID,
+			}, {
+				Value:      "foo.3@bar.de",
+				IdentityID: ident1.ID,
+				NID:        ident1.NID,
+			}, {
+				Value:      "conflict@bar.de",
+				IdentityID: ident1.ID,
+				NID:        ident1.NID,
+			}, {
+				Value:      "foo.4@bar.de",
+				IdentityID: ident1.ID,
+				NID:        ident1.NID,
+			}}
+
+			t.Run("case=fails all without partial inserts", func(t *testing.T) {
+				_ = p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
+					conn := &TracerConnection{
+						Tracer:     tracer,
+						Connection: tx,
+					}
+					err := Create(ctx, conn, addresses)
+					assert.ErrorIs(t, err, sqlcon.ErrUniqueViolation)
+					if partial := new(PartialConflictError[identity.VerifiableAddress]); errors.As(err, &partial) {
+						require.NoError(t, partial, "expected no partial error")
+					}
+					return err
+				})
+			})
+
+			t.Run("case=return partial error with partial inserts", func(t *testing.T) {
+				_ = p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
+					conn := &TracerConnection{
+						Tracer:     tracer,
+						Connection: tx,
+					}
+
+					err := Create(ctx, conn, addresses, WithPartialInserts)
+					assert.ErrorIs(t, err, sqlcon.ErrUniqueViolation)
+
+					if conn.Connection.Dialect.Name() != dbal.DriverMySQL {
+						// MySQL does not support partial errors.
+						partialErr := new(PartialConflictError[identity.VerifiableAddress])
+						require.ErrorAs(t, err, &partialErr)
+						assert.Len(t, partialErr.Failed, 1)
+					}
+
+					return nil
+				})
+			})
+		})
+	}
+}
diff --git a/persistence/sql/identity/persister_identity.go b/persistence/sql/identity/persister_identity.go
index 984fb0199da2..990f97a550ba 100644
--- a/persistence/sql/identity/persister_identity.go
+++ b/persistence/sql/identity/persister_identity.go
@@ -13,8 +13,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/ory/x/crdbx"
-
 	"github.com/gobuffalo/pop/v6"
 	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
@@ -31,7 +29,9 @@ import (
 	"github.com/ory/kratos/persistence/sql/update"
 	"github.com/ory/kratos/schema"
 	"github.com/ory/kratos/x"
+	"github.com/ory/kratos/x/events"
 	"github.com/ory/x/contextx"
+	"github.com/ory/x/crdbx"
 	"github.com/ory/x/errorsx"
 	"github.com/ory/x/otelx"
 	"github.com/ory/x/pagination/keysetpagination"
@@ -239,7 +239,7 @@ func (p *IdentityPersister) FindByCredentialsIdentifier(ctx context.Context, ct
 		return nil, nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("The SQL adapter failed to return the appropriate credentials_type \"%s\". This is a bug in the code.", ct))
 	}
 
-	return i.CopyWithoutCredentials(), creds, nil
+	return i, creds, nil
 }
 
 func (p *IdentityPersister) FindIdentityByWebauthnUserHandle(ctx context.Context, userHandle []byte) (_ *identity.Identity, err error) {
@@ -280,36 +280,6 @@ LIMIT 1`, jsonPath, jsonPath),
 	return &id, nil
 }
 
-var credentialsTypes = struct {
-	sync.RWMutex
-	m map[identity.CredentialsType]*identity.CredentialsTypeTable
-}{
-	m: map[identity.CredentialsType]*identity.CredentialsTypeTable{},
-}
-
-func (p *IdentityPersister) findIdentityCredentialsType(ctx context.Context, ct identity.CredentialsType) (_ *identity.CredentialsTypeTable, err error) {
-	credentialsTypes.RLock()
-	v, ok := credentialsTypes.m[ct]
-	credentialsTypes.RUnlock()
-
-	if ok && v != nil {
-		return v, nil
-	}
-
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.findIdentityCredentialsType")
-	defer otelx.End(span, &err)
-
-	var m identity.CredentialsTypeTable
-	if err := p.GetConnection(ctx).Where("name = ?", ct).First(&m); err != nil {
-		return nil, sqlcon.HandleError(err)
-	}
-	credentialsTypes.Lock()
-	credentialsTypes.m[ct] = &m
-	credentialsTypes.Unlock()
-
-	return &m, nil
-}
-
 func (p *IdentityPersister) createIdentityCredentials(ctx context.Context, conn *pop.Connection, identities ...*identity.Identity) (err error) {
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.createIdentityCredentials",
 		trace.WithAttributes(
@@ -324,6 +294,11 @@ func (p *IdentityPersister) createIdentityCredentials(ctx context.Context, conn
 		identifiers []*identity.CredentialIdentifier
 	)
 
+	var opts []batch.CreateOpts
+	if len(identities) > 1 {
+		opts = append(opts, batch.WithPartialInserts)
+	}
+
 	for _, ident := range identities {
 		for k := range ident.Credentials {
 			cred := ident.Credentials[k]
@@ -332,7 +307,7 @@ func (p *IdentityPersister) createIdentityCredentials(ctx context.Context, conn
 				cred.Config = sqlxx.JSONRawMessage("{}")
 			}
 
-			ct, err := p.findIdentityCredentialsType(ctx, cred.Type)
+			ct, err := FindIdentityCredentialsTypeByName(conn, cred.Type)
 			if err != nil {
 				return err
 			}
@@ -343,13 +318,13 @@ func (p *IdentityPersister) createIdentityCredentials(ctx context.Context, conn
 			}
 			cred.IdentityID = ident.ID
 			cred.NID = nid
-			cred.IdentityCredentialTypeID = ct.ID
+			cred.IdentityCredentialTypeID = ct
 			credentials = append(credentials, &cred)
 
 			ident.Credentials[k] = cred
 		}
 	}
-	if err = batch.Create(ctx, traceConn, credentials); err != nil {
+	if err = batch.Create(ctx, traceConn, credentials, opts...); err != nil {
 		return err
 	}
 
@@ -363,7 +338,7 @@ func (p *IdentityPersister) createIdentityCredentials(ctx context.Context, conn
 					"Unable to create identity credentials with missing or empty identifier."))
 			}
 
-			ct, err := p.findIdentityCredentialsType(ctx, cred.Type)
+			ct, err := FindIdentityCredentialsTypeByName(conn, cred.Type)
 			if err != nil {
 				return err
 			}
@@ -371,13 +346,13 @@ func (p *IdentityPersister) createIdentityCredentials(ctx context.Context, conn
 			identifiers = append(identifiers, &identity.CredentialIdentifier{
 				Identifier:                identifier,
 				IdentityCredentialsID:     cred.ID,
-				IdentityCredentialsTypeID: ct.ID,
+				IdentityCredentialsTypeID: ct,
 				NID:                       p.NetworkID(ctx),
 			})
 		}
 	}
 
-	if err = batch.Create(ctx, traceConn, identifiers); err != nil {
+	if err = batch.Create(ctx, traceConn, identifiers, opts...); err != nil {
 		return err
 	}
 
@@ -397,8 +372,12 @@ func (p *IdentityPersister) createVerifiableAddresses(ctx context.Context, conn
 			work = append(work, &id.VerifiableAddresses[i])
 		}
 	}
+	var opts []batch.CreateOpts
+	if len(identities) > 1 {
+		opts = append(opts, batch.WithPartialInserts)
+	}
 
-	return batch.Create(ctx, &batch.TracerConnection{Tracer: p.r.Tracer(ctx), Connection: conn}, work)
+	return batch.Create(ctx, &batch.TracerConnection{Tracer: p.r.Tracer(ctx), Connection: conn}, work, opts...)
 }
 
 func updateAssociation[T interface {
@@ -509,7 +488,12 @@ func (p *IdentityPersister) createRecoveryAddresses(ctx context.Context, conn *p
 		}
 	}
 
-	return batch.Create(ctx, &batch.TracerConnection{Tracer: p.r.Tracer(ctx), Connection: conn}, work)
+	var opts []batch.CreateOpts
+	if len(identities) > 1 {
+		opts = append(opts, batch.WithPartialInserts)
+	}
+
+	return batch.Create(ctx, &batch.TracerConnection{Tracer: p.r.Tracer(ctx), Connection: conn}, work, opts...)
 }
 
 func (p *IdentityPersister) CountIdentities(ctx context.Context) (n int64, err error) {
@@ -538,7 +522,7 @@ func (p *IdentityPersister) CreateIdentity(ctx context.Context, ident *identity.
 func (p *IdentityPersister) CreateIdentities(ctx context.Context, identities ...*identity.Identity) (err error) {
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.CreateIdentities",
 		trace.WithAttributes(
-			attribute.Int("num_identities", len(identities)),
+			attribute.Int("identities.count", len(identities)),
 			attribute.Stringer("network.id", p.NetworkID(ctx))))
 	defer otelx.End(span, &err)
 
@@ -568,12 +552,28 @@ func (p *IdentityPersister) CreateIdentities(ctx context.Context, identities ...
 		}
 	}
 
-	return p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
+	var succeededIDs []uuid.UUID
+
+	defer func() {
+		// Report succeeded identities as created.
+		for _, identID := range succeededIDs {
+			span.AddEvent(events.NewIdentityCreated(ctx, identID))
+		}
+	}()
+
+	var partialErr *identity.CreateIdentitiesError
+	if err := p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
 		conn := &batch.TracerConnection{
 			Tracer:     p.r.Tracer(ctx),
 			Connection: tx,
 		}
 
+		succeededIDs = make([]uuid.UUID, 0, len(identities))
+		failedIdentityIDs := make(map[uuid.UUID]struct{})
+		partialErr = nil
+
+		// Don't use batch.WithPartialInserts, because identities have no other
+		// constraints other than the primary key that could cause conflicts.
 		if err := batch.Create(ctx, conn, identities); err != nil {
 			return sqlcon.HandleError(err)
 		}
@@ -581,16 +581,77 @@ func (p *IdentityPersister) CreateIdentities(ctx context.Context, identities ...
 		p.normalizeAllAddressess(ctx, identities...)
 
 		if err = p.createVerifiableAddresses(ctx, tx, identities...); err != nil {
-			return sqlcon.HandleError(err)
+			if paritalErr := new(batch.PartialConflictError[identity.VerifiableAddress]); errors.As(err, &paritalErr) {
+				for _, k := range paritalErr.Failed {
+					failedIdentityIDs[k.IdentityID] = struct{}{}
+				}
+			} else {
+				return sqlcon.HandleError(err)
+			}
 		}
 		if err = p.createRecoveryAddresses(ctx, tx, identities...); err != nil {
-			return sqlcon.HandleError(err)
+			if paritalErr := new(batch.PartialConflictError[identity.RecoveryAddress]); errors.As(err, &paritalErr) {
+				for _, k := range paritalErr.Failed {
+					failedIdentityIDs[k.IdentityID] = struct{}{}
+				}
+			} else {
+				return sqlcon.HandleError(err)
+			}
 		}
 		if err = p.createIdentityCredentials(ctx, tx, identities...); err != nil {
-			return sqlcon.HandleError(err)
+			if paritalErr := new(batch.PartialConflictError[identity.Credentials]); errors.As(err, &paritalErr) {
+				for _, k := range paritalErr.Failed {
+					failedIdentityIDs[k.IdentityID] = struct{}{}
+				}
+			} else if paritalErr := new(batch.PartialConflictError[identity.CredentialIdentifier]); errors.As(err, &paritalErr) {
+				for _, k := range paritalErr.Failed {
+					credID := k.IdentityCredentialsID
+					for _, ident := range identities {
+						for _, cred := range ident.Credentials {
+							if cred.ID == credID {
+								failedIdentityIDs[ident.ID] = struct{}{}
+							}
+						}
+					}
+				}
+			} else {
+				return sqlcon.HandleError(err)
+			}
 		}
+
+		// If any of the batch inserts failed on conflict, let's delete the corresponding
+		// identities and return a list of failed identities in the error.
+		if len(failedIdentityIDs) > 0 {
+			partialErr = identity.NewCreateIdentitiesError(len(failedIdentityIDs))
+			failedIDs := make([]uuid.UUID, 0, len(failedIdentityIDs))
+
+			for _, ident := range identities {
+				if _, ok := failedIdentityIDs[ident.ID]; ok {
+					partialErr.AddFailedIdentity(ident, sqlcon.ErrUniqueViolation)
+					failedIDs = append(failedIDs, ident.ID)
+				} else {
+					succeededIDs = append(succeededIDs, ident.ID)
+				}
+			}
+			// Manually roll back by deleting the identities that were inserted before the
+			// error occurred.
+			if err := p.DeleteIdentities(ctx, failedIDs); err != nil {
+				return sqlcon.HandleError(err)
+			}
+
+			return nil
+		} else {
+			// No failures: report all identities as created.
+			for _, ident := range identities {
+				succeededIDs = append(succeededIDs, ident.ID)
+			}
+		}
+
 		return nil
-	})
+	}); err != nil {
+		return err
+	}
+	return partialErr.ErrOrNil()
 }
 
 func (p *IdentityPersister) HydrateIdentityAssociations(ctx context.Context, i *identity.Identity, expand identity.Expandables) (err error) {
@@ -600,10 +661,7 @@ func (p *IdentityPersister) HydrateIdentityAssociations(ctx context.Context, i *
 			attribute.Stringer("network.id", p.NetworkID(ctx))))
 	defer otelx.End(span, &err)
 
-	var (
-		con = p.GetConnection(ctx)
-		nid = p.NetworkID(ctx)
-	)
+	nid := p.NetworkID(ctx)
 
 	eg, ctx := errgroup.WithContext(ctx)
 	if expand.Has(identity.ExpandFieldRecoveryAddresses) {
@@ -612,7 +670,7 @@ func (p *IdentityPersister) HydrateIdentityAssociations(ctx context.Context, i *
 			// from complaining incorrectly.
 			//
 			// https://github.com/gobuffalo/pop/issues/723
-			if err := con.WithContext(ctx).
+			if err := p.GetConnection(ctx).WithContext(ctx).
 				Where("identity_id = ? AND nid = ?", i.ID, nid).
 				Order("id ASC").
 				All(&i.RecoveryAddresses); err != nil {
@@ -628,7 +686,7 @@ func (p *IdentityPersister) HydrateIdentityAssociations(ctx context.Context, i *
 			// from complaining incorrectly.
 			//
 			// https://github.com/gobuffalo/pop/issues/723
-			if err := con.WithContext(ctx).
+			if err := p.GetConnection(ctx).WithContext(ctx).
 				Order("id ASC").
 				Where("identity_id = ? AND nid = ?", i.ID, nid).
 				All(&i.VerifiableAddresses); err != nil {
@@ -644,9 +702,9 @@ func (p *IdentityPersister) HydrateIdentityAssociations(ctx context.Context, i *
 			// from complaining incorrectly.
 			//
 			// https://github.com/gobuffalo/pop/issues/723
-			con := con.WithContext(ctx)
-			creds, err := QueryForCredentials(con,
-				Where{"(identity_credentials.identity_id = ? AND identity_credentials.nid = ?)", []interface{}{i.ID, nid}})
+			creds, err := QueryForCredentials(p.GetConnection(ctx).WithContext(ctx),
+				Where{"identity_credentials.identity_id = ?", []interface{}{i.ID}},
+				Where{"identity_credentials.nid = ?", []interface{}{nid}})
 			if err != nil {
 				return err
 			}
@@ -671,16 +729,8 @@ func (p *IdentityPersister) HydrateIdentityAssociations(ctx context.Context, i *
 }
 
 type queryCredentials struct {
-	ID         uuid.UUID                `db:"cred_id"`
-	IdentityID uuid.UUID                `db:"identity_id"`
-	NID        uuid.UUID                `db:"nid"`
-	Type       identity.CredentialsType `db:"cred_type"`
-	TypeID     uuid.UUID                `db:"cred_type_id"`
-	Identifier string                   `db:"cred_identifier"`
-	Config     sqlxx.JSONRawMessage     `db:"cred_config"`
-	Version    int                      `db:"cred_version"`
-	CreatedAt  time.Time                `db:"created_at"`
-	UpdatedAt  time.Time                `db:"updated_at"`
+	Identifier string `db:"cred_identifier"`
+	identity.Credentials
 }
 
 func (queryCredentials) TableName() string {
@@ -694,35 +744,23 @@ type Where struct {
 
 // QueryForCredentials queries for identity credentials with custom WHERE
 // clauses, returning the results resolved by the owning identity's UUID.
-func QueryForCredentials(con *pop.Connection, where ...Where) (map[uuid.UUID](map[identity.CredentialsType]identity.Credentials), error) {
-	ici := "identity_credential_identifiers"
-	switch con.Dialect.Name() {
-	case "cockroach":
-		ici += "@identity_credential_identifiers_nid_identity_credential_id_idx"
-	case "sqlite3":
-		ici += " INDEXED BY identity_credential_identifiers_nid_identity_credential_id_idx"
-	case "mysql":
-		ici += " USE INDEX(identity_credential_identifiers_nid_identity_credential_id_idx)"
-	default:
-		// good luck 🤷‍♂️
-	}
+func QueryForCredentials(con *pop.Connection, where ...Where) (credentialsPerIdentity map[uuid.UUID](map[identity.CredentialsType]identity.Credentials), err error) {
+	// This query has been meticulously crafted to be as fast as possible.
+	// If you touch it, you will likely introduce a performance regression.
 	q := con.Select(
-		"identity_credentials.id cred_id",
-		"identity_credentials.identity_id identity_id",
-		"identity_credentials.nid nid",
-		"ict.name cred_type",
-		"ict.id cred_type_id",
 		"COALESCE(identity_credential_identifiers.identifier, '') cred_identifier",
-		"identity_credentials.config cred_config",
-		"identity_credentials.version cred_version",
-		"identity_credentials.created_at created_at",
-		"identity_credentials.updated_at updated_at",
-	).InnerJoin(
-		"identity_credential_types ict",
-		"(identity_credentials.identity_credential_type_id = ict.id)",
-	).LeftJoin(
-		ici,
+		"identity_credentials.id",
+		"identity_credentials.identity_credential_type_id",
+		"identity_credentials.identity_id",
+		"identity_credentials.nid",
+		"identity_credentials.config",
+		"identity_credentials.version",
+		"identity_credentials.created_at",
+		"identity_credentials.updated_at",
+	).LeftJoin(identifiersTableNameWithIndexHint(con),
 		"identity_credential_identifiers.identity_credential_id = identity_credentials.id AND identity_credential_identifiers.nid = identity_credentials.nid",
+	).Order(
+		"identity_credential_identifiers.identifier ASC",
 	)
 	for _, w := range where {
 		q = q.Where("("+w.Condition+")", w.Args...)
@@ -731,8 +769,16 @@ func QueryForCredentials(con *pop.Connection, where ...Where) (map[uuid.UUID](ma
 	if err := q.All(&results); err != nil {
 		return nil, sqlcon.HandleError(err)
 	}
-	credentialsPerIdentity := map[uuid.UUID](map[identity.CredentialsType]identity.Credentials){}
+
+	// assemble
+	credentialsPerIdentity = map[uuid.UUID](map[identity.CredentialsType]identity.Credentials){}
 	for _, res := range results {
+
+		res.Type, err = FindIdentityCredentialsTypeByID(con, res.IdentityCredentialTypeID)
+		if err != nil {
+			return nil, err
+		}
+
 		credentials, ok := credentialsPerIdentity[res.IdentityID]
 		if !ok {
 			credentialsPerIdentity[res.IdentityID] = make(map[identity.CredentialsType]identity.Credentials)
@@ -745,20 +791,10 @@ func QueryForCredentials(con *pop.Connection, where ...Where) (map[uuid.UUID](ma
 		if identifiers == nil {
 			identifiers = make([]string, 0)
 		}
-		c := identity.Credentials{
-			ID:                       res.ID,
-			IdentityID:               res.IdentityID,
-			NID:                      res.NID,
-			Type:                     res.Type,
-			IdentityCredentialTypeID: res.TypeID,
-			Identifiers:              identifiers,
-			Config:                   res.Config,
-			Version:                  res.Version,
-			CreatedAt:                res.CreatedAt,
-			UpdatedAt:                res.UpdatedAt,
-		}
-		credentials[res.Type] = c
+		res.Identifiers = identifiers
+		credentials[res.Type] = res.Credentials
 	}
+
 	// We need deterministic ordering for testing, but sorting in the
 	// database can be expensive under certain circumstances.
 	for _, creds := range credentialsPerIdentity {
@@ -769,6 +805,21 @@ func QueryForCredentials(con *pop.Connection, where ...Where) (map[uuid.UUID](ma
 	return credentialsPerIdentity, nil
 }
 
+func identifiersTableNameWithIndexHint(con *pop.Connection) string {
+	ici := "identity_credential_identifiers"
+	switch con.Dialect.Name() {
+	case "cockroach":
+		ici += "@identity_credential_identifiers_ici_nid_i_idx"
+	case "sqlite3":
+		ici += " INDEXED BY identity_credential_identifiers_ici_nid_i_idx"
+	case "mysql":
+		ici += " USE INDEX(identity_credential_identifiers_ici_nid_i_idx)"
+	default:
+		// good luck 🤷‍♂️
+	}
+	return ici
+}
+
 func paginationAttributes(params *identity.ListIdentityParameters, paginator *keysetpagination.Paginator) []attribute.KeyValue {
 	attrs := []attribute.KeyValue{
 		attribute.StringSlice("expand", params.Expand.ToEager()),
@@ -787,6 +838,23 @@ func paginationAttributes(params *identity.ListIdentityParameters, paginator *ke
 	return attrs
 }
 
+// getCredentialTypeIDs returns a map of credential types to their respective IDs.
+//
+// If a credential type is not found, an error is returned.
+func (p *IdentityPersister) getCredentialTypeIDs(ctx context.Context, credentialTypes []identity.CredentialsType) (map[identity.CredentialsType]uuid.UUID, error) {
+	result := map[identity.CredentialsType]uuid.UUID{}
+
+	for _, ct := range credentialTypes {
+		typeID, err := FindIdentityCredentialsTypeByName(p.GetConnection(ctx), ct)
+		if err != nil {
+			return nil, err
+		}
+		result[ct] = typeID
+	}
+
+	return result, nil
+}
+
 func (p *IdentityPersister) ListIdentities(ctx context.Context, params identity.ListIdentityParameters) (_ []identity.Identity, nextPage *keysetpagination.Paginator, err error) {
 	paginator := keysetpagination.GetPaginator(append(
 		params.KeySetPagination,
@@ -799,6 +867,10 @@ func (p *IdentityPersister) ListIdentities(ctx context.Context, params identity.
 		attribute.Stringer("network.id", p.NetworkID(ctx)))...))
 	defer otelx.End(span, &err)
 
+	if _, err := uuid.FromString(paginator.Token().Parse("id")["id"]); err != nil {
+		return nil, nil, errors.WithStack(x.PageTokenInvalid)
+	}
+
 	nid := p.NetworkID(ctx)
 	var is []identity.Identity
 
@@ -832,29 +904,47 @@ func (p *IdentityPersister) ListIdentities(ctx context.Context, params identity.
 		}
 
 		if len(identifier) > 0 {
+			types, err := p.getCredentialTypeIDs(ctx, []identity.CredentialsType{
+				identity.CredentialsTypeWebAuthn,
+				identity.CredentialsTypePassword,
+				identity.CredentialsTypeCodeAuth,
+				identity.CredentialsTypeOIDC,
+			})
+			if err != nil {
+				return err
+			}
+
 			// When filtering by credentials identifier, we most likely are looking for a username or email. It is therefore
 			// important to normalize the identifier before querying the database.
 
-			joins = `
-			INNER JOIN identity_credentials ic ON ic.identity_id = identities.id
-			INNER JOIN identity_credential_types ict ON ict.id = ic.identity_credential_type_id
-			INNER JOIN identity_credential_identifiers ici ON ici.identity_credential_id = ic.id`
+			joins = params.TransformStatement(`
+			INNER JOIN identity_credentials ic ON ic.identity_id = identities.id AND ic.nid = identities.nid
+			INNER JOIN identity_credential_identifiers ici ON ici.identity_credential_id = ic.id AND ici.nid = ic.nid
+`)
+
 			wheres += fmt.Sprintf(`
 			AND ic.nid = ? AND ici.nid = ?
-			AND ((ict.name IN (?, ?, ?) AND ici.identifier %s ?)
-              OR (ict.name IN (?) AND ici.identifier %s ?))
+			AND ((ici.identity_credential_type_id IN (?, ?, ?) AND ici.identifier %s ?)
+              OR (ici.identity_credential_type_id IN (?) AND ici.identifier %s ?))
 			`, identifierOperator, identifierOperator)
 			args = append(args,
 				nid, nid,
-				identity.CredentialsTypeWebAuthn, identity.CredentialsTypePassword, identity.CredentialsTypeCodeAuth, NormalizeIdentifier(identity.CredentialsTypePassword, identifier),
-				identity.CredentialsTypeOIDC, identifier)
+				types[identity.CredentialsTypeWebAuthn], types[identity.CredentialsTypePassword], types[identity.CredentialsTypeCodeAuth],
+				NormalizeIdentifier(identity.CredentialsTypePassword, identifier),
+				types[identity.CredentialsTypeOIDC], identifier,
+			)
 		}
 
-		if params.IdsFilter != nil && len(params.IdsFilter) != 0 {
+		if len(params.IdsFilter) > 0 {
 			wheres += `
 				AND identities.id in (?)
 			`
 			args = append(args, params.IdsFilter)
+		} else if !params.OrganizationID.IsNil() {
+			wheres += `
+				AND identities.organization_id = ?
+			`
+			args = append(args, params.OrganizationID.String())
 		}
 
 		query := fmt.Sprintf(`
@@ -890,7 +980,7 @@ func (p *IdentityPersister) ListIdentities(ctx context.Context, params identity.
 			switch e {
 			case identity.ExpandFieldCredentials:
 				creds, err := QueryForCredentials(con,
-					Where{"identity_credentials.nid = ?", []any{nid}},
+					Where{"identity_credentials.nid = ?", []interface{}{nid}},
 					Where{"identity_credentials.identity_id IN (?)", identityIDs})
 				if err != nil {
 					return err
@@ -900,7 +990,7 @@ func (p *IdentityPersister) ListIdentities(ctx context.Context, params identity.
 				}
 			case identity.ExpandFieldVerifiableAddresses:
 				addrs := make([]identity.VerifiableAddress, 0)
-				if err := con.Where("nid = ?", nid).Where("identity_id IN (?)", identityIDs).Order("id").All(&addrs); err != nil {
+				if err := con.Where("identity_id IN (?)", identityIDs).Where("nid = ?", nid).Order("id").All(&addrs); err != nil {
 					return sqlcon.HandleError(err)
 				}
 				for _, addr := range addrs {
@@ -908,7 +998,7 @@ func (p *IdentityPersister) ListIdentities(ctx context.Context, params identity.
 				}
 			case identity.ExpandFieldRecoveryAddresses:
 				addrs := make([]identity.RecoveryAddress, 0)
-				if err := con.Where("nid = ?", nid).Where("identity_id IN (?)", identityIDs).Order("id").All(&addrs); err != nil {
+				if err := con.Where("identity_id IN (?)", identityIDs).Where("nid = ?", nid).Order("id").All(&addrs); err != nil {
 					return sqlcon.HandleError(err)
 				}
 				for _, addr := range addrs {
@@ -949,6 +1039,24 @@ func (p *IdentityPersister) ListIdentities(ctx context.Context, params identity.
 	return is, nextPage, nil
 }
 
+func (p *IdentityPersister) UpdateIdentityColumns(ctx context.Context, i *identity.Identity, columns ...string) (err error) {
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.UpdateIdentity",
+		trace.WithAttributes(
+			attribute.Stringer("identity.id", i.ID),
+			attribute.Stringer("network.id", p.NetworkID(ctx))))
+	defer otelx.End(span, &err)
+
+	if err := p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
+		_, err := tx.Where("id = ? AND nid = ?", i.ID, p.NetworkID(ctx)).UpdateQuery(i, columns...)
+		return sqlcon.HandleError(err)
+	}); err != nil {
+		return err
+	}
+
+	span.AddEvent(events.NewIdentityUpdated(ctx, i.ID))
+	return nil
+}
+
 func (p *IdentityPersister) UpdateIdentity(ctx context.Context, i *identity.Identity) (err error) {
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.UpdateIdentity",
 		trace.WithAttributes(
@@ -961,7 +1069,8 @@ func (p *IdentityPersister) UpdateIdentity(ctx context.Context, i *identity.Iden
 	}
 
 	i.NID = p.NetworkID(ctx)
-	return sqlcon.HandleError(p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
+	i.UpdatedAt = time.Now().UTC().Truncate(time.Microsecond)
+	if err := sqlcon.HandleError(p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
 		// This returns "ErrNoRows" if the identity does not exist
 		if err := update.Generic(WithTransaction(ctx, tx), tx, p.r.Tracer(ctx).Tracer(), i); err != nil {
 			return err
@@ -986,7 +1095,12 @@ func (p *IdentityPersister) UpdateIdentity(ctx context.Context, i *identity.Iden
 		}
 
 		return sqlcon.HandleError(p.createIdentityCredentials(ctx, tx, i))
-	}))
+	})); err != nil {
+		return err
+	}
+
+	span.AddEvent(events.NewIdentityUpdated(ctx, i.ID))
+	return nil
 }
 
 func (p *IdentityPersister) DeleteIdentity(ctx context.Context, id uuid.UUID) (err error) {
@@ -1011,6 +1125,45 @@ func (p *IdentityPersister) DeleteIdentity(ctx context.Context, id uuid.UUID) (e
 	if count == 0 {
 		return errors.WithStack(sqlcon.ErrNoRows)
 	}
+	span.AddEvent(events.NewIdentityDeleted(ctx, id))
+	return nil
+}
+
+func (p *IdentityPersister) DeleteIdentities(ctx context.Context, ids []uuid.UUID) (err error) {
+	stringIDs := make([]string, len(ids))
+	for k, id := range ids {
+		stringIDs[k] = id.String()
+	}
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.DeleteIdentites",
+		trace.WithAttributes(
+			attribute.StringSlice("identity.ids", stringIDs),
+			attribute.Stringer("network.id", p.NetworkID(ctx))))
+	defer otelx.End(span, &err)
+
+	placeholders := strings.TrimSuffix(strings.Repeat("?, ", len(ids)), ", ")
+	args := make([]any, 0, len(ids)+1)
+	for _, id := range ids {
+		args = append(args, id)
+	}
+	args = append(args, p.NetworkID(ctx))
+
+	tableName := new(identity.Identity).TableName(ctx)
+	if p.c.Dialect.Name() == "cockroach" {
+		tableName += "@primary"
+	}
+	count, err := p.GetConnection(ctx).RawQuery(fmt.Sprintf(
+		"DELETE FROM %s WHERE id IN (%s) AND nid = ?",
+		tableName,
+		placeholders,
+	),
+		args...,
+	).ExecWithCount()
+	if err != nil {
+		return sqlcon.HandleError(err)
+	}
+	if count != len(ids) {
+		return errors.WithStack(sqlcon.ErrNoRows)
+	}
 	return nil
 }
 
@@ -1150,3 +1303,64 @@ func (p *IdentityPersister) InjectTraitsSchemaURL(ctx context.Context, i *identi
 	i.SchemaURL = s.SchemaURL(p.r.Config().SelfPublicURL(ctx)).String()
 	return nil
 }
+
+var (
+	credentialTypesID   = x.NewSyncMap[uuid.UUID, identity.CredentialsType]()
+	credentialTypesName = x.NewSyncMap[identity.CredentialsType, uuid.UUID]()
+)
+
+func FindIdentityCredentialsTypeByID(con *pop.Connection, id uuid.UUID) (identity.CredentialsType, error) {
+	result, found := credentialTypesID.Load(id)
+	if !found {
+		if err := loadCredentialTypes(con); err != nil {
+			return "", err
+		}
+
+		result, found = credentialTypesID.Load(id)
+	}
+
+	if !found {
+		return "", errors.WithStack(herodot.ErrInternalServerError.WithReasonf("The SQL adapter failed to return the appropriate credentials_type for id %q. This is a bug in the code.", id))
+	}
+
+	return result, nil
+}
+
+func FindIdentityCredentialsTypeByName(con *pop.Connection, ct identity.CredentialsType) (uuid.UUID, error) {
+	result, found := credentialTypesName.Load(ct)
+	if !found {
+		if err := loadCredentialTypes(con); err != nil {
+			return uuid.Nil, err
+		}
+
+		result, found = credentialTypesName.Load(ct)
+	}
+
+	if !found {
+		return uuid.Nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("The SQL adapter failed to return the appropriate credentials_type for name %q. This is a bug in the code.", ct))
+	}
+
+	return result, nil
+}
+
+var mux sync.Mutex
+
+func loadCredentialTypes(con *pop.Connection) (err error) {
+	ctx, span := trace.SpanFromContext(con.Context()).TracerProvider().Tracer("").Start(con.Context(), "persistence.sql.identity.loadCredentialTypes")
+	defer otelx.End(span, &err)
+	_ = ctx
+
+	mux.Lock()
+	defer mux.Unlock()
+	var tt []identity.CredentialsTypeTable
+	if err := con.WithContext(ctx).All(&tt); err != nil {
+		return sqlcon.HandleError(err)
+	}
+
+	for _, t := range tt {
+		credentialTypesID.Store(t.ID, t.Name)
+		credentialTypesName.Store(t.Name, t.ID)
+	}
+
+	return nil
+}
diff --git a/persistence/sql/migratest/migration_test.go b/persistence/sql/migratest/migration_test.go
index bf727683248b..bafe38c040d6 100644
--- a/persistence/sql/migratest/migration_test.go
+++ b/persistence/sql/migratest/migration_test.go
@@ -422,6 +422,7 @@ func testDatabase(t *testing.T, db string, c *pop.Connection) {
 		})
 	})
 
-	tm.DumpMigrations = false
-	require.NoError(t, tm.Down(ctx, -1))
+	tm.DumpMigrations = false // true for debug
+	err = tm.Down(ctx, -1)    // for easy breakpointing
+	require.NoError(t, err)
 }
diff --git a/persistence/sql/migratest/testdata/20200402142539_testdata.sql b/persistence/sql/migratest/testdata/20200402142539_testdata.sql
index 36781f7a493a..6d67a5358c80 100644
--- a/persistence/sql/migratest/testdata/20200402142539_testdata.sql
+++ b/persistence/sql/migratest/testdata/20200402142539_testdata.sql
@@ -3,13 +3,13 @@ INSERT INTO identities (id, traits_schema_id, traits, created_at, updated_at) VA
 
 INSERT INTO continuity_containers (id, identity_id, name, payload, expires_at, created_at, updated_at) VALUES ('50ba09d3-481b-4060-844a-9541a9cec39c', '5ff66179-c240-4703-b0d8-494592cefff5', 'ory_kratos_settings_profile', '{"traits":{"email":"baz@ory.sh"},"request_id":""}', '2013-10-07 08:23:19', '2013-10-07 08:23:19', '2013-10-07 08:23:19');
 
-INSERT INTO courier_messages (id, type, status, body, subject, recipient, created_at, updated_at) VALUES ('98f45a85-0782-49f1-a7b5-8f83d160b4a5', 1, 2, 'Hi, please verify your account by clicking the following link:
+INSERT INTO courier_messages (id, type, status, body, subject, recipient, created_at, updated_at) VALUES ('98f45a85-0782-49f1-a7b5-8f83d160b4a5', 1, 2, 'Hi, Verify your account by opening the following link:
 
 <a href="http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/swmcFweNFSfvTSTKecmZjO6I8x0hxzZS">http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/swmcFweNFSfvTSTKecmZjO6I8x0hxzZS</a>', 'Please verify your email address', 'foo@ory.sh', '2013-10-07 08:23:19', '2013-10-07 08:23:19');
 
-INSERT INTO courier_messages (id, type, status, body, subject, recipient, created_at, updated_at) VALUES ('7a9d6df4-3b60-4cae-996e-d15d78b0fc36', 1, 2, 'Hi, please verify your account by clicking the following link: <a href="http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/u9ZcBr5HbRTR8f53Qj2Ng3KR8Mv1Zjdb">http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/u9ZcBr5HbRTR8f53Qj2Ng3KR8Mv1Zjdb</a>', 'Please verify your email address', 'foobar@ory.sh', '2013-10-07 08:23:19', '2013-10-07 08:23:19');
-INSERT INTO courier_messages (id, type, status, body, subject, recipient, created_at, updated_at) VALUES ('77fdc5e0-2260-49da-8aae-c36ba255d05b', 1, 2, 'Hi, please verify your account by clicking the following link: <a href="http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/SQcSX0Jx6IVEDKqAuaLZLNEw00J4vlig">http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/SQcSX0Jx6IVEDKqAuaLZLNEw00J4vlig</a>', 'Please verify your email address', 'foobar@ory.sh', '2013-10-07 08:23:19', '2013-10-07 08:23:19');
-INSERT INTO courier_messages (id, type, status, body, subject, recipient, created_at, updated_at) VALUES ('a3ea4c30-0c6e-47b1-99ba-8fa69282e166', 1, 2, 'Hi, please verify your account by clicking the following link: <a href="http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/AtsREGbtXu0RlIcwv3RPpxHEZNEcq3R9">http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/AtsREGbtXu0RlIcwv3RPpxHEZNEcq3R9</a>', 'Please verify your email address', 'foo@ory.sh', '2013-10-07 08:23:19', '2013-10-07 08:23:19');
+INSERT INTO courier_messages (id, type, status, body, subject, recipient, created_at, updated_at) VALUES ('7a9d6df4-3b60-4cae-996e-d15d78b0fc36', 1, 2, 'Hi, Verify your account by opening the following link: <a href="http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/u9ZcBr5HbRTR8f53Qj2Ng3KR8Mv1Zjdb">http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/u9ZcBr5HbRTR8f53Qj2Ng3KR8Mv1Zjdb</a>', 'Please verify your email address', 'foobar@ory.sh', '2013-10-07 08:23:19', '2013-10-07 08:23:19');
+INSERT INTO courier_messages (id, type, status, body, subject, recipient, created_at, updated_at) VALUES ('77fdc5e0-2260-49da-8aae-c36ba255d05b', 1, 2, 'Hi, Verify your account by opening the following link: <a href="http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/SQcSX0Jx6IVEDKqAuaLZLNEw00J4vlig">http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/SQcSX0Jx6IVEDKqAuaLZLNEw00J4vlig</a>', 'Please verify your email address', 'foobar@ory.sh', '2013-10-07 08:23:19', '2013-10-07 08:23:19');
+INSERT INTO courier_messages (id, type, status, body, subject, recipient, created_at, updated_at) VALUES ('a3ea4c30-0c6e-47b1-99ba-8fa69282e166', 1, 2, 'Hi, Verify your account by opening the following link: <a href="http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/AtsREGbtXu0RlIcwv3RPpxHEZNEcq3R9">http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/AtsREGbtXu0RlIcwv3RPpxHEZNEcq3R9</a>', 'Please verify your email address', 'foo@ory.sh', '2013-10-07 08:23:19', '2013-10-07 08:23:19');
 
 INSERT INTO identity_credential_types (id, name) VALUES ('22bff9ae-f5aa-45d7-803b-97ec0b4e7b32', 'password');
 INSERT INTO identity_credential_types (id, name) VALUES ('8071b37b-0d54-4c6f-8234-72cffb4ce784', 'totp');
diff --git a/persistence/sql/migratest/testdata/20210307130558_testdata.sql b/persistence/sql/migratest/testdata/20210307130558_testdata.sql
index e92788541f35..b256c62cb945 100644
--- a/persistence/sql/migratest/testdata/20210307130558_testdata.sql
+++ b/persistence/sql/migratest/testdata/20210307130558_testdata.sql
@@ -1 +1 @@
-INSERT INTO courier_messages (id, type, status, body, subject, recipient, created_at, updated_at) VALUES ('34948489-31dc-454a-ab3b-b2dcc75a787f', 1, 2, 'Hi, please verify your account by clicking the following link: <a href="http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/AtsREGbtXu0RlIcwv3RPpxHEZNEcq3R9">http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/AtsREGbtXu0RlIcwv3RPpxHEZNEcq3R9</a>', 'Please verify your email address', 'foo@ory.sh', '2013-10-07 08:23:19', '2013-10-07 08:23:19');
+INSERT INTO courier_messages (id, type, status, body, subject, recipient, created_at, updated_at) VALUES ('34948489-31dc-454a-ab3b-b2dcc75a787f', 1, 2, 'Hi, Verify your account by opening the following link: <a href="http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/AtsREGbtXu0RlIcwv3RPpxHEZNEcq3R9">http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/AtsREGbtXu0RlIcwv3RPpxHEZNEcq3R9</a>', 'Please verify your email address', 'foo@ory.sh', '2013-10-07 08:23:19', '2013-10-07 08:23:19');
diff --git a/persistence/sql/migratest/testdata/20221205095201_testdata.sql b/persistence/sql/migratest/testdata/20221205095201_testdata.sql
index de20fc952a73..fee47fdd5e8d 100644
--- a/persistence/sql/migratest/testdata/20221205095201_testdata.sql
+++ b/persistence/sql/migratest/testdata/20221205095201_testdata.sql
@@ -17,7 +17,7 @@ VALUES
         'd9d4401c-08a1-434c-8ab5-4a7edefde351',
         1,
         2,
-        'Hi, please verify your account by clicking the following link: <a href=http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/u9ZcBr5HbRTR8f53Qj2Ng3KR8Mv1Zjdb>http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/u9ZcBr5HbRTR8f53Qj2Ng3KR8Mv1Zjdb</a>',
+        'Hi, Verify your account by opening the following link: <a href=http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/u9ZcBr5HbRTR8f53Qj2Ng3KR8Mv1Zjdb>http://127.0.0.1:4455/.ory/kratos/public/self-service/browser/flows/verification/email/confirm/u9ZcBr5HbRTR8f53Qj2Ng3KR8Mv1Zjdb</a>',
         'Please verify your email address',
         'foobar@ory.sh',
         '2013-10-07 08:23:19',
@@ -38,4 +38,4 @@ VALUES
         '884f556e-eb3a-4b9f-bee3-11345642c6c0',
         '2013-10-07 08:23:19',
         '2013-10-07 08:23:19'
-    )
\ No newline at end of file
+    )
diff --git a/persistence/sql/migrations/sql/20240923095000000001_organization_id_index.down.sql b/persistence/sql/migrations/sql/20240923095000000001_organization_id_index.down.sql
new file mode 100644
index 000000000000..cca461b9eeab
--- /dev/null
+++ b/persistence/sql/migrations/sql/20240923095000000001_organization_id_index.down.sql
@@ -0,0 +1 @@
+DROP INDEX identities_nid_organization_id_idx;
\ No newline at end of file
diff --git a/persistence/sql/migrations/sql/20240923095000000001_organization_id_index.mysql.down.sql b/persistence/sql/migrations/sql/20240923095000000001_organization_id_index.mysql.down.sql
new file mode 100644
index 000000000000..c2fbff7ff081
--- /dev/null
+++ b/persistence/sql/migrations/sql/20240923095000000001_organization_id_index.mysql.down.sql
@@ -0,0 +1 @@
+DROP INDEX identities_nid_organization_id_idx ON identities;
diff --git a/persistence/sql/migrations/sql/20240923095000000001_organization_id_index.up.sql b/persistence/sql/migrations/sql/20240923095000000001_organization_id_index.up.sql
new file mode 100644
index 000000000000..10a84cb55cd7
--- /dev/null
+++ b/persistence/sql/migrations/sql/20240923095000000001_organization_id_index.up.sql
@@ -0,0 +1 @@
+CREATE INDEX identities_nid_organization_id_idx ON identities (organization_id);
diff --git a/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.down.sql b/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.down.sql
new file mode 100644
index 000000000000..2c71ddb0abac
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.down.sql
@@ -0,0 +1,6 @@
+CREATE INDEX IF NOT EXISTS identity_credentials_id_nid_idx ON identity_credentials (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS identity_credentials_nid_id_idx ON identity_credentials (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS identity_credentials_nid_identity_id_idx ON identity_credentials (identity_id ASC, nid ASC);
+
+DROP INDEX IF EXISTS identity_credentials_identity_id_idx;
+DROP INDEX IF EXISTS identity_credentials_nid_idx;
diff --git a/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.mysql.down.sql b/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.mysql.down.sql
new file mode 100644
index 000000000000..b86304241b16
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.mysql.down.sql
@@ -0,0 +1,4 @@
+CREATE INDEX identity_credentials_id_nid_idx ON identity_credentials (id ASC, nid ASC);
+CREATE INDEX identity_credentials_nid_id_idx ON identity_credentials (nid ASC, id ASC);
+
+DROP INDEX identity_credentials_nid_idx ON identity_credentials;
diff --git a/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.mysql.up.sql b/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.mysql.up.sql
new file mode 100644
index 000000000000..d53879b3f058
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.mysql.up.sql
@@ -0,0 +1,5 @@
+CREATE INDEX identity_credentials_nid_idx ON identity_credentials (nid ASC);
+
+DROP INDEX identity_credentials_id_nid_idx ON identity_credentials;
+DROP INDEX identity_credentials_nid_id_idx ON identity_credentials;
+
diff --git a/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.up.sql b/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.up.sql
new file mode 100644
index 000000000000..c360d9aa24a1
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000001_drop_unused_indices_identity_credentials.up.sql
@@ -0,0 +1,6 @@
+CREATE INDEX IF NOT EXISTS identity_credentials_identity_id_idx ON identity_credentials (identity_id ASC);
+CREATE INDEX IF NOT EXISTS identity_credentials_nid_idx ON identity_credentials (nid ASC);
+
+DROP INDEX IF EXISTS identity_credentials_id_nid_idx;
+DROP INDEX IF EXISTS identity_credentials_nid_id_idx;
+DROP INDEX IF EXISTS identity_credentials_nid_identity_id_idx;
diff --git a/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.down.sql b/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.down.sql
new file mode 100644
index 000000000000..3514f4bb5bd1
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.down.sql
@@ -0,0 +1,9 @@
+CREATE INDEX IF NOT EXISTS sessions_nid_id_identity_id_idx ON sessions(nid ASC, identity_id ASC, id ASC);
+CREATE INDEX IF NOT EXISTS sessions_id_nid_idx ON sessions(id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS sessions_token_nid_idx ON sessions(nid ASC, token ASC);
+CREATE INDEX IF NOT EXISTS sessions_identity_id_nid_sorted_idx ON sessions(identity_id ASC, nid ASC, authenticated_at DESC);
+CREATE INDEX IF NOT EXISTS sessions_nid_created_at_id_idx ON sessions(nid ASC, created_at DESC, id ASC);
+
+DROP INDEX IF EXISTS sessions_list_idx;
+DROP INDEX IF EXISTS sessions_list_active_idx;
+DROP INDEX IF EXISTS sessions_list_identity_idx;
diff --git a/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.mysql.down.sql b/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.mysql.down.sql
new file mode 100644
index 000000000000..357de26c4957
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.mysql.down.sql
@@ -0,0 +1,9 @@
+CREATE INDEX sessions_nid_id_identity_id_idx ON sessions(nid ASC, identity_id ASC, id ASC);
+CREATE INDEX sessions_id_nid_idx ON sessions(id ASC, nid ASC);
+CREATE INDEX sessions_token_nid_idx ON sessions(nid ASC, token ASC);
+CREATE INDEX sessions_identity_id_nid_sorted_idx ON sessions(identity_id ASC, nid ASC, authenticated_at DESC);
+CREATE INDEX sessions_nid_created_at_id_idx ON sessions(nid ASC, created_at DESC, id ASC);
+
+DROP INDEX sessions_list_idx ON sessions;
+DROP INDEX sessions_list_active_idx ON sessions;
+DROP INDEX sessions_list_identity_idx ON sessions;
diff --git a/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.mysql.up.sql b/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.mysql.up.sql
new file mode 100644
index 000000000000..fecfd833afcb
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.mysql.up.sql
@@ -0,0 +1,9 @@
+CREATE INDEX sessions_list_idx ON sessions (nid ASC, created_at DESC, id ASC);
+CREATE INDEX sessions_list_active_idx ON sessions (nid ASC, expires_at ASC, active ASC, created_at DESC, id ASC);
+CREATE INDEX sessions_list_identity_idx ON sessions (identity_id ASC, nid ASC, created_at DESC);
+
+DROP INDEX sessions_nid_id_identity_id_idx ON sessions;
+DROP INDEX sessions_id_nid_idx ON sessions;
+DROP INDEX sessions_token_nid_idx ON sessions;
+DROP INDEX sessions_identity_id_nid_sorted_idx ON sessions;
+DROP INDEX sessions_nid_created_at_id_idx ON sessions;
diff --git a/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.up.sql b/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.up.sql
new file mode 100644
index 000000000000..cd5122959f80
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000002_drop_unused_indices_sessions.up.sql
@@ -0,0 +1,9 @@
+CREATE INDEX IF NOT EXISTS sessions_list_idx ON sessions (nid ASC, created_at DESC, id ASC);
+CREATE INDEX IF NOT EXISTS sessions_list_active_idx ON sessions (nid ASC, expires_at ASC, active ASC, created_at DESC, id ASC);
+CREATE INDEX IF NOT EXISTS sessions_list_identity_idx ON sessions (identity_id ASC, nid ASC, created_at DESC);
+
+DROP INDEX IF EXISTS sessions_nid_id_identity_id_idx;
+DROP INDEX IF EXISTS sessions_id_nid_idx;
+DROP INDEX IF EXISTS sessions_token_nid_idx;
+DROP INDEX IF EXISTS sessions_identity_id_nid_sorted_idx;
+DROP INDEX IF EXISTS sessions_nid_created_at_id_idx;
diff --git a/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.cockroach.down.sql b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.cockroach.down.sql
new file mode 100644
index 000000000000..696d0027da57
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.cockroach.down.sql
@@ -0,0 +1,11 @@
+-- THIS IS COCKROACH ONLY
+ALTER INDEX identity_credential_identifiers_identifier_nid_type_uq_idx RENAME TO identity_credential_identifiers_identifier_nid_type_uq_idx_deleteme;
+CREATE UNIQUE INDEX IF NOT EXISTS identity_credential_identifiers_identifier_nid_type_uq_idx ON identity_credential_identifiers(nid ASC, identity_credential_type_id ASC, identifier ASC);
+DROP INDEX IF EXISTS identity_credential_identifiers_identifier_nid_type_uq_idx_deleteme;
+--
+
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_nid_id_idx ON identity_credential_identifiers (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_id_nid_idx ON identity_credential_identifiers (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_nid_identity_credential_id_idx ON identity_credential_identifiers (identity_credential_id ASC, nid ASC);
+
+DROP INDEX IF EXISTS identity_credential_identifiers_identity_credential_id_idx;
diff --git a/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.cockroach.up.sql b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.cockroach.up.sql
new file mode 100644
index 000000000000..b03363cbe982
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.cockroach.up.sql
@@ -0,0 +1,11 @@
+-- THIS IS COCKROACH ONLY
+ALTER INDEX identity_credential_identifiers_identifier_nid_type_uq_idx RENAME TO identity_credential_identifiers_identifier_nid_type_uq_idx_deleteme;
+CREATE UNIQUE INDEX IF NOT EXISTS identity_credential_identifiers_identifier_nid_type_uq_idx ON identity_credential_identifiers (nid ASC, identity_credential_type_id ASC, identifier ASC) STORING (identity_credential_id);
+DROP INDEX IF EXISTS identity_credential_identifiers_identifier_nid_type_uq_idx_deleteme;
+--
+
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_identity_credential_id_idx ON identity_credential_identifiers (identity_credential_id ASC);
+
+DROP INDEX IF EXISTS identity_credential_identifiers_nid_id_idx;
+DROP INDEX IF EXISTS identity_credential_identifiers_id_nid_idx;
+DROP INDEX IF EXISTS identity_credential_identifiers_nid_identity_credential_id_idx;
diff --git a/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.down.sql b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.down.sql
new file mode 100644
index 000000000000..dd899bc7cf3f
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.down.sql
@@ -0,0 +1,5 @@
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_nid_id_idx ON identity_credential_identifiers (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_id_nid_idx ON identity_credential_identifiers (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_nid_identity_credential_id_idx ON identity_credential_identifiers (identity_credential_id ASC, nid ASC);
+
+DROP INDEX IF EXISTS identity_credential_identifiers_identity_credential_id_idx;
diff --git a/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.mysql.down.sql b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.mysql.down.sql
new file mode 100644
index 000000000000..53fcfae91bbc
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.mysql.down.sql
@@ -0,0 +1,5 @@
+CREATE INDEX identity_credential_identifiers_nid_id_idx ON identity_credential_identifiers (nid ASC, id ASC);
+CREATE INDEX identity_credential_identifiers_id_nid_idx ON identity_credential_identifiers (id ASC, nid ASC);
+CREATE INDEX identity_credential_identifiers_nid_identity_credential_id_idx ON identity_credential_identifiers (identity_credential_id ASC, nid ASC);
+
+DROP INDEX identity_credential_identifiers_identity_credential_id_idx ON identity_credential_identifiers;
diff --git a/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.mysql.up.sql b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.mysql.up.sql
new file mode 100644
index 000000000000..9cbfb64b6375
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.mysql.up.sql
@@ -0,0 +1,5 @@
+CREATE INDEX identity_credential_identifiers_identity_credential_id_idx ON identity_credential_identifiers (identity_credential_id ASC);
+
+DROP INDEX identity_credential_identifiers_nid_id_idx ON identity_credential_identifiers;
+DROP INDEX identity_credential_identifiers_id_nid_idx ON identity_credential_identifiers;
+DROP INDEX identity_credential_identifiers_nid_identity_credential_id_idx ON identity_credential_identifiers;
diff --git a/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.up.sql b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.up.sql
new file mode 100644
index 000000000000..9841ea69404e
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241023142500000003_drop_unused_indices_credential_identifiers.up.sql
@@ -0,0 +1,5 @@
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_identity_credential_id_idx ON identity_credential_identifiers (identity_credential_id ASC);
+
+DROP INDEX IF EXISTS identity_credential_identifiers_nid_id_idx;
+DROP INDEX IF EXISTS identity_credential_identifiers_id_nid_idx;
+DROP INDEX IF EXISTS identity_credential_identifiers_nid_identity_credential_id_idx;
diff --git a/persistence/sql/migrations/sql/20241029102200000001_self_service.down.sql b/persistence/sql/migrations/sql/20241029102200000001_self_service.down.sql
new file mode 100644
index 000000000000..9ca6f56a49c0
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241029102200000001_self_service.down.sql
@@ -0,0 +1,26 @@
+CREATE INDEX IF NOT EXISTS selfservice_login_flows_nid_id_idx ON selfservice_login_flows (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS selfservice_login_flows_id_nid_idx ON selfservice_login_flows (id ASC, nid ASC);
+DROP INDEX IF EXISTS selfservice_login_flows_nid_idx;
+
+CREATE INDEX IF NOT EXISTS selfservice_errors_errors_nid_id_idx ON selfservice_errors (nid ASC, id ASC);
+DROP INDEX IF EXISTS selfservice_errors_nid_idx;
+
+CREATE INDEX IF NOT EXISTS selfservice_recovery_flows_nid_id_idx ON selfservice_recovery_flows (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS selfservice_recovery_flows_id_nid_idx ON selfservice_recovery_flows (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS selfservice_recovery_flows_recovered_identity_id_nid_idx ON selfservice_recovery_flows (recovered_identity_id ASC, nid ASC);
+DROP INDEX IF EXISTS selfservice_recovery_flows_nid_idx;
+DROP INDEX IF EXISTS selfservice_recovery_flows_recovered_identity_id_idx;
+
+CREATE INDEX IF NOT EXISTS selfservice_registration_flows_nid_id_idx ON selfservice_registration_flows (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS selfservice_registration_flows_id_nid_idx ON selfservice_registration_flows (id ASC, nid ASC);
+DROP INDEX IF EXISTS selfservice_registration_flows_nid_idx;
+
+CREATE INDEX IF NOT EXISTS selfservice_settings_flows_nid_id_idx ON selfservice_settings_flows (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS selfservice_settings_flows_id_nid_idx ON selfservice_settings_flows (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS selfservice_settings_flows_identity_id_nid_idx ON selfservice_settings_flows (identity_id ASC, nid ASC);
+DROP INDEX IF EXISTS selfservice_settings_flows_nid_idx;
+DROP INDEX IF EXISTS selfservice_settings_flows_identity_id_idx;
+
+CREATE INDEX IF NOT EXISTS selfservice_verification_flows_nid_id_idx ON selfservice_verification_flows (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS selfservice_verification_flows_id_nid_idx ON selfservice_verification_flows (id ASC, nid ASC);
+DROP INDEX IF EXISTS selfservice_verification_flows_nid_idx;
diff --git a/persistence/sql/migrations/sql/20241029102200000001_self_service.mysql.down.sql b/persistence/sql/migrations/sql/20241029102200000001_self_service.mysql.down.sql
new file mode 100644
index 000000000000..0d669e21fe52
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241029102200000001_self_service.mysql.down.sql
@@ -0,0 +1,26 @@
+CREATE INDEX selfservice_login_flows_nid_id_idx ON selfservice_login_flows (nid ASC, id ASC);
+CREATE INDEX selfservice_login_flows_id_nid_idx ON selfservice_login_flows (id ASC, nid ASC);
+DROP INDEX selfservice_login_flows_nid_idx ON selfservice_login_flows;
+
+CREATE INDEX selfservice_errors_errors_nid_id_idx ON selfservice_errors (nid ASC, id ASC);
+DROP INDEX selfservice_errors_nid_idx ON selfservice_errors;
+
+CREATE INDEX selfservice_recovery_flows_nid_id_idx ON selfservice_recovery_flows (nid ASC, id ASC);
+CREATE INDEX selfservice_recovery_flows_id_nid_idx ON selfservice_recovery_flows (id ASC, nid ASC);
+CREATE INDEX selfservice_recovery_flows_recovered_identity_id_nid_idx ON selfservice_recovery_flows (recovered_identity_id ASC, nid ASC);
+DROP INDEX selfservice_recovery_flows_nid_idx ON selfservice_recovery_flows;
+DROP INDEX selfservice_recovery_flows_recovered_identity_id_idx ON selfservice_recovery_flows;
+
+CREATE INDEX selfservice_registration_flows_nid_id_idx ON selfservice_registration_flows (nid ASC, id ASC);
+CREATE INDEX selfservice_registration_flows_id_nid_idx ON selfservice_registration_flows (id ASC, nid ASC);
+DROP INDEX selfservice_registration_flows_nid_idx ON selfservice_registration_flows;
+
+CREATE INDEX selfservice_settings_flows_nid_id_idx ON selfservice_settings_flows (nid ASC, id ASC);
+CREATE INDEX selfservice_settings_flows_id_nid_idx ON selfservice_settings_flows (id ASC, nid ASC);
+CREATE INDEX selfservice_settings_flows_identity_id_nid_idx ON selfservice_settings_flows (identity_id ASC, nid ASC);
+DROP INDEX selfservice_settings_flows_nid_idx ON selfservice_settings_flows;
+DROP INDEX selfservice_settings_flows_identity_id_idx ON selfservice_settings_flows;
+
+CREATE INDEX selfservice_verification_flows_nid_id_idx ON selfservice_verification_flows (nid ASC, id ASC);
+CREATE INDEX selfservice_verification_flows_id_nid_idx ON selfservice_verification_flows (id ASC, nid ASC);
+DROP INDEX selfservice_verification_flows_nid_idx ON selfservice_verification_flows;
diff --git a/persistence/sql/migrations/sql/20241029102200000001_self_service.mysql.up.sql b/persistence/sql/migrations/sql/20241029102200000001_self_service.mysql.up.sql
new file mode 100644
index 000000000000..678658c48e05
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241029102200000001_self_service.mysql.up.sql
@@ -0,0 +1,26 @@
+CREATE INDEX selfservice_login_flows_nid_idx ON selfservice_login_flows (nid ASC);
+DROP INDEX selfservice_login_flows_nid_id_idx ON selfservice_login_flows;
+DROP INDEX selfservice_login_flows_id_nid_idx ON selfservice_login_flows;
+
+CREATE INDEX selfservice_errors_nid_idx ON selfservice_errors (nid ASC);
+DROP INDEX selfservice_errors_errors_nid_id_idx ON selfservice_errors;
+
+CREATE INDEX selfservice_recovery_flows_nid_idx ON selfservice_recovery_flows (nid ASC);
+CREATE INDEX selfservice_recovery_flows_recovered_identity_id_idx ON selfservice_recovery_flows (recovered_identity_id ASC);
+DROP INDEX selfservice_recovery_flows_nid_id_idx ON selfservice_recovery_flows;
+DROP INDEX selfservice_recovery_flows_id_nid_idx ON selfservice_recovery_flows;
+DROP INDEX selfservice_recovery_flows_recovered_identity_id_nid_idx ON selfservice_recovery_flows;
+
+CREATE INDEX selfservice_registration_flows_nid_idx ON selfservice_registration_flows (nid ASC);
+DROP INDEX selfservice_registration_flows_nid_id_idx ON selfservice_registration_flows;
+DROP INDEX selfservice_registration_flows_id_nid_idx ON selfservice_registration_flows;
+
+CREATE INDEX selfservice_settings_flows_nid_idx ON selfservice_settings_flows (nid ASC);
+CREATE INDEX selfservice_settings_flows_identity_id_idx ON selfservice_settings_flows (identity_id ASC);
+DROP INDEX selfservice_settings_flows_nid_id_idx ON selfservice_settings_flows;
+DROP INDEX selfservice_settings_flows_id_nid_idx ON selfservice_settings_flows;
+DROP INDEX selfservice_settings_flows_identity_id_nid_idx ON selfservice_settings_flows;
+
+CREATE INDEX selfservice_verification_flows_nid_idx ON selfservice_verification_flows (nid ASC);
+DROP INDEX selfservice_verification_flows_nid_id_idx ON selfservice_verification_flows;
+DROP INDEX selfservice_verification_flows_id_nid_idx ON selfservice_verification_flows;
diff --git a/persistence/sql/migrations/sql/20241029102200000001_self_service.up.sql b/persistence/sql/migrations/sql/20241029102200000001_self_service.up.sql
new file mode 100644
index 000000000000..e40ce8dd8808
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241029102200000001_self_service.up.sql
@@ -0,0 +1,26 @@
+CREATE INDEX IF NOT EXISTS selfservice_login_flows_nid_idx ON selfservice_login_flows (nid ASC);
+DROP INDEX IF EXISTS selfservice_login_flows_nid_id_idx;
+DROP INDEX IF EXISTS selfservice_login_flows_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS selfservice_errors_nid_idx ON selfservice_errors (nid ASC);
+DROP INDEX IF EXISTS selfservice_errors_errors_nid_id_idx;
+
+CREATE INDEX IF NOT EXISTS selfservice_recovery_flows_recovered_identity_id_idx ON selfservice_recovery_flows (recovered_identity_id ASC);
+CREATE INDEX IF NOT EXISTS selfservice_recovery_flows_nid_idx ON selfservice_recovery_flows (nid ASC);
+DROP INDEX IF EXISTS selfservice_recovery_flows_nid_id_idx;
+DROP INDEX IF EXISTS selfservice_recovery_flows_id_nid_idx;
+DROP INDEX IF EXISTS selfservice_recovery_flows_recovered_identity_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS selfservice_registration_flows_nid_idx ON selfservice_registration_flows (nid ASC);
+DROP INDEX IF EXISTS selfservice_registration_flows_nid_id_idx;
+DROP INDEX IF EXISTS selfservice_registration_flows_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS selfservice_settings_flows_nid_idx ON selfservice_settings_flows (nid ASC);
+CREATE INDEX IF NOT EXISTS selfservice_settings_flows_identity_id_idx ON selfservice_settings_flows (identity_id ASC);
+DROP INDEX IF EXISTS selfservice_settings_flows_nid_id_idx;
+DROP INDEX IF EXISTS selfservice_settings_flows_id_nid_idx;
+DROP INDEX IF EXISTS selfservice_settings_flows_identity_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS selfservice_verification_flows_nid_idx ON selfservice_verification_flows (nid ASC);
+DROP INDEX IF EXISTS selfservice_verification_flows_nid_id_idx;
+DROP INDEX IF EXISTS selfservice_verification_flows_id_nid_idx;
diff --git a/persistence/sql/migrations/sql/20241029153900000001_identities.autocommit.down.sql b/persistence/sql/migrations/sql/20241029153900000001_identities.autocommit.down.sql
new file mode 100644
index 000000000000..eea887f40899
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241029153900000001_identities.autocommit.down.sql
@@ -0,0 +1,13 @@
+CREATE INDEX IF NOT EXISTS identities_id_nid_idx ON identities (id ASC, nid ASC);
+
+CREATE INDEX IF NOT EXISTS identity_recovery_addresses_status_via_idx ON identity_recovery_addresses (nid ASC, via ASC, value ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_addresses_nid_identity_id_idx ON identity_recovery_addresses (identity_id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_addresses_nid_id_idx ON identity_recovery_addresses (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_addresses_id_nid_idx ON identity_recovery_addresses (id ASC, nid ASC);
+DROP INDEX IF EXISTS identity_recovery_addresses_identity_id_idx;
+
+CREATE INDEX IF NOT EXISTS identity_verifiable_addresses_status_via_idx ON identity_verifiable_addresses (nid ASC, via ASC, value ASC);
+CREATE INDEX IF NOT EXISTS identity_verifiable_addresses_nid_identity_id_idx ON identity_verifiable_addresses (identity_id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS identity_verifiable_addresses_nid_id_idx ON identity_verifiable_addresses (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS identity_verifiable_addresses_id_nid_idx ON identity_verifiable_addresses (id ASC, nid ASC);
+DROP INDEX IF EXISTS identity_verifiable_addresses_identity_id_idx;
diff --git a/persistence/sql/migrations/sql/20241029153900000001_identities.autocommit.up.sql b/persistence/sql/migrations/sql/20241029153900000001_identities.autocommit.up.sql
new file mode 100644
index 000000000000..faea35148340
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241029153900000001_identities.autocommit.up.sql
@@ -0,0 +1,13 @@
+DROP INDEX IF EXISTS  identities_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_recovery_addresses_identity_id_idx ON identity_recovery_addresses(identity_id ASC);
+DROP INDEX IF EXISTS identity_recovery_addresses_status_via_idx;
+DROP INDEX IF EXISTS identity_recovery_addresses_nid_identity_id_idx;
+DROP INDEX IF EXISTS identity_recovery_addresses_nid_id_idx;
+DROP INDEX IF EXISTS identity_recovery_addresses_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_verifiable_addresses_identity_id_idx ON identity_verifiable_addresses (identity_id ASC);
+DROP INDEX IF EXISTS identity_verifiable_addresses_status_via_idx;
+DROP INDEX IF EXISTS identity_verifiable_addresses_nid_identity_id_idx;
+DROP INDEX IF EXISTS identity_verifiable_addresses_nid_id_idx;
+DROP INDEX IF EXISTS identity_verifiable_addresses_id_nid_idx;
diff --git a/persistence/sql/migrations/sql/20241029153900000001_identities.mysql.down.sql b/persistence/sql/migrations/sql/20241029153900000001_identities.mysql.down.sql
new file mode 100644
index 000000000000..83a531c1e0ec
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241029153900000001_identities.mysql.down.sql
@@ -0,0 +1,17 @@
+CREATE INDEX identities_id_nid_idx ON identities (id ASC, nid ASC);
+
+CREATE INDEX identity_recovery_addresses_status_via_idx ON identity_recovery_addresses (nid ASC, via ASC, value ASC);
+-- While this index did not exist in the past, it is needed in MySQL for foreign key relations. We accept
+-- that this index is "unaccounted" for if we execute down and then up migrations on MySQL.
+CREATE INDEX identity_recovery_addresses_identity_id_fk_idx ON identity_recovery_addresses (identity_id ASC);
+CREATE INDEX identity_recovery_addresses_nid_id_idx ON identity_recovery_addresses (nid ASC, id ASC);
+CREATE INDEX identity_recovery_addresses_id_nid_idx ON identity_recovery_addresses (id ASC, nid ASC);
+DROP INDEX identity_recovery_addresses_identity_id_idx ON identity_recovery_addresses;
+
+CREATE INDEX identity_verifiable_addresses_status_via_idx ON identity_verifiable_addresses (nid ASC, via ASC, value ASC);
+-- While this index did not exist in the past, it is needed in MySQL for foreign key relations. We accept
+-- that this index is "unaccounted" for if we execute down and then up migrations on MySQL.
+CREATE INDEX identity_verifiable_addresses_identity_id_fk_idx ON identity_verifiable_addresses (identity_id ASC);
+CREATE INDEX identity_verifiable_addresses_nid_id_idx ON identity_verifiable_addresses (nid ASC, id ASC);
+CREATE INDEX identity_verifiable_addresses_id_nid_idx ON identity_verifiable_addresses (id ASC, nid ASC);
+DROP INDEX identity_verifiable_addresses_identity_id_idx ON identity_verifiable_addresses;
diff --git a/persistence/sql/migrations/sql/20241029153900000001_identities.mysql.up.sql b/persistence/sql/migrations/sql/20241029153900000001_identities.mysql.up.sql
new file mode 100644
index 000000000000..8d2ce70d220a
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241029153900000001_identities.mysql.up.sql
@@ -0,0 +1,13 @@
+DROP INDEX identities_id_nid_idx ON identities;
+
+CREATE INDEX identity_recovery_addresses_identity_id_idx ON identity_recovery_addresses (identity_id ASC);
+DROP INDEX identity_recovery_addresses_status_via_idx ON identity_recovery_addresses;
+-- DROP INDEX identity_recovery_addresses_nid_identity_id_idx ON identity_recovery_addresses;
+DROP INDEX identity_recovery_addresses_nid_id_idx ON identity_recovery_addresses;
+DROP INDEX identity_recovery_addresses_id_nid_idx ON identity_recovery_addresses;
+
+CREATE INDEX identity_verifiable_addresses_identity_id_idx ON identity_verifiable_addresses (identity_id ASC);
+DROP INDEX identity_verifiable_addresses_status_via_idx ON identity_verifiable_addresses;
+-- DROP INDEX identity_verifiable_addresses_nid_identity_id_idx ON identity_verifiable_addresses;
+DROP INDEX identity_verifiable_addresses_nid_id_idx ON identity_verifiable_addresses;
+DROP INDEX identity_verifiable_addresses_id_nid_idx ON identity_verifiable_addresses;
diff --git a/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.autocommit.down.sql b/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.autocommit.down.sql
new file mode 100644
index 000000000000..487f44fb21a1
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.autocommit.down.sql
@@ -0,0 +1,56 @@
+CREATE INDEX IF NOT EXISTS session_devices_id_nid_idx ON session_devices (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS session_devices_session_id_nid_idx ON session_devices (session_id ASC, nid ASC);
+DROP INDEX IF EXISTS session_devices_nid_idx;
+DROP INDEX IF EXISTS session_devices_session_id_idx;
+
+CREATE INDEX IF NOT EXISTS session_token_exchanges_nid_code_idx ON session_token_exchanges (init_code ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS session_token_exchanges_nid_flow_id_idx ON session_token_exchanges (flow_id ASC, nid ASC);
+DROP INDEX IF EXISTS session_token_exchanges_flow_id_nid_init_code_idx;
+DROP INDEX IF EXISTS session_token_exchanges_nid_init_code_idx;
+
+CREATE INDEX IF NOT EXISTS courier_messages_status_idx ON  courier_messages (status ASC);
+CREATE INDEX IF NOT EXISTS courier_messages_nid_id_idx ON  courier_messages (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS courier_messages_id_nid_idx ON  courier_messages (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS courier_messages_nid_created_at_id_idx ON  courier_messages (nid ASC, created_at DESC);
+DROP INDEX IF EXISTS courier_messages_status_id_idx;
+DROP INDEX IF EXISTS courier_messages_nid_id_created_at_idx;
+
+CREATE INDEX IF NOT EXISTS continuity_containers_nid_id_idx ON continuity_containers (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS continuity_containers_id_nid_idx ON continuity_containers (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS continuity_containers_identity_id_nid_idx ON continuity_containers (identity_id ASC, nid ASC);
+DROP INDEX IF EXISTS continuity_containers_identity_id_idx;
+DROP INDEX IF EXISTS continuity_containers_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_verification_codes_nid_flow_id_idx ON identity_verification_codes (nid ASC, selfservice_verification_flow_id ASC);
+CREATE INDEX IF NOT EXISTS identity_verification_codes_id_nid_idx ON identity_verification_codes (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS identity_verification_codes_verifiable_address_nid_idx ON identity_verification_codes (identity_verifiable_address_id ASC, nid ASC);
+DROP INDEX IF EXISTS identity_verification_codes_identity_verifiable_address_id_idx;
+DROP INDEX IF EXISTS identity_verification_codes_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_verification_tokens_nid_id_idx ON identity_verification_tokens (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS identity_verification_tokens_id_nid_idx ON identity_verification_tokens (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS identity_verification_tokens_token_nid_used_flow_id_idx ON identity_verification_tokens (nid ASC, token ASC, used ASC, selfservice_verification_flow_id ASC);
+DROP INDEX IF EXISTS identity_verification_tokens_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_registration_codes_nid_flow_id_idx ON identity_registration_codes (nid ASC, selfservice_registration_flow_id ASC);
+CREATE INDEX IF NOT EXISTS identity_registration_codes_id_nid_idx ON identity_registration_codes (id ASC, nid ASC);
+DROP INDEX IF EXISTS identity_registration_codes_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_recovery_tokens_nid_id_idx  ON identity_recovery_tokens (nid ASC, id ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_tokens_id_nid_idx  ON identity_recovery_tokens (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_tokens_token_nid_used_idx  ON identity_recovery_tokens (nid ASC, token ASC, used ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_tokens_identity_id_nid_idx  ON identity_recovery_tokens (identity_id ASC, nid ASC);
+DROP INDEX IF EXISTS identity_recovery_tokens_identity_id_idx;
+DROP INDEX IF EXISTS identity_recovery_tokens_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_recovery_codes_nid_flow_id_idx ON identity_recovery_codes (nid ASC, selfservice_recovery_flow_id ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_codes_id_nid_idx ON identity_recovery_codes (id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_codes_identity_id_nid_idx ON identity_recovery_codes (identity_id ASC, nid ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_codes_identity_recovery_address_id_nid_idx ON identity_recovery_codes (identity_recovery_address_id ASC, nid ASC);
+DROP INDEX IF EXISTS identity_recovery_codes_identity_recovery_address_id_idx;
+DROP INDEX IF EXISTS identity_recovery_codes_identity_id_idx;
+DROP INDEX IF EXISTS identity_recovery_codes_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_login_codes_nid_flow_id_idx ON identity_login_codes (nid ASC, selfservice_login_flow_id ASC);
+CREATE INDEX IF NOT EXISTS identity_login_codes_id_nid_idx ON identity_login_codes (id ASC, nid ASC);
+DROP INDEX IF EXISTS identity_login_codes_nid_idx;
diff --git a/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.autocommit.up.sql b/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.autocommit.up.sql
new file mode 100644
index 000000000000..1e9ffae8c664
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.autocommit.up.sql
@@ -0,0 +1,56 @@
+CREATE INDEX IF NOT EXISTS session_devices_nid_idx ON session_devices (nid ASC);
+CREATE INDEX IF NOT EXISTS session_devices_session_id_idx ON session_devices (session_id ASC);
+DROP INDEX IF EXISTS session_devices_id_nid_idx;
+DROP INDEX IF EXISTS session_devices_session_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS session_token_exchanges_flow_id_nid_init_code_idx ON session_token_exchanges (flow_id ASC, nid ASC, init_code ASC);
+CREATE INDEX IF NOT EXISTS session_token_exchanges_nid_init_code_idx ON session_token_exchanges (nid ASC, init_code ASC);
+DROP INDEX IF EXISTS session_token_exchanges_nid_code_idx;
+DROP INDEX IF EXISTS session_token_exchanges_nid_flow_id_idx;
+
+CREATE INDEX IF NOT EXISTS courier_messages_status_id_idx ON courier_messages (status ASC, id ASC);
+CREATE INDEX IF NOT EXISTS courier_messages_nid_id_created_at_idx ON courier_messages (nid ASC, id ASC, created_at DESC);
+DROP INDEX IF EXISTS courier_messages_status_idx;
+DROP INDEX IF EXISTS courier_messages_nid_id_idx;
+DROP INDEX IF EXISTS courier_messages_id_nid_idx;
+DROP INDEX IF EXISTS courier_messages_nid_created_at_id_idx;
+
+CREATE INDEX IF NOT EXISTS continuity_containers_identity_id_idx ON continuity_containers (identity_id ASC);
+CREATE INDEX IF NOT EXISTS continuity_containers_nid_idx ON continuity_containers (nid ASC);
+DROP INDEX IF EXISTS continuity_containers_nid_id_idx;
+DROP INDEX IF EXISTS continuity_containers_id_nid_idx;
+DROP INDEX IF EXISTS continuity_containers_identity_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_verification_codes_identity_verifiable_address_id_idx ON identity_verification_codes (identity_verifiable_address_id ASC);
+CREATE INDEX IF NOT EXISTS identity_verification_codes_nid_idx ON identity_verification_codes (nid ASC);
+DROP INDEX IF EXISTS identity_verification_codes_nid_flow_id_idx;
+DROP INDEX IF EXISTS identity_verification_codes_id_nid_idx;
+DROP INDEX IF EXISTS identity_verification_codes_verifiable_address_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_verification_tokens_nid_idx ON identity_verification_tokens (nid ASC);
+DROP INDEX IF EXISTS identity_verification_tokens_nid_id_idx;
+DROP INDEX IF EXISTS identity_verification_tokens_id_nid_idx;
+DROP INDEX IF EXISTS identity_verification_tokens_token_nid_used_flow_id_idx;
+
+CREATE INDEX IF NOT EXISTS identity_registration_codes_nid_idx ON identity_registration_codes (nid ASC);
+DROP INDEX IF EXISTS identity_registration_codes_nid_flow_id_idx;
+DROP INDEX IF EXISTS identity_registration_codes_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_recovery_tokens_identity_id_idx ON identity_recovery_tokens (identity_id ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_tokens_nid_idx ON identity_recovery_tokens (nid ASC);
+DROP INDEX IF EXISTS identity_recovery_tokens_nid_id_idx;
+DROP INDEX IF EXISTS identity_recovery_tokens_id_nid_idx;
+DROP INDEX IF EXISTS identity_recovery_tokens_token_nid_used_idx;
+DROP INDEX IF EXISTS identity_recovery_tokens_identity_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_recovery_codes_identity_recovery_address_id_idx ON identity_recovery_codes (identity_recovery_address_id ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_codes_identity_id_idx ON identity_recovery_codes (identity_id ASC);
+CREATE INDEX IF NOT EXISTS identity_recovery_codes_nid_idx ON identity_recovery_codes (nid ASC);
+DROP INDEX IF EXISTS identity_recovery_codes_nid_flow_id_idx;
+DROP INDEX IF EXISTS identity_recovery_codes_id_nid_idx;
+DROP INDEX IF EXISTS identity_recovery_codes_identity_id_nid_idx;
+DROP INDEX IF EXISTS identity_recovery_codes_identity_recovery_address_id_nid_idx;
+
+CREATE INDEX IF NOT EXISTS identity_login_codes_nid_idx ON identity_login_codes (nid ASC);
+DROP INDEX IF EXISTS identity_login_codes_nid_flow_id_idx;
+DROP INDEX IF EXISTS identity_login_codes_id_nid_idx;
diff --git a/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.mysql.autocommit.down.sql b/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.mysql.autocommit.down.sql
new file mode 100644
index 000000000000..61d763673656
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.mysql.autocommit.down.sql
@@ -0,0 +1,56 @@
+CREATE INDEX session_devices_id_nid_idx ON session_devices (nid ASC, id ASC); -- the original index is id, nid - but then we can't drop session_devices_nid_idx
+CREATE INDEX session_devices_session_id_nid_idx ON session_devices (session_id ASC, nid ASC);
+DROP INDEX session_devices_nid_idx ON session_devices;
+DROP INDEX session_devices_session_id_idx ON session_devices;
+
+CREATE INDEX session_token_exchanges_nid_code_idx ON session_token_exchanges (init_code ASC, nid ASC);
+CREATE INDEX session_token_exchanges_nid_flow_id_idx ON session_token_exchanges (flow_id ASC, nid ASC);
+DROP INDEX session_token_exchanges_flow_id_nid_init_code_idx ON session_token_exchanges;
+DROP INDEX session_token_exchanges_nid_init_code_idx ON session_token_exchanges;
+
+CREATE INDEX courier_messages_status_idx ON courier_messages (status ASC);
+CREATE INDEX courier_messages_nid_id_idx ON courier_messages (nid ASC, id ASC);
+CREATE INDEX courier_messages_id_nid_idx ON courier_messages (id ASC, nid ASC);
+CREATE INDEX courier_messages_nid_created_at_id_idx ON courier_messages (nid ASC, created_at DESC);
+DROP INDEX courier_messages_status_id_idx ON courier_messages;
+DROP INDEX courier_messages_nid_id_created_at_idx ON courier_messages;
+
+CREATE INDEX continuity_containers_nid_id_idx ON continuity_containers (nid ASC, id ASC);
+CREATE INDEX continuity_containers_id_nid_idx ON continuity_containers (id ASC, nid ASC);
+CREATE INDEX continuity_containers_identity_id_nid_idx ON continuity_containers (identity_id ASC, nid ASC);
+DROP INDEX continuity_containers_identity_id_idx ON continuity_containers;
+DROP INDEX continuity_containers_nid_idx ON continuity_containers;
+
+CREATE INDEX identity_verification_codes_nid_flow_id_idx ON identity_verification_codes (nid ASC, selfservice_verification_flow_id ASC);
+CREATE INDEX identity_verification_codes_id_nid_idx ON identity_verification_codes (id ASC, nid ASC);
+CREATE INDEX identity_verification_codes_verifiable_address_nid_idx ON identity_verification_codes (identity_verifiable_address_id ASC, nid ASC);
+DROP INDEX identity_verification_codes_verifiable_address_idx ON identity_verification_codes;
+DROP INDEX identity_verification_codes_nid_idx ON identity_verification_codes;
+
+CREATE INDEX identity_verification_tokens_nid_id_idx ON identity_verification_tokens (nid ASC, id ASC);
+CREATE INDEX identity_verification_tokens_id_nid_idx ON identity_verification_tokens (id ASC, nid ASC);
+CREATE INDEX identity_verification_tokens_token_nid_used_flow_id_idx ON identity_verification_tokens (nid ASC, token ASC, used ASC, selfservice_verification_flow_id ASC);
+DROP INDEX identity_verification_tokens_nid_idx ON identity_verification_tokens;
+
+CREATE INDEX identity_registration_codes_nid_flow_id_idx ON identity_registration_codes (nid ASC, selfservice_registration_flow_id ASC);
+CREATE INDEX identity_registration_codes_id_nid_idx ON identity_registration_codes (id ASC, nid ASC);
+DROP INDEX identity_registration_codes_nid_idx ON identity_registration_codes;
+
+CREATE INDEX identity_recovery_tokens_nid_id_idx ON identity_recovery_tokens (nid ASC, id ASC);
+CREATE INDEX identity_recovery_tokens_id_nid_idx ON identity_recovery_tokens (id ASC, nid ASC);
+CREATE INDEX identity_recovery_tokens_token_nid_used_idx ON identity_recovery_tokens (nid ASC, token ASC, used ASC);
+CREATE INDEX identity_recovery_tokens_identity_id_nid_idx ON identity_recovery_tokens (identity_id ASC, nid ASC);
+DROP INDEX identity_recovery_tokens_identity_id_idx ON identity_recovery_tokens;
+DROP INDEX identity_recovery_tokens_nid_idx ON identity_recovery_tokens;
+
+CREATE INDEX identity_recovery_codes_nid_flow_id_idx ON identity_recovery_codes (nid ASC, selfservice_recovery_flow_id ASC);
+CREATE INDEX identity_recovery_codes_id_nid_idx ON identity_recovery_codes (id ASC, nid ASC);
+CREATE INDEX identity_recovery_codes_identity_id_nid_idx ON identity_recovery_codes (identity_id ASC, nid ASC);
+CREATE INDEX identity_recovery_codes_identity_recovery_address_id_nid_idx ON identity_recovery_codes (identity_recovery_address_id ASC, nid ASC);
+DROP INDEX identity_recovery_codes_address_id_idx ON identity_recovery_codes;
+DROP INDEX identity_recovery_codes_identity_id_idx ON identity_recovery_codes;
+DROP INDEX identity_recovery_codes_nid_idx ON identity_recovery_codes;
+
+CREATE INDEX identity_login_codes_nid_flow_id_idx ON identity_login_codes (nid ASC, selfservice_login_flow_id ASC);
+CREATE INDEX identity_login_codes_id_nid_idx ON identity_login_codes (id ASC, nid ASC);
+DROP INDEX identity_login_codes_nid_idx ON identity_login_codes;
diff --git a/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.mysql.autocommit.up.sql b/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.mysql.autocommit.up.sql
new file mode 100644
index 000000000000..1f6a636b74bf
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241031094100000001_remaining_unused_indices.mysql.autocommit.up.sql
@@ -0,0 +1,56 @@
+CREATE INDEX session_devices_nid_idx ON session_devices (nid ASC);
+CREATE INDEX session_devices_session_id_idx ON session_devices (session_id ASC);
+DROP INDEX session_devices_id_nid_idx ON session_devices;
+DROP INDEX session_devices_session_id_nid_idx ON session_devices;
+
+CREATE INDEX session_token_exchanges_flow_id_nid_init_code_idx ON session_token_exchanges (flow_id ASC, nid ASC, init_code ASC);
+CREATE INDEX session_token_exchanges_nid_init_code_idx ON session_token_exchanges (nid ASC, init_code ASC);
+DROP INDEX session_token_exchanges_nid_code_idx ON session_token_exchanges;
+DROP INDEX session_token_exchanges_nid_flow_id_idx ON session_token_exchanges;
+
+CREATE INDEX courier_messages_status_id_idx ON courier_messages (status ASC, id ASC);
+CREATE INDEX courier_messages_nid_id_created_at_idx ON courier_messages (nid ASC, id ASC, created_at DESC);
+DROP INDEX courier_messages_status_idx ON courier_messages;
+DROP INDEX courier_messages_nid_id_idx ON courier_messages;
+DROP INDEX courier_messages_id_nid_idx ON courier_messages;
+DROP INDEX courier_messages_nid_created_at_id_idx ON courier_messages;
+
+CREATE INDEX continuity_containers_identity_id_idx ON continuity_containers (identity_id ASC);
+CREATE INDEX continuity_containers_nid_idx ON continuity_containers (nid ASC);
+DROP INDEX continuity_containers_nid_id_idx ON continuity_containers;
+DROP INDEX continuity_containers_id_nid_idx ON continuity_containers;
+DROP INDEX continuity_containers_identity_id_nid_idx ON continuity_containers;
+
+CREATE INDEX identity_verification_codes_verifiable_address_idx ON identity_verification_codes (identity_verifiable_address_id ASC);
+CREATE INDEX identity_verification_codes_nid_idx ON identity_verification_codes (nid ASC);
+DROP INDEX identity_verification_codes_nid_flow_id_idx ON identity_verification_codes;
+DROP INDEX identity_verification_codes_id_nid_idx ON identity_verification_codes;
+DROP INDEX identity_verification_codes_verifiable_address_nid_idx ON identity_verification_codes;
+
+CREATE INDEX identity_verification_tokens_nid_idx ON identity_verification_tokens (nid ASC);
+DROP INDEX identity_verification_tokens_nid_id_idx ON identity_verification_tokens;
+DROP INDEX identity_verification_tokens_id_nid_idx ON identity_verification_tokens;
+DROP INDEX identity_verification_tokens_token_nid_used_flow_id_idx ON identity_verification_tokens;
+
+CREATE INDEX identity_registration_codes_nid_idx ON identity_registration_codes (nid ASC);
+DROP INDEX identity_registration_codes_nid_flow_id_idx ON identity_registration_codes;
+DROP INDEX identity_registration_codes_id_nid_idx ON identity_registration_codes;
+
+CREATE INDEX identity_recovery_tokens_identity_id_idx ON identity_recovery_tokens (identity_id ASC);
+CREATE INDEX identity_recovery_tokens_nid_idx ON identity_recovery_tokens (nid ASC);
+DROP INDEX identity_recovery_tokens_nid_id_idx ON identity_recovery_tokens;
+DROP INDEX identity_recovery_tokens_id_nid_idx ON identity_recovery_tokens;
+DROP INDEX identity_recovery_tokens_token_nid_used_idx ON identity_recovery_tokens;
+DROP INDEX identity_recovery_tokens_identity_id_nid_idx ON identity_recovery_tokens;
+
+CREATE INDEX identity_recovery_codes_address_id_idx ON identity_recovery_codes (identity_recovery_address_id ASC);
+CREATE INDEX identity_recovery_codes_identity_id_idx ON identity_recovery_codes (identity_id ASC);
+CREATE INDEX identity_recovery_codes_nid_idx ON identity_recovery_codes (nid ASC);
+DROP INDEX identity_recovery_codes_nid_flow_id_idx ON identity_recovery_codes;
+DROP INDEX identity_recovery_codes_id_nid_idx ON identity_recovery_codes;
+DROP INDEX identity_recovery_codes_identity_id_nid_idx ON identity_recovery_codes;
+DROP INDEX identity_recovery_codes_identity_recovery_address_id_nid_idx ON identity_recovery_codes;
+
+CREATE INDEX identity_login_codes_nid_idx ON identity_login_codes (nid ASC);
+DROP INDEX identity_login_codes_nid_flow_id_idx ON identity_login_codes;
+DROP INDEX identity_login_codes_id_nid_idx ON identity_login_codes;
diff --git a/persistence/sql/migrations/sql/20241031094100000002_foreign_key.autocommit.down.sql b/persistence/sql/migrations/sql/20241031094100000002_foreign_key.autocommit.down.sql
new file mode 100644
index 000000000000..b31030e3c951
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241031094100000002_foreign_key.autocommit.down.sql
@@ -0,0 +1 @@
+ALTER TABLE session_token_exchanges DROP CONSTRAINT session_token_exchanges_nid_fk;
diff --git a/persistence/sql/migrations/sql/20241031094100000002_foreign_key.autocommit.up.sql b/persistence/sql/migrations/sql/20241031094100000002_foreign_key.autocommit.up.sql
new file mode 100644
index 000000000000..1180d4337076
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241031094100000002_foreign_key.autocommit.up.sql
@@ -0,0 +1 @@
+ALTER TABLE session_token_exchanges ADD CONSTRAINT session_token_exchanges_nid_fk FOREIGN KEY (nid) REFERENCES networks (id) ON DELETE CASCADE;
diff --git a/persistence/sql/migrations/sql/20241031094100000002_foreign_key.sqlite.autocommit.down.sql b/persistence/sql/migrations/sql/20241031094100000002_foreign_key.sqlite.autocommit.down.sql
new file mode 100644
index 000000000000..f0d12fdfea4e
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241031094100000002_foreign_key.sqlite.autocommit.down.sql
@@ -0,0 +1,27 @@
+-- Step 1: Create a temporary table without the nid column and foreign key constraint
+CREATE TABLE session_token_exchanges_temp
+(
+  id             TEXT        NOT NULL,
+  flow_id        TEXT        NOT NULL,
+  session_id     TEXT,
+  init_code      VARCHAR(64) NOT NULL,
+  return_to_code VARCHAR(64) NOT NULL,
+  created_at     TIMESTAMP   NOT NULL,
+  updated_at     TIMESTAMP   NOT NULL,
+  PRIMARY KEY (id)
+);
+
+-- Step 2: Copy data from the original table to the temporary table (excluding the nid column)
+INSERT INTO session_token_exchanges_temp (id, flow_id, session_id, init_code, return_to_code, created_at, updated_at)
+SELECT id, flow_id, session_id, init_code, return_to_code, created_at, updated_at
+FROM session_token_exchanges;
+
+-- Step 3: Drop the original table
+DROP TABLE session_token_exchanges;
+
+-- Step 4: Rename the temporary table to the original table name
+ALTER TABLE session_token_exchanges_temp RENAME TO session_token_exchanges;
+
+-- Step 5: Recreate indexes as needed (excluding nid)
+CREATE INDEX session_token_exchanges_nid_code_idx ON session_token_exchanges (init_code);
+CREATE INDEX session_token_exchanges_nid_flow_id_idx ON session_token_exchanges (flow_id);
diff --git a/persistence/sql/migrations/sql/20241031094100000002_foreign_key.sqlite.autocommit.up.sql b/persistence/sql/migrations/sql/20241031094100000002_foreign_key.sqlite.autocommit.up.sql
new file mode 100644
index 000000000000..210f7f9034b4
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241031094100000002_foreign_key.sqlite.autocommit.up.sql
@@ -0,0 +1,37 @@
+-- Step 1: Create a temporary table with the new column and foreign key constraint
+CREATE TABLE session_token_exchanges_temp
+(
+  id             TEXT        NOT NULL,
+  nid            TEXT        NOT NULL,
+  flow_id        TEXT        NOT NULL,
+  session_id     TEXT,
+  init_code      VARCHAR(64) NOT NULL,
+  return_to_code VARCHAR(64) NOT NULL,
+  created_at     TIMESTAMP   NOT NULL,
+  updated_at     TIMESTAMP   NOT NULL,
+  PRIMARY KEY (id),
+  FOREIGN KEY (nid) REFERENCES networks (id) ON DELETE CASCADE
+);
+
+-- Step 2: Copy data from the original table to the temporary table
+INSERT INTO session_token_exchanges_temp (id, nid, flow_id, session_id, init_code, return_to_code, created_at,
+                                          updated_at)
+SELECT id,
+       nid,
+       flow_id,
+       session_id,
+       init_code,
+       return_to_code,
+       created_at,
+       updated_at
+FROM session_token_exchanges;
+
+-- Step 3: Drop the original table
+DROP TABLE session_token_exchanges;
+
+-- Step 4: Rename the temporary table to the original table name
+ALTER TABLE session_token_exchanges_temp RENAME TO session_token_exchanges;
+
+-- Step 5: Recreate indexes as needed
+CREATE INDEX session_token_exchanges_nid_code_idx ON session_token_exchanges (init_code, nid);
+CREATE INDEX session_token_exchanges_nid_flow_id_idx ON session_token_exchanges (flow_id, nid);
diff --git a/persistence/sql/migrations/sql/20241106142200000001_identities.autocommit.down.sql b/persistence/sql/migrations/sql/20241106142200000001_identities.autocommit.down.sql
new file mode 100644
index 000000000000..a989898db612
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241106142200000001_identities.autocommit.down.sql
@@ -0,0 +1 @@
+DROP INDEX IF EXISTS identity_credential_identifiers_nid_ici_i_idx;
diff --git a/persistence/sql/migrations/sql/20241106142200000001_identities.autocommit.up.sql b/persistence/sql/migrations/sql/20241106142200000001_identities.autocommit.up.sql
new file mode 100644
index 000000000000..57c2306bb72d
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241106142200000001_identities.autocommit.up.sql
@@ -0,0 +1,2 @@
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_nid_ici_i_idx
+    ON identity_credential_identifiers (nid ASC, identity_credential_id ASC, identifier ASC);
diff --git a/persistence/sql/migrations/sql/20241106142200000001_identities.mysql.autocommit.down.sql b/persistence/sql/migrations/sql/20241106142200000001_identities.mysql.autocommit.down.sql
new file mode 100644
index 000000000000..859252365579
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241106142200000001_identities.mysql.autocommit.down.sql
@@ -0,0 +1 @@
+DROP INDEX identity_credential_identifiers_nid_ici_i_idx ON identity_credential_identifiers;
diff --git a/persistence/sql/migrations/sql/20241106142200000001_identities.mysql.autocommit.up.sql b/persistence/sql/migrations/sql/20241106142200000001_identities.mysql.autocommit.up.sql
new file mode 100644
index 000000000000..a39eab684412
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241106142200000001_identities.mysql.autocommit.up.sql
@@ -0,0 +1,2 @@
+CREATE INDEX identity_credential_identifiers_nid_ici_i_idx
+    ON identity_credential_identifiers (nid ASC, identity_credential_id ASC, identifier ASC);
diff --git a/persistence/sql/migrations/sql/20241106142200000002_identities.autocommit.down.sql b/persistence/sql/migrations/sql/20241106142200000002_identities.autocommit.down.sql
new file mode 100644
index 000000000000..d6b71451755d
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241106142200000002_identities.autocommit.down.sql
@@ -0,0 +1,2 @@
+
+DROP INDEX IF EXISTS identity_credential_identifiers_ici_nid_i_idx;
diff --git a/persistence/sql/migrations/sql/20241106142200000002_identities.autocommit.up.sql b/persistence/sql/migrations/sql/20241106142200000002_identities.autocommit.up.sql
new file mode 100644
index 000000000000..75f08549f757
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241106142200000002_identities.autocommit.up.sql
@@ -0,0 +1,2 @@
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_ici_nid_i_idx
+    ON identity_credential_identifiers (identity_credential_id ASC, nid ASC, identifier ASC);
diff --git a/persistence/sql/migrations/sql/20241106142200000002_identities.mysql.autocommit.down.sql b/persistence/sql/migrations/sql/20241106142200000002_identities.mysql.autocommit.down.sql
new file mode 100644
index 000000000000..1eef66d657ce
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241106142200000002_identities.mysql.autocommit.down.sql
@@ -0,0 +1 @@
+DROP INDEX identity_credential_identifiers_ici_nid_i_idx ON identity_credential_identifiers;
diff --git a/persistence/sql/migrations/sql/20241106142200000002_identities.mysql.autocommit.up.sql b/persistence/sql/migrations/sql/20241106142200000002_identities.mysql.autocommit.up.sql
new file mode 100644
index 000000000000..bd4b293aa682
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241106142200000002_identities.mysql.autocommit.up.sql
@@ -0,0 +1,2 @@
+CREATE INDEX identity_credential_identifiers_ici_nid_i_idx
+  ON identity_credential_identifiers (identity_credential_id ASC, nid ASC, identifier ASC);
diff --git a/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.autocommit.down.sql b/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.autocommit.down.sql
new file mode 100644
index 000000000000..12d9fec56edb
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.autocommit.down.sql
@@ -0,0 +1,5 @@
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_nid_ici_i_idx
+  ON identity_credential_identifiers (nid ASC, identity_credential_id ASC, identifier ASC);
+
+CREATE INDEX IF NOT EXISTS identity_credential_identifiers_identity_credential_id_idx
+  ON identity_credential_identifiers (identity_credential_id ASC);
diff --git a/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.autocommit.up.sql b/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.autocommit.up.sql
new file mode 100644
index 000000000000..f672d728035a
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.autocommit.up.sql
@@ -0,0 +1,5 @@
+-- This index is replaced by identity_credential_identifiers_ici_nid_i_idx (included in the previous OEL release)
+DROP INDEX IF EXISTS identity_credential_identifiers_nid_ici_i_idx;
+
+-- This index is replaced by identity_credential_identifiers_ici_nid_i_idx (included in the previous OEL release)
+DROP INDEX IF EXISTS identity_credential_identifiers_identity_credential_id_idx;
diff --git a/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.mysql.autocommit.down.sql b/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.mysql.autocommit.down.sql
new file mode 100644
index 000000000000..6f1e2d289538
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.mysql.autocommit.down.sql
@@ -0,0 +1,5 @@
+CREATE INDEX identity_credential_identifiers_nid_ici_i_idx
+  ON identity_credential_identifiers (nid ASC, identity_credential_id ASC, identifier ASC);
+
+CREATE INDEX identity_credential_identifiers_identity_credential_id_idx
+  ON identity_credential_identifiers (identity_credential_id ASC);
diff --git a/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.mysql.autocommit.up.sql b/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.mysql.autocommit.up.sql
new file mode 100644
index 000000000000..28f9cbdb8700
--- /dev/null
+++ b/persistence/sql/migrations/sql/20241108105000000001_index_cleanup.mysql.autocommit.up.sql
@@ -0,0 +1,5 @@
+-- This index is replaced by identity_credential_identifiers_ici_nid_i_idx (included in the previous OEL release)
+DROP INDEX identity_credential_identifiers_nid_ici_i_idx ON identity_credential_identifiers;
+
+-- This index is replaced by identity_credential_identifiers_ici_nid_i_idx (included in the previous OEL release)
+DROP INDEX identity_credential_identifiers_identity_credential_id_idx ON identity_credential_identifiers;
diff --git a/persistence/sql/persister.go b/persistence/sql/persister.go
index 85bcdf7466c8..9962b373255f 100644
--- a/persistence/sql/persister.go
+++ b/persistence/sql/persister.go
@@ -11,7 +11,6 @@ import (
 
 	"github.com/gobuffalo/pop/v6"
 	"github.com/gofrs/uuid"
-	"github.com/laher/mergefs"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 
@@ -24,6 +23,7 @@ import (
 	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/x"
 	"github.com/ory/x/contextx"
+	"github.com/ory/x/fsx"
 	"github.com/ory/x/networkx"
 	"github.com/ory/x/otelx"
 	"github.com/ory/x/popx"
@@ -57,8 +57,9 @@ type (
 )
 
 type persisterOptions struct {
-	extraMigrations []fs.FS
-	disableLogging  bool
+	extraMigrations   []fs.FS
+	extraGoMigrations popx.Migrations
+	disableLogging    bool
 }
 
 type persisterOption func(o *persisterOptions)
@@ -69,6 +70,12 @@ func WithExtraMigrations(fss ...fs.FS) persisterOption {
 	}
 }
 
+func WithExtraGoMigrations(ms ...popx.Migration) persisterOption {
+	return func(o *persisterOptions) {
+		o.extraGoMigrations = ms
+	}
+}
+
 func WithDisabledLogging(v bool) persisterOption {
 	return func(o *persisterOptions) {
 		o.disableLogging = v
@@ -85,15 +92,9 @@ func NewPersister(ctx context.Context, r persisterDependencies, c *pop.Connectio
 		logger.Logrus().SetLevel(logrus.WarnLevel)
 	}
 	m, err := popx.NewMigrationBox(
-		mergefs.Merge(
-			append(
-				[]fs.FS{
-					migrations, networkx.Migrations,
-				},
-				o.extraMigrations...,
-			)...,
-		),
+		fsx.Merge(append([]fs.FS{migrations, networkx.Migrations}, o.extraMigrations...)...),
 		popx.NewMigrator(c, logger, r.Tracer(ctx), 0),
+		popx.WithGoMigrations(o.extraGoMigrations),
 	)
 	if err != nil {
 		return nil, err
@@ -177,13 +178,8 @@ func (p *Persister) Close(ctx context.Context) error {
 	return errors.WithStack(p.GetConnection(ctx).Close())
 }
 
-func (p *Persister) Ping() error {
-	type pinger interface {
-		Ping() error
-	}
-
-	// This can not be contextualized because of some gobuffalo/pop limitations.
-	return errors.WithStack(p.c.Store.(pinger).Ping())
+func (p *Persister) Ping(ctx context.Context) error {
+	return errors.WithStack(p.c.Store.SQLDB().PingContext(ctx))
 }
 
 func (p *Persister) CleanupDatabase(ctx context.Context, wait time.Duration, older time.Duration, batchSize int) error {
diff --git a/persistence/sql/persister_code.go b/persistence/sql/persister_code.go
index ece7dea75ec3..8b859918e389 100644
--- a/persistence/sql/persister_code.go
+++ b/persistence/sql/persister_code.go
@@ -12,6 +12,8 @@ import (
 	"github.com/gobuffalo/pop/v6"
 	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/kratos/selfservice/strategy/code"
 	"github.com/ory/x/otelx"
@@ -41,7 +43,7 @@ func useOneTimeCode[P any, U interface {
 	*P
 	oneTimeCodeProvider
 }](ctx context.Context, p *Persister, flowID uuid.UUID, userProvidedCode string, flowTableName string, foreignKeyName string, opts ...codeOption,
-) (_ U, err error) {
+) (target U, err error) {
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.useOneTimeCode")
 	defer otelx.End(span, &err)
 
@@ -50,33 +52,21 @@ func useOneTimeCode[P any, U interface {
 		opt(o)
 	}
 
-	var target U
-	nid := p.NetworkID(ctx)
-	if err := p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
-		//#nosec G201 -- TableName is static
-		if err := tx.RawQuery(fmt.Sprintf("UPDATE %s SET submit_count = submit_count + 1 WHERE id = ? AND nid = ?", flowTableName), flowID, nid).Exec(); err != nil {
-			return err
-		}
-
-		var submitCount int
-		// Because MySQL does not support "RETURNING" clauses, but we need the updated `submit_count` later on.
-		//#nosec G201 -- TableName is static
-		if err := sqlcon.HandleError(tx.RawQuery(fmt.Sprintf("SELECT submit_count FROM %s WHERE id = ? AND nid = ?", flowTableName), flowID, nid).First(&submitCount)); err != nil {
-			if errors.Is(err, sqlcon.ErrNoRows) {
-				// Return no error, as that would roll back the transaction
-				return nil
-			}
-			return err
-		}
+	// Before we do anything else, increment the submit count and check if we're
+	// being brute-forced. This is a separate statement/transaction to the rest
+	// of the operations so that it is correct for all transaction isolation
+	// levels.
+	submitCount, err := incrementOTPCodeSubmitCount(ctx, p, flowID, flowTableName)
+	if err != nil {
+		return nil, err
+	}
+	if submitCount > 5 {
+		return nil, errors.WithStack(code.ErrCodeSubmittedTooOften)
+	}
 
-		// This check prevents parallel brute force attacks by checking the submit count inside this database
-		// transaction. If the flow has been submitted more than 5 times, the transaction is aborted (regardless of
-		// whether the code was correct or not) and we thus give no indication whether the supplied code was correct or
-		// not. For more explanation see [this comment](https://github.com/ory/kratos/pull/2645#discussion_r984732899).
-		if submitCount > 5 {
-			return errors.WithStack(code.ErrCodeSubmittedTooOften)
-		}
+	nid := p.NetworkID(ctx)
 
+	if err := p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
 		var codes []U
 		codesQuery := tx.Where(fmt.Sprintf("nid = ? AND %s = ?", foreignKeyName), nid, flowID)
 		if o.IdentityID != nil {
@@ -85,10 +75,8 @@ func useOneTimeCode[P any, U interface {
 
 		if err := sqlcon.HandleError(codesQuery.All(&codes)); err != nil {
 			if errors.Is(err, sqlcon.ErrNoRows) {
-				// Return no error, as that would roll back the transaction and reset the submit count.
-				return nil
+				return errors.WithStack(code.ErrCodeNotFound)
 			}
-
 			return err
 		}
 
@@ -107,7 +95,7 @@ func useOneTimeCode[P any, U interface {
 		}
 
 		if target.Validate() != nil {
-			// Return no error, as that would roll back the transaction
+			// Return no error, as that would roll back the transaction. We re-validate the code after the transaction.
 			return nil
 		}
 
@@ -123,3 +111,52 @@ func useOneTimeCode[P any, U interface {
 
 	return target, nil
 }
+
+func incrementOTPCodeSubmitCount(ctx context.Context, p *Persister, flowID uuid.UUID, flowTableName string) (submitCount int, err error) {
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.incrementOTPCodeSubmitCount",
+		trace.WithAttributes(attribute.Stringer("flow_id", flowID), attribute.String("flow_table_name", flowTableName)))
+	defer otelx.End(span, &err)
+	defer func() {
+		span.SetAttributes(attribute.Int("submit_count", submitCount))
+	}()
+
+	nid := p.NetworkID(ctx)
+
+	// The branch below is a marginal performance optimization for databases
+	// supporting RETURNING (one query instead of two). There is no real
+	// security difference here, but there is an observable difference in
+	// behavior.
+	//
+	// Databases supporting RETURNING will perform the increment+select
+	// atomically. That means that always exactly 5 attempts will be allowed for
+	// each flow, no matter how many concurrent attempts are made.
+	//
+	// Databases without support for RETURNING (MySQL) will perform the UPDATE
+	// and SELECT in two queries, which are not atomic. The effect is that there
+	// will still never be more than 5 attempts for each flow, but there may be
+	// fewer before we reject. Under normal operation, this is never a problem
+	// because a human will never submit their code as quickly as would be
+	// required to trigger this race condition.
+	//
+	// In a very strict sense of the word, the MySQL implementation is even more
+	// secure than the RETURNING implementation. But we're ok either way :)
+	if p.c.Dialect.Name() == "mysql" {
+		//#nosec G201 -- TableName is static
+		qUpdate := fmt.Sprintf("UPDATE %s SET submit_count = submit_count + 1 WHERE id = ? AND nid = ?", flowTableName)
+		if err := p.GetConnection(ctx).RawQuery(qUpdate, flowID, nid).Exec(); err != nil {
+			return 0, sqlcon.HandleError(err)
+		}
+		//#nosec G201 -- TableName is static
+		qSelect := fmt.Sprintf("SELECT submit_count FROM %s WHERE id = ? AND nid = ?", flowTableName)
+		err = sqlcon.HandleError(p.GetConnection(ctx).RawQuery(qSelect, flowID, nid).First(&submitCount))
+	} else {
+		//#nosec G201 -- TableName is static
+		q := fmt.Sprintf("UPDATE %s SET submit_count = submit_count + 1 WHERE id = ? AND nid = ? RETURNING submit_count", flowTableName)
+		err = sqlcon.HandleError(p.Connection(ctx).RawQuery(q, flowID, nid).First(&submitCount))
+	}
+	if errors.Is(err, sqlcon.ErrNoRows) {
+		return 0, errors.WithStack(code.ErrCodeNotFound)
+	}
+
+	return submitCount, err
+}
diff --git a/persistence/sql/persister_courier.go b/persistence/sql/persister_courier.go
index 456efea4fe70..ec9694924f6e 100644
--- a/persistence/sql/persister_courier.go
+++ b/persistence/sql/persister_courier.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/ory/kratos/courier"
 	"github.com/ory/kratos/persistence/sql/update"
+	"github.com/ory/kratos/x"
 )
 
 var _ courier.Persister = new(Persister)
@@ -57,6 +58,10 @@ func (p *Persister) ListMessages(ctx context.Context, filter courier.ListCourier
 	opts = append(opts, keysetpagination.WithColumn("created_at", "DESC"))
 	paginator := keysetpagination.GetPaginator(opts...)
 
+	if _, err := uuid.FromString(paginator.Token().Parse("id")["id"]); err != nil {
+		return nil, 0, nil, errors.WithStack(x.PageTokenInvalid)
+	}
+
 	messages := make([]courier.Message, paginator.Size())
 	if err := q.Scope(keysetpagination.Paginate[courier.Message](paginator)).
 		All(&messages); err != nil {
diff --git a/persistence/sql/persister_login_code.go b/persistence/sql/persister_login_code.go
index 808e65b9d2a4..deee50f02f59 100644
--- a/persistence/sql/persister_login_code.go
+++ b/persistence/sql/persister_login_code.go
@@ -43,7 +43,7 @@ func (p *Persister) UseLoginCode(ctx context.Context, flowID uuid.UUID, identity
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.UseLoginCode")
 	defer otelx.End(span, &err)
 
-	codeRow, err := useOneTimeCode[code.LoginCode, *code.LoginCode](ctx, p, flowID, userProvidedCode, new(login.Flow).TableName(ctx), "selfservice_login_flow_id", withCheckIdentityID(identityID))
+	codeRow, err := useOneTimeCode[code.LoginCode](ctx, p, flowID, userProvidedCode, new(login.Flow).TableName(ctx), "selfservice_login_flow_id", withCheckIdentityID(identityID))
 	if err != nil {
 		return nil, err
 	}
diff --git a/persistence/sql/persister_recovery_code.go b/persistence/sql/persister_recovery_code.go
index 9dc4dd26bb83..7b27aff12e84 100644
--- a/persistence/sql/persister_recovery_code.go
+++ b/persistence/sql/persister_recovery_code.go
@@ -58,7 +58,7 @@ func (p *Persister) UseRecoveryCode(ctx context.Context, flowID uuid.UUID, userP
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.UseRecoveryCode")
 	defer otelx.End(span, &err)
 
-	codeRow, err := useOneTimeCode[code.RecoveryCode, *code.RecoveryCode](ctx, p, flowID, userProvidedCode, new(recovery.Flow).TableName(ctx), "selfservice_recovery_flow_id")
+	codeRow, err := useOneTimeCode[code.RecoveryCode](ctx, p, flowID, userProvidedCode, new(recovery.Flow).TableName(ctx), "selfservice_recovery_flow_id")
 	if err != nil {
 		return nil, err
 	}
diff --git a/persistence/sql/persister_registration_code.go b/persistence/sql/persister_registration_code.go
index 095cb45156ba..3ef33048a60e 100644
--- a/persistence/sql/persister_registration_code.go
+++ b/persistence/sql/persister_registration_code.go
@@ -44,7 +44,7 @@ func (p *Persister) UseRegistrationCode(ctx context.Context, flowID uuid.UUID, u
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.UseRegistrationCode")
 	defer otelx.End(span, &err)
 
-	codeRow, err := useOneTimeCode[code.RegistrationCode, *code.RegistrationCode](ctx, p, flowID, userProvidedCode, new(registration.Flow).TableName(ctx), "selfservice_registration_flow_id")
+	codeRow, err := useOneTimeCode[code.RegistrationCode](ctx, p, flowID, userProvidedCode, new(registration.Flow).TableName(ctx), "selfservice_registration_flow_id")
 	if err != nil {
 		return nil, err
 	}
diff --git a/persistence/sql/persister_session.go b/persistence/sql/persister_session.go
index 412ed2d8a825..987fc5f76edf 100644
--- a/persistence/sql/persister_session.go
+++ b/persistence/sql/persister_session.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/ory/herodot"
 	"github.com/ory/x/dbal"
+	"github.com/ory/x/pointerx"
 
 	"github.com/gobuffalo/pop/v6"
 	"github.com/gofrs/uuid"
@@ -19,6 +20,7 @@ import (
 
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/session"
+	"github.com/ory/kratos/x"
 	"github.com/ory/kratos/x/events"
 	"github.com/ory/x/otelx"
 	"github.com/ory/x/pagination/keysetpagination"
@@ -67,12 +69,11 @@ func (p *Persister) GetSession(ctx context.Context, sid uuid.UUID, expandables s
 	return &s, nil
 }
 
-func (p *Persister) ListSessions(ctx context.Context, active *bool, paginatorOpts []keysetpagination.Option, expandables session.Expandables) (_ []session.Session, _ int64, _ *keysetpagination.Paginator, err error) {
+func (p *Persister) ListSessions(ctx context.Context, active *bool, paginatorOpts []keysetpagination.Option, expandables session.Expandables) (_ []session.Session, _ *keysetpagination.Paginator, err error) {
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.ListSessions")
 	defer otelx.End(span, &err)
 
 	s := make([]session.Session, 0)
-	t := int64(0)
 	nid := p.NetworkID(ctx)
 
 	paginatorOpts = append(paginatorOpts, keysetpagination.WithDefaultSize(paginationDefaultItemsSize))
@@ -81,6 +82,10 @@ func (p *Persister) ListSessions(ctx context.Context, active *bool, paginatorOpt
 	paginatorOpts = append(paginatorOpts, keysetpagination.WithColumn("created_at", "DESC"))
 	paginator := keysetpagination.GetPaginator(paginatorOpts...)
 
+	if _, err := uuid.FromString(paginator.Token().Parse("id")["id"]); err != nil {
+		return nil, nil, errors.WithStack(x.PageTokenInvalid)
+	}
+
 	if err := p.Transaction(ctx, func(ctx context.Context, c *pop.Connection) error {
 		q := c.Where("nid = ?", nid)
 		if active != nil {
@@ -91,13 +96,6 @@ func (p *Persister) ListSessions(ctx context.Context, active *bool, paginatorOpt
 			}
 		}
 
-		// Get the total count of matching items
-		total, err := q.Count(new(session.Session))
-		if err != nil {
-			return sqlcon.HandleError(err)
-		}
-		t = int64(total)
-
 		if len(expandables) > 0 {
 			q = q.EagerPreload(expandables.ToEager()...)
 		}
@@ -109,7 +107,7 @@ func (p *Persister) ListSessions(ctx context.Context, active *bool, paginatorOpt
 
 		return nil
 	}); err != nil {
-		return nil, 0, nil, err
+		return nil, nil, err
 	}
 
 	for k := range s {
@@ -117,12 +115,12 @@ func (p *Persister) ListSessions(ctx context.Context, active *bool, paginatorOpt
 			continue
 		}
 		if err := p.InjectTraitsSchemaURL(ctx, s[k].Identity); err != nil {
-			return nil, 0, nil, err
+			return nil, nil, err
 		}
 	}
 
 	s, nextPage := keysetpagination.Result(s, paginator)
-	return s, t, nextPage, nil
+	return s, nextPage, nil
 }
 
 // ListSessionsByIdentity retrieves sessions for an identity from the store.
@@ -165,7 +163,7 @@ func (p *Persister) ListSessionsByIdentity(
 		}
 		t = int64(total)
 
-		q.Order("authenticated_at DESC")
+		q.Order("created_at DESC")
 
 		// Get the paginated list of matching items
 		if err := q.Paginate(page, perPage).All(&s); err != nil {
@@ -286,10 +284,10 @@ func (p *Persister) UpsertSession(ctx context.Context, s *session.Session) (err
 			device.NID = s.NID
 
 			if device.Location != nil {
-				device.Location = stringsx.GetPointer(stringsx.TruncateByteLen(*device.Location, SessionDeviceLocationMaxLength))
+				device.Location = pointerx.Ptr(stringsx.TruncateByteLen(*device.Location, SessionDeviceLocationMaxLength))
 			}
 			if device.UserAgent != nil {
-				device.UserAgent = stringsx.GetPointer(stringsx.TruncateByteLen(*device.UserAgent, SessionDeviceUserAgentMaxLength))
+				device.UserAgent = pointerx.Ptr(stringsx.TruncateByteLen(*device.UserAgent, SessionDeviceUserAgentMaxLength))
 			}
 
 			if err := p.DevicePersister.CreateDevice(ctx, device); err != nil {
diff --git a/persistence/sql/persister_test.go b/persistence/sql/persister_test.go
index 6a48e763d0f3..3029cdc51ef0 100644
--- a/persistence/sql/persister_test.go
+++ b/persistence/sql/persister_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/ory/kratos/internal"
 	"github.com/ory/kratos/internal/testhelpers"
 	"github.com/ory/kratos/persistence/sql"
+	"github.com/ory/kratos/persistence/sql/batch"
 	sqltesthelpers "github.com/ory/kratos/persistence/sql/testhelpers"
 	"github.com/ory/kratos/schema"
 	errorx "github.com/ory/kratos/selfservice/errorx/test"
@@ -100,8 +101,12 @@ func createCleanDatabases(t testing.TB) map[string]*driver.RegistryDefault {
 	var l sync.Mutex
 	if !testing.Short() {
 		funcs := map[string]func(t testing.TB) string{
-			"postgres":  dockertest.RunTestPostgreSQL,
-			"mysql":     dockertest.RunTestMySQL,
+			"postgres": func(t testing.TB) string {
+				return dockertest.RunTestPostgreSQLWithVersion(t, "16")
+			},
+			"mysql": func(t testing.TB) string {
+				return dockertest.RunTestMySQLWithVersion(t, "8.0")
+			},
 			"cockroach": newLocalTestCRDBServer,
 		}
 
@@ -260,6 +265,10 @@ func TestPersister(t *testing.T) {
 				t.Parallel()
 				continuity.TestPersister(ctx, p)(t)
 			})
+			t.Run("contract=batch.TestPersister", func(t *testing.T) {
+				t.Parallel()
+				batch.TestPersister(ctx, reg.Tracer(ctx), p)(t)
+			})
 		})
 	}
 }
diff --git a/persistence/sql/persister_verification_code.go b/persistence/sql/persister_verification_code.go
index 3c3fc6d9bed5..1186712cdac9 100644
--- a/persistence/sql/persister_verification_code.go
+++ b/persistence/sql/persister_verification_code.go
@@ -55,7 +55,7 @@ func (p *Persister) UseVerificationCode(ctx context.Context, flowID uuid.UUID, u
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.UseVerificationCode")
 	defer otelx.End(span, &err)
 
-	codeRow, err := useOneTimeCode[code.VerificationCode, *code.VerificationCode](ctx, p, flowID, userProvidedCode, new(verification.Flow).TableName(ctx), "selfservice_verification_flow_id")
+	codeRow, err := useOneTimeCode[code.VerificationCode](ctx, p, flowID, userProvidedCode, new(verification.Flow).TableName(ctx), "selfservice_verification_flow_id")
 	if err != nil {
 		return nil, err
 	}
diff --git a/proto/oidc/v1/state.proto b/proto/oidc/v1/state.proto
new file mode 100644
index 000000000000..255f7f118e05
--- /dev/null
+++ b/proto/oidc/v1/state.proto
@@ -0,0 +1,10 @@
+syntax = "proto3";
+
+package oidc.v1;
+
+message State {
+  bytes flow_id = 1;
+  bytes session_token_exchange_code_sha512 = 2;
+  string provider_id = 3;
+  string pkce_verifier = 4;
+}
diff --git a/quickstart-mysql.yml b/quickstart-mysql.yml
index 7412e22c55df..f0cda5c4ea69 100644
--- a/quickstart-mysql.yml
+++ b/quickstart-mysql.yml
@@ -1,4 +1,4 @@
-version: '3.7'
+version: "3.7"
 
 services:
   kratos-migrate:
@@ -10,7 +10,7 @@ services:
       - DSN=mysql://root:secret@tcp(mysqld:3306)/mysql?max_conns=20&max_idle_conns=4
 
   mysqld:
-    image: mysql:5.7
+    image: mysql:8.0
     ports:
       - "3306:3306"
     environment:
diff --git a/quickstart-postgres.yml b/quickstart-postgres.yml
index 8c0dee47a2f3..93cad3a2ffc5 100644
--- a/quickstart-postgres.yml
+++ b/quickstart-postgres.yml
@@ -1,4 +1,4 @@
-version: '3.7'
+version: "3.7"
 
 services:
   kratos-migrate:
@@ -10,7 +10,7 @@ services:
       - DSN=postgres://kratos:secret@postgresd:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
 
   postgresd:
-    image: postgres:11.8
+    image: postgres:14
     ports:
       - "5432:5432"
     environment:
diff --git a/quickstart.yml b/quickstart.yml
index 10a331c397b1..fc2ac34058f1 100644
--- a/quickstart.yml
+++ b/quickstart.yml
@@ -1,7 +1,7 @@
 version: '3.7'
 services:
   kratos-migrate:
-    image: oryd/kratos:v1.2.0
+    image: oryd/kratos:v1.3.1
     environment:
       - DSN=sqlite:///var/lib/sqlite/db.sqlite?_fk=true&mode=rwc
     volumes:
@@ -17,7 +17,7 @@ services:
     networks:
       - intranet
   kratos-selfservice-ui-node:
-    image: oryd/kratos-selfservice-ui-node:v1.2.0
+    image: oryd/kratos-selfservice-ui-node:v1.3.1
     environment:
       - KRATOS_PUBLIC_URL=http://kratos:4433/
       - KRATOS_BROWSER_URL=http://127.0.0.1:4433/
@@ -30,7 +30,7 @@ services:
   kratos:
     depends_on:
       - kratos-migrate
-    image: oryd/kratos:v1.2.0
+    image: oryd/kratos:v1.3.1
     ports:
       - '4433:4433' # public
       - '4434:4434' # admin
diff --git a/request/builder.go b/request/builder.go
index 4651f64d43e2..bcf2e1a4dce4 100644
--- a/request/builder.go
+++ b/request/builder.go
@@ -44,20 +44,38 @@ type (
 		r      *retryablehttp.Request
 		Config *Config
 		deps   Dependencies
-		cache  *ristretto.Cache
+		cache  *ristretto.Cache[[]byte, []byte]
 	}
+	options struct {
+		cache *ristretto.Cache[[]byte, []byte]
+	}
+	BuilderOption = func(*options)
 )
 
-func NewBuilder(ctx context.Context, config json.RawMessage, deps Dependencies, jsonnetCache *ristretto.Cache) (_ *Builder, err error) {
+func WithCache(cache *ristretto.Cache[[]byte, []byte]) BuilderOption {
+	return func(o *options) {
+		o.cache = cache
+	}
+}
+
+func NewBuilder(ctx context.Context, config json.RawMessage, deps Dependencies, o ...BuilderOption) (_ *Builder, err error) {
 	_, span := deps.Tracer(ctx).Tracer().Start(ctx, "request.NewBuilder")
 	defer otelx.End(span, &err)
 
-	c, err := parseConfig(config)
-	if err != nil {
+	var opts options
+	for _, f := range o {
+		f(&opts)
+	}
+
+	c := Config{}
+	if err := json.Unmarshal(config, &c); err != nil {
 		return nil, err
 	}
 
-	span.SetAttributes(attribute.String("url", c.URL), attribute.String("method", c.Method))
+	span.SetAttributes(
+		attribute.String("url", c.URL),
+		attribute.String("method", c.Method),
+	)
 
 	r, err := retryablehttp.NewRequest(c.Method, c.URL, nil)
 	if err != nil {
@@ -66,9 +84,9 @@ func NewBuilder(ctx context.Context, config json.RawMessage, deps Dependencies,
 
 	return &Builder{
 		r:      r,
-		Config: c,
+		Config: &c,
 		deps:   deps,
-		cache:  jsonnetCache,
+		cache:  opts.cache,
 	}, nil
 }
 
diff --git a/request/builder_test.go b/request/builder_test.go
index 3b443dd2ce29..5101546148ae 100644
--- a/request/builder_test.go
+++ b/request/builder_test.go
@@ -245,7 +245,7 @@ func TestBuildRequest(t *testing.T) {
 	} {
 		t.Run(
 			"request-type="+tc.name, func(t *testing.T) {
-				rb, err := NewBuilder(context.Background(), json.RawMessage(tc.rawConfig), newTestDependencyProvider(t), nil)
+				rb, err := NewBuilder(context.Background(), json.RawMessage(tc.rawConfig), newTestDependencyProvider(t))
 				require.NoError(t, err)
 
 				assert.Equal(t, tc.bodyTemplateURI, rb.Config.TemplateURI)
@@ -279,7 +279,7 @@ func TestBuildRequest(t *testing.T) {
 	"method": "POST",
 	"body": "file://./stub/cancel_body.jsonnet"
 }`,
-			), newTestDependencyProvider(t), nil)
+			), newTestDependencyProvider(t))
 			require.NoError(t, err)
 
 			_, err = rb.BuildRequest(context.Background(), json.RawMessage(`{}`))
diff --git a/request/config.go b/request/config.go
index 92fc9898fc06..9ee2ed47f66a 100644
--- a/request/config.go
+++ b/request/config.go
@@ -17,48 +17,36 @@ type (
 	}
 
 	Config struct {
-		Method      string      `json:"method"`
-		URL         string      `json:"url"`
-		TemplateURI string      `json:"body"`
-		Header      http.Header `json:"headers"`
-		Auth        Auth        `json:"auth,omitempty"`
-	}
-)
-
-func parseConfig(r json.RawMessage) (*Config, error) {
-	type rawConfig struct {
 		Method      string          `json:"method"`
 		URL         string          `json:"url"`
 		TemplateURI string          `json:"body"`
-		Header      json.RawMessage `json:"headers"`
-		Auth        Auth            `json:"auth,omitempty"`
+		Header      http.Header     `json:"-"`
+		RawHeader   json.RawMessage `json:"headers"`
+		Auth        Auth            `json:"auth"`
 	}
+)
 
-	var rc rawConfig
-	err := json.Unmarshal(r, &rc)
+func (c *Config) UnmarshalJSON(raw []byte) error {
+	type Alias Config
+	var a Alias
+	err := json.Unmarshal(raw, &a)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	rawHeader := gjson.ParseBytes(rc.Header).Map()
-	hdr := http.Header{}
+	rawHeader := gjson.ParseBytes(a.RawHeader).Map()
+	a.Header = make(http.Header, len(rawHeader))
 
 	_, ok := rawHeader["Content-Type"]
 	if !ok {
-		hdr.Set("Content-Type", ContentTypeJSON)
+		a.Header.Set("Content-Type", ContentTypeJSON)
 	}
 
 	for key, value := range rawHeader {
-		hdr.Set(key, value.String())
+		a.Header.Set(key, value.String())
 	}
 
-	c := Config{
-		Method:      rc.Method,
-		URL:         rc.URL,
-		TemplateURI: rc.TemplateURI,
-		Header:      hdr,
-		Auth:        rc.Auth,
-	}
+	*c = Config(a)
 
-	return &c, nil
+	return nil
 }
diff --git a/schema/errors.go b/schema/errors.go
index 30c1f72976f3..6ff52a5047c2 100644
--- a/schema/errors.go
+++ b/schema/errors.go
@@ -117,12 +117,21 @@ func NewInvalidCredentialsError() error {
 		ValidationError: &jsonschema.ValidationError{
 			Message:     `the provided credentials are invalid, check for spelling mistakes in your password or username, email address, or phone number`,
 			InstancePtr: "#/",
-			Context:     &ValidationErrorContextPasswordPolicyViolation{},
 		},
 		Messages: new(text.Messages).Add(text.NewErrorValidationInvalidCredentials()),
 	})
 }
 
+func NewAccountNotFoundError() error {
+	return errors.WithStack(&ValidationError{
+		ValidationError: &jsonschema.ValidationError{
+			Message:     "this account does not exist or has no login method configured",
+			InstancePtr: "#/identifier",
+		},
+		Messages: new(text.Messages).Add(text.NewErrorValidationAccountNotFound()),
+	})
+}
+
 type ValidationErrorContextDuplicateCredentialsError struct {
 	AvailableCredentials   []string `json:"available_credential_types"`
 	AvailableOIDCProviders []string `json:"available_oidc_providers"`
diff --git a/schema/handler.go b/schema/handler.go
index ff06bc8c43ef..acf6a0dc786a 100644
--- a/schema/handler.go
+++ b/schema/handler.go
@@ -13,18 +13,14 @@ import (
 	"os"
 	"strings"
 
-	"github.com/ory/x/otelx"
-
-	"github.com/ory/x/pagination/migrationpagination"
-
-	"github.com/ory/kratos/driver/config"
-
 	"github.com/julienschmidt/httprouter"
 	"github.com/pkg/errors"
 
 	"github.com/ory/herodot"
-
+	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/x"
+	"github.com/ory/x/otelx"
+	"github.com/ory/x/pagination/migrationpagination"
 )
 
 type (
@@ -73,7 +69,16 @@ func (h *Handler) RegisterAdminRoutes(admin *x.RouterAdmin) {
 //
 //nolint:deadcode,unused
 //lint:ignore U1000 Used to generate Swagger and OpenAPI definitions
-type identitySchema = json.RawMessage
+type identitySchema json.RawMessage
+
+func (m identitySchema) MarshalJSON() ([]byte, error) {
+	return json.RawMessage(m).MarshalJSON()
+}
+
+func (m *identitySchema) UnmarshalJSON(data []byte) error {
+	mm := json.RawMessage(*m)
+	return mm.UnmarshalJSON(data)
+}
 
 // Get Identity JSON Schema Response
 //
@@ -155,7 +160,7 @@ type identitySchemaContainer struct {
 	// The ID of the Identity JSON Schema
 	ID string `json:"id"`
 	// The actual Identity JSON Schema
-	Schema identitySchema `json:"schema"`
+	Schema json.RawMessage `json:"schema"`
 }
 
 // List Identity JSON Schemas Response
diff --git a/schema/handler_test.go b/schema/handler_test.go
index a5bdf06a5a83..36aeb3aea75d 100644
--- a/schema/handler_test.go
+++ b/schema/handler_test.go
@@ -15,13 +15,11 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/ory/client-go"
-
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/ory/client-go"
 	_ "github.com/ory/jsonschema/v3/fileloader"
-
 	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/internal"
 	"github.com/ory/kratos/schema"
@@ -191,7 +189,7 @@ func TestHandler(t *testing.T) {
 		body := getFromTSPaginated(t, 0, 2, http.StatusOK)
 
 		var result []client.IdentitySchemaContainer
-		require.NoError(t, json.Unmarshal(body, &result))
+		require.NoError(t, json.Unmarshal(body, &result), "%s", body)
 
 		ids_orig := []string{}
 		for _, s := range schemas {
diff --git a/script/testenv.sh b/script/testenv.sh
index 15977c10fc8b..becd47b98c7a 100755
--- a/script/testenv.sh
+++ b/script/testenv.sh
@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 
 docker rm -f kratos_test_database_mysql kratos_test_database_postgres kratos_test_database_cockroach kratos_test_hydra || true
-docker run --platform linux/amd64 --name kratos_test_database_mysql -p 3444:3306 -e MYSQL_ROOT_PASSWORD=secret -d mysql:8.0.34
-docker run --platform linux/amd64 --name kratos_test_database_postgres -p 3445:5432 -e POSTGRES_PASSWORD=secret -e POSTGRES_DB=postgres -d postgres:11.8 postgres -c log_statement=all
-docker run --platform linux/amd64 --name kratos_test_database_cockroach -p 3446:26257 -p 3447:8080 -d cockroachdb/cockroach:v22.2.6 start-single-node --insecure
-docker run --platform linux/amd64 --name kratos_test_hydra -p 4444:4444 -p 4445:4445 -d -e DSN=memory -e URLS_SELF_ISSUER=http://localhost:4444/ -e URLS_LOGIN=http://localhost:4446/login -e URLS_CONSENT=http://localhost:4446/consent oryd/hydra:v2.0.2 serve all --dev
+docker run --name kratos_test_database_mysql -p 3444:3306 -e MYSQL_ROOT_PASSWORD=secret -d mysql:8.0
+docker run --name kratos_test_database_postgres -p 3445:5432 -e POSTGRES_PASSWORD=secret -e POSTGRES_DB=postgres -d postgres:14 postgres -c log_statement=all
+docker run --name kratos_test_database_cockroach -p 3446:26257 -p 3447:8080 -d cockroachdb/cockroach:v22.2.6 start-single-node --insecure
+docker run --name kratos_test_hydra -p 4444:4444 -p 4445:4445 -d -e DSN=memory -e URLS_SELF_ISSUER=http://localhost:4444/ -e URLS_LOGIN=http://localhost:4446/login -e URLS_CONSENT=http://localhost:4446/consent oryd/hydra:v2.0.2 serve all --dev
 
 source script/test-envs.sh
diff --git a/selfservice/flow/continue_with.go b/selfservice/flow/continue_with.go
index 7a5f9ce22410..bac63d72a273 100644
--- a/selfservice/flow/continue_with.go
+++ b/selfservice/flow/continue_with.go
@@ -89,6 +89,8 @@ type ContinueWithVerificationUIFlow struct {
 
 	// The URL of the verification flow
 	//
+	// If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
+	//
 	// required: false
 	URL string `json:"url,omitempty"`
 }
@@ -134,6 +136,7 @@ type ContinueWithSettingsUI struct {
 	//
 	// required: true
 	Action ContinueWithActionShowSettingsUI `json:"action"`
+
 	// Flow contains the ID of the verification flow
 	//
 	// required: true
@@ -146,13 +149,21 @@ type ContinueWithSettingsUIFlow struct {
 	//
 	// required: true
 	ID uuid.UUID `json:"id"`
+
+	// The URL of the settings flow
+	//
+	// If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
+	//
+	// required: false
+	URL string `json:"url,omitempty"`
 }
 
-func NewContinueWithSettingsUI(f Flow) *ContinueWithSettingsUI {
+func NewContinueWithSettingsUI(f Flow, redirectTo string) *ContinueWithSettingsUI {
 	return &ContinueWithSettingsUI{
 		Action: ContinueWithActionShowSettingsUIString,
 		Flow: ContinueWithSettingsUIFlow{
-			ID: f.GetID(),
+			ID:  f.GetID(),
+			URL: redirectTo,
 		},
 	}
 }
@@ -188,6 +199,8 @@ type ContinueWithRecoveryUIFlow struct {
 
 	// The URL of the recovery flow
 	//
+	// If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
+	//
 	// required: false
 	URL string `json:"url,omitempty"`
 }
@@ -201,6 +214,36 @@ func NewContinueWithRecoveryUI(f Flow) *ContinueWithRecoveryUI {
 	}
 }
 
+// swagger:enum ContinueWithActionRedirectBrowserTo
+type ContinueWithActionRedirectBrowserTo string
+
+// #nosec G101 -- only a key constant
+const (
+	ContinueWithActionRedirectBrowserToString ContinueWithActionRedirectBrowserTo = "redirect_browser_to"
+)
+
+// Indicates, that the UI flow could be continued by showing a recovery ui
+//
+// swagger:model continueWithRedirectBrowserTo
+type ContinueWithRedirectBrowserTo struct {
+	// Action will always be `redirect_browser_to`
+	//
+	// required: true
+	Action ContinueWithActionRedirectBrowserTo `json:"action"`
+
+	// The URL to redirect the browser to
+	//
+	// required: true
+	RedirectTo string `json:"redirect_browser_to"`
+}
+
+func NewContinueWithRedirectBrowserTo(redirectTo string) *ContinueWithRedirectBrowserTo {
+	return &ContinueWithRedirectBrowserTo{
+		Action:     ContinueWithActionRedirectBrowserToString,
+		RedirectTo: redirectTo,
+	}
+}
+
 func ErrorWithContinueWith(err *herodot.DefaultError, continueWith ...ContinueWith) *herodot.DefaultError {
 	if err.DetailsField == nil {
 		err.DetailsField = map[string]interface{}{}
diff --git a/selfservice/flow/error.go b/selfservice/flow/error.go
index d666822fa5c0..8449ec58ad3e 100644
--- a/selfservice/flow/error.go
+++ b/selfservice/flow/error.go
@@ -73,7 +73,7 @@ func NewFlowReplacedError(message *text.Message) *ReplacedError {
 	return &ReplacedError{
 		DefaultError: x.ErrGone.WithID(text.ErrIDSelfServiceFlowReplaced).
 			WithError("self-service flow replaced").
-			WithReasonf(message.Text),
+			WithReason(message.Text),
 	}
 }
 
diff --git a/selfservice/flow/login/error.go b/selfservice/flow/login/error.go
index 94311b92a815..ec58345eb3c6 100644
--- a/selfservice/flow/login/error.go
+++ b/selfservice/flow/login/error.go
@@ -6,6 +6,8 @@ package login
 import (
 	"net/http"
 
+	"github.com/gofrs/uuid"
+
 	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/kratos/selfservice/sessiontokenexchange"
@@ -79,19 +81,21 @@ func (s *ErrorHandler) PrepareReplacementForExpiredFlow(w http.ResponseWriter, r
 }
 
 func (s *ErrorHandler) WriteFlowError(w http.ResponseWriter, r *http.Request, f *Flow, group node.UiNodeGroup, err error) {
-	s.d.Audit().
+	logger := s.d.Audit().
 		WithError(err).
 		WithRequest(r).
-		WithField("login_flow", f).
+		WithField("login_flow", f.ToLoggerField())
+
+	logger.
 		Info("Encountered self-service login error.")
 
 	if f == nil {
-		trace.SpanFromContext(r.Context()).AddEvent(events.NewLoginFailed(r.Context(), "", "", false))
+		trace.SpanFromContext(r.Context()).AddEvent(events.NewLoginFailed(r.Context(), uuid.Nil, "", "", false, err))
 		s.forward(w, r, nil, err)
 		return
 	}
 
-	trace.SpanFromContext(r.Context()).AddEvent(events.NewLoginFailed(r.Context(), string(f.Type), string(f.RequestedAAL), f.Refresh))
+	trace.SpanFromContext(r.Context()).AddEvent(events.NewLoginFailed(r.Context(), f.ID, string(f.Type), string(f.RequestedAAL), f.Refresh, err))
 
 	if expired, inner := s.PrepareReplacementForExpiredFlow(w, r, f, err); inner != nil {
 		s.WriteFlowError(w, r, f, group, inner)
diff --git a/selfservice/flow/login/error_test.go b/selfservice/flow/login/error_test.go
index 5cc78c35bda1..20481cf290f9 100644
--- a/selfservice/flow/login/error_test.go
+++ b/selfservice/flow/login/error_test.go
@@ -74,7 +74,12 @@ func TestHandleError(t *testing.T) {
 		require.NoError(t, err)
 
 		for _, s := range reg.LoginStrategies(context.Background()) {
-			require.NoError(t, s.PopulateLoginMethod(req, identity.AuthenticatorAssuranceLevel1, f))
+			switch s.(type) {
+			case login.UnifiedFormHydrator:
+				require.NoError(t, s.(login.UnifiedFormHydrator).PopulateLoginMethod(req, identity.AuthenticatorAssuranceLevel1, f))
+			case login.FormHydrator:
+				require.NoError(t, s.(login.FormHydrator).PopulateLoginMethodFirstFactor(req, f))
+			}
 		}
 
 		require.NoError(t, reg.LoginFlowPersister().CreateLoginFlow(context.Background(), f))
@@ -87,7 +92,7 @@ func TestHandleError(t *testing.T) {
 		defer res.Body.Close()
 		require.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowErrorURL(ctx).String()+"?id=")
 
-		sse, _, err := sdk.FrontendApi.GetFlowError(context.Background()).Id(res.Request.URL.Query().Get("id")).Execute()
+		sse, _, err := sdk.FrontendAPI.GetFlowError(context.Background()).Id(res.Request.URL.Query().Get("id")).Execute()
 		require.NoError(t, err)
 
 		return sse.Error, nil
diff --git a/selfservice/flow/login/export_test.go b/selfservice/flow/login/export_test.go
index 645bcaf7c000..eafe4a70d179 100644
--- a/selfservice/flow/login/export_test.go
+++ b/selfservice/flow/login/export_test.go
@@ -4,11 +4,11 @@
 package login
 
 import (
-	"net/http"
+	"context"
 
 	"github.com/ory/kratos/session"
 )
 
-func RequiresAAL2ForTest(e HookExecutor, r *http.Request, s *session.Session) (bool, error) {
-	return e.requiresAAL2(r, s, nil) // *login.Flow is nil to avoid an import cycle
+func CheckAALForTest(ctx context.Context, e *HookExecutor, s *session.Session, flow *Flow) error {
+	return e.checkAAL(ctx, s, flow)
 }
diff --git a/selfservice/flow/login/flow.go b/selfservice/flow/login/flow.go
index a01d449a2751..1c04dcaf2ef4 100644
--- a/selfservice/flow/login/flow.go
+++ b/selfservice/flow/login/flow.go
@@ -155,6 +155,8 @@ type Flow struct {
 
 	// ReturnToVerification contains the redirect URL for the verification flow.
 	ReturnToVerification string `json:"-" db:"-"`
+
+	isAccountLinkingFlow bool `json:"-" db:"-"`
 }
 
 var _ flow.Flow = new(Flow)
@@ -230,9 +232,9 @@ func (f Flow) GetID() uuid.UUID {
 	return f.ID
 }
 
-// IsForced returns true if the login flow was triggered to re-authenticate the user.
+// IsRefresh returns true if the login flow was triggered to re-authenticate the user.
 // This is the case if the refresh query parameter is set to true.
-func (f *Flow) IsForced() bool {
+func (f *Flow) IsRefresh() bool {
 	return f.Refresh
 }
 
@@ -327,3 +329,20 @@ func (f *Flow) ContinueWith() []flow.ContinueWith {
 func (f *Flow) SetReturnToVerification(to string) {
 	f.ReturnToVerification = to
 }
+
+func (f *Flow) ToLoggerField() map[string]interface{} {
+	if f == nil {
+		return map[string]interface{}{}
+	}
+	return map[string]interface{}{
+		"id":            f.ID.String(),
+		"return_to":     f.ReturnTo,
+		"request_url":   f.RequestURL,
+		"active":        f.Active,
+		"type":          f.Type,
+		"nid":           f.NID,
+		"state":         f.State,
+		"refresh":       f.Refresh,
+		"requested_aal": f.RequestedAAL,
+	}
+}
diff --git a/selfservice/flow/login/flow_test.go b/selfservice/flow/login/flow_test.go
index 24c9d03dcb52..1df47e132974 100644
--- a/selfservice/flow/login/flow_test.go
+++ b/selfservice/flow/login/flow_test.go
@@ -16,11 +16,10 @@ import (
 
 	"github.com/tidwall/gjson"
 
-	"github.com/ory/x/jsonx"
-	"github.com/ory/x/sqlxx"
-
 	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/identity"
+	"github.com/ory/x/jsonx"
+	"github.com/ory/x/sqlxx"
 
 	"github.com/ory/kratos/internal"
 
diff --git a/selfservice/flow/login/handler.go b/selfservice/flow/login/handler.go
index 88b3712602a0..f98ba66cd3fb 100644
--- a/selfservice/flow/login/handler.go
+++ b/selfservice/flow/login/handler.go
@@ -9,6 +9,8 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/ory/x/otelx"
+
 	"github.com/gofrs/uuid"
 	"github.com/julienschmidt/httprouter"
 	"github.com/pkg/errors"
@@ -54,6 +56,7 @@ type (
 		x.WriterProvider
 		x.CSRFTokenGeneratorProvider
 		x.CSRFProvider
+		x.TracingProvider
 		config.Provider
 		ErrorHandlerProvider
 		sessiontokenexchange.PersistenceProvider
@@ -101,6 +104,18 @@ func WithFlowReturnTo(returnTo string) FlowOption {
 	}
 }
 
+func WithOrganizationID(organizationID uuid.NullUUID) FlowOption {
+	return func(f *Flow) {
+		f.OrganizationID = organizationID
+	}
+}
+
+func WithRequestedAAL(aal identity.AuthenticatorAssuranceLevel) FlowOption {
+	return func(f *Flow) {
+		f.RequestedAAL = aal
+	}
+}
+
 func WithInternalContext(internalContext []byte) FlowOption {
 	return func(f *Flow) {
 		f.InternalContext = internalContext
@@ -115,6 +130,12 @@ func WithFormErrorMessage(messages []text.Message) FlowOption {
 	}
 }
 
+func WithIsAccountLinking() FlowOption {
+	return func(f *Flow) {
+		f.isAccountLinkingFlow = true
+	}
+}
+
 func (h *Handler) NewLoginFlow(w http.ResponseWriter, r *http.Request, ft flow.Type, opts ...FlowOption) (*Flow, *session.Session, error) {
 	conf := h.d.Config()
 	f, err := NewFlow(conf, conf.SelfServiceFlowLoginRequestLifespan(r.Context()), h.d.GenerateCSRFToken(r), r, ft)
@@ -208,12 +229,49 @@ preLoginHook:
 
 	if orgID.Valid {
 		f.OrganizationID = orgID
-		strategyFilters = []StrategyFilter{func(s Strategy) bool { return s.ID() == identity.CredentialsTypeOIDC }}
+		if f.RequestedAAL == identity.AuthenticatorAssuranceLevel1 {
+			// We only apply the filter on AAL1, because the OIDC strategy can only satsify
+			// AAL1.
+			strategyFilters = []StrategyFilter{func(s Strategy) bool {
+				return s.ID() == identity.CredentialsTypeOIDC || s.ID() == identity.CredentialsTypeSAML
+			}}
+		}
 	}
 
 	for _, s := range h.d.LoginStrategies(r.Context(), strategyFilters...) {
-		if err := s.PopulateLoginMethod(r, f.RequestedAAL, f); err != nil {
-			return nil, nil, err
+		var populateErr error
+
+		switch strategy := s.(type) {
+		case FormHydrator:
+			switch {
+			case f.RequestedAAL == identity.AuthenticatorAssuranceLevel1:
+				switch {
+				case f.IsRefresh():
+					// Refreshing takes precedence over identifier_first auth which can not be a refresh flow.
+					// Therefor this comes first.
+					populateErr = strategy.PopulateLoginMethodFirstFactorRefresh(r, f)
+				case h.d.Config().SelfServiceLoginFlowIdentifierFirstEnabled(r.Context()) && !f.isAccountLinkingFlow:
+					populateErr = strategy.PopulateLoginMethodIdentifierFirstIdentification(r, f)
+				default:
+					populateErr = strategy.PopulateLoginMethodFirstFactor(r, f)
+				}
+			case f.RequestedAAL == identity.AuthenticatorAssuranceLevel2:
+				switch {
+				case f.IsRefresh():
+					// Refresh takes precedence.
+					populateErr = strategy.PopulateLoginMethodSecondFactorRefresh(r, f)
+				default:
+					populateErr = strategy.PopulateLoginMethodSecondFactor(r, f)
+				}
+			}
+		case UnifiedFormHydrator:
+			populateErr = strategy.PopulateLoginMethod(r, f.RequestedAAL, f)
+		default:
+			populateErr = errors.WithStack(x.PseudoPanic.WithReasonf("A login strategy was expected to implement one of the interfaces UnifiedFormHydrator or FormHydrator but did not."))
+		}
+
+		if populateErr != nil {
+			return nil, nil, populateErr
 		}
 	}
 
@@ -297,8 +355,18 @@ type createNativeLoginFlow struct {
 	// in: query
 	ReturnTo string `json:"return_to"`
 
+	// An optional organization ID that should be used for logging this user in.
+	// This parameter is only effective in the Ory Network.
+	//
+	// required: false
+	// in: query
+	Organization string `json:"organization"`
+
 	// Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.
 	//
+	// DEPRECATED: This field is deprecated. Please remove it from your requests. The user will now see a choice
+	// of MFA credentials to choose from to perform the second factor instead.
+	//
 	// in: query
 	Via string `json:"via"`
 }
@@ -338,6 +406,11 @@ type createNativeLoginFlow struct {
 //	  400: errorGeneric
 //	  default: errorGeneric
 func (h *Handler) createNativeLoginFlow(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+	var err error
+	ctx, span := h.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.flow.login.createNativeLoginFlow")
+	r = r.WithContext(ctx)
+	defer otelx.End(span, &err)
+
 	f, _, err := h.NewLoginFlow(w, r, flow.TypeAPI)
 	if err != nil {
 		h.d.Writer().WriteError(w, r, err)
@@ -406,6 +479,9 @@ type createBrowserLoginFlow struct {
 
 	// Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.
 	//
+	// DEPRECATED: This field is deprecated. Please remove it from your requests. The user will now see a choice
+	// of MFA credentials to choose from to perform the second factor instead.
+	//
 	// in: query
 	Via string `json:"via"`
 }
@@ -449,6 +525,11 @@ type createBrowserLoginFlow struct {
 //	  400: errorGeneric
 //	  default: errorGeneric
 func (h *Handler) createBrowserLoginFlow(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+	var err error
+	ctx, span := h.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.flow.login.createBrowserLoginFlow")
+	r = r.WithContext(ctx)
+	defer otelx.End(span, &err)
+
 	var (
 		hydraLoginRequest   *hydraclientgo.OAuth2LoginRequest
 		hydraLoginChallenge sqlxx.NullString
@@ -457,13 +538,13 @@ func (h *Handler) createBrowserLoginFlow(w http.ResponseWriter, r *http.Request,
 		var err error
 		hydraLoginChallenge, err = hydra.GetLoginChallengeID(h.d.Config(), r)
 		if err != nil {
-			h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, err)
+			h.d.SelfServiceErrorManager().Forward(ctx, w, r, err)
 			return
 		}
 
-		hydraLoginRequest, err = h.d.Hydra().GetLoginRequest(r.Context(), string(hydraLoginChallenge))
+		hydraLoginRequest, err = h.d.Hydra().GetLoginRequest(ctx, string(hydraLoginChallenge))
 		if err != nil {
-			h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, err)
+			h.d.SelfServiceErrorManager().Forward(ctx, w, r, err)
 			return
 		}
 
@@ -479,7 +560,7 @@ func (h *Handler) createBrowserLoginFlow(w http.ResponseWriter, r *http.Request,
 		// different flows, such as login to registration and login to recovery.
 		// After completing a complex flow, such as recovery, we want the user
 		// to be redirected back to the original OAuth2 login flow.
-		if hydraLoginRequest.RequestUrl != "" && h.d.Config().OAuth2ProviderOverrideReturnTo(r.Context()) {
+		if hydraLoginRequest.RequestUrl != "" && h.d.Config().OAuth2ProviderOverrideReturnTo(ctx) {
 			// replace the return_to query parameter
 			q := r.URL.Query()
 			q.Set("return_to", hydraLoginRequest.RequestUrl)
@@ -491,11 +572,11 @@ func (h *Handler) createBrowserLoginFlow(w http.ResponseWriter, r *http.Request,
 	if errors.Is(err, ErrAlreadyLoggedIn) {
 		if hydraLoginRequest != nil {
 			if !hydraLoginRequest.GetSkip() {
-				h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, errors.WithStack(herodot.ErrInternalServerError.WithReason("ErrAlreadyLoggedIn indicated we can skip login, but Hydra asked us to refresh")))
+				h.d.SelfServiceErrorManager().Forward(ctx, w, r, errors.WithStack(herodot.ErrInternalServerError.WithReason("ErrAlreadyLoggedIn indicated we can skip login, but Hydra asked us to refresh")))
 				return
 			}
 
-			rt, err := h.d.Hydra().AcceptLoginRequest(r.Context(),
+			rt, err := h.d.Hydra().AcceptLoginRequest(ctx,
 				hydra.AcceptLoginRequestParams{
 					LoginChallenge:        string(hydraLoginChallenge),
 					IdentityID:            sess.IdentityID.String(),
@@ -503,37 +584,37 @@ func (h *Handler) createBrowserLoginFlow(w http.ResponseWriter, r *http.Request,
 					AuthenticationMethods: sess.AMR,
 				})
 			if err != nil {
-				h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, err)
+				h.d.SelfServiceErrorManager().Forward(ctx, w, r, err)
 				return
 			}
 			returnTo, err := url.Parse(rt)
 			if err != nil {
-				h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to parse URL: %s", rt)))
+				h.d.SelfServiceErrorManager().Forward(ctx, w, r, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to parse URL: %s", rt)))
 				return
 			}
 			x.AcceptToRedirectOrJSON(w, r, h.d.Writer(), err, returnTo.String())
 			return
 		}
 
-		returnTo, redirErr := x.SecureRedirectTo(r, h.d.Config().SelfServiceBrowserDefaultReturnTo(r.Context()),
-			x.SecureRedirectAllowSelfServiceURLs(h.d.Config().SelfPublicURL(r.Context())),
-			x.SecureRedirectAllowURLs(h.d.Config().SelfServiceBrowserAllowedReturnToDomains(r.Context())),
+		returnTo, redirErr := x.SecureRedirectTo(r, h.d.Config().SelfServiceBrowserDefaultReturnTo(ctx),
+			x.SecureRedirectAllowSelfServiceURLs(h.d.Config().SelfPublicURL(ctx)),
+			x.SecureRedirectAllowURLs(h.d.Config().SelfServiceBrowserAllowedReturnToDomains(ctx)),
 		)
 		if redirErr != nil {
-			h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, redirErr)
+			h.d.SelfServiceErrorManager().Forward(ctx, w, r, redirErr)
 			return
 		}
 
 		x.AcceptToRedirectOrJSON(w, r, h.d.Writer(), err, returnTo.String())
 		return
 	} else if err != nil {
-		h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, err)
+		h.d.SelfServiceErrorManager().Forward(ctx, w, r, err)
 		return
 	}
 
 	a.HydraLoginRequest = hydraLoginRequest
 
-	x.AcceptToRedirectOrJSON(w, r, h.d.Writer(), a, a.AppendTo(h.d.Config().SelfServiceFlowLoginUI(r.Context())).String())
+	x.AcceptToRedirectOrJSON(w, r, h.d.Writer(), a, a.AppendTo(h.d.Config().SelfServiceFlowLoginUI(ctx)).String())
 }
 
 // Get Login Flow Parameters
@@ -602,7 +683,12 @@ type getLoginFlow struct {
 //	  410: errorGeneric
 //	  default: errorGeneric
 func (h *Handler) getLoginFlow(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	ar, err := h.d.LoginFlowPersister().GetLoginFlow(r.Context(), x.ParseUUID(r.URL.Query().Get("id")))
+	var err error
+	ctx, span := h.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.flow.login.getLoginFlow")
+	r = r.WithContext(ctx)
+	defer otelx.End(span, &err)
+
+	ar, err := h.d.LoginFlowPersister().GetLoginFlow(ctx, x.ParseUUID(r.URL.Query().Get("id")))
 	if err != nil {
 		h.d.Writer().WriteError(w, r, err)
 		return
@@ -618,7 +704,7 @@ func (h *Handler) getLoginFlow(w http.ResponseWriter, r *http.Request, _ httprou
 
 	if ar.ExpiresAt.Before(time.Now()) {
 		if ar.Type == flow.TypeBrowser {
-			redirectURL := flow.GetFlowExpiredRedirectURL(r.Context(), h.d.Config(), RouteInitBrowserFlow, ar.ReturnTo)
+			redirectURL := flow.GetFlowExpiredRedirectURL(ctx, h.d.Config(), RouteInitBrowserFlow, ar.ReturnTo)
 
 			h.d.Writer().WriteError(w, r, errors.WithStack(x.ErrGone.WithID(text.ErrIDSelfServiceFlowExpired).
 				WithReason("The login flow has expired. Redirect the user to the login flow init endpoint to initialize a new login flow.").
@@ -628,16 +714,16 @@ func (h *Handler) getLoginFlow(w http.ResponseWriter, r *http.Request, _ httprou
 		}
 		h.d.Writer().WriteError(w, r, errors.WithStack(x.ErrGone.WithID(text.ErrIDSelfServiceFlowExpired).
 			WithReason("The login flow has expired. Call the login flow init API endpoint to initialize a new login flow.").
-			WithDetail("api", urlx.AppendPaths(h.d.Config().SelfPublicURL(r.Context()), RouteInitAPIFlow).String())))
+			WithDetail("api", urlx.AppendPaths(h.d.Config().SelfPublicURL(ctx), RouteInitAPIFlow).String())))
 		return
 	}
 
 	if ar.OAuth2LoginChallenge != "" {
-		hlr, err := h.d.Hydra().GetLoginRequest(r.Context(), string(ar.OAuth2LoginChallenge))
+		hlr, err := h.d.Hydra().GetLoginRequest(ctx, string(ar.OAuth2LoginChallenge))
 		if err != nil {
 			// We don't redirect back to the third party on errors because Hydra doesn't
 			// give us the 3rd party return_uri when it redirects to the login UI.
-			h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, err)
+			h.d.SelfServiceErrorManager().Forward(ctx, w, r, err)
 			return
 		}
 		ar.HydraLoginRequest = hlr
@@ -739,19 +825,24 @@ type updateLoginFlowBody struct{}
 //	  422: errorBrowserLocationChangeRequired
 //	  default: errorGeneric
 func (h *Handler) updateLoginFlow(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+	var err error
+	ctx, span := h.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.flow.login.updateLoginFlow")
+	r = r.WithContext(ctx)
+	defer otelx.End(span, &err)
+
 	rid, err := flow.GetFlowID(r)
 	if err != nil {
 		h.d.LoginFlowErrorHandler().WriteFlowError(w, r, nil, node.DefaultGroup, err)
 		return
 	}
 
-	f, err := h.d.LoginFlowPersister().GetLoginFlow(r.Context(), rid)
+	f, err := h.d.LoginFlowPersister().GetLoginFlow(ctx, rid)
 	if err != nil {
 		h.d.LoginFlowErrorHandler().WriteFlowError(w, r, f, node.DefaultGroup, err)
 		return
 	}
 
-	sess, err := h.d.SessionManager().FetchFromRequest(r.Context(), r)
+	sess, err := h.d.SessionManager().FetchFromRequest(ctx, r)
 	if err == nil {
 		if f.Refresh {
 			// If we want to refresh, continue the login
@@ -769,7 +860,7 @@ func (h *Handler) updateLoginFlow(w http.ResponseWriter, r *http.Request, _ http
 			return
 		}
 
-		http.Redirect(w, r, h.d.Config().SelfServiceBrowserDefaultReturnTo(r.Context()).String(), http.StatusSeeOther)
+		http.Redirect(w, r, h.d.Config().SelfServiceBrowserDefaultReturnTo(ctx).String(), http.StatusSeeOther)
 		return
 	} else if e := new(session.ErrNoActiveSessionFound); errors.As(err, &e) {
 		// Only failure scenario here is if we try to upgrade the session to a higher AAL without actually
@@ -811,7 +902,7 @@ continueLogin:
 			sess = session.NewInactiveSession()
 		}
 
-		method := ss.CompletedAuthenticationMethod(r.Context(), sess.AMR)
+		method := ss.CompletedAuthenticationMethod(ctx)
 		sess.CompletedLoginForMethod(method)
 		i = interim
 		break
diff --git a/selfservice/flow/login/handler_test.go b/selfservice/flow/login/handler_test.go
index c8d5ac97772e..504db9436100 100644
--- a/selfservice/flow/login/handler_test.go
+++ b/selfservice/flow/login/handler_test.go
@@ -21,12 +21,11 @@ import (
 
 	"github.com/ory/x/sqlxx"
 
+	stdtotp "github.com/pquerna/otp/totp"
+
 	"github.com/ory/kratos/hydra"
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/strategy/totp"
-	"github.com/ory/kratos/session"
-
-	stdtotp "github.com/pquerna/otp/totp"
 
 	"github.com/ory/kratos/ui/container"
 
@@ -458,7 +457,7 @@ func TestFlowLifecycle(t *testing.T) {
 			require.NoError(t, reg.IdentityManager().Update(context.Background(), id, identity.ManagerAllowWriteProtectedTraits))
 
 			h := func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-				sess, err := session.NewActiveSession(r, id, reg.Config(), time.Now().UTC(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+				sess, err := testhelpers.NewActiveSession(r, reg, id, time.Now().UTC(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 				require.NoError(t, err)
 				sess.AuthenticatorAssuranceLevel = identity.AuthenticatorAssuranceLevel1
 				require.NoError(t, reg.SessionPersister().UpsertSession(context.Background(), sess))
diff --git a/selfservice/flow/login/hook.go b/selfservice/flow/login/hook.go
index f0e06ccfc934..5978cb5a3b33 100644
--- a/selfservice/flow/login/hook.go
+++ b/selfservice/flow/login/hook.go
@@ -7,12 +7,12 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"net/url"
 	"time"
 
 	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
-	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/hydra"
@@ -48,6 +48,7 @@ type (
 		config.Provider
 		hydra.Provider
 		identity.PrivilegedPoolProvider
+		identity.ManagementProvider
 		session.ManagementProvider
 		session.PersistenceProvider
 		x.CSRFTokenGeneratorProvider
@@ -55,6 +56,7 @@ type (
 		x.LoggingProvider
 		x.TracingProvider
 		sessiontokenexchange.PersistenceProvider
+		HandlerProvider
 
 		FlowPersistenceProvider
 		HooksProvider
@@ -80,19 +82,20 @@ func NewHookExecutor(d executorDependencies) *HookExecutor {
 	return &HookExecutor{d: d}
 }
 
-func (e *HookExecutor) requiresAAL2(r *http.Request, s *session.Session, a *Flow) (bool, error) {
-	err := e.d.SessionManager().DoesSessionSatisfy(r, s, e.d.Config().SessionWhoAmIAAL(r.Context()))
+func (e *HookExecutor) checkAAL(ctx context.Context, s *session.Session, a *Flow) error {
+	err := e.d.SessionManager().DoesSessionSatisfy(ctx, s, e.d.Config().SessionWhoAmIAAL(ctx))
+	if err == nil {
+		return nil
+	}
 
 	if aalErr := new(session.ErrAALNotSatisfied); errors.As(err, &aalErr) {
-		if aalErr.PassReturnToAndLoginChallengeParameters(a.RequestURL) != nil {
+		if a != nil && aalErr.PassReturnToAndLoginChallengeParameters(a.RequestURL) != nil {
 			_ = aalErr.WithDetail("pass_request_params_error", "failed to pass request parameters to aalErr.RedirectTo")
 		}
-		return true, aalErr
-	} else if err != nil {
-		return true, errors.WithStack(err)
+		return aalErr
 	}
 
-	return false, nil
+	return err
 }
 
 func (e *HookExecutor) handleLoginError(_ http.ResponseWriter, r *http.Request, g node.UiNodeGroup, f *Flow, i *identity.Identity, flowError error) error {
@@ -132,23 +135,27 @@ func (e *HookExecutor) PostLoginHook(
 	r = r.WithContext(ctx)
 	defer otelx.End(span, &err)
 
-	if err := e.maybeLinkCredentials(r.Context(), s, i, f); err != nil {
+	// We need to set the identity here because we check the available AAL in maybeLinkCredentials.
+	s.IdentityID = i.ID
+	s.Identity = i
+
+	if err := e.maybeLinkCredentials(ctx, s, i, f); err != nil {
 		return err
 	}
 
-	if err := s.Activate(r, i, e.d.Config(), time.Now().UTC()); err != nil {
+	if err := e.d.SessionManager().ActivateSession(r, s, i, time.Now().UTC()); err != nil {
 		return err
 	}
 
 	c := e.d.Config()
 	// Verify the redirect URL before we do any other processing.
 	returnTo, err := x.SecureRedirectTo(r,
-		c.SelfServiceBrowserDefaultReturnTo(r.Context()),
+		c.SelfServiceBrowserDefaultReturnTo(ctx),
 		x.SecureRedirectReturnTo(f.ReturnTo),
 		x.SecureRedirectUseSourceURL(f.RequestURL),
-		x.SecureRedirectAllowURLs(c.SelfServiceBrowserAllowedReturnToDomains(r.Context())),
-		x.SecureRedirectAllowSelfServiceURLs(c.SelfPublicURL(r.Context())),
-		x.SecureRedirectOverrideDefaultReturnTo(c.SelfServiceFlowLoginReturnTo(r.Context(), f.Active.String())),
+		x.SecureRedirectAllowURLs(c.SelfServiceBrowserAllowedReturnToDomains(ctx)),
+		x.SecureRedirectAllowSelfServiceURLs(c.SelfPublicURL(ctx)),
+		x.SecureRedirectOverrideDefaultReturnTo(c.SelfServiceFlowLoginReturnTo(ctx, f.Active.String())),
 	)
 	if err != nil {
 		return err
@@ -159,6 +166,10 @@ func (e *HookExecutor) PostLoginHook(
 		"redirect_reason": "login successful",
 	})...)
 
+	if f.Type == flow.TypeBrowser && x.IsJSONRequest(r) {
+		f.AddContinueWith(flow.NewContinueWithRedirectBrowserTo(returnTo.String()))
+	}
+
 	classified := s
 	s = s.Declassified()
 
@@ -167,14 +178,14 @@ func (e *HookExecutor) PostLoginHook(
 		WithField("identity_id", i.ID).
 		WithField("flow_method", f.Active).
 		Debug("Running ExecuteLoginPostHook.")
-	for k, executor := range e.d.PostLoginHooks(r.Context(), f.Active) {
+	for k, executor := range e.d.PostLoginHooks(ctx, f.Active) {
 		if err := executor.ExecuteLoginPostHook(w, r, g, f, s); err != nil {
 			if errors.Is(err, ErrHookAbortFlow) {
 				e.d.Logger().
 					WithRequest(r).
 					WithField("executor", fmt.Sprintf("%T", executor)).
 					WithField("executor_position", k).
-					WithField("executors", PostHookExecutorNames(e.d.PostLoginHooks(r.Context(), f.Active))).
+					WithField("executors", PostHookExecutorNames(e.d.PostLoginHooks(ctx, f.Active))).
 					WithField("identity_id", i.ID).
 					WithField("flow_method", f.Active).
 					Debug("A ExecuteLoginPostHook hook aborted early.")
@@ -190,7 +201,7 @@ func (e *HookExecutor) PostLoginHook(
 			WithRequest(r).
 			WithField("executor", fmt.Sprintf("%T", executor)).
 			WithField("executor_position", k).
-			WithField("executors", PostHookExecutorNames(e.d.PostLoginHooks(r.Context(), f.Active))).
+			WithField("executors", PostHookExecutorNames(e.d.PostLoginHooks(ctx, f.Active))).
 			WithField("identity_id", i.ID).
 			WithField("flow_method", f.Active).
 			Debug("ExecuteLoginPostHook completed successfully.")
@@ -198,7 +209,7 @@ func (e *HookExecutor) PostLoginHook(
 
 	if f.Type == flow.TypeAPI {
 		span.SetAttributes(attribute.String("flow_type", string(flow.TypeAPI)))
-		if err := e.d.SessionPersister().UpsertSession(r.Context(), s); err != nil {
+		if err := e.d.SessionPersister().UpsertSession(ctx, s); err != nil {
 			return errors.WithStack(err)
 		}
 		e.d.Audit().
@@ -207,9 +218,10 @@ func (e *HookExecutor) PostLoginHook(
 			WithField("identity_id", i.ID).
 			Info("Identity authenticated successfully and was issued an Ory Kratos Session Token.")
 
-		span.AddEvent(events.NewLoginSucceeded(r.Context(), &events.LoginSucceededOpts{
+		span.AddEvent(events.NewLoginSucceeded(ctx, &events.LoginSucceededOpts{
 			SessionID:    s.ID,
 			IdentityID:   i.ID,
+			FlowID:       f.ID,
 			FlowType:     string(f.Type),
 			RequestedAAL: string(f.RequestedAAL),
 			IsRefresh:    f.Refresh,
@@ -230,7 +242,7 @@ func (e *HookExecutor) PostLoginHook(
 			Token:        s.Token,
 			ContinueWith: f.ContinueWith(),
 		}
-		if required, _ := e.requiresAAL2(r, classified, f); required {
+		if e.checkAAL(ctx, classified, f) != nil {
 			// If AAL is not satisfied, we omit the identity to preserve the user's privacy in case of a phishing attack.
 			response.Session.Identity = nil
 		}
@@ -239,7 +251,7 @@ func (e *HookExecutor) PostLoginHook(
 		return nil
 	}
 
-	if err := e.d.SessionManager().UpsertAndIssueCookie(r.Context(), w, r, s); err != nil {
+	if err := e.d.SessionManager().UpsertAndIssueCookie(ctx, w, r, s); err != nil {
 		return errors.WithStack(err)
 	}
 
@@ -249,8 +261,9 @@ func (e *HookExecutor) PostLoginHook(
 		WithField("session_id", s.ID).
 		Info("Identity authenticated successfully and was issued an Ory Kratos Session Cookie.")
 
-	trace.SpanFromContext(r.Context()).AddEvent(events.NewLoginSucceeded(r.Context(), &events.LoginSucceededOpts{
+	span.AddEvent(events.NewLoginSucceeded(ctx, &events.LoginSucceededOpts{
 		SessionID:  s.ID,
+		FlowID:     f.ID,
 		IdentityID: i.ID, FlowType: string(f.Type), RequestedAAL: string(f.RequestedAAL), IsRefresh: f.Refresh, Method: f.Active.String(),
 		SSOProvider: provider,
 	}))
@@ -262,10 +275,30 @@ func (e *HookExecutor) PostLoginHook(
 		s.Token = ""
 
 		// If we detect that whoami would require a higher AAL, we redirect!
-		if _, err := e.requiresAAL2(r, s, f); err != nil {
+		if err := e.checkAAL(ctx, classified, f); err != nil {
 			if aalErr := new(session.ErrAALNotSatisfied); errors.As(err, &aalErr) {
-				span.SetAttributes(attribute.String("return_to", aalErr.RedirectTo), attribute.String("redirect_reason", "requires aal2"))
-				e.d.Writer().WriteError(w, r, flow.NewBrowserLocationChangeRequiredError(aalErr.RedirectTo))
+				if data, _ := flow.DuplicateCredentials(f); data == nil {
+					span.SetAttributes(attribute.String("return_to", aalErr.RedirectTo), attribute.String("redirect_reason", "requires aal2"))
+					e.d.Writer().WriteError(w, r, flow.NewBrowserLocationChangeRequiredError(aalErr.RedirectTo))
+					return nil
+				}
+
+				// Special case: If we are in a flow that wants to link credentials, we create a
+				// new login flow here that asks for the require AAL, but also copies over the
+				// internal context and the organization ID.
+				r.URL, err = url.Parse(aalErr.RedirectTo)
+				if err != nil {
+					return errors.WithStack(err)
+				}
+				newFlow, _, err := e.d.LoginHandler().NewLoginFlow(w, r, flow.TypeBrowser,
+					WithInternalContext(f.InternalContext),
+					WithOrganizationID(f.OrganizationID),
+				)
+				if err != nil {
+					return errors.WithStack(err)
+				}
+
+				x.AcceptToRedirectOrJSON(w, r, e.d.Writer(), newFlow, newFlow.AppendTo(e.d.Config().SelfServiceFlowLoginUI(ctx)).String())
 				return nil
 			}
 			return err
@@ -274,7 +307,7 @@ func (e *HookExecutor) PostLoginHook(
 		// If Kratos is used as a Hydra login provider, we need to redirect back to Hydra by returning a 422 status
 		// with the post login challenge URL as the body.
 		if f.OAuth2LoginChallenge != "" {
-			postChallengeURL, err := e.d.Hydra().AcceptLoginRequest(r.Context(),
+			postChallengeURL, err := e.d.Hydra().AcceptLoginRequest(ctx,
 				hydra.AcceptLoginRequestParams{
 					LoginChallenge:        string(f.OAuth2LoginChallenge),
 					IdentityID:            i.ID.String(),
@@ -298,9 +331,29 @@ func (e *HookExecutor) PostLoginHook(
 	}
 
 	// If we detect that whoami would require a higher AAL, we redirect!
-	if _, err := e.requiresAAL2(r, s, f); err != nil {
+	if err := e.checkAAL(ctx, classified, f); err != nil {
 		if aalErr := new(session.ErrAALNotSatisfied); errors.As(err, &aalErr) {
-			http.Redirect(w, r, aalErr.RedirectTo, http.StatusSeeOther)
+			if data, _ := flow.DuplicateCredentials(f); data == nil {
+				http.Redirect(w, r, aalErr.RedirectTo, http.StatusSeeOther)
+				return nil
+			}
+
+			// Special case: If we are in a flow that wants to link credentials, we create a
+			// new login flow here that asks for the require AAL, but also copies over the
+			// internal context and the organization ID.
+			r.URL, err = url.Parse(aalErr.RedirectTo)
+			if err != nil {
+				return errors.WithStack(err)
+			}
+			newFlow, _, err := e.d.LoginHandler().NewLoginFlow(w, r, flow.TypeBrowser,
+				WithInternalContext(f.InternalContext),
+				WithOrganizationID(f.OrganizationID),
+			)
+			if err != nil {
+				return errors.WithStack(err)
+			}
+
+			x.AcceptToRedirectOrJSON(w, r, e.d.Writer(), newFlow, newFlow.AppendTo(e.d.Config().SelfServiceFlowLoginUI(ctx)).String())
 			return nil
 		}
 		return errors.WithStack(err)
@@ -308,7 +361,7 @@ func (e *HookExecutor) PostLoginHook(
 
 	finalReturnTo := returnTo.String()
 	if f.OAuth2LoginChallenge != "" {
-		rt, err := e.d.Hydra().AcceptLoginRequest(r.Context(),
+		rt, err := e.d.Hydra().AcceptLoginRequest(ctx,
 			hydra.AcceptLoginRequestParams{
 				LoginChallenge:        string(f.OAuth2LoginChallenge),
 				IdentityID:            i.ID.String(),
@@ -341,6 +394,11 @@ func (e *HookExecutor) PreLoginHook(w http.ResponseWriter, r *http.Request, a *F
 
 // maybeLinkCredentials links the identity with the credentials of the inner context of the login flow.
 func (e *HookExecutor) maybeLinkCredentials(ctx context.Context, sess *session.Session, ident *identity.Identity, loginFlow *Flow) error {
+	if e.checkAAL(ctx, sess, loginFlow) != nil {
+		// we don't yet want to link credentials because the required AAL is not satisfied
+		return nil
+	}
+
 	lc, err := flow.DuplicateCredentials(loginFlow)
 	if err != nil {
 		return err
@@ -348,7 +406,7 @@ func (e *HookExecutor) maybeLinkCredentials(ctx context.Context, sess *session.S
 		return nil
 	}
 
-	if err := e.checkDuplicateCredentialsIdentifierMatch(ctx, ident.ID, lc.DuplicateIdentifier); err != nil {
+	if err = e.checkDuplicateCredentialsIdentifierMatch(ctx, ident.ID, lc.DuplicateIdentifier); err != nil {
 		return err
 	}
 	strategy, err := e.d.AllLoginStrategies().Strategy(lc.CredentialsType)
@@ -366,8 +424,9 @@ func (e *HookExecutor) maybeLinkCredentials(ctx context.Context, sess *session.S
 		return err
 	}
 
-	method := strategy.CompletedAuthenticationMethod(ctx, sess.AMR)
-	sess.CompletedLoginForMethod(method)
+	if err = linkableStrategy.CompletedLogin(sess, lc); err != nil {
+		return err
+	}
 
 	return nil
 }
diff --git a/selfservice/flow/login/hook_test.go b/selfservice/flow/login/hook_test.go
index fe73f22d7eef..c75118f369e6 100644
--- a/selfservice/flow/login/hook_test.go
+++ b/selfservice/flow/login/hook_test.go
@@ -5,28 +5,30 @@ package login_test
 
 import (
 	"context"
+	"database/sql"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"testing"
 	"time"
 
-	"github.com/stretchr/testify/require"
-
-	"github.com/gobuffalo/httptest"
+	"github.com/gofrs/uuid"
 	"github.com/julienschmidt/httprouter"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/tidwall/gjson"
 
-	"github.com/ory/kratos/hydra"
-	"github.com/ory/kratos/schema"
-	"github.com/ory/kratos/session"
-
 	"github.com/ory/kratos/driver/config"
+	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
+	"github.com/ory/kratos/hydra"
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/internal"
 	"github.com/ory/kratos/internal/testhelpers"
+	"github.com/ory/kratos/schema"
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/session"
+	"github.com/ory/kratos/ui/node"
 	"github.com/ory/kratos/x"
 )
 
@@ -35,8 +37,6 @@ func TestLoginExecutor(t *testing.T) {
 	ctx := context.Background()
 
 	for _, strategy := range identity.AllCredentialTypes {
-		strategy := strategy
-
 		t.Run("strategy="+strategy.String(), func(t *testing.T) {
 			t.Parallel()
 
@@ -44,6 +44,7 @@ func TestLoginExecutor(t *testing.T) {
 			reg.WithHydra(hydra.NewFake())
 			testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/login.schema.json")
 			conf.MustSet(ctx, config.ViperKeySelfServiceBrowserDefaultReturnTo, "https://www.ory.sh/")
+			_ = testhelpers.NewLoginUIFlowEchoServer(t, reg)
 
 			newServer := func(t *testing.T, ft flow.Type, useIdentity *identity.Identity, flowCallback ...func(*login.Flow)) *httptest.Server {
 				router := httprouter.New()
@@ -75,6 +76,26 @@ func TestLoginExecutor(t *testing.T) {
 						reg.LoginHookExecutor().PostLoginHook(w, r, strategy.ToUiNodeGroup(), loginFlow, useIdentity, sess, ""))
 				})
 
+				router.GET("/login/post2fa", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+					loginFlow, err := login.NewFlow(conf, time.Minute, "", r, ft)
+					require.NoError(t, err)
+					loginFlow.Active = strategy
+					loginFlow.RequestURL = x.RequestURL(r).String()
+					for _, cb := range flowCallback {
+						cb(loginFlow)
+					}
+
+					sess := session.NewInactiveSession()
+					sess.CompletedLoginFor(identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+					sess.CompletedLoginFor(identity.CredentialsTypeTOTP, identity.AuthenticatorAssuranceLevel2)
+					if useIdentity == nil {
+						useIdentity = testhelpers.SelfServiceHookCreateFakeIdentity(t, reg)
+					}
+
+					testhelpers.SelfServiceHookLoginErrorHandler(t, w, r,
+						reg.LoginHookExecutor().PostLoginHook(w, r, strategy.ToUiNodeGroup(), loginFlow, useIdentity, sess, ""))
+				})
+
 				ts := httptest.NewServer(router)
 				t.Cleanup(ts.Close)
 				conf.MustSet(ctx, config.ViperKeyPublicBaseURL, ts.URL)
@@ -93,22 +114,34 @@ func TestLoginExecutor(t *testing.T) {
 					assert.EqualValues(t, "https://www.ory.sh/", res.Request.URL.String())
 				})
 
+				t.Run("case=pass without hooks if client is ajax", func(t *testing.T) {
+					t.Cleanup(testhelpers.SelfServiceHookConfigReset(t, conf))
+
+					ts := newServer(t, flow.TypeBrowser, nil)
+					res, body := makeRequestPost(t, ts, true, url.Values{})
+					require.Equal(t, http.StatusOK, res.StatusCode)
+					assert.Contains(t, res.Request.URL.String(), ts.URL)
+					assert.EqualValues(t, gjson.Get(body, "continue_with").Raw, `[{"action":"redirect_browser_to","redirect_browser_to":"https://www.ory.sh/"}]`)
+				})
+
 				t.Run("case=pass if hooks pass", func(t *testing.T) {
 					t.Cleanup(testhelpers.SelfServiceHookConfigReset(t, conf))
 					viperSetPost(t, conf, strategy.String(), []config.SelfServiceHook{{Name: "err", Config: []byte(`{}`)}})
 
 					res, _ := makeRequestPost(t, newServer(t, flow.TypeBrowser, nil), false, url.Values{})
-					assert.EqualValues(t, http.StatusOK, res.StatusCode)
-					assert.EqualValues(t, "https://www.ory.sh/", res.Request.URL.String())
+					require.Equal(t, http.StatusOK, res.StatusCode)
+					assert.Equal(t, "https://www.ory.sh/", res.Request.URL.String())
 				})
 
 				t.Run("case=fail if hooks fail", func(t *testing.T) {
 					t.Cleanup(testhelpers.SelfServiceHookConfigReset(t, conf))
 					viperSetPost(t, conf, strategy.String(), []config.SelfServiceHook{{Name: "err", Config: []byte(`{"ExecuteLoginPostHook": "abort"}`)}})
 
-					res, body := makeRequestPost(t, newServer(t, flow.TypeBrowser, nil), false, url.Values{})
-					assert.EqualValues(t, http.StatusOK, res.StatusCode)
-					assert.Equal(t, "", body)
+					ts := newServer(t, flow.TypeBrowser, nil)
+					res, body := makeRequestPost(t, ts, false, url.Values{})
+					require.Equal(t, http.StatusOK, res.StatusCode)
+					assert.Contains(t, res.Request.URL.String(), ts.URL)
+					assert.Empty(t, body)
 				})
 
 				t.Run("case=use return_to value", func(t *testing.T) {
@@ -116,8 +149,8 @@ func TestLoginExecutor(t *testing.T) {
 					conf.MustSet(ctx, config.ViperKeyURLsAllowedReturnToDomains, []string{"https://www.ory.sh/"})
 
 					res, _ := makeRequestPost(t, newServer(t, flow.TypeBrowser, nil), false, url.Values{"return_to": {"https://www.ory.sh/kratos/"}})
-					assert.EqualValues(t, http.StatusOK, res.StatusCode)
-					assert.EqualValues(t, "https://www.ory.sh/kratos/", res.Request.URL.String())
+					require.Equal(t, http.StatusOK, res.StatusCode)
+					assert.Equal(t, "https://www.ory.sh/kratos/", res.Request.URL.String())
 				})
 
 				t.Run("case=use nested config value", func(t *testing.T) {
@@ -192,7 +225,6 @@ func TestLoginExecutor(t *testing.T) {
 
 				t.Run("case=work normally if AAL is satisfied", func(t *testing.T) {
 					conf.MustSet(ctx, config.ViperKeySessionWhoAmIAAL, "aal1")
-					_ = testhelpers.NewLoginUIFlowEchoServer(t, reg)
 					t.Cleanup(testhelpers.SelfServiceHookConfigReset(t, conf))
 
 					useIdentity := &identity.Identity{Credentials: map[identity.CredentialsType]identity.Credentials{
@@ -225,7 +257,6 @@ func TestLoginExecutor(t *testing.T) {
 
 				t.Run("case=redirect to login if AAL is too low", func(t *testing.T) {
 					conf.MustSet(ctx, config.ViperKeySessionWhoAmIAAL, "highest_available")
-					_ = testhelpers.NewLoginUIFlowEchoServer(t, reg)
 					t.Cleanup(func() {
 						conf.MustSet(ctx, config.ViperKeySessionWhoAmIAAL, "aal1")
 					})
@@ -286,48 +317,132 @@ func TestLoginExecutor(t *testing.T) {
 					})
 				})
 			})
+
 			t.Run("case=maybe links credential", func(t *testing.T) {
 				t.Cleanup(testhelpers.SelfServiceHookConfigReset(t, conf))
+				conf.MustSet(ctx, config.ViperKeySessionWhoAmIAAL, config.HighestAvailableAAL)
+				conf.MustSet(ctx, "selfservice.methods.totp.enabled", true)
 
-				email := testhelpers.RandomEmail()
-				useIdentity := &identity.Identity{Credentials: map[identity.CredentialsType]identity.Credentials{
+				email1, email2 := testhelpers.RandomEmail(), testhelpers.RandomEmail()
+				passwordOnlyIdentity := &identity.Identity{Credentials: map[identity.CredentialsType]identity.Credentials{
+					identity.CredentialsTypePassword: {
+						Type:        identity.CredentialsTypePassword,
+						Config:      []byte(`{"hashed_password": "$argon2id$v=19$m=32,t=2,p=4$cm94YnRVOW5jZzFzcVE4bQ$MNzk5BtR2vUhrp6qQEjRNw"}`),
+						Identifiers: []string{email1},
+					},
+				}}
+				twoFAIdentitiy := &identity.Identity{Credentials: map[identity.CredentialsType]identity.Credentials{
 					identity.CredentialsTypePassword: {
 						Type:        identity.CredentialsTypePassword,
 						Config:      []byte(`{"hashed_password": "$argon2id$v=19$m=32,t=2,p=4$cm94YnRVOW5jZzFzcVE4bQ$MNzk5BtR2vUhrp6qQEjRNw"}`),
-						Identifiers: []string{email},
+						Identifiers: []string{email2},
+					},
+					identity.CredentialsTypeTOTP: {
+						Type:        identity.CredentialsTypeTOTP,
+						Config:      []byte(`{"totp_url":"otpauth://totp/test"}`),
+						Identifiers: []string{email2},
 					},
 				}}
-				require.NoError(t, reg.Persister().CreateIdentity(context.Background(), useIdentity))
+				require.NoError(t, reg.Persister().CreateIdentity(ctx, passwordOnlyIdentity))
+				require.NoError(t, reg.Persister().CreateIdentity(ctx, twoFAIdentitiy))
 
-				credsOIDC, err := identity.NewCredentialsOIDC(
+				credsOIDCPWOnly, err := identity.NewCredentialsOIDC(
 					&identity.CredentialsOIDCEncryptedTokens{IDToken: "id-token", AccessToken: "access-token", RefreshToken: "refresh-token"},
 					"my-provider",
-					email,
+					email1,
 					"",
 				)
 				require.NoError(t, err)
+				credsOIDC2FA, err := identity.NewCredentialsOIDC(
+					&identity.CredentialsOIDCEncryptedTokens{IDToken: "id-token", AccessToken: "access-token", RefreshToken: "refresh-token"},
+					"my-provider",
+					email2,
+					"",
+				)
+				require.NoError(t, err)
+
+				t.Run("sub-case=does not link after first factor when second factor is available", func(t *testing.T) {
+					duplicateCredentialsData := flow.DuplicateCredentialsData{
+						CredentialsType:     identity.CredentialsTypeOIDC,
+						CredentialsConfig:   credsOIDC2FA.Config,
+						DuplicateIdentifier: email2,
+					}
+					ts := newServer(t, flow.TypeBrowser, twoFAIdentitiy, func(l *login.Flow) {
+						require.NoError(t, flow.SetDuplicateCredentials(l, duplicateCredentialsData))
+					})
+					res, _ := makeRequestPost(t, ts, false, url.Values{})
+
+					assert.Equal(t, reg.Config().SelfServiceFlowLoginUI(ctx).Host, res.Request.URL.Host)
+					assert.Equal(t, reg.Config().SelfServiceFlowLoginUI(ctx).Path, res.Request.URL.Path)
+					newFlowID := res.Request.URL.Query().Get("flow")
+					assert.NotEmpty(t, newFlowID)
+
+					newFlow, err := reg.LoginFlowPersister().GetLoginFlow(ctx, uuid.Must(uuid.FromString(newFlowID)))
+					require.NoError(t, err)
+					newFlowDuplicateCredentialsData, err := flow.DuplicateCredentials(newFlow)
+					require.NoError(t, err)
+
+					// Duplicate credentials data should have been copied over
+					assert.Equal(t, duplicateCredentialsData.CredentialsType, newFlowDuplicateCredentialsData.CredentialsType)
+					assert.Equal(t, duplicateCredentialsData.DuplicateIdentifier, newFlowDuplicateCredentialsData.DuplicateIdentifier)
+					assert.JSONEq(t, string(duplicateCredentialsData.CredentialsConfig), string(newFlowDuplicateCredentialsData.CredentialsConfig))
+
+					// AAL should be AAL2
+					assert.Equal(t, identity.AuthenticatorAssuranceLevel2, newFlow.RequestedAAL)
+
+					// TOTP nodes should be present
+					found := false
+					for _, n := range newFlow.UI.Nodes {
+						if n.Group == node.TOTPGroup {
+							found = true
+							break
+						}
+					}
+					assert.True(t, found, "could not find TOTP nodes in %+v", newFlow.UI.Nodes)
+
+					ident, err := reg.Persister().GetIdentity(ctx, twoFAIdentitiy.ID, identity.ExpandCredentials)
+					require.NoError(t, err)
+					assert.Len(t, ident.Credentials, 2)
+				})
+
+				t.Run("sub-case=links after second factor when second factor is available", func(t *testing.T) {
+					ts := newServer(t, flow.TypeBrowser, twoFAIdentitiy, func(l *login.Flow) {
+						require.NoError(t, flow.SetDuplicateCredentials(l, flow.DuplicateCredentialsData{
+							CredentialsType:     identity.CredentialsTypeOIDC,
+							CredentialsConfig:   credsOIDC2FA.Config,
+							DuplicateIdentifier: email2,
+						}))
+					})
+					res, body := testhelpers.SelfServiceMakeHookRequest(t, ts, "/login/post2fa", false, url.Values{})
+					assert.Equalf(t, http.StatusOK, res.StatusCode, "%s", body)
+					assert.Equalf(t, "https://www.ory.sh/", res.Request.URL.String(), "%s", body)
+
+					ident, err := reg.Persister().GetIdentity(ctx, twoFAIdentitiy.ID, identity.ExpandCredentials)
+					require.NoError(t, err)
+					assert.Len(t, ident.Credentials, 3)
+				})
 
 				t.Run("sub-case=links matching identity", func(t *testing.T) {
-					res, _ := makeRequestPost(t, newServer(t, flow.TypeBrowser, useIdentity, func(l *login.Flow) {
+					res, body := makeRequestPost(t, newServer(t, flow.TypeBrowser, passwordOnlyIdentity, func(l *login.Flow) {
 						require.NoError(t, flow.SetDuplicateCredentials(l, flow.DuplicateCredentialsData{
 							CredentialsType:     identity.CredentialsTypeOIDC,
-							CredentialsConfig:   credsOIDC.Config,
-							DuplicateIdentifier: email,
+							CredentialsConfig:   credsOIDCPWOnly.Config,
+							DuplicateIdentifier: email1,
 						}))
 					}), false, url.Values{})
-					assert.EqualValues(t, http.StatusOK, res.StatusCode)
-					assert.EqualValues(t, "https://www.ory.sh/", res.Request.URL.String())
+					assert.Equalf(t, http.StatusOK, res.StatusCode, "%s", body)
+					assert.Equalf(t, "https://www.ory.sh/", res.Request.URL.String(), "%s", body)
 
-					ident, err := reg.Persister().GetIdentity(ctx, useIdentity.ID, identity.ExpandCredentials)
+					ident, err := reg.Persister().GetIdentity(ctx, passwordOnlyIdentity.ID, identity.ExpandCredentials)
 					require.NoError(t, err)
-					assert.Equal(t, 2, len(ident.Credentials))
+					assert.Len(t, ident.Credentials, 2)
 				})
 
 				t.Run("sub-case=errors on non-matching identity", func(t *testing.T) {
-					res, body := makeRequestPost(t, newServer(t, flow.TypeBrowser, useIdentity, func(l *login.Flow) {
+					res, body := makeRequestPost(t, newServer(t, flow.TypeBrowser, passwordOnlyIdentity, func(l *login.Flow) {
 						require.NoError(t, flow.SetDuplicateCredentials(l, flow.DuplicateCredentialsData{
 							CredentialsType:     identity.CredentialsTypeOIDC,
-							CredentialsConfig:   credsOIDC.Config,
+							CredentialsConfig:   credsOIDCPWOnly.Config,
 							DuplicateIdentifier: "wrong@example.com",
 						}))
 					}), false, url.Values{})
@@ -357,12 +472,62 @@ func TestLoginExecutor(t *testing.T) {
 					conf,
 				))
 			})
-
-			t.Run("requiresAAL2 should return true if there's an error", func(t *testing.T) {
-				requiresAAL2, err := login.RequiresAAL2ForTest(*reg.LoginHookExecutor(), &http.Request{}, &session.Session{})
-				require.NotNil(t, err)
-				require.True(t, requiresAAL2)
-			})
 		})
 	}
+
+	t.Run("method=checkAAL", func(t *testing.T) {
+		ctx := confighelpers.WithConfigValue(ctx, config.ViperKeyPublicBaseURL, "https://www.ory.sh/")
+
+		conf, reg := internal.NewFastRegistryWithMocks(t)
+		testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/login.schema.json")
+		conf.MustSet(ctx, config.ViperKeySelfServiceBrowserDefaultReturnTo, "https://www.ory.sh/")
+
+		t.Run("returns no error when sufficient", func(t *testing.T) {
+			ctx := confighelpers.WithConfigValue(ctx, config.ViperKeySessionWhoAmIAAL, identity.AuthenticatorAssuranceLevel1)
+			assert.NoError(t,
+				login.CheckAALForTest(ctx, reg.LoginHookExecutor(), &session.Session{
+					AMR: session.AuthenticationMethods{{
+						Method: identity.CredentialsTypePassword,
+						AAL:    identity.AuthenticatorAssuranceLevel1,
+					}},
+					AuthenticatorAssuranceLevel: identity.AuthenticatorAssuranceLevel1,
+				}, nil),
+			)
+
+			ctx = confighelpers.WithConfigValue(ctx, config.ViperKeySessionWhoAmIAAL, config.HighestAvailableAAL)
+			assert.NoError(t,
+				login.CheckAALForTest(ctx, reg.LoginHookExecutor(), &session.Session{
+					AMR: session.AuthenticationMethods{{
+						Method: identity.CredentialsTypePassword,
+						AAL:    identity.AuthenticatorAssuranceLevel1,
+					}, {
+						Method: identity.CredentialsTypeLookup,
+						AAL:    identity.AuthenticatorAssuranceLevel2,
+					}},
+					AuthenticatorAssuranceLevel: identity.AuthenticatorAssuranceLevel2,
+				}, nil),
+			)
+		})
+
+		t.Run("copies parameters to redirect URL when AAL is not sufficient", func(t *testing.T) {
+			ctx := confighelpers.WithConfigValue(ctx, config.ViperKeySessionWhoAmIAAL, config.HighestAvailableAAL)
+			aalErr := new(session.ErrAALNotSatisfied)
+			require.ErrorAs(t,
+				login.CheckAALForTest(ctx, reg.LoginHookExecutor(), &session.Session{
+					AMR: session.AuthenticationMethods{{
+						Method: identity.CredentialsTypePassword,
+						AAL:    identity.AuthenticatorAssuranceLevel1,
+					}},
+					AuthenticatorAssuranceLevel: identity.AuthenticatorAssuranceLevel1,
+					Identity: &identity.Identity{
+						InternalAvailableAAL: identity.NullableAuthenticatorAssuranceLevel{sql.NullString{String: string(identity.AuthenticatorAssuranceLevel2), Valid: true}},
+					},
+				}, &login.Flow{
+					RequestURL: "https://www.ory.sh/?return_to=https://www.ory.sh/kratos&login_challenge=challenge",
+				}),
+				&aalErr,
+			)
+			assert.Equal(t, "https://www.ory.sh/self-service/login/browser?aal=aal2&login_challenge=challenge&return_to=https%3A%2F%2Fwww.ory.sh%2Fkratos", aalErr.RedirectTo)
+		})
+	})
 }
diff --git a/selfservice/flow/login/strategy.go b/selfservice/flow/login/strategy.go
index c70ad9cc8684..2291b760079b 100644
--- a/selfservice/flow/login/strategy.go
+++ b/selfservice/flow/login/strategy.go
@@ -10,6 +10,7 @@ import (
 	"github.com/pkg/errors"
 
 	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/ui/node"
 	"github.com/ory/kratos/x"
@@ -20,15 +21,16 @@ type Strategy interface {
 	ID() identity.CredentialsType
 	NodeGroup() node.UiNodeGroup
 	RegisterLoginRoutes(*x.RouterPublic)
-	PopulateLoginMethod(r *http.Request, requestedAAL identity.AuthenticatorAssuranceLevel, sr *Flow) error
 	Login(w http.ResponseWriter, r *http.Request, f *Flow, sess *session.Session) (i *identity.Identity, err error)
-	CompletedAuthenticationMethod(ctx context.Context, methods session.AuthenticationMethods) session.AuthenticationMethod
+	CompletedAuthenticationMethod(ctx context.Context) session.AuthenticationMethod
 }
 
 type Strategies []Strategy
 
 type LinkableStrategy interface {
 	Link(ctx context.Context, i *identity.Identity, credentials sqlxx.JSONRawMessage) error
+	CompletedLogin(sess *session.Session, data *flow.DuplicateCredentialsData) error
+	SetDuplicateCredentials(f flow.InternalContexter, duplicateIdentifier string, credentials identity.Credentials, provider string) error
 }
 
 func (s Strategies) Strategy(id identity.CredentialsType) (Strategy, error) {
diff --git a/selfservice/flow/login/strategy_form_hydrator.go b/selfservice/flow/login/strategy_form_hydrator.go
new file mode 100644
index 000000000000..098c195b5df4
--- /dev/null
+++ b/selfservice/flow/login/strategy_form_hydrator.go
@@ -0,0 +1,67 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package login
+
+import (
+	"net/http"
+
+	"github.com/pkg/errors"
+
+	"github.com/ory/kratos/identity"
+)
+
+type UnifiedFormHydrator interface {
+	PopulateLoginMethod(r *http.Request, requestedAAL identity.AuthenticatorAssuranceLevel, sr *Flow) error
+}
+
+type FormHydrator interface {
+	PopulateLoginMethodFirstFactorRefresh(r *http.Request, sr *Flow) error
+	PopulateLoginMethodFirstFactor(r *http.Request, sr *Flow) error
+	PopulateLoginMethodSecondFactor(r *http.Request, sr *Flow) error
+	PopulateLoginMethodSecondFactorRefresh(r *http.Request, sr *Flow) error
+
+	// PopulateLoginMethodIdentifierFirstCredentials populates the login form with the first factor credentials.
+	// This method is called when the login flow is set to identifier first. The method will receive information
+	// about the identity that is being used to log in and the identifier that was used to find the identity.
+	//
+	// The method should populate the login form with the credentials of the identity.
+	//
+	// If the method can not find any credentials (because the identity does not exist) idfirst.ErrNoCredentialsFound
+	// must be returned. When returning  idfirst.ErrNoCredentialsFound the strategy will appropriately deal with
+	// account enumeration mitigation.
+	//
+	// This method does however need to take appropriate steps to show/hide certain fields depending on the account
+	// enumeration configuration.
+	PopulateLoginMethodIdentifierFirstCredentials(r *http.Request, sr *Flow, options ...FormHydratorModifier) error
+	PopulateLoginMethodIdentifierFirstIdentification(r *http.Request, sr *Flow) error
+}
+
+var ErrBreakLoginPopulate = errors.New("skip rest of login form population")
+
+type FormHydratorOptions struct {
+	IdentityHint *identity.Identity
+	Identifier   string
+}
+
+type FormHydratorModifier func(o *FormHydratorOptions)
+
+func WithIdentityHint(i *identity.Identity) FormHydratorModifier {
+	return func(o *FormHydratorOptions) {
+		o.IdentityHint = i
+	}
+}
+
+func WithIdentifier(i string) FormHydratorModifier {
+	return func(o *FormHydratorOptions) {
+		o.Identifier = i
+	}
+}
+
+func NewFormHydratorOptions(modifiers []FormHydratorModifier) *FormHydratorOptions {
+	o := new(FormHydratorOptions)
+	for _, m := range modifiers {
+		m(o)
+	}
+	return o
+}
diff --git a/selfservice/flow/login/strategy_form_hydrator_test.go b/selfservice/flow/login/strategy_form_hydrator_test.go
new file mode 100644
index 000000000000..863a1031051d
--- /dev/null
+++ b/selfservice/flow/login/strategy_form_hydrator_test.go
@@ -0,0 +1,24 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package login
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/ory/kratos/identity"
+)
+
+func TestWithIdentityHint(t *testing.T) {
+	expected := new(identity.Identity)
+	opts := NewFormHydratorOptions([]FormHydratorModifier{WithIdentityHint(expected)})
+	assert.Equal(t, expected, opts.IdentityHint)
+}
+
+func TestWithIdentifier(t *testing.T) {
+	expected := "identifier"
+	opts := NewFormHydratorOptions([]FormHydratorModifier{WithIdentifier(expected)})
+	assert.Equal(t, expected, opts.Identifier)
+}
diff --git a/selfservice/flow/recovery/.snapshots/TestHandleError-flow=api-case=fails_if_active_strategy_is_disabled.json b/selfservice/flow/recovery/.snapshots/TestHandleError-flow=api-case=fails_if_active_strategy_is_disabled.json
index f4c0270da2dc..17eb6e965bcb 100644
--- a/selfservice/flow/recovery/.snapshots/TestHandleError-flow=api-case=fails_if_active_strategy_is_disabled.json
+++ b/selfservice/flow/recovery/.snapshots/TestHandleError-flow=api-case=fails_if_active_strategy_is_disabled.json
@@ -50,8 +50,8 @@
         "messages": [],
         "meta": {
           "label": {
-            "id": 1070005,
-            "text": "Submit",
+            "id": 1070009,
+            "text": "Continue",
             "type": "info"
           }
         }
diff --git a/selfservice/flow/recovery/.snapshots/TestHandleError-flow=spa-case=fails_if_active_strategy_is_disabled.json b/selfservice/flow/recovery/.snapshots/TestHandleError-flow=spa-case=fails_if_active_strategy_is_disabled.json
index 56782eed4571..a9ad1e527fb4 100644
--- a/selfservice/flow/recovery/.snapshots/TestHandleError-flow=spa-case=fails_if_active_strategy_is_disabled.json
+++ b/selfservice/flow/recovery/.snapshots/TestHandleError-flow=spa-case=fails_if_active_strategy_is_disabled.json
@@ -50,8 +50,8 @@
         "messages": [],
         "meta": {
           "label": {
-            "id": 1070005,
-            "text": "Submit",
+            "id": 1070009,
+            "text": "Continue",
             "type": "info"
           }
         }
diff --git a/selfservice/flow/recovery/.snapshots/TestHandleError_WithContinueWith-flow=api-case=fails_if_active_strategy_is_disabled.json b/selfservice/flow/recovery/.snapshots/TestHandleError_WithContinueWith-flow=api-case=fails_if_active_strategy_is_disabled.json
index f4c0270da2dc..17eb6e965bcb 100644
--- a/selfservice/flow/recovery/.snapshots/TestHandleError_WithContinueWith-flow=api-case=fails_if_active_strategy_is_disabled.json
+++ b/selfservice/flow/recovery/.snapshots/TestHandleError_WithContinueWith-flow=api-case=fails_if_active_strategy_is_disabled.json
@@ -50,8 +50,8 @@
         "messages": [],
         "meta": {
           "label": {
-            "id": 1070005,
-            "text": "Submit",
+            "id": 1070009,
+            "text": "Continue",
             "type": "info"
           }
         }
diff --git a/selfservice/flow/recovery/.snapshots/TestHandleError_WithContinueWith-flow=spa-case=fails_if_active_strategy_is_disabled.json b/selfservice/flow/recovery/.snapshots/TestHandleError_WithContinueWith-flow=spa-case=fails_if_active_strategy_is_disabled.json
index 56782eed4571..a9ad1e527fb4 100644
--- a/selfservice/flow/recovery/.snapshots/TestHandleError_WithContinueWith-flow=spa-case=fails_if_active_strategy_is_disabled.json
+++ b/selfservice/flow/recovery/.snapshots/TestHandleError_WithContinueWith-flow=spa-case=fails_if_active_strategy_is_disabled.json
@@ -50,8 +50,8 @@
         "messages": [],
         "meta": {
           "label": {
-            "id": 1070005,
-            "text": "Submit",
+            "id": 1070009,
+            "text": "Continue",
             "type": "info"
           }
         }
diff --git a/selfservice/flow/recovery/error.go b/selfservice/flow/recovery/error.go
index 9f93af941447..f46f637254e7 100644
--- a/selfservice/flow/recovery/error.go
+++ b/selfservice/flow/recovery/error.go
@@ -7,6 +7,8 @@ import (
 	"net/http"
 	"net/url"
 
+	"github.com/gofrs/uuid"
+
 	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/kratos/x/events"
@@ -64,19 +66,21 @@ func (s *ErrorHandler) WriteFlowError(
 	group node.UiNodeGroup,
 	recoveryErr error,
 ) {
-	s.d.Audit().
+	logger := s.d.Audit().
 		WithError(recoveryErr).
 		WithRequest(r).
-		WithField("recovery_flow", f).
+		WithField("recovery_flow", f.ToLoggerField())
+
+	logger.
 		Info("Encountered self-service recovery error.")
 
 	if f == nil {
-		trace.SpanFromContext(r.Context()).AddEvent(events.NewRecoveryFailed(r.Context(), "", ""))
+		trace.SpanFromContext(r.Context()).AddEvent(events.NewRecoveryFailed(r.Context(), uuid.Nil, "", "", recoveryErr))
 		s.forward(w, r, nil, recoveryErr)
 		return
 	}
 
-	trace.SpanFromContext(r.Context()).AddEvent(events.NewRecoveryFailed(r.Context(), string(f.Type), f.Active.String()))
+	trace.SpanFromContext(r.Context()).AddEvent(events.NewRecoveryFailed(r.Context(), f.ID, string(f.Type), f.Active.String(), recoveryErr))
 
 	if expiredError := new(flow.ExpiredError); errors.As(recoveryErr, &expiredError) {
 		strategy, err := s.d.RecoveryStrategies(r.Context()).Strategy(f.Active.String())
diff --git a/selfservice/flow/recovery/error_test.go b/selfservice/flow/recovery/error_test.go
index 432d149a04f1..6a7414050d6e 100644
--- a/selfservice/flow/recovery/error_test.go
+++ b/selfservice/flow/recovery/error_test.go
@@ -88,7 +88,7 @@ func TestHandleError(t *testing.T) {
 		defer res.Body.Close()
 		require.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowErrorURL(ctx).String()+"?id=")
 
-		sse, _, err := sdk.FrontendApi.GetFlowError(context.Background()).Id(res.Request.URL.Query().Get("id")).Execute()
+		sse, _, err := sdk.FrontendAPI.GetFlowError(context.Background()).Id(res.Request.URL.Query().Get("id")).Execute()
 		require.NoError(t, err)
 
 		return sse.Error, nil
@@ -346,7 +346,7 @@ func TestHandleError_WithContinueWith(t *testing.T) {
 		defer res.Body.Close()
 		require.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowErrorURL(ctx).String()+"?id=")
 
-		sse, _, err := sdk.FrontendApi.GetFlowError(context.Background()).Id(res.Request.URL.Query().Get("id")).Execute()
+		sse, _, err := sdk.FrontendAPI.GetFlowError(context.Background()).Id(res.Request.URL.Query().Get("id")).Execute()
 		require.NoError(t, err)
 
 		return sse.Error, nil
diff --git a/selfservice/flow/recovery/flow.go b/selfservice/flow/recovery/flow.go
index 9eac423266cb..7dc1845a77b6 100644
--- a/selfservice/flow/recovery/flow.go
+++ b/selfservice/flow/recovery/flow.go
@@ -248,3 +248,18 @@ func (f *Flow) SetState(state State) {
 func (t *Flow) GetTransientPayload() json.RawMessage {
 	return t.TransientPayload
 }
+
+func (f *Flow) ToLoggerField() map[string]interface{} {
+	if f == nil {
+		return map[string]interface{}{}
+	}
+	return map[string]interface{}{
+		"id":          f.ID.String(),
+		"return_to":   f.ReturnTo,
+		"request_url": f.RequestURL,
+		"active":      f.Active,
+		"type":        f.Type,
+		"nid":         f.NID,
+		"state":       f.State,
+	}
+}
diff --git a/selfservice/flow/recovery/hook.go b/selfservice/flow/recovery/hook.go
index 15c3078e918c..163bc247c8f7 100644
--- a/selfservice/flow/recovery/hook.go
+++ b/selfservice/flow/recovery/hook.go
@@ -81,10 +81,14 @@ func NewHookExecutor(d executorDependencies) *HookExecutor {
 }
 
 func (e *HookExecutor) PostRecoveryHook(w http.ResponseWriter, r *http.Request, a *Flow, s *session.Session) error {
-	e.d.Logger().
-		WithRequest(r).
-		WithField("identity_id", s.Identity.ID).
-		Debug("Running ExecutePostRecoveryHooks.")
+	logger := e.d.Logger().
+		WithRequest(r)
+
+	if s.Identity != nil {
+		logger = logger.WithField("identity_id", s.Identity.ID)
+	}
+
+	logger.Debug("Running ExecutePostRecoveryHooks.")
 	for k, executor := range e.d.PostRecoveryHooks(r.Context()) {
 		if err := executor.ExecutePostRecoveryHook(w, r, a, s); err != nil {
 			var traits identity.Traits
@@ -94,20 +98,16 @@ func (e *HookExecutor) PostRecoveryHook(w http.ResponseWriter, r *http.Request,
 			return flow.HandleHookError(w, r, a, traits, node.LinkGroup, err, e.d, e.d)
 		}
 
-		e.d.Logger().WithRequest(r).
+		logger.
 			WithField("executor", fmt.Sprintf("%T", executor)).
 			WithField("executor_position", k).
 			WithField("executors", PostHookRecoveryExecutorNames(e.d.PostRecoveryHooks(r.Context()))).
-			WithField("identity_id", s.Identity.ID).
 			Debug("ExecutePostRecoveryHook completed successfully.")
 	}
 
-	trace.SpanFromContext(r.Context()).AddEvent(events.NewRecoverySucceeded(r.Context(), s.Identity.ID, string(a.Type), a.Active.String()))
+	trace.SpanFromContext(r.Context()).AddEvent(events.NewRecoverySucceeded(r.Context(), a.ID, s.Identity.ID, string(a.Type), a.Active.String()))
 
-	e.d.Logger().
-		WithRequest(r).
-		WithField("identity_id", s.Identity.ID).
-		Debug("Post recovery execution hooks completed successfully.")
+	logger.Debug("Post recovery execution hooks completed successfully.")
 
 	return nil
 }
diff --git a/selfservice/flow/recovery/hook_test.go b/selfservice/flow/recovery/hook_test.go
index deb4b0426363..ce4ccf6deb76 100644
--- a/selfservice/flow/recovery/hook_test.go
+++ b/selfservice/flow/recovery/hook_test.go
@@ -10,8 +10,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/ory/kratos/session"
-
 	"github.com/ory/kratos/selfservice/flow/recovery"
 	"github.com/ory/kratos/selfservice/strategy/code"
 
@@ -31,6 +29,7 @@ import (
 func TestRecoveryExecutor(t *testing.T) {
 	ctx := context.Background()
 	conf, reg := internal.NewFastRegistryWithMocks(t)
+	testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/identity.schema.json")
 	s := code.NewStrategy(reg)
 
 	newServer := func(t *testing.T, i *identity.Identity, ft flow.Type) *httptest.Server {
@@ -46,13 +45,14 @@ func TestRecoveryExecutor(t *testing.T) {
 		router.GET("/recovery/post", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
 			a, err := recovery.NewFlow(conf, time.Minute, x.FakeCSRFToken, r, s, ft)
 			require.NoError(t, err)
-			s, _ := session.NewActiveSession(r,
+			s, err := testhelpers.NewActiveSession(r,
+				reg,
 				i,
-				conf,
 				time.Now().UTC(),
 				identity.CredentialsTypeRecoveryLink,
 				identity.AuthenticatorAssuranceLevel1,
 			)
+			require.NoError(t, err)
 			a.RequestURL = x.RequestURL(r).String()
 			if testhelpers.SelfServiceHookErrorHandler(t, w, r, recovery.ErrHookAbortFlow, reg.RecoveryExecutor().PostRecoveryHook(w, r, a, s)) {
 				_, _ = w.Write([]byte("ok"))
diff --git a/selfservice/flow/registration/error.go b/selfservice/flow/registration/error.go
index b3ef3d9054df..0bf8b0f6abdc 100644
--- a/selfservice/flow/registration/error.go
+++ b/selfservice/flow/registration/error.go
@@ -6,6 +6,8 @@ package registration
 import (
 	"net/http"
 
+	"github.com/gofrs/uuid"
+
 	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/kratos/identity"
@@ -72,6 +74,7 @@ func (s *ErrorHandler) PrepareReplacementForExpiredFlow(w http.ResponseWriter, r
 
 	return e.WithFlow(a), nil
 }
+
 func (s *ErrorHandler) WriteFlowError(
 	w http.ResponseWriter,
 	r *http.Request,
@@ -79,23 +82,24 @@ func (s *ErrorHandler) WriteFlowError(
 	group node.UiNodeGroup,
 	err error,
 ) {
-
 	if dup := new(identity.ErrDuplicateCredentials); errors.As(err, &dup) {
 		err = schema.NewDuplicateCredentialsError(dup)
 	}
 
-	s.d.Audit().
+	logger := s.d.Audit().
 		WithError(err).
 		WithRequest(r).
-		WithField("registration_flow", f).
+		WithField("registration_flow", f.ToLoggerField())
+
+	logger.
 		Info("Encountered self-service flow error.")
 
 	if f == nil {
-		trace.SpanFromContext(r.Context()).AddEvent(events.NewRegistrationFailed(r.Context(), "", ""))
+		trace.SpanFromContext(r.Context()).AddEvent(events.NewRegistrationFailed(r.Context(), uuid.Nil, "", "", err))
 		s.forward(w, r, nil, err)
 		return
 	}
-	trace.SpanFromContext(r.Context()).AddEvent(events.NewRegistrationFailed(r.Context(), string(f.Type), f.Active.String()))
+	trace.SpanFromContext(r.Context()).AddEvent(events.NewRegistrationFailed(r.Context(), f.ID, string(f.Type), f.Active.String(), err))
 
 	if expired, inner := s.PrepareReplacementForExpiredFlow(w, r, f, err); inner != nil {
 		s.forward(w, r, f, err)
diff --git a/selfservice/flow/registration/error_test.go b/selfservice/flow/registration/error_test.go
index 4b5464f88652..02fdd9fb1e4c 100644
--- a/selfservice/flow/registration/error_test.go
+++ b/selfservice/flow/registration/error_test.go
@@ -87,7 +87,7 @@ func TestHandleError(t *testing.T) {
 		defer res.Body.Close()
 		require.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowErrorURL(ctx).String()+"?id=")
 
-		sse, _, err := sdk.FrontendApi.GetFlowError(context.Background()).Id(res.Request.URL.Query().Get("id")).Execute()
+		sse, _, err := sdk.FrontendAPI.GetFlowError(context.Background()).Id(res.Request.URL.Query().Get("id")).Execute()
 		require.NoError(t, err)
 
 		return sse.Error, nil
diff --git a/selfservice/flow/registration/flow.go b/selfservice/flow/registration/flow.go
index 17ad0c6d720a..5b39dd76f750 100644
--- a/selfservice/flow/registration/flow.go
+++ b/selfservice/flow/registration/flow.go
@@ -272,10 +272,25 @@ func (f *Flow) SetState(state State) {
 	f.State = state
 }
 
-func (t *Flow) GetTransientPayload() json.RawMessage {
-	return t.TransientPayload
+func (f *Flow) GetTransientPayload() json.RawMessage {
+	return f.TransientPayload
 }
 
 func (f *Flow) SetReturnToVerification(to string) {
 	f.ReturnToVerification = to
 }
+
+func (f *Flow) ToLoggerField() map[string]interface{} {
+	if f == nil {
+		return map[string]interface{}{}
+	}
+	return map[string]interface{}{
+		"id":          f.ID.String(),
+		"return_to":   f.ReturnTo,
+		"request_url": f.RequestURL,
+		"active":      f.Active,
+		"Type":        f.Type,
+		"nid":         f.NID,
+		"state":       f.State,
+	}
+}
diff --git a/selfservice/flow/registration/handler.go b/selfservice/flow/registration/handler.go
index 8cfe59e4d6d9..c3f46d3a8397 100644
--- a/selfservice/flow/registration/handler.go
+++ b/selfservice/flow/registration/handler.go
@@ -141,7 +141,9 @@ func (h *Handler) NewRegistrationFlow(w http.ResponseWriter, r *http.Request, ft
 			h.d.Logger().WithError(err).Warnf("ignoring invalid UUID %q in query parameter `organization`", rawOrg)
 		} else {
 			f.OrganizationID = uuid.NullUUID{UUID: orgID, Valid: true}
-			strategyFilters = []StrategyFilter{func(s Strategy) bool { return s.ID() == identity.CredentialsTypeOIDC }}
+			strategyFilters = []StrategyFilter{func(s Strategy) bool {
+				return s.ID() == identity.CredentialsTypeOIDC || s.ID() == identity.CredentialsTypeSAML
+			}}
 		}
 	}
 	for _, s := range h.d.RegistrationStrategies(r.Context(), strategyFilters...) {
@@ -237,6 +239,13 @@ type createNativeRegistrationFlow struct {
 	//
 	// in: query
 	ReturnTo string `json:"return_to"`
+
+	// An optional organization ID that should be used to register this user.
+	// This parameter is only effective in the Ory Network.
+	//
+	// required: false
+	// in: query
+	Organization string `json:"organization"`
 }
 
 // Create Browser Registration Flow Parameters
@@ -274,6 +283,9 @@ type createBrowserRegistrationFlow struct {
 	// in: query
 	AfterVerificationReturnTo string `json:"after_verification_return_to"`
 
+	// An optional organization ID that should be used to register this user.
+	// This parameter is only effective in the Ory Network.
+	//
 	// required: false
 	// in: query
 	Organization string `json:"organization"`
@@ -663,7 +675,7 @@ func (h *Handler) updateRegistrationFlow(w http.ResponseWriter, r *http.Request,
 		return
 	}
 
-	if err := h.d.RegistrationExecutor().PostRegistrationHook(w, r, s.ID(), "", f, i); err != nil {
+	if err := h.d.RegistrationExecutor().PostRegistrationHook(w, r, s.ID(), "", "", f, i); err != nil {
 		h.d.RegistrationFlowErrorHandler().WriteFlowError(w, r, f, s.NodeGroup(), err)
 		return
 	}
diff --git a/selfservice/flow/registration/handler_test.go b/selfservice/flow/registration/handler_test.go
index a9e7b842718c..c2767bdd4192 100644
--- a/selfservice/flow/registration/handler_test.go
+++ b/selfservice/flow/registration/handler_test.go
@@ -426,7 +426,7 @@ func TestOIDCStrategyOrder(t *testing.T) {
 
 	// reorder the strategies
 	reg.WithSelfserviceStrategies(t, []any{
-		oidc.NewStrategy(reg),
+		oidc.NewStrategy(reg, oidc.ForCredentialType(identity.CredentialsTypeOIDC)),
 		password.NewStrategy(reg),
 	})
 
diff --git a/selfservice/flow/registration/hook.go b/selfservice/flow/registration/hook.go
index 6a997009c1c5..ab7400b60936 100644
--- a/selfservice/flow/registration/hook.go
+++ b/selfservice/flow/registration/hook.go
@@ -9,7 +9,6 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/julienschmidt/httprouter"
 	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
 
@@ -101,7 +100,7 @@ func NewHookExecutor(d executorDependencies) *HookExecutor {
 	return &HookExecutor{d: d}
 }
 
-func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Request, ct identity.CredentialsType, provider string, registrationFlow *Flow, i *identity.Identity) (err error) {
+func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Request, ct identity.CredentialsType, provider, organizationID string, registrationFlow *Flow, i *identity.Identity) (err error) {
 	ctx := r.Context()
 	ctx, span := e.d.Tracer(ctx).Tracer().Start(ctx, "HookExecutor.PostRegistrationHook")
 	r = r.WithContext(ctx)
@@ -112,14 +111,14 @@ func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Reque
 		WithField("identity_id", i.ID).
 		WithField("flow_method", ct).
 		Debug("Running PostRegistrationPrePersistHooks.")
-	for k, executor := range e.d.PostRegistrationPrePersistHooks(r.Context(), ct) {
+	for k, executor := range e.d.PostRegistrationPrePersistHooks(ctx, ct) {
 		if err := executor.ExecutePostRegistrationPrePersistHook(w, r, registrationFlow, i); err != nil {
 			if errors.Is(err, ErrHookAbortFlow) {
 				e.d.Logger().
 					WithRequest(r).
 					WithField("executor", fmt.Sprintf("%T", executor)).
 					WithField("executor_position", k).
-					WithField("executors", ExecutorNames(e.d.PostRegistrationPrePersistHooks(r.Context(), ct))).
+					WithField("executors", ExecutorNames(e.d.PostRegistrationPrePersistHooks(ctx, ct))).
 					WithField("identity_id", i.ID).
 					WithField("flow_method", ct).
 					Debug("A ExecutePostRegistrationPrePersistHook hook aborted early.")
@@ -130,7 +129,7 @@ func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Reque
 				WithRequest(r).
 				WithField("executor", fmt.Sprintf("%T", executor)).
 				WithField("executor_position", k).
-				WithField("executors", ExecutorNames(e.d.PostRegistrationPrePersistHooks(r.Context(), ct))).
+				WithField("executors", ExecutorNames(e.d.PostRegistrationPrePersistHooks(ctx, ct))).
 				WithField("identity_id", i.ID).
 				WithField("flow_method", ct).
 				WithError(err).
@@ -143,36 +142,37 @@ func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Reque
 		e.d.Logger().WithRequest(r).
 			WithField("executor", fmt.Sprintf("%T", executor)).
 			WithField("executor_position", k).
-			WithField("executors", ExecutorNames(e.d.PostRegistrationPrePersistHooks(r.Context(), ct))).
+			WithField("executors", ExecutorNames(e.d.PostRegistrationPrePersistHooks(ctx, ct))).
 			WithField("identity_id", i.ID).
 			WithField("flow_method", ct).
 			Debug("ExecutePostRegistrationPrePersistHook completed successfully.")
 	}
 
 	// We need to make sure that the identity has a valid schema before passing it down to the identity pool.
-	if err := e.d.IdentityValidator().Validate(r.Context(), i); err != nil {
+	if err := e.d.IdentityValidator().Validate(ctx, i); err != nil {
 		return err
-		// We're now creating the identity because any of the hooks could trigger a "redirect" or a "session" which
-		// would imply that the identity has to exist already.
-	} else if err := e.d.IdentityManager().Create(r.Context(), i); err != nil {
+	}
+	// We're now creating the identity because any of the hooks could trigger a "redirect" or a "session" which
+	// would imply that the identity has to exist already.
+	if err := e.d.IdentityManager().Create(ctx, i); err != nil {
 		if errors.Is(err, sqlcon.ErrUniqueViolation) {
 			strategy, err := e.d.AllLoginStrategies().Strategy(ct)
 			if err != nil {
 				return err
 			}
 
-			if _, ok := strategy.(login.LinkableStrategy); ok {
-				duplicateIdentifier, err := e.getDuplicateIdentifier(r.Context(), i)
+			if strategy, ok := strategy.(login.LinkableStrategy); ok {
+				duplicateIdentifier, err := e.getDuplicateIdentifier(ctx, i)
 				if err != nil {
 					return err
 				}
-				registrationDuplicateCredentials := flow.DuplicateCredentialsData{
-					CredentialsType:     ct,
-					CredentialsConfig:   i.Credentials[ct].Config,
-					DuplicateIdentifier: duplicateIdentifier,
-				}
 
-				if err := flow.SetDuplicateCredentials(registrationFlow, registrationDuplicateCredentials); err != nil {
+				if err := strategy.SetDuplicateCredentials(
+					registrationFlow,
+					duplicateIdentifier,
+					i.Credentials[ct],
+					provider,
+				); err != nil {
 					return err
 				}
 			}
@@ -180,42 +180,50 @@ func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Reque
 		return err
 	}
 
+	// At this point the identity is already created and will not be rolled back, so
+	// we want all PostPersist hooks to be able to continue even when the client cancels the request.
+	ctx = context.WithoutCancel(ctx)
+	r = r.WithContext(ctx)
+
 	// Verify the redirect URL before we do any other processing.
 	c := e.d.Config()
-	returnTo, err := x.SecureRedirectTo(r, c.SelfServiceBrowserDefaultReturnTo(r.Context()),
+	returnTo, err := x.SecureRedirectTo(r, c.SelfServiceBrowserDefaultReturnTo(ctx),
 		x.SecureRedirectReturnTo(registrationFlow.ReturnTo),
 		x.SecureRedirectUseSourceURL(registrationFlow.RequestURL),
-		x.SecureRedirectAllowURLs(c.SelfServiceBrowserAllowedReturnToDomains(r.Context())),
-		x.SecureRedirectAllowSelfServiceURLs(c.SelfPublicURL(r.Context())),
-		x.SecureRedirectOverrideDefaultReturnTo(c.SelfServiceFlowRegistrationReturnTo(r.Context(), ct.String())),
+		x.SecureRedirectAllowURLs(c.SelfServiceBrowserAllowedReturnToDomains(ctx)),
+		x.SecureRedirectAllowSelfServiceURLs(c.SelfPublicURL(ctx)),
+		x.SecureRedirectOverrideDefaultReturnTo(c.SelfServiceFlowRegistrationReturnTo(ctx, ct.String())),
 	)
 	if err != nil {
 		return err
 	}
+
 	span.SetAttributes(otelx.StringAttrs(map[string]string{
 		"return_to":       returnTo.String(),
-		"flow_type":       string(flow.TypeBrowser),
+		"flow_type":       string(registrationFlow.Type),
 		"redirect_reason": "registration successful",
 	})...)
 
+	if registrationFlow.Type == flow.TypeBrowser && x.IsJSONRequest(r) {
+		registrationFlow.AddContinueWith(flow.NewContinueWithRedirectBrowserTo(returnTo.String()))
+	}
+
 	e.d.Audit().
 		WithRequest(r).
 		WithField("identity_id", i.ID).
 		Info("A new identity has registered using self-service registration.")
 
-	span.AddEvent(events.NewRegistrationSucceeded(r.Context(), i.ID, string(registrationFlow.Type), registrationFlow.Active.String(), provider))
+	span.AddEvent(events.NewRegistrationSucceeded(ctx, registrationFlow.ID, i.ID, string(registrationFlow.Type), registrationFlow.Active.String(), provider))
 
 	s := session.NewInactiveSession()
 
-	s.CompletedLoginForWithProvider(ct, identity.AuthenticatorAssuranceLevel1, provider,
-		httprouter.ParamsFromContext(r.Context()).ByName("organization"))
-	if err := s.Activate(r, i, c, time.Now().UTC()); err != nil {
+	s.CompletedLoginForWithProvider(ct, identity.AuthenticatorAssuranceLevel1, provider, organizationID)
+	if err := e.d.SessionManager().ActivateSession(r, s, i, time.Now().UTC()); err != nil {
 		return err
 	}
 
 	// We persist the session here so that subsequent hooks (like verification) can use it.
-	s.AuthenticatedAt = time.Now().UTC()
-	if err := e.d.SessionPersister().UpsertSession(r.Context(), s); err != nil {
+	if err := e.d.SessionPersister().UpsertSession(ctx, s); err != nil {
 		return err
 	}
 
@@ -224,14 +232,14 @@ func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Reque
 		WithField("identity_id", i.ID).
 		WithField("flow_method", ct).
 		Debug("Running PostRegistrationPostPersistHooks.")
-	for k, executor := range e.d.PostRegistrationPostPersistHooks(r.Context(), ct) {
+	for k, executor := range e.d.PostRegistrationPostPersistHooks(ctx, ct) {
 		if err := executor.ExecutePostRegistrationPostPersistHook(w, r, registrationFlow, s); err != nil {
 			if errors.Is(err, ErrHookAbortFlow) {
 				e.d.Logger().
 					WithRequest(r).
 					WithField("executor", fmt.Sprintf("%T", executor)).
 					WithField("executor_position", k).
-					WithField("executors", ExecutorNames(e.d.PostRegistrationPostPersistHooks(r.Context(), ct))).
+					WithField("executors", ExecutorNames(e.d.PostRegistrationPostPersistHooks(ctx, ct))).
 					WithField("identity_id", i.ID).
 					WithField("flow_method", ct).
 					Debug("A ExecutePostRegistrationPostPersistHook hook aborted early.")
@@ -245,7 +253,7 @@ func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Reque
 				WithRequest(r).
 				WithField("executor", fmt.Sprintf("%T", executor)).
 				WithField("executor_position", k).
-				WithField("executors", ExecutorNames(e.d.PostRegistrationPostPersistHooks(r.Context(), ct))).
+				WithField("executors", ExecutorNames(e.d.PostRegistrationPostPersistHooks(ctx, ct))).
 				WithField("identity_id", i.ID).
 				WithField("flow_method", ct).
 				WithError(err).
@@ -260,7 +268,7 @@ func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Reque
 		e.d.Logger().WithRequest(r).
 			WithField("executor", fmt.Sprintf("%T", executor)).
 			WithField("executor_position", k).
-			WithField("executors", ExecutorNames(e.d.PostRegistrationPostPersistHooks(r.Context(), ct))).
+			WithField("executors", ExecutorNames(e.d.PostRegistrationPostPersistHooks(ctx, ct))).
 			WithField("identity_id", i.ID).
 			WithField("flow_method", ct).
 			Debug("ExecutePostRegistrationPostPersistHook completed successfully.")
@@ -298,7 +306,7 @@ func (e *HookExecutor) PostRegistrationHook(w http.ResponseWriter, r *http.Reque
 			// redirect to the verification URL first and then return to Hydra.
 			finalReturnTo = registrationFlow.ReturnToVerification
 		} else {
-			callbackURL, err := e.d.Hydra().AcceptLoginRequest(r.Context(),
+			callbackURL, err := e.d.Hydra().AcceptLoginRequest(ctx,
 				hydra.AcceptLoginRequestParams{
 					LoginChallenge:        string(registrationFlow.OAuth2LoginChallenge),
 					IdentityID:            i.ID.String(),
diff --git a/selfservice/flow/registration/hook_test.go b/selfservice/flow/registration/hook_test.go
index 3761692e3f45..9a65b05a0eeb 100644
--- a/selfservice/flow/registration/hook_test.go
+++ b/selfservice/flow/registration/hook_test.go
@@ -65,7 +65,7 @@ func TestRegistrationExecutor(t *testing.T) {
 					for _, callback := range flowCallbacks {
 						callback(regFlow)
 					}
-					_ = handleErr(t, w, r, reg.RegistrationHookExecutor().PostRegistrationHook(w, r, identity.CredentialsType(strategy), "", regFlow, i))
+					_ = handleErr(t, w, r, reg.RegistrationHookExecutor().PostRegistrationHook(w, r, identity.CredentialsType(strategy), "", "", regFlow, i))
 				})
 
 				ts := httptest.NewServer(router)
@@ -91,6 +91,21 @@ func TestRegistrationExecutor(t *testing.T) {
 					assert.Equal(t, actual.Traits, i.Traits)
 				})
 
+				t.Run("case=pass without hooks if ajax client", func(t *testing.T) {
+					t.Cleanup(testhelpers.SelfServiceHookConfigReset(t, conf))
+					i := testhelpers.SelfServiceHookFakeIdentity(t)
+
+					ts := newServer(t, i, flow.TypeBrowser)
+					res, body := makeRequestPost(t, ts, true, url.Values{})
+					assert.EqualValues(t, http.StatusOK, res.StatusCode)
+					assert.Contains(t, res.Request.URL.String(), ts.URL)
+					assert.EqualValues(t, gjson.Get(body, "continue_with").Raw, `[{"action":"redirect_browser_to","redirect_browser_to":"https://www.ory.sh/"}]`)
+
+					actual, err := reg.IdentityPool().GetIdentity(context.Background(), i.ID, identity.ExpandNothing)
+					require.NoError(t, err)
+					assert.Equal(t, actual.Traits, i.Traits)
+				})
+
 				t.Run("case=pass if hooks pass", func(t *testing.T) {
 					t.Cleanup(testhelpers.SelfServiceHookConfigReset(t, conf))
 					viperSetPost(t, conf, strategy, []config.SelfServiceHook{{Name: "err", Config: []byte(`{}`)}})
diff --git a/selfservice/flow/request.go b/selfservice/flow/request.go
index bb140eae24a2..a4c5cb74740d 100644
--- a/selfservice/flow/request.go
+++ b/selfservice/flow/request.go
@@ -9,6 +9,9 @@ import (
 	"net/http"
 	"strings"
 
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+
 	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/selfservice/strategy"
 	"github.com/ory/x/decoderx"
@@ -100,8 +103,9 @@ func MethodEnabledAndAllowedFromRequest(r *http.Request, flow FlowName, expected
 	return MethodEnabledAndAllowed(r.Context(), flow, expected, method.Method, d)
 }
 
-func MethodEnabledAndAllowed(ctx context.Context, flowName FlowName, expected, actual string, d config.Provider) error {
+func MethodEnabledAndAllowed(ctx context.Context, _ FlowName, expected, actual string, d config.Provider) error {
 	if actual != expected {
+		trace.SpanFromContext(ctx).SetAttributes(attribute.String("not_responsible_reason", "method mismatch"))
 		return errors.WithStack(ErrStrategyNotResponsible)
 	}
 
diff --git a/selfservice/flow/settings/error.go b/selfservice/flow/settings/error.go
index 2583cd9dd526..d8b97bf65c18 100644
--- a/selfservice/flow/settings/error.go
+++ b/selfservice/flow/settings/error.go
@@ -4,9 +4,14 @@
 package settings
 
 import (
+	"context"
 	"net/http"
 	"net/url"
 
+	"github.com/gofrs/uuid"
+
+	"github.com/ory/x/otelx"
+
 	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/kratos/x/events"
@@ -39,6 +44,7 @@ type (
 		errorx.ManagementProvider
 		x.WriterProvider
 		x.LoggingProvider
+		x.TracingProvider
 
 		HandlerProvider
 		FlowPersistenceProvider
@@ -91,18 +97,19 @@ func NewErrorHandler(d errorHandlerDependencies) *ErrorHandler {
 }
 
 func (s *ErrorHandler) reauthenticate(
+	ctx context.Context,
 	w http.ResponseWriter,
 	r *http.Request,
 	f *Flow,
 	err *FlowNeedsReAuth,
 ) {
-	returnTo := urlx.CopyWithQuery(urlx.AppendPaths(s.d.Config().SelfPublicURL(r.Context()), r.URL.Path), r.URL.Query())
+	returnTo := urlx.CopyWithQuery(urlx.AppendPaths(s.d.Config().SelfPublicURL(ctx), r.URL.Path), r.URL.Query())
 
 	params := url.Values{}
 	params.Set("refresh", "true")
 	params.Set("return_to", returnTo.String())
 
-	redirectTo := urlx.AppendPaths(urlx.CopyWithQuery(s.d.Config().SelfPublicURL(r.Context()), params), login.RouteInitBrowserFlow).String()
+	redirectTo := urlx.AppendPaths(urlx.CopyWithQuery(s.d.Config().SelfPublicURL(ctx), params), login.RouteInitBrowserFlow).String()
 	err.RedirectBrowserTo = redirectTo
 	if f.Type == flow.TypeAPI || x.IsJSONRequest(r) {
 		s.d.Writer().WriteError(w, r, err)
@@ -112,20 +119,20 @@ func (s *ErrorHandler) reauthenticate(
 	http.Redirect(w, r, redirectTo, http.StatusSeeOther)
 }
 
-func (s *ErrorHandler) PrepareReplacementForExpiredFlow(w http.ResponseWriter, r *http.Request, f *Flow, id *identity.Identity, err error) (*flow.ExpiredError, error) {
+func (s *ErrorHandler) PrepareReplacementForExpiredFlow(ctx context.Context, w http.ResponseWriter, r *http.Request, f *Flow, id *identity.Identity, err error) (*flow.ExpiredError, error) {
 	e := new(flow.ExpiredError)
 	if !errors.As(err, &e) {
 		return nil, nil
 	}
 
 	// create new flow because the old one is not valid
-	a, err := s.d.SettingsHandler().FromOldFlow(w, r, id, *f)
+	a, err := s.d.SettingsHandler().FromOldFlow(ctx, w, r, id, *f)
 	if err != nil {
 		return nil, err
 	}
 
 	a.UI.Messages.Add(text.NewErrorValidationSettingsFlowExpired(e.ExpiredAt))
-	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(r.Context(), a); err != nil {
+	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(ctx, a); err != nil {
 		return nil, err
 	}
 
@@ -133,6 +140,7 @@ func (s *ErrorHandler) PrepareReplacementForExpiredFlow(w http.ResponseWriter, r
 }
 
 func (s *ErrorHandler) WriteFlowError(
+	ctx context.Context,
 	w http.ResponseWriter,
 	r *http.Request,
 	group node.UiNodeGroup,
@@ -140,11 +148,15 @@ func (s *ErrorHandler) WriteFlowError(
 	id *identity.Identity,
 	err error,
 ) {
-	s.d.Audit().
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.flow.settings.ErrorHandler.WriteFlowError")
+	defer otelx.End(span, &err)
+
+	logger := s.d.Audit().
 		WithError(err).
 		WithRequest(r).
-		WithField("settings_flow", f).
-		Info("Encountered self-service settings error.")
+		WithField("settings_flow", f.ToLoggerField())
+
+	logger.Info("Encountered self-service settings error.")
 
 	shouldRespondWithJSON := x.IsJSONRequest(r)
 	if f != nil && f.Type == flow.TypeAPI {
@@ -155,7 +167,7 @@ func (s *ErrorHandler) WriteFlowError(
 		if shouldRespondWithJSON {
 			s.d.Writer().WriteError(w, r, err)
 		} else {
-			http.Redirect(w, r, urlx.AppendPaths(s.d.Config().SelfPublicURL(r.Context()), login.RouteInitBrowserFlow).String(), http.StatusSeeOther)
+			http.Redirect(w, r, urlx.AppendPaths(s.d.Config().SelfPublicURL(ctx), login.RouteInitBrowserFlow).String(), http.StatusSeeOther)
 		}
 		return
 	}
@@ -170,25 +182,25 @@ func (s *ErrorHandler) WriteFlowError(
 	}
 
 	if f == nil {
-		trace.SpanFromContext(r.Context()).AddEvent(events.NewSettingsFailed(r.Context(), "", ""))
-		s.forward(w, r, nil, err)
+		trace.SpanFromContext(ctx).AddEvent(events.NewSettingsFailed(ctx, uuid.Nil, "", "", err))
+		s.forward(ctx, w, r, nil, err)
 		return
 	}
-	trace.SpanFromContext(r.Context()).AddEvent(events.NewSettingsFailed(r.Context(), string(f.Type), f.Active.String()))
+	trace.SpanFromContext(ctx).AddEvent(events.NewSettingsFailed(ctx, f.ID, string(f.Type), f.Active.String(), err))
 
-	if expired, inner := s.PrepareReplacementForExpiredFlow(w, r, f, id, err); inner != nil {
-		s.forward(w, r, f, err)
+	if expired, inner := s.PrepareReplacementForExpiredFlow(ctx, w, r, f, id, err); inner != nil {
+		s.forward(ctx, w, r, f, err)
 		return
 	} else if expired != nil {
 		if id == nil {
-			s.forward(w, r, f, err)
+			s.forward(ctx, w, r, f, err)
 			return
 		}
 
 		if f.Type == flow.TypeAPI || x.IsJSONRequest(r) {
 			s.d.Writer().WriteError(w, r, expired)
 		} else {
-			http.Redirect(w, r, expired.GetFlow().AppendTo(s.d.Config().SelfServiceFlowSettingsUI(r.Context())).String(), http.StatusSeeOther)
+			http.Redirect(w, r, expired.GetFlow().AppendTo(s.d.Config().SelfServiceFlowSettingsUI(ctx)).String(), http.StatusSeeOther)
 		}
 		return
 	}
@@ -197,71 +209,71 @@ func (s *ErrorHandler) WriteFlowError(
 		if shouldRespondWithJSON {
 			s.d.Writer().Write(w, r, f)
 		} else {
-			http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowSettingsUI(r.Context())).String(), http.StatusSeeOther)
+			http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowSettingsUI(ctx)).String(), http.StatusSeeOther)
 		}
 		return
 	}
 
 	if e := new(FlowNeedsReAuth); errors.As(err, &e) {
-		s.reauthenticate(w, r, f, e)
+		s.reauthenticate(ctx, w, r, f, e)
 		return
 	}
 
 	if err := f.UI.ParseError(group, err); err != nil {
-		s.forward(w, r, f, err)
+		s.forward(ctx, w, r, f, err)
 		return
 	}
 
 	// Lookup the schema from the loaded configuration. This local schema
 	// URL is needed for sorting the UI nodes, instead of the public URL.
-	schemas, err := s.d.IdentityTraitsSchemas(r.Context())
+	schemas, err := s.d.IdentityTraitsSchemas(ctx)
 	if err != nil {
-		s.forward(w, r, f, err)
+		s.forward(ctx, w, r, f, err)
 		return
 	}
 
 	schema, err := schemas.GetByID(id.SchemaID)
 	if err != nil {
-		s.forward(w, r, f, err)
+		s.forward(ctx, w, r, f, err)
 		return
 	}
 
-	if err := sortNodes(r.Context(), f.UI.Nodes, schema.RawURL); err != nil {
-		s.forward(w, r, f, err)
+	if err := sortNodes(ctx, f.UI.Nodes, schema.RawURL); err != nil {
+		s.forward(ctx, w, r, f, err)
 		return
 	}
 
-	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(r.Context(), f); err != nil {
-		s.forward(w, r, f, err)
+	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(ctx, f); err != nil {
+		s.forward(ctx, w, r, f, err)
 		return
 	}
 
 	if f.Type == flow.TypeBrowser && !x.IsJSONRequest(r) {
-		http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowSettingsUI(r.Context())).String(), http.StatusSeeOther)
+		http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowSettingsUI(ctx)).String(), http.StatusSeeOther)
 		return
 	}
 
-	updatedFlow, innerErr := s.d.SettingsFlowPersister().GetSettingsFlow(r.Context(), f.ID)
+	updatedFlow, innerErr := s.d.SettingsFlowPersister().GetSettingsFlow(ctx, f.ID)
 	if innerErr != nil {
-		s.forward(w, r, updatedFlow, innerErr)
+		s.forward(ctx, w, r, updatedFlow, innerErr)
 	}
 
 	s.d.Writer().WriteCode(w, r, x.RecoverStatusCode(err, http.StatusBadRequest), updatedFlow)
 }
 
-func (s *ErrorHandler) forward(w http.ResponseWriter, r *http.Request, rr *Flow, err error) {
+func (s *ErrorHandler) forward(ctx context.Context, w http.ResponseWriter, r *http.Request, rr *Flow, err error) {
 	if rr == nil {
 		if x.IsJSONRequest(r) {
 			s.d.Writer().WriteError(w, r, err)
 			return
 		}
-		s.d.SelfServiceErrorManager().Forward(r.Context(), w, r, err)
+		s.d.SelfServiceErrorManager().Forward(ctx, w, r, err)
 		return
 	}
 
 	if rr.Type == flow.TypeAPI || x.IsJSONRequest(r) {
 		s.d.Writer().WriteErrorCode(w, r, x.RecoverStatusCode(err, http.StatusBadRequest), err)
 	} else {
-		s.d.SelfServiceErrorManager().Forward(r.Context(), w, r, err)
+		s.d.SelfServiceErrorManager().Forward(ctx, w, r, err)
 	}
 }
diff --git a/selfservice/flow/settings/error_test.go b/selfservice/flow/settings/error_test.go
index 5776cd2b6942..f37d3c0cf8e4 100644
--- a/selfservice/flow/settings/error_test.go
+++ b/selfservice/flow/settings/error_test.go
@@ -11,6 +11,8 @@ import (
 	"testing"
 	"time"
 
+	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
+
 	"github.com/pkg/errors"
 
 	"github.com/gofrs/uuid"
@@ -69,7 +71,7 @@ func TestHandleError(t *testing.T) {
 	require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &id))
 
 	router.GET("/error", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-		h.WriteFlowError(w, r, flowMethod, settingsFlow, &id, flowError)
+		h.WriteFlowError(ctx, w, r, flowMethod, settingsFlow, &id, flowError)
 	})
 
 	router.GET("/fake-redirect", func(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
@@ -88,7 +90,7 @@ func TestHandleError(t *testing.T) {
 		require.NoError(t, err)
 
 		for _, s := range reg.SettingsStrategies(context.Background()) {
-			require.NoError(t, s.PopulateSettingsMethod(req, &id, f))
+			require.NoError(t, s.PopulateSettingsMethod(ctx, req, &id, f))
 		}
 
 		require.NoError(t, reg.SettingsFlowPersister().CreateSettingsFlow(context.Background(), f))
@@ -101,7 +103,7 @@ func TestHandleError(t *testing.T) {
 		defer res.Body.Close()
 		require.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowErrorURL(ctx).String()+"?id=")
 
-		sse, _, err := sdk.FrontendApi.GetFlowError(context.Background()).
+		sse, _, err := sdk.FrontendAPI.GetFlowError(context.Background()).
 			Id(res.Request.URL.Query().Get("id")).Execute()
 		require.NoError(t, err)
 
@@ -149,11 +151,12 @@ func TestHandleError(t *testing.T) {
 				t.Cleanup(reset)
 
 				req := httptest.NewRequest("GET", "/sessions/whoami", nil)
+				req.WithContext(confighelpers.WithConfigValue(ctx, config.ViperKeySessionLifespan, time.Hour))
 
 				// This needs an authenticated client in order to call the RouteGetFlow endpoint
-				s, err := session.NewActiveSession(req, &id, testhelpers.NewSessionLifespanProvider(time.Hour), time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+				s, err := testhelpers.NewActiveSession(req, reg, &id, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 				require.NoError(t, err)
-				c := testhelpers.NewHTTPClientWithSessionToken(t, reg, s)
+				c := testhelpers.NewHTTPClientWithSessionToken(t, ctx, reg, s)
 
 				settingsFlow = newFlow(t, time.Minute, tc.t)
 				flowError = flow.NewFlowExpiredError(expiredAnHourAgo)
diff --git a/selfservice/flow/settings/flow.go b/selfservice/flow/settings/flow.go
index 7b0c14bc347e..b32b4676effb 100644
--- a/selfservice/flow/settings/flow.go
+++ b/selfservice/flow/settings/flow.go
@@ -265,3 +265,18 @@ func (f *Flow) SetState(state State) {
 func (t *Flow) GetTransientPayload() json.RawMessage {
 	return t.TransientPayload
 }
+
+func (f *Flow) ToLoggerField() map[string]interface{} {
+	if f == nil {
+		return map[string]interface{}{}
+	}
+	return map[string]interface{}{
+		"id":          f.ID.String(),
+		"return_to":   f.ReturnTo,
+		"request_url": f.RequestURL,
+		"active":      f.Active,
+		"Type":        f.Type,
+		"nid":         f.NID,
+		"state":       f.State,
+	}
+}
diff --git a/selfservice/flow/settings/handler.go b/selfservice/flow/settings/handler.go
index efc1e5a84bc3..3fae390131a1 100644
--- a/selfservice/flow/settings/handler.go
+++ b/selfservice/flow/settings/handler.go
@@ -4,10 +4,13 @@
 package settings
 
 import (
+	"context"
 	"net/http"
 	"net/url"
 	"time"
 
+	"github.com/ory/x/otelx"
+
 	"github.com/julienschmidt/httprouter"
 	"github.com/pkg/errors"
 
@@ -48,6 +51,7 @@ type (
 		x.CSRFProvider
 		x.WriterProvider
 		x.LoggingProvider
+		x.TracingProvider
 
 		config.Provider
 
@@ -120,27 +124,30 @@ func (h *Handler) RegisterAdminRoutes(admin *x.RouterAdmin) {
 	admin.GET(RouteSubmitFlow, x.RedirectToPublicRoute(h.d))
 }
 
-func (h *Handler) NewFlow(w http.ResponseWriter, r *http.Request, i *identity.Identity, ft flow.Type) (*Flow, error) {
+func (h *Handler) NewFlow(ctx context.Context, w http.ResponseWriter, r *http.Request, i *identity.Identity, ft flow.Type) (_ *Flow, err error) {
+	ctx, span := h.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.flow.settings.Handler.NewFlow")
+	defer otelx.End(span, &err)
+
 	f, err := NewFlow(h.d.Config(), h.d.Config().SelfServiceFlowSettingsFlowLifespan(r.Context()), r, i, ft)
 	if err != nil {
 		return nil, err
 	}
 
-	if err := h.d.SettingsHookExecutor().PreSettingsHook(w, r, f); err != nil {
+	if err := h.d.SettingsHookExecutor().PreSettingsHook(ctx, w, r, f); err != nil {
 		return nil, err
 	}
 
-	for _, strategy := range h.d.SettingsStrategies(r.Context()) {
-		if err := h.d.ContinuityManager().Abort(r.Context(), w, r, ContinuityKey(strategy.SettingsStrategyID())); err != nil {
+	for _, strategy := range h.d.SettingsStrategies(ctx) {
+		if err := h.d.ContinuityManager().Abort(ctx, w, r, ContinuityKey(strategy.SettingsStrategyID())); err != nil {
 			return nil, err
 		}
 
-		if err := strategy.PopulateSettingsMethod(r, i, f); err != nil {
+		if err := strategy.PopulateSettingsMethod(ctx, r, i, f); err != nil {
 			return nil, err
 		}
 	}
 
-	ds, err := h.d.Config().DefaultIdentityTraitsSchemaURL(r.Context())
+	ds, err := h.d.Config().DefaultIdentityTraitsSchemaURL(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -156,8 +163,8 @@ func (h *Handler) NewFlow(w http.ResponseWriter, r *http.Request, i *identity.Id
 	return f, nil
 }
 
-func (h *Handler) FromOldFlow(w http.ResponseWriter, r *http.Request, i *identity.Identity, of Flow) (*Flow, error) {
-	nf, err := h.NewFlow(w, r, i, of.Type)
+func (h *Handler) FromOldFlow(ctx context.Context, w http.ResponseWriter, r *http.Request, i *identity.Identity, of Flow) (*Flow, error) {
+	nf, err := h.NewFlow(ctx, w, r, i, of.Type)
 	if err != nil {
 		return nil, err
 	}
@@ -213,18 +220,19 @@ type createNativeSettingsFlow struct {
 //		  400: errorGeneric
 //		  default: errorGeneric
 func (h *Handler) createNativeSettingsFlow(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	s, err := h.d.SessionManager().FetchFromRequest(r.Context(), r)
+	ctx := r.Context()
+	s, err := h.d.SessionManager().FetchFromRequestContext(ctx, r)
 	if err != nil {
 		h.d.Writer().WriteError(w, r, err)
 		return
 	}
 
-	if err := h.d.SessionManager().DoesSessionSatisfy(r, s, h.d.Config().SelfServiceSettingsRequiredAAL(r.Context())); err != nil {
+	if err := h.d.SessionManager().DoesSessionSatisfy(ctx, s, h.d.Config().SelfServiceSettingsRequiredAAL(ctx)); err != nil {
 		h.d.Writer().WriteError(w, r, err)
 		return
 	}
 
-	f, err := h.NewFlow(w, r, s.Identity, flow.TypeAPI)
+	f, err := h.NewFlow(ctx, w, r, s.Identity, flow.TypeAPI)
 	if err != nil {
 		h.d.Writer().WriteError(w, r, err)
 		return
@@ -295,10 +303,11 @@ type createBrowserSettingsFlow struct {
 //	  401: errorGeneric
 //	  403: errorGeneric
 //	  default: errorGeneric
-func (h *Handler) createBrowserSettingsFlow(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
-	s, err := h.d.SessionManager().FetchFromRequest(r.Context(), r)
+func (h *Handler) createBrowserSettingsFlow(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+	ctx := r.Context()
+	s, err := h.d.SessionManager().FetchFromRequestContext(ctx, r)
 	if err != nil {
-		h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, err)
+		h.d.SelfServiceErrorManager().Forward(ctx, w, r, err)
 		return
 	}
 
@@ -308,18 +317,18 @@ func (h *Handler) createBrowserSettingsFlow(w http.ResponseWriter, r *http.Reque
 		managerOptions = append(managerOptions, session.WithRequestURL(requestURL.String()))
 	}
 
-	if err := h.d.SessionManager().DoesSessionSatisfy(r, s, h.d.Config().SelfServiceSettingsRequiredAAL(r.Context()), managerOptions...); err != nil {
-		h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, node.DefaultGroup, nil, nil, err)
+	if err := h.d.SessionManager().DoesSessionSatisfy(ctx, s, h.d.Config().SelfServiceSettingsRequiredAAL(ctx), managerOptions...); err != nil {
+		h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, node.DefaultGroup, nil, nil, err)
 		return
 	}
 
-	f, err := h.NewFlow(w, r, s.Identity, flow.TypeBrowser)
+	f, err := h.NewFlow(ctx, w, r, s.Identity, flow.TypeBrowser)
 	if err != nil {
-		h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, err)
+		h.d.SelfServiceErrorManager().Forward(ctx, w, r, err)
 		return
 	}
 
-	redirTo := f.AppendTo(h.d.Config().SelfServiceFlowSettingsUI(r.Context())).String()
+	redirTo := f.AppendTo(h.d.Config().SelfServiceFlowSettingsUI(ctx)).String()
 	x.AcceptToRedirectOrJSON(w, r, h.d.Writer(), f, redirTo)
 }
 
@@ -393,55 +402,54 @@ type getSettingsFlow struct {
 //	  404: errorGeneric
 //	  410: errorGeneric
 //	  default: errorGeneric
-func (h *Handler) getSettingsFlow(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
-	if err := h.fetchFlow(w, r); err != nil {
-		h.d.Writer().WriteError(w, r, err)
-		return
-	}
-}
-
-func (h *Handler) fetchFlow(w http.ResponseWriter, r *http.Request) error {
+func (h *Handler) getSettingsFlow(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+	ctx := r.Context()
 	rid := x.ParseUUID(r.URL.Query().Get("id"))
-	pr, err := h.d.SettingsFlowPersister().GetSettingsFlow(r.Context(), rid)
+	pr, err := h.d.SettingsFlowPersister().GetSettingsFlow(ctx, rid)
 	if err != nil {
-		return err
+		h.d.Writer().WriteError(w, r, err)
+		return
 	}
 
-	sess, err := h.d.SessionManager().FetchFromRequest(r.Context(), r)
+	sess, err := h.d.SessionManager().FetchFromRequestContext(ctx, r)
 	if err != nil {
-		return err
+		h.d.Writer().WriteError(w, r, err)
+		return
 	}
 
 	if pr.IdentityID != sess.Identity.ID {
-		return errors.WithStack(herodot.ErrForbidden.WithID(text.ErrIDInitiatedBySomeoneElse).WithReasonf("The request was made for another identity and has been blocked for security reasons."))
+		h.d.Writer().WriteError(w, r, errors.WithStack(herodot.ErrForbidden.
+			WithID(text.ErrIDInitiatedBySomeoneElse).
+			WithReasonf("The request was made for another identity and has been blocked for security reasons.")))
+		return
 	}
 
 	// we cannot redirect back to the request URL (/self-service/settings/flows?id=...) since it would just redirect
 	// to a page displaying raw JSON to the client (browser), which is not what we want.
 	// Let's rather carry over the flow ID as a query parameter and redirect to the settings UI URL.
-	requestURL := urlx.CopyWithQuery(h.d.Config().SelfServiceFlowSettingsUI(r.Context()), url.Values{"flow": {rid.String()}})
-	if err := h.d.SessionManager().DoesSessionSatisfy(r, sess, h.d.Config().SelfServiceSettingsRequiredAAL(r.Context()), session.WithRequestURL(requestURL.String())); err != nil {
-		return err
+	requestURL := urlx.CopyWithQuery(h.d.Config().SelfServiceFlowSettingsUI(ctx), url.Values{"flow": {rid.String()}})
+	if err := h.d.SessionManager().DoesSessionSatisfy(ctx, sess, h.d.Config().SelfServiceSettingsRequiredAAL(ctx), session.WithRequestURL(requestURL.String())); err != nil {
+		h.d.Writer().WriteError(w, r, err)
+		return
 	}
 
 	if pr.ExpiresAt.Before(time.Now().UTC()) {
 		if pr.Type == flow.TypeBrowser {
-			redirectURL := flow.GetFlowExpiredRedirectURL(r.Context(), h.d.Config(), RouteInitBrowserFlow, pr.ReturnTo)
+			redirectURL := flow.GetFlowExpiredRedirectURL(ctx, h.d.Config(), RouteInitBrowserFlow, pr.ReturnTo)
 
 			h.d.Writer().WriteError(w, r, errors.WithStack(x.ErrGone.
 				WithReason("The settings flow has expired. Redirect the user to the settings flow init endpoint to initialize a new settings flow.").
 				WithDetail("redirect_to", redirectURL.String()).
 				WithDetail("return_to", pr.ReturnTo)))
-			return nil
+			return
 		}
 		h.d.Writer().WriteError(w, r, errors.WithStack(x.ErrGone.
 			WithReason("The settings flow has expired. Call the settings flow init API endpoint to initialize a new settings flow.").
-			WithDetail("api", urlx.AppendPaths(h.d.Config().SelfPublicURL(r.Context()), RouteInitAPIFlow).String())))
-		return nil
+			WithDetail("api", urlx.AppendPaths(h.d.Config().SelfPublicURL(ctx), RouteInitAPIFlow).String())))
+		return
 	}
 
 	h.d.Writer().Write(w, r, pr)
-	return nil
 }
 
 // Update Settings Flow Parameters
@@ -557,48 +565,56 @@ type updateSettingsFlowBody struct{}
 //	  422: errorBrowserLocationChangeRequired
 //	  default: errorGeneric
 func (h *Handler) updateSettingsFlow(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+	var (
+		err error
+		ctx = r.Context()
+	)
+
+	ctx, span := h.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.flow.settings.Handler.updateSettingsFlow")
+	defer otelx.End(span, &err)
+
 	rid, err := GetFlowID(r)
 	if err != nil {
-		h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, node.DefaultGroup, nil, nil, err)
+		h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, node.DefaultGroup, nil, nil, err)
 		return
 	}
 
-	f, err := h.d.SettingsFlowPersister().GetSettingsFlow(r.Context(), rid)
+	f, err := h.d.SettingsFlowPersister().GetSettingsFlow(ctx, rid)
 	if errors.Is(err, sqlcon.ErrNoRows) {
-		h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, node.DefaultGroup, nil, nil, errors.WithStack(herodot.ErrNotFound.WithReasonf("The settings request could not be found. Please restart the flow.")))
+		h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, node.DefaultGroup, nil, nil, errors.WithStack(herodot.ErrNotFound.WithReasonf("The settings request could not be found. Please restart the flow.")))
 		return
 	} else if err != nil {
-		h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, node.DefaultGroup, nil, nil, err)
+		h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, node.DefaultGroup, nil, nil, err)
 		return
 	}
 
-	ss, err := h.d.SessionManager().FetchFromRequest(r.Context(), r)
+	ss, err := h.d.SessionManager().FetchFromRequestContext(ctx, r)
 	if err != nil {
-		h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, node.DefaultGroup, f, nil, err)
+		h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, node.DefaultGroup, f, nil, err)
 		return
 	}
 
 	requestURL := x.RequestURL(r).String()
-	if err := h.d.SessionManager().DoesSessionSatisfy(r, ss, h.d.Config().SelfServiceSettingsRequiredAAL(r.Context()), session.WithRequestURL(requestURL)); err != nil {
-		h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, node.DefaultGroup, f, nil, err)
+	if err := h.d.SessionManager().DoesSessionSatisfy(ctx, ss, h.d.Config().SelfServiceSettingsRequiredAAL(ctx), session.WithRequestURL(requestURL)); err != nil {
+		h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, node.DefaultGroup, f, nil, err)
 		return
 	}
 
 	if err := f.Valid(ss); err != nil {
-		h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, node.DefaultGroup, f, ss.Identity, err)
+		h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, node.DefaultGroup, f, ss.Identity, err)
 		return
 	}
 
 	var s string
 	var updateContext *UpdateContext
 	for _, strat := range h.d.AllSettingsStrategies() {
-		uc, err := strat.Settings(w, r, f, ss)
+		uc, err := strat.Settings(ctx, w, r, f, ss)
 		if errors.Is(err, flow.ErrStrategyNotResponsible) {
 			continue
 		} else if errors.Is(err, flow.ErrCompletedByStrategy) {
 			return
 		} else if err != nil {
-			h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, strat.NodeGroup(), f, ss.Identity, err)
+			h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, strat.NodeGroup(), f, ss.Identity, err)
 			return
 		}
 
@@ -608,19 +624,19 @@ func (h *Handler) updateSettingsFlow(w http.ResponseWriter, r *http.Request, ps
 	}
 
 	if updateContext == nil {
-		h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, node.DefaultGroup, f, ss.Identity, errors.WithStack(schema.NewNoSettingsStrategyResponsible()))
+		h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, node.DefaultGroup, f, ss.Identity, errors.WithStack(schema.NewNoSettingsStrategyResponsible()))
 		return
 	}
 
 	i, err := updateContext.GetIdentityToUpdate()
 	if err != nil {
 		// An identity to update must always be present.
-		h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, node.DefaultGroup, f, ss.Identity, err)
+		h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, node.DefaultGroup, f, ss.Identity, err)
 		return
 	}
 
-	if err := h.d.SettingsHookExecutor().PostSettingsHook(w, r, s, updateContext, i); err != nil {
-		h.d.SettingsFlowErrorHandler().WriteFlowError(w, r, node.DefaultGroup, f, ss.Identity, err)
+	if err := h.d.SettingsHookExecutor().PostSettingsHook(ctx, w, r, s, updateContext, i); err != nil {
+		h.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, node.DefaultGroup, f, ss.Identity, err)
 		return
 	}
 }
diff --git a/selfservice/flow/settings/handler_test.go b/selfservice/flow/settings/handler_test.go
index 35d34fd735fc..9d4b3e670a17 100644
--- a/selfservice/flow/settings/handler_test.go
+++ b/selfservice/flow/settings/handler_test.go
@@ -67,8 +67,8 @@ func TestHandler(t *testing.T) {
 
 	primaryIdentity := &identity.Identity{ID: x.NewUUID(), Traits: identity.Traits(`{}`)}
 	require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), primaryIdentity))
-	primaryUser := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, primaryIdentity)
-	otherUser := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg)
+	primaryUser := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, primaryIdentity)
+	otherUser := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, ctx, reg)
 
 	newExpiredFlow := func() *settings.Flow {
 		f, err := settings.NewFlow(conf, -time.Minute,
@@ -133,7 +133,7 @@ func TestHandler(t *testing.T) {
 		return initAuthenticatedFlow(t, hc, false, true, opts...)
 	}
 
-	aal2Identity := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, &identity.Identity{
+	aal2Identity := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, &identity.Identity{
 		State:  identity.StateActive,
 		Traits: []byte(`{"email":"foo@bar"}`),
 		Credentials: map[identity.CredentialsType]identity.Credentials{
@@ -151,7 +151,7 @@ func TestHandler(t *testing.T) {
 			})
 
 			t.Run("description=success", func(t *testing.T) {
-				user1 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, reg)
+				user1 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, ctx, reg)
 				res, body := initFlow(t, user1, true)
 				assert.Contains(t, res.Request.URL.String(), settings.RouteInitAPIFlow)
 				assertion(t, body, true)
@@ -206,7 +206,7 @@ func TestHandler(t *testing.T) {
 			})
 
 			t.Run("description=success", func(t *testing.T) {
-				user1 := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg)
+				user1 := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, ctx, reg)
 				res, body := initFlow(t, user1, false)
 				assert.Contains(t, res.Request.URL.String(), reg.Config().SelfServiceFlowSettingsUI(ctx).String())
 				assertion(t, body, false)
@@ -241,7 +241,7 @@ func TestHandler(t *testing.T) {
 			})
 
 			t.Run("case=redirects with 303", func(t *testing.T) {
-				c := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg)
+				c := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, ctx, reg)
 				// prevent the redirect
 				c.CheckRedirect = func(req *http.Request, via []*http.Request) error {
 					return http.ErrUseLastResponse
@@ -268,7 +268,7 @@ func TestHandler(t *testing.T) {
 			})
 
 			t.Run("description=success", func(t *testing.T) {
-				user1 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, reg)
+				user1 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, ctx, reg)
 				res, body := initSPAFlow(t, user1)
 				assert.Contains(t, res.Request.URL.String(), settings.RouteInitBrowserFlow)
 				assertion(t, body, false)
@@ -277,7 +277,7 @@ func TestHandler(t *testing.T) {
 			t.Run("description=can not init if identity has aal2 but session has aal1", func(t *testing.T) {
 				email := testhelpers.RandomEmail()
 				conf.MustSet(ctx, config.ViperKeySelfServiceSettingsRequiredAAL, config.HighestAvailableAAL)
-				user1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, &identity.Identity{
+				user1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, &identity.Identity{
 					State:  identity.StateActive,
 					Traits: []byte(`{"email":"` + email + `"}`),
 					Credentials: map[identity.CredentialsType]identity.Credentials{
@@ -303,7 +303,7 @@ func TestHandler(t *testing.T) {
 			t.Run("description=settings return_to should persist through mfa flows", func(t *testing.T) {
 				email := testhelpers.RandomEmail()
 				conf.MustSet(ctx, config.ViperKeySelfServiceSettingsRequiredAAL, config.HighestAvailableAAL)
-				user1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, &identity.Identity{
+				user1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, &identity.Identity{
 					State:  identity.StateActive,
 					Traits: []byte(`{"email":"` + email + `"}`),
 					Credentials: map[identity.CredentialsType]identity.Credentials{
@@ -334,7 +334,7 @@ func TestHandler(t *testing.T) {
 
 	t.Run("endpoint=fetch", func(t *testing.T) {
 		t.Run("description=fetching a non-existent flow should return a 404 error", func(t *testing.T) {
-			_, _, err := testhelpers.NewSDKCustomClient(publicTS, otherUser).FrontendApi.GetSettingsFlow(context.Background()).Id("i-do-not-exist").Execute()
+			_, _, err := testhelpers.NewSDKCustomClient(publicTS, otherUser).FrontendAPI.GetSettingsFlow(context.Background()).Id("i-do-not-exist").Execute()
 			require.Error(t, err)
 
 			require.IsTypef(t, new(kratos.GenericOpenAPIError), err, "%T", err)
@@ -345,7 +345,7 @@ func TestHandler(t *testing.T) {
 			pr := newExpiredFlow()
 			require.NoError(t, reg.SettingsFlowPersister().CreateSettingsFlow(context.Background(), pr))
 
-			_, _, err := testhelpers.NewSDKCustomClient(publicTS, primaryUser).FrontendApi.GetSettingsFlow(context.Background()).Id(pr.ID.String()).Execute()
+			_, _, err := testhelpers.NewSDKCustomClient(publicTS, primaryUser).FrontendAPI.GetSettingsFlow(context.Background()).Id(pr.ID.String()).Execute()
 			require.Error(t, err)
 
 			require.IsTypef(t, new(kratos.GenericOpenAPIError), err, "%T", err)
@@ -356,7 +356,7 @@ func TestHandler(t *testing.T) {
 			returnTo := "https://www.ory.sh"
 			conf.MustSet(ctx, config.ViperKeyURLsAllowedReturnToDomains, []string{returnTo})
 
-			client := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, reg)
+			client := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, ctx, reg)
 			body := testhelpers.EasyGetBody(t, client, publicTS.URL+settings.RouteInitBrowserFlow+"?return_to="+returnTo)
 
 			// Expire the flow
@@ -385,8 +385,8 @@ func TestHandler(t *testing.T) {
 
 		t.Run("description=should fail to fetch request if identity changed", func(t *testing.T) {
 			t.Run("type=api", func(t *testing.T) {
-				user1 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, reg)
-				user2 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, reg)
+				user1 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, ctx, reg)
+				user2 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, ctx, reg)
 
 				res, err := user1.Get(publicTS.URL + settings.RouteInitAPIFlow)
 				require.NoError(t, err)
@@ -413,7 +413,7 @@ func TestHandler(t *testing.T) {
 				rid := res.Request.URL.Query().Get("flow")
 				require.NotEmpty(t, rid)
 
-				_, _, err = testhelpers.NewSDKCustomClient(publicTS, otherUser).FrontendApi.GetSettingsFlow(context.Background()).Id(rid).Execute()
+				_, _, err = testhelpers.NewSDKCustomClient(publicTS, otherUser).FrontendAPI.GetSettingsFlow(context.Background()).Id(rid).Execute()
 				require.Error(t, err)
 				require.IsTypef(t, new(kratos.GenericOpenAPIError), err, "%T", err)
 				assert.Equal(t, int64(http.StatusForbidden), gjson.GetBytes(err.(*kratos.GenericOpenAPIError).Body(), "error.code").Int(), "should return a 403 error because the identities from the cookies do not match")
@@ -537,8 +537,8 @@ func TestHandler(t *testing.T) {
 
 		t.Run("description=fail to submit form as another user", func(t *testing.T) {
 			t.Run("type=api", func(t *testing.T) {
-				user1 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, reg)
-				user2 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, reg)
+				user1 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, ctx, reg)
+				user2 := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, ctx, reg)
 				_, body := initFlow(t, user1, true)
 				var f kratos.SettingsFlow
 				require.NoError(t, json.Unmarshal(body, &f))
@@ -549,8 +549,8 @@ func TestHandler(t *testing.T) {
 			})
 
 			t.Run("type=spa", func(t *testing.T) {
-				user1 := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg)
-				user2 := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg)
+				user1 := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, ctx, reg)
+				user2 := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, ctx, reg)
 				_, body := initFlow(t, user1, true)
 				var f kratos.SettingsFlow
 				require.NoError(t, json.Unmarshal(body, &f))
@@ -561,8 +561,8 @@ func TestHandler(t *testing.T) {
 			})
 
 			t.Run("type=browser", func(t *testing.T) {
-				user1 := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg)
-				user2 := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg)
+				user1 := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, ctx, reg)
+				user2 := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, ctx, reg)
 				_, body := initFlow(t, user1, true)
 				var f kratos.SettingsFlow
 				require.NoError(t, json.Unmarshal(body, &f))
@@ -580,7 +580,7 @@ func TestHandler(t *testing.T) {
 				require.NoError(t, json.Unmarshal(body, &f))
 
 				actual, res := testhelpers.SettingsMakeRequest(t, false, true, &f, primaryUser, fmt.Sprintf(`{"method":"profile", "numby": 15, "csrf_token": "%s"}`, x.FakeCSRFToken))
-				assert.Equal(t, http.StatusOK, res.StatusCode)
+				require.Equal(t, http.StatusOK, res.StatusCode)
 				require.Len(t, primaryUser.Jar.Cookies(urlx.ParseOrPanic(publicTS.URL+login.RouteGetFlow)), 1)
 				require.Contains(t, fmt.Sprintf("%v", primaryUser.Jar.Cookies(urlx.ParseOrPanic(publicTS.URL))), "ory_kratos_session")
 				assert.Equal(t, "Your changes have been saved!", gjson.Get(actual, "ui.messages.0.text").String(), actual)
@@ -602,7 +602,7 @@ func TestHandler(t *testing.T) {
 
 	t.Run("case=relative redirect when self-service settings ui is a relative url", func(t *testing.T) {
 		reg.Config().MustSet(ctx, config.ViperKeySelfServiceSettingsURL, "/settings-ts")
-		user1 := testhelpers.NewNoRedirectHTTPClientWithArbitrarySessionCookie(t, reg)
+		user1 := testhelpers.NewNoRedirectHTTPClientWithArbitrarySessionCookie(t, ctx, reg)
 		res, _ := initFlow(t, user1, false)
 		assert.Regexp(
 			t,
diff --git a/selfservice/flow/settings/hook.go b/selfservice/flow/settings/hook.go
index b688fd0fc431..645957b07e30 100644
--- a/selfservice/flow/settings/hook.go
+++ b/selfservice/flow/settings/hook.go
@@ -9,6 +9,8 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/ory/x/otelx"
+
 	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/kratos/x/events"
@@ -67,6 +69,7 @@ type (
 		x.CSRFTokenGeneratorProvider
 		x.LoggingProvider
 		x.WriterProvider
+		x.TracingProvider
 	}
 	HookExecutor struct {
 		d executorDependencies
@@ -120,7 +123,7 @@ func WithCallback(cb func(ctxUpdate *UpdateContext) error) func(o *postSettingsH
 	}
 }
 
-func (e *HookExecutor) handleSettingsError(_ http.ResponseWriter, r *http.Request, settingsType string, f *Flow, i *identity.Identity, flowError error) error {
+func (e *HookExecutor) handleSettingsError(_ context.Context, _ http.ResponseWriter, r *http.Request, settingsType string, f *Flow, i *identity.Identity, flowError error) error {
 	if f != nil {
 		if i != nil {
 			var group node.UiNodeGroup
@@ -151,7 +154,10 @@ func (e *HookExecutor) handleSettingsError(_ http.ResponseWriter, r *http.Reques
 	return flowError
 }
 
-func (e *HookExecutor) PostSettingsHook(w http.ResponseWriter, r *http.Request, settingsType string, ctxUpdate *UpdateContext, i *identity.Identity, opts ...PostSettingsHookOption) error {
+func (e *HookExecutor) PostSettingsHook(ctx context.Context, w http.ResponseWriter, r *http.Request, settingsType string, ctxUpdate *UpdateContext, i *identity.Identity, opts ...PostSettingsHookOption) (err error) {
+	ctx, span := e.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.flow.settings.HookExecutor.PostSettingsHook")
+	defer otelx.End(span, &err)
+
 	e.d.Logger().
 		WithRequest(r).
 		WithField("identity_id", i.ID).
@@ -160,13 +166,13 @@ func (e *HookExecutor) PostSettingsHook(w http.ResponseWriter, r *http.Request,
 
 	// Verify the redirect URL before we do any other processing.
 	c := e.d.Config()
-	returnTo, err := x.SecureRedirectTo(r, c.SelfServiceBrowserDefaultReturnTo(r.Context()),
+	returnTo, err := x.SecureRedirectTo(r, c.SelfServiceBrowserDefaultReturnTo(ctx),
 		x.SecureRedirectUseSourceURL(ctxUpdate.Flow.RequestURL),
-		x.SecureRedirectAllowURLs(c.SelfServiceBrowserAllowedReturnToDomains(r.Context())),
-		x.SecureRedirectAllowSelfServiceURLs(c.SelfPublicURL(r.Context())),
+		x.SecureRedirectAllowURLs(c.SelfServiceBrowserAllowedReturnToDomains(ctx)),
+		x.SecureRedirectAllowSelfServiceURLs(c.SelfPublicURL(ctx)),
 		x.SecureRedirectOverrideDefaultReturnTo(
-			e.d.Config().SelfServiceFlowSettingsReturnTo(r.Context(), settingsType,
-				ctxUpdate.Flow.AppendTo(e.d.Config().SelfServiceFlowSettingsUI(r.Context())))),
+			e.d.Config().SelfServiceFlowSettingsReturnTo(ctx, settingsType,
+				ctxUpdate.Flow.AppendTo(e.d.Config().SelfServiceFlowSettingsUI(ctx)))),
 	)
 	if err != nil {
 		return err
@@ -177,11 +183,11 @@ func (e *HookExecutor) PostSettingsHook(w http.ResponseWriter, r *http.Request,
 		f(hookOptions)
 	}
 
-	for k, executor := range e.d.PostSettingsPrePersistHooks(r.Context(), settingsType) {
+	for k, executor := range e.d.PostSettingsPrePersistHooks(ctx, settingsType) {
 		logFields := logrus.Fields{
 			"executor":          fmt.Sprintf("%T", executor),
 			"executor_position": k,
-			"executors":         PostHookPrePersistExecutorNames(e.d.PostSettingsPrePersistHooks(r.Context(), settingsType)),
+			"executors":         PostHookPrePersistExecutorNames(e.d.PostSettingsPrePersistHooks(ctx, settingsType)),
 			"identity_id":       i.ID,
 			"flow_method":       settingsType,
 		}
@@ -199,23 +205,19 @@ func (e *HookExecutor) PostSettingsHook(w http.ResponseWriter, r *http.Request,
 			case "oidc":
 				group = node.OpenIDConnectGroup
 			}
-			var traits identity.Traits
-			if i != nil {
-				traits = i.Traits
-			}
-			return flow.HandleHookError(w, r, ctxUpdate.Flow, traits, group, err, e.d, e.d)
+			return flow.HandleHookError(w, r, ctxUpdate.Flow, i.Traits, group, err, e.d, e.d)
 		}
 
 		e.d.Logger().WithRequest(r).WithFields(logFields).Debug("ExecuteSettingsPrePersistHook completed successfully.")
 	}
 
 	options := []identity.ManagerOption{identity.ManagerExposeValidationErrorsForInternalTypeAssertion}
-	ttl := e.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(r.Context())
+	ttl := e.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(ctx)
 	if ctxUpdate.Session.AuthenticatedAt.Add(ttl).After(time.Now()) {
 		options = append(options, identity.ManagerAllowWriteProtectedTraits)
 	}
 
-	if err := e.d.IdentityManager().Update(r.Context(), i, options...); err != nil {
+	if err := e.d.IdentityManager().Update(ctx, i, options...); err != nil {
 		if errors.Is(err, identity.ErrProtectedFieldModified) {
 			e.d.Logger().WithError(err).Debug("Modifying protected field requires re-authentication.")
 			return errors.WithStack(NewFlowNeedsReAuth())
@@ -238,7 +240,7 @@ func (e *HookExecutor) PostSettingsHook(w http.ResponseWriter, r *http.Request,
 		}
 	}
 
-	newFlow, err := e.d.SettingsHandler().NewFlow(w, r, i, ctxUpdate.Flow.Type)
+	newFlow, err := e.d.SettingsHandler().NewFlow(ctx, w, r, i, ctxUpdate.Flow.Type)
 	if err != nil {
 		return err
 	}
@@ -247,30 +249,30 @@ func (e *HookExecutor) PostSettingsHook(w http.ResponseWriter, r *http.Request,
 	ctxUpdate.Flow.UI.ResetMessages()
 	ctxUpdate.Flow.UI.AddMessage(node.DefaultGroup, text.NewInfoSelfServiceSettingsUpdateSuccess())
 	ctxUpdate.Flow.InternalContext = newFlow.InternalContext
-	if err := e.d.SettingsFlowPersister().UpdateSettingsFlow(r.Context(), ctxUpdate.Flow); err != nil {
+	if err := e.d.SettingsFlowPersister().UpdateSettingsFlow(ctx, ctxUpdate.Flow); err != nil {
 		return err
 	}
 
-	for k, executor := range e.d.PostSettingsPostPersistHooks(r.Context(), settingsType) {
+	for k, executor := range e.d.PostSettingsPostPersistHooks(ctx, settingsType) {
 		if err := executor.ExecuteSettingsPostPersistHook(w, r, ctxUpdate.Flow, i, ctxUpdate.Session); err != nil {
 			if errors.Is(err, ErrHookAbortFlow) {
 				e.d.Logger().
 					WithRequest(r).
 					WithField("executor", fmt.Sprintf("%T", executor)).
 					WithField("executor_position", k).
-					WithField("executors", PostHookPostPersistExecutorNames(e.d.PostSettingsPostPersistHooks(r.Context(), settingsType))).
+					WithField("executors", PostHookPostPersistExecutorNames(e.d.PostSettingsPostPersistHooks(ctx, settingsType))).
 					WithField("identity_id", i.ID).
 					WithField("flow_method", settingsType).
 					Debug("A ExecuteSettingsPostPersistHook hook aborted early.")
 				return nil
 			}
-			return e.handleSettingsError(w, r, settingsType, ctxUpdate.Flow, i, err)
+			return e.handleSettingsError(ctx, w, r, settingsType, ctxUpdate.Flow, i, err)
 		}
 
 		e.d.Logger().WithRequest(r).
 			WithField("executor", fmt.Sprintf("%T", executor)).
 			WithField("executor_position", k).
-			WithField("executors", PostHookPostPersistExecutorNames(e.d.PostSettingsPostPersistHooks(r.Context(), settingsType))).
+			WithField("executors", PostHookPostPersistExecutorNames(e.d.PostSettingsPostPersistHooks(ctx, settingsType))).
 			WithField("identity_id", i.ID).
 			WithField("flow_method", settingsType).
 			Debug("ExecuteSettingsPostPersistHook completed successfully.")
@@ -282,10 +284,11 @@ func (e *HookExecutor) PostSettingsHook(w http.ResponseWriter, r *http.Request,
 		WithField("flow_method", settingsType).
 		Debug("Completed all PostSettingsPrePersistHooks and PostSettingsPostPersistHooks.")
 
-	trace.SpanFromContext(r.Context()).AddEvent(events.NewSettingsSucceeded(r.Context(), i.ID, string(ctxUpdate.Flow.Type), ctxUpdate.Flow.Active.String()))
+	trace.SpanFromContext(ctx).AddEvent(events.NewSettingsSucceeded(
+		ctx, ctxUpdate.Flow.ID, i.ID, string(ctxUpdate.Flow.Type), settingsType))
 
 	if ctxUpdate.Flow.Type == flow.TypeAPI {
-		updatedFlow, err := e.d.SettingsFlowPersister().GetSettingsFlow(r.Context(), ctxUpdate.Flow.ID)
+		updatedFlow, err := e.d.SettingsFlowPersister().GetSettingsFlow(ctx, ctxUpdate.Flow.ID)
 		if err != nil {
 			return err
 		}
@@ -297,17 +300,18 @@ func (e *HookExecutor) PostSettingsHook(w http.ResponseWriter, r *http.Request,
 		return nil
 	}
 
-	if err := e.d.SessionManager().IssueCookie(r.Context(), w, r, ctxUpdate.Session); err != nil {
+	if err := e.d.SessionManager().IssueCookie(ctx, w, r, ctxUpdate.Session); err != nil {
 		return errors.WithStack(err)
 	}
 
 	if x.IsJSONRequest(r) {
-		updatedFlow, err := e.d.SettingsFlowPersister().GetSettingsFlow(r.Context(), ctxUpdate.Flow.ID)
+		updatedFlow, err := e.d.SettingsFlowPersister().GetSettingsFlow(ctx, ctxUpdate.Flow.ID)
 		if err != nil {
 			return err
 		}
 		// ContinueWith items are transient items, not stored in the database, and need to be carried over here, so
 		// they can be returned to the client.
+		ctxUpdate.Flow.AddContinueWith(flow.NewContinueWithRedirectBrowserTo(returnTo.String()))
 		updatedFlow.ContinueWithItems = ctxUpdate.Flow.ContinueWithItems
 
 		e.d.Writer().Write(w, r, updatedFlow)
@@ -318,8 +322,11 @@ func (e *HookExecutor) PostSettingsHook(w http.ResponseWriter, r *http.Request,
 	return nil
 }
 
-func (e *HookExecutor) PreSettingsHook(w http.ResponseWriter, r *http.Request, a *Flow) error {
-	for _, executor := range e.d.PreSettingsHooks(r.Context()) {
+func (e *HookExecutor) PreSettingsHook(ctx context.Context, w http.ResponseWriter, r *http.Request, a *Flow) (err error) {
+	ctx, span := e.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.flow.settings.HookExecutor.PreSettingsHook")
+	defer otelx.End(span, &err)
+
+	for _, executor := range e.d.PreSettingsHooks(ctx) {
 		if err := executor.ExecuteSettingsPreHook(w, r, a); err != nil {
 			return err
 		}
diff --git a/selfservice/flow/settings/hook_test.go b/selfservice/flow/settings/hook_test.go
index 0ab28a1504f9..70bb94212279 100644
--- a/selfservice/flow/settings/hook_test.go
+++ b/selfservice/flow/settings/hook_test.go
@@ -24,7 +24,6 @@ import (
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/settings"
 	"github.com/ory/kratos/selfservice/hook"
-	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/x"
 )
 
@@ -54,11 +53,11 @@ func TestSettingsExecutor(t *testing.T) {
 					if i == nil {
 						i = testhelpers.SelfServiceHookCreateFakeIdentity(t, reg)
 					}
-					sess, _ := session.NewActiveSession(r, i, conf, time.Now().UTC(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+					sess, _ := testhelpers.NewActiveSession(r, reg, i, time.Now().UTC(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 
 					f, err := settings.NewFlow(conf, time.Minute, r, sess.Identity, ft)
 					require.NoError(t, err)
-					if handleErr(t, w, r, reg.SettingsHookExecutor().PreSettingsHook(w, r, f)) {
+					if handleErr(t, w, r, reg.SettingsHookExecutor().PreSettingsHook(r.Context(), w, r, f)) {
 						_, _ = w.Write([]byte("ok"))
 					}
 				})
@@ -67,14 +66,14 @@ func TestSettingsExecutor(t *testing.T) {
 					if i == nil {
 						i = testhelpers.SelfServiceHookCreateFakeIdentity(t, reg)
 					}
-					sess, _ := session.NewActiveSession(r, i, conf, time.Now().UTC(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+					sess, _ := testhelpers.NewActiveSession(r, reg, i, time.Now().UTC(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 
 					a, err := settings.NewFlow(conf, time.Minute, r, sess.Identity, ft)
 					require.NoError(t, err)
 					a.RequestURL = x.RequestURL(r).String()
 					require.NoError(t, reg.SettingsFlowPersister().CreateSettingsFlow(r.Context(), a))
 					_ = handleErr(t, w, r, reg.SettingsHookExecutor().
-						PostSettingsHook(w, r, strategy, &settings.UpdateContext{Flow: a, Session: sess}, i))
+						PostSettingsHook(ctx, w, r, strategy, &settings.UpdateContext{Flow: a, Session: sess}, i))
 				})
 				ts := httptest.NewServer(router)
 				t.Cleanup(ts.Close)
@@ -101,6 +100,16 @@ func TestSettingsExecutor(t *testing.T) {
 					assert.Contains(t, res.Request.URL.String(), uiURL)
 				})
 
+				t.Run("case=pass without hooks if ajax client", func(t *testing.T) {
+					t.Cleanup(testhelpers.SelfServiceHookConfigReset(t, conf))
+
+					ts := newServer(t, nil, flow.TypeBrowser)
+					res, body := makeRequestPost(t, ts, true, url.Values{})
+					assert.EqualValues(t, http.StatusOK, res.StatusCode)
+					assert.Contains(t, res.Request.URL.String(), ts.URL)
+					assert.EqualValues(t, gjson.Get(body, "continue_with.0.action").String(), "redirect_browser_to")
+				})
+
 				t.Run("case=pass if hooks pass", func(t *testing.T) {
 					t.Cleanup(testhelpers.SelfServiceHookConfigReset(t, conf))
 
diff --git a/selfservice/flow/settings/strategy.go b/selfservice/flow/settings/strategy.go
index 011166540b22..be10fb92568f 100644
--- a/selfservice/flow/settings/strategy.go
+++ b/selfservice/flow/settings/strategy.go
@@ -28,8 +28,8 @@ type Strategy interface {
 	SettingsStrategyID() string
 	NodeGroup() node.UiNodeGroup
 	RegisterSettingsRoutes(*x.RouterPublic)
-	PopulateSettingsMethod(*http.Request, *identity.Identity, *Flow) error
-	Settings(w http.ResponseWriter, r *http.Request, f *Flow, s *session.Session) (*UpdateContext, error)
+	PopulateSettingsMethod(context.Context, *http.Request, *identity.Identity, *Flow) error
+	Settings(ctx context.Context, w http.ResponseWriter, r *http.Request, f *Flow, s *session.Session) (*UpdateContext, error)
 }
 
 type Strategies []Strategy
diff --git a/selfservice/flow/state.go b/selfservice/flow/state.go
index 76a0683fc19d..a6b4f1a98966 100644
--- a/selfservice/flow/state.go
+++ b/selfservice/flow/state.go
@@ -33,7 +33,11 @@ const (
 	StateSuccess         State = "success"
 )
 
-var states = []State{StateChooseMethod, StateEmailSent, StatePassedChallenge}
+var states = []State{
+	StateChooseMethod,
+	StateEmailSent,
+	StatePassedChallenge,
+}
 
 func indexOf(current State) int {
 	for k, s := range states {
diff --git a/selfservice/flow/verification/error.go b/selfservice/flow/verification/error.go
index b39875b233d0..5ed7e308e90c 100644
--- a/selfservice/flow/verification/error.go
+++ b/selfservice/flow/verification/error.go
@@ -7,6 +7,8 @@ import (
 	"net/http"
 	"net/url"
 
+	"github.com/gofrs/uuid"
+
 	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/kratos/x/events"
@@ -60,18 +62,20 @@ func (s *ErrorHandler) WriteFlowError(
 	group node.UiNodeGroup,
 	err error,
 ) {
-	s.d.Audit().
+	logger := s.d.Audit().
 		WithError(err).
 		WithRequest(r).
-		WithField("verification_flow", f).
+		WithField("verification_flow", f.ToLoggerField())
+
+	logger.
 		Info("Encountered self-service verification error.")
 
 	if f == nil {
-		trace.SpanFromContext(r.Context()).AddEvent(events.NewVerificationFailed(r.Context(), "", ""))
+		trace.SpanFromContext(r.Context()).AddEvent(events.NewVerificationFailed(r.Context(), uuid.Nil, "", "", err))
 		s.forward(w, r, nil, err)
 		return
 	}
-	trace.SpanFromContext(r.Context()).AddEvent(events.NewVerificationFailed(r.Context(), string(f.Type), f.Active.String()))
+	trace.SpanFromContext(r.Context()).AddEvent(events.NewVerificationFailed(r.Context(), f.ID, string(f.Type), f.Active.String(), err))
 
 	if e := new(flow.ExpiredError); errors.As(err, &e) {
 		strategy, err := s.d.VerificationStrategies(r.Context()).Strategy(f.Active.String())
diff --git a/selfservice/flow/verification/error_test.go b/selfservice/flow/verification/error_test.go
index 86f4d2e1e32a..7359f8c81e1d 100644
--- a/selfservice/flow/verification/error_test.go
+++ b/selfservice/flow/verification/error_test.go
@@ -87,7 +87,7 @@ func TestHandleError(t *testing.T) {
 		defer res.Body.Close()
 		require.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowErrorURL(ctx).String()+"?id=")
 
-		sse, _, err := sdk.FrontendApi.GetFlowError(context.Background()).Id(res.Request.URL.Query().Get("id")).Execute()
+		sse, _, err := sdk.FrontendAPI.GetFlowError(context.Background()).Id(res.Request.URL.Query().Get("id")).Execute()
 		require.NoError(t, err)
 
 		return sse.Error, nil
diff --git a/selfservice/flow/verification/flow.go b/selfservice/flow/verification/flow.go
index a0de0250b54d..c82ac9148430 100644
--- a/selfservice/flow/verification/flow.go
+++ b/selfservice/flow/verification/flow.go
@@ -185,6 +185,7 @@ func NewPostHookFlow(conf *config.Config, exp time.Duration, csrf string, r *htt
 	if err != nil {
 		return nil, err
 	}
+	f.TransientPayload = original.GetTransientPayload()
 	requestURL, err := url.ParseRequestURI(original.GetRequestURL())
 	if err != nil {
 		requestURL = new(url.URL)
@@ -297,3 +298,18 @@ func (f *Flow) SetState(state State) {
 func (t *Flow) GetTransientPayload() json.RawMessage {
 	return t.TransientPayload
 }
+
+func (f *Flow) ToLoggerField() map[string]interface{} {
+	if f == nil {
+		return map[string]interface{}{}
+	}
+	return map[string]interface{}{
+		"id":          f.ID.String(),
+		"return_to":   f.ReturnTo,
+		"request_url": f.RequestURL,
+		"active":      f.Active,
+		"Type":        f.Type,
+		"nid":         f.NID,
+		"state":       f.State,
+	}
+}
diff --git a/selfservice/flow/verification/handler.go b/selfservice/flow/verification/handler.go
index 8b0e832ad8e7..785f627e7f6a 100644
--- a/selfservice/flow/verification/handler.go
+++ b/selfservice/flow/verification/handler.go
@@ -123,6 +123,20 @@ func (h *Handler) NewVerificationFlow(w http.ResponseWriter, r *http.Request, ft
 	return f, nil
 }
 
+// Create Verification Flow Parameters for Native Apps
+//
+// swagger:parameters createNativeVerificationFlow
+//
+//nolint:deadcode,unused
+//lint:ignore U1000 Used to generate Swagger and OpenAPI definitions
+type createNativeVerificationFlow struct {
+	// A URL contained in the return_to key of the verification flow.
+	// This piece of data has no effect on the actual logic of the flow and is purely informational.
+	//
+	// in: query
+	ReturnTo string `json:"return_to"`
+}
+
 // swagger:route GET /self-service/verification/api frontend createNativeVerificationFlow
 //
 // # Create Verification Flow for Native Apps
diff --git a/selfservice/flow/verification/hook.go b/selfservice/flow/verification/hook.go
index c556acd51f16..f22c41b6d20c 100644
--- a/selfservice/flow/verification/hook.go
+++ b/selfservice/flow/verification/hook.go
@@ -112,7 +112,7 @@ func (e *HookExecutor) PostVerificationHook(w http.ResponseWriter, r *http.Reque
 			Debug("ExecutePostVerificationHook completed successfully.")
 	}
 
-	trace.SpanFromContext(r.Context()).AddEvent(events.NewVerificationSucceeded(r.Context(), i.ID, string(a.Type), a.Active.String()))
+	trace.SpanFromContext(r.Context()).AddEvent(events.NewVerificationSucceeded(r.Context(), a.ID, i.ID, string(a.Type), a.Active.String()))
 
 	e.d.Logger().
 		WithRequest(r).
diff --git a/selfservice/flowhelpers/login.go b/selfservice/flowhelpers/login.go
index 2e97f85ebe30..60c17176a740 100644
--- a/selfservice/flowhelpers/login.go
+++ b/selfservice/flowhelpers/login.go
@@ -15,11 +15,11 @@ func GuessForcedLoginIdentifier(r *http.Request, d interface {
 	session.ManagementProvider
 	identity.PrivilegedPoolProvider
 }, f interface {
-	IsForced() bool
+	IsRefresh() bool
 }, ct identity.CredentialsType) (identifier string, id *identity.Identity, creds *identity.Credentials) {
 	var ok bool
 	// This block adds the identifier to the method when the request is forced - as a hint for the user.
-	if !f.IsForced() {
+	if !f.IsRefresh() {
 		// do nothing
 	} else if sess, err := d.SessionManager().FetchFromRequest(r.Context(), r); err != nil {
 		// do nothing
diff --git a/selfservice/flowhelpers/login_test.go b/selfservice/flowhelpers/login_test.go
index 3506c73c8513..0a400ff7d4b7 100644
--- a/selfservice/flowhelpers/login_test.go
+++ b/selfservice/flowhelpers/login_test.go
@@ -17,7 +17,6 @@ import (
 	"github.com/ory/kratos/internal/testhelpers"
 	"github.com/ory/kratos/selfservice/flow/login"
 	"github.com/ory/kratos/selfservice/flowhelpers"
-	"github.com/ory/kratos/session"
 )
 
 func TestGuessForcedLoginIdentifier(t *testing.T) {
@@ -34,9 +33,9 @@ func TestGuessForcedLoginIdentifier(t *testing.T) {
 
 	req := httptest.NewRequest("GET", "/sessions/whoami", nil)
 
-	sess, err := session.NewActiveSession(req, i, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+	sess, err := testhelpers.NewActiveSession(req, reg, i, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 	require.NoError(t, err)
-	reg.SessionPersister().UpsertSession(context.Background(), sess)
+	require.NoError(t, reg.SessionPersister().UpsertSession(context.Background(), sess))
 
 	r := httptest.NewRequest("GET", "/login", nil)
 	r.Header.Set("Authorization", "Bearer "+sess.Token)
diff --git a/selfservice/hook/code_address_verifier_test.go b/selfservice/hook/code_address_verifier_test.go
index 579432e60556..000002cdac36 100644
--- a/selfservice/hook/code_address_verifier_test.go
+++ b/selfservice/hook/code_address_verifier_test.go
@@ -40,7 +40,7 @@ func TestCodeAddressVerifier(t *testing.T) {
 
 		_, err := reg.RegistrationCodePersister().CreateRegistrationCode(ctx, &code.CreateRegistrationCodeParams{
 			Address:     address,
-			AddressType: identity.CodeAddressTypeEmail,
+			AddressType: identity.AddressTypeEmail,
 			RawCode:     rawCode,
 			ExpiresIn:   time.Hour,
 			FlowID:      rf.ID,
diff --git a/selfservice/hook/password_migration_hook.go b/selfservice/hook/password_migration_hook.go
new file mode 100644
index 000000000000..c22909bed068
--- /dev/null
+++ b/selfservice/hook/password_migration_hook.go
@@ -0,0 +1,112 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package hook
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/pkg/errors"
+	"github.com/tidwall/gjson"
+	"go.opentelemetry.io/otel/codes"
+	semconv "go.opentelemetry.io/otel/semconv/v1.11.0"
+	"go.opentelemetry.io/otel/trace"
+	grpccodes "google.golang.org/grpc/codes"
+
+	"github.com/ory/herodot"
+	"github.com/ory/kratos/request"
+	"github.com/ory/kratos/schema"
+	"github.com/ory/kratos/x"
+	"github.com/ory/x/otelx"
+)
+
+type (
+	PasswordMigration struct {
+		deps webHookDependencies
+		conf json.RawMessage
+	}
+	PasswordMigrationRequest struct {
+		Identifier string `json:"identifier"`
+		Password   string `json:"password"`
+	}
+	PasswordMigrationResponse struct {
+		Status string `json:"status"`
+	}
+)
+
+func NewPasswordMigrationHook(deps webHookDependencies, conf json.RawMessage) *PasswordMigration {
+	return &PasswordMigration{deps: deps, conf: conf}
+}
+
+func (p *PasswordMigration) Execute(ctx context.Context, data *PasswordMigrationRequest) (err error) {
+	var (
+		httpClient = p.deps.HTTPClient(ctx)
+		emitEvent  = gjson.GetBytes(p.conf, "emit_analytics_event").Bool() || !gjson.GetBytes(p.conf, "emit_analytics_event").Exists() // default true
+		tracer     = trace.SpanFromContext(ctx).TracerProvider().Tracer("kratos-webhooks")
+	)
+
+	ctx, span := tracer.Start(ctx, "selfservice.login.password_migration")
+	defer otelx.End(span, &err)
+
+	if emitEvent {
+		instrumentHTTPClientForEvents(ctx, httpClient, x.NewUUID(), "password_migration_hook")
+	}
+	builder, err := request.NewBuilder(ctx, p.conf, p.deps)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+	req, err := builder.BuildRequest(ctx, nil) // passing a nil body here skips Jsonnet
+	if err != nil {
+		return errors.WithStack(err)
+	}
+	rawData, err := json.Marshal(data)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+	if err = req.SetBody(rawData); err != nil {
+		return errors.WithStack(err)
+	}
+
+	p.deps.Logger().WithRequest(req.Request).Info("Dispatching password migration hook")
+	req = req.WithContext(ctx)
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return herodot.DefaultError{
+			CodeField:     http.StatusBadGateway,
+			StatusField:   http.StatusText(http.StatusBadGateway),
+			GRPCCodeField: grpccodes.Aborted,
+			ReasonField:   "A third-party upstream service could not be reached. Please try again later.",
+			ErrorField:    "calling the password migration hook failed",
+		}.WithWrap(errors.WithStack(err))
+	}
+	defer resp.Body.Close()
+	span.SetAttributes(semconv.HTTPAttributesFromHTTPStatusCode(resp.StatusCode)...)
+
+	switch resp.StatusCode {
+	case http.StatusOK:
+		// We now check if the response matches `{"status": "password_match" }`.
+		dec := json.NewDecoder(io.LimitReader(resp.Body, 1024)) // limit the response body to 1KB
+		var response PasswordMigrationResponse
+		if err := dec.Decode(&response); err != nil || response.Status != "password_match" {
+			return errors.WithStack(schema.NewInvalidCredentialsError())
+		}
+		return nil
+
+	case http.StatusForbidden:
+		return errors.WithStack(schema.NewInvalidCredentialsError())
+	default:
+		span.SetStatus(codes.Error, "Unexpected HTTP status code")
+		return herodot.DefaultError{
+			CodeField:     http.StatusBadGateway,
+			StatusField:   http.StatusText(http.StatusBadGateway),
+			GRPCCodeField: grpccodes.Aborted,
+			ReasonField:   "A third-party upstream service responded improperly. Please try again later.",
+			ErrorField:    fmt.Sprintf("password migration hook failed with status code %v", resp.StatusCode),
+		}
+	}
+}
diff --git a/selfservice/hook/session_issuer.go b/selfservice/hook/session_issuer.go
index 4150fdeffdec..7e6664220696 100644
--- a/selfservice/hook/session_issuer.go
+++ b/selfservice/hook/session_issuer.go
@@ -75,6 +75,7 @@ func (e *SessionIssuer) executePostRegistrationPostPersistHook(w http.ResponseWr
 		trace.SpanFromContext(r.Context()).AddEvent(events.NewLoginSucceeded(r.Context(), &events.LoginSucceededOpts{
 			SessionID:  s.ID,
 			IdentityID: s.Identity.ID,
+			FlowID:     a.ID,
 			FlowType:   string(a.Type),
 			Method:     a.Active.String(),
 		}))
@@ -90,6 +91,7 @@ func (e *SessionIssuer) executePostRegistrationPostPersistHook(w http.ResponseWr
 	trace.SpanFromContext(r.Context()).AddEvent(events.NewLoginSucceeded(r.Context(), &events.LoginSucceededOpts{
 		SessionID:  s.ID,
 		IdentityID: s.Identity.ID,
+		FlowID:     a.ID,
 		FlowType:   string(a.Type),
 		Method:     a.Active.String(),
 	}))
diff --git a/selfservice/hook/show_verification_ui.go b/selfservice/hook/show_verification_ui.go
index 65a5935ec7a6..580292a26ccd 100644
--- a/selfservice/hook/show_verification_ui.go
+++ b/selfservice/hook/show_verification_ui.go
@@ -53,7 +53,7 @@ func (e *ShowVerificationUIHook) ExecutePostRegistrationPostPersistHook(_ http.R
 // ExecuteLoginPostHook adds redirect headers and status code if the request is a browser request.
 // If the request is not a browser request, this hook does nothing.
 func (e *ShowVerificationUIHook) ExecuteLoginPostHook(_ http.ResponseWriter, r *http.Request, _ node.UiNodeGroup, f *login.Flow, _ *session.Session) error {
-	return otelx.WithSpan(r.Context(), "selfservice.hook.ShowVerificationUIHook.ExecutePostRegistrationPostPersistHook", func(ctx context.Context) error {
+	return otelx.WithSpan(r.Context(), "selfservice.hook.ShowVerificationUIHook.ExecuteLoginPostHook", func(ctx context.Context) error {
 		return e.execute(r.WithContext(ctx), f)
 	})
 }
diff --git a/selfservice/hook/web_hook.go b/selfservice/hook/web_hook.go
index d4c8131e50d5..d756338b13e6 100644
--- a/selfservice/hook/web_hook.go
+++ b/selfservice/hook/web_hook.go
@@ -8,7 +8,9 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"maps"
 	"net/http"
+	"net/textproto"
 	"time"
 
 	"github.com/dgraph-io/ristretto"
@@ -60,7 +62,7 @@ var _ interface {
 	settings.PostHookPostPersistExecutor
 } = (*WebHook)(nil)
 
-var jsonnetCache, _ = ristretto.NewCache(&ristretto.Config{
+var jsonnetCache, _ = ristretto.NewCache(&ristretto.Config[[]byte, []byte]{
 	MaxCost:     100 << 20, // 100MB,
 	NumCounters: 1_000_000, // 1kB per snippet -> 100k snippets -> 1M counters
 	BufferItems: 64,
@@ -297,7 +299,10 @@ func (e *WebHook) execute(ctx context.Context, data *templateContext) error {
 		canInterrupt   = gjson.GetBytes(e.conf, "can_interrupt").Bool()
 		parseResponse  = gjson.GetBytes(e.conf, "response.parse").Bool()
 		emitEvent      = gjson.GetBytes(e.conf, "emit_analytics_event").Bool() || !gjson.GetBytes(e.conf, "emit_analytics_event").Exists() // default true
-		tracer         = trace.SpanFromContext(ctx).TracerProvider().Tracer("kratos-webhooks")
+		webhookID      = gjson.GetBytes(e.conf, "id").Str
+		// The trigger ID is a random ID. It can be used to correlate webhook requests across retries.
+		triggerID = x.NewUUID()
+		tracer    = trace.SpanFromContext(ctx).TracerProvider().Tracer("kratos-webhooks")
 	)
 	if ignoreResponse && (parseResponse || canInterrupt) {
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("A webhook is configured to ignore the response but also to parse the response. This is not possible."))
@@ -316,7 +321,7 @@ func (e *WebHook) execute(ctx context.Context, data *templateContext) error {
 		defer otelx.End(span, &finalErr)
 
 		if emitEvent {
-			instrumentHTTPClientForEvents(ctx, httpClient)
+			instrumentHTTPClientForEvents(ctx, httpClient, triggerID, webhookID)
 		}
 
 		defer func(startTime time.Time) {
@@ -327,7 +332,7 @@ func (e *WebHook) execute(ctx context.Context, data *templateContext) error {
 			}).WithField("duration", time.Since(startTime))
 			if finalErr != nil {
 				if emitEvent && !errors.Is(finalErr, context.Canceled) {
-					span.AddEvent(events.NewWebhookFailed(ctx, finalErr))
+					span.AddEvent(events.NewWebhookFailed(ctx, finalErr, triggerID, webhookID))
 				}
 				if ignoreResponse {
 					logger.WithError(finalErr).Warning("Webhook request failed but the error was ignored because the configuration indicated that the upstream response should be ignored")
@@ -337,12 +342,12 @@ func (e *WebHook) execute(ctx context.Context, data *templateContext) error {
 			} else {
 				logger.Info("Webhook request succeeded")
 				if emitEvent {
-					span.AddEvent(events.NewWebhookSucceeded(ctx))
+					span.AddEvent(events.NewWebhookSucceeded(ctx, triggerID, webhookID))
 				}
 			}
 		}(time.Now())
 
-		builder, err := request.NewBuilder(ctx, e.conf, e.deps, jsonnetCache)
+		builder, err := request.NewBuilder(ctx, e.conf, e.deps, request.WithCache(jsonnetCache))
 		if err != nil {
 			return err
 		}
@@ -354,6 +359,8 @@ func (e *WebHook) execute(ctx context.Context, data *templateContext) error {
 			attribute.Bool("webhook.response.parse", parseResponse),
 		)
 
+		removeDisallowedHeaders(data)
+
 		req, err := builder.BuildRequest(ctx, data)
 		if errors.Is(err, request.ErrCancel) {
 			span.SetAttributes(attribute.Bool("webhook.jsonnet.canceled", true))
@@ -422,6 +429,37 @@ func (e *WebHook) execute(ctx context.Context, data *templateContext) error {
 	return nil
 }
 
+// RequestHeaderAllowList contains the allowed request headers that are forwarded
+// to the web hook target in canonical form (textproto.CanonicalMIMEHeaderKey).
+var RequestHeaderAllowList = map[string]struct{}{
+	"Accept":             {},
+	"Accept-Encoding":    {},
+	"Accept-Language":    {},
+	"Content-Length":     {},
+	"Content-Type":       {},
+	"Origin":             {},
+	"Priority":           {},
+	"Referer":            {},
+	"Sec-Ch-Ua":          {},
+	"Sec-Ch-Ua-Mobile":   {},
+	"Sec-Ch-Ua-Platform": {},
+	"Sec-Fetch-Dest":     {},
+	"Sec-Fetch-Mode":     {},
+	"Sec-Fetch-Site":     {},
+	"Sec-Fetch-User":     {},
+	"True-Client-Ip":     {},
+	"User-Agent":         {},
+}
+
+func removeDisallowedHeaders(data *templateContext) {
+	headers := maps.Clone(data.RequestHeaders)
+	maps.DeleteFunc(headers, func(key string, _ []string) bool {
+		_, found := RequestHeaderAllowList[textproto.CanonicalMIMEHeaderKey(key)]
+		return !found
+	})
+	data.RequestHeaders = headers
+}
+
 func parseWebhookResponse(resp *http.Response, id *identity.Identity) (err error) {
 	if resp == nil {
 		return errors.Errorf("empty response provided from the webhook")
@@ -516,7 +554,7 @@ func isTimeoutError(err error) bool {
 	return errors.As(err, &te) && te.Timeout() || errors.Is(err, context.DeadlineExceeded)
 }
 
-func instrumentHTTPClientForEvents(ctx context.Context, httpClient *retryablehttp.Client) {
+func instrumentHTTPClientForEvents(ctx context.Context, httpClient *retryablehttp.Client, triggerID uuid.UUID, webhookID string) {
 	// TODO(@alnr): improve this implementation to redact sensitive data
 	var (
 		attempt   = 0
@@ -525,8 +563,9 @@ func instrumentHTTPClientForEvents(ctx context.Context, httpClient *retryablehtt
 	)
 	httpClient.RequestLogHook = func(_ retryablehttp.Logger, req *http.Request, retryNumber int) {
 		attempt = retryNumber + 1
-		requestID = uuid.Must(uuid.NewV4())
+		requestID = x.NewUUID()
 		req.Header.Set("Ory-Webhook-Request-ID", requestID.String())
+		req.Header.Set("Ory-Webhook-Trigger-ID", triggerID.String())
 		// TODO(@alnr): redact sensitive data
 		// reqBody, _ = httputil.DumpRequestOut(req, true)
 		reqBody = []byte("<redacted>")
@@ -537,6 +576,6 @@ func instrumentHTTPClientForEvents(ctx context.Context, httpClient *retryablehtt
 		// resBody = resBody[:min(len(resBody), 2<<10)] // truncate response body to 2 kB for event
 		// TODO(@alnr): redact sensitive data
 		resBody := []byte("<redacted>")
-		trace.SpanFromContext(ctx).AddEvent(events.NewWebhookDelivered(ctx, res.Request.URL, reqBody, res.StatusCode, resBody, attempt, requestID))
+		trace.SpanFromContext(ctx).AddEvent(events.NewWebhookDelivered(ctx, res.Request.URL, reqBody, res.StatusCode, resBody, attempt, requestID, triggerID, webhookID))
 	}
 }
diff --git a/selfservice/hook/web_hook_integration_test.go b/selfservice/hook/web_hook_integration_test.go
index 59159f49b6cf..700835309345 100644
--- a/selfservice/hook/web_hook_integration_test.go
+++ b/selfservice/hook/web_hook_integration_test.go
@@ -14,6 +14,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"slices"
 	"strconv"
 	"sync"
 	"testing"
@@ -23,9 +24,10 @@ import (
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/tidwall/sjson"
+	"go.opentelemetry.io/otel/attribute"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
 	"go.opentelemetry.io/otel/sdk/trace/tracetest"
-	"golang.org/x/exp/slices"
 
 	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/identity"
@@ -42,9 +44,11 @@ import (
 	"github.com/ory/kratos/text"
 	"github.com/ory/kratos/ui/node"
 	"github.com/ory/kratos/x"
+	"github.com/ory/kratos/x/events"
 	"github.com/ory/x/jsonnetsecure"
 	"github.com/ory/x/logrusx"
 	"github.com/ory/x/otelx"
+	"github.com/ory/x/otelx/semconv"
 	"github.com/ory/x/snapshotx"
 )
 
@@ -117,10 +121,8 @@ func TestWebHooks(t *testing.T) {
 	}
 
 	bodyWithFlowOnly := func(req *http.Request, f flow.Flow) string {
-		h, _ := json.Marshal(req.Header)
-		return fmt.Sprintf(`{
+		body := fmt.Sprintf(`{
 					"flow_id": "%s",
-					"headers": %s,
 					"method": "%s",
 					"url": "%s",
 					"cookies": {
@@ -128,15 +130,20 @@ func TestWebHooks(t *testing.T) {
 						"Some-Cookie-2": "Some-other-Cookie-Value",
 						"Some-Cookie-3": "Third-Cookie-Value"
 					}
-				}`, f.GetID(), string(h), req.Method, "http://www.ory.sh/some_end_point")
+				}`, f.GetID(), req.Method, "http://www.ory.sh/some_end_point")
+		if len(req.Header) != 0 {
+			if ua := req.Header.Get("User-Agent"); ua != "" {
+				body, _ = sjson.Set(body, "headers.User-Agent", []string{ua})
+			}
+		}
+
+		return body
 	}
 
 	bodyWithFlowAndIdentityAndTransientPayload := func(req *http.Request, f flow.Flow, s *session.Session, tp json.RawMessage) string {
-		h, _ := json.Marshal(req.Header)
-		return fmt.Sprintf(`{
+		body := fmt.Sprintf(`{
 					"flow_id": "%s",
 					"identity_id": "%s",
-					"headers": %s,
 					"method": "%s",
 					"url": "%s",
 					"cookies": {
@@ -145,16 +152,21 @@ func TestWebHooks(t *testing.T) {
 						"Some-Cookie-3": "Third-Cookie-Value"
 					},
 					"transient_payload": %s
-				}`, f.GetID(), s.Identity.ID, string(h), req.Method, "http://www.ory.sh/some_end_point", string(tp))
+				}`, f.GetID(), s.Identity.ID, req.Method, "http://www.ory.sh/some_end_point", string(tp))
+		if len(req.Header) != 0 {
+			if ua := req.Header.Get("User-Agent"); ua != "" {
+				body, _ = sjson.Set(body, "headers.User-Agent", []string{ua})
+			}
+		}
+
+		return body
 	}
 
 	bodyWithFlowAndIdentityAndSessionAndTransientPayload := func(req *http.Request, f flow.Flow, s *session.Session, tp json.RawMessage) string {
-		h, _ := json.Marshal(req.Header)
-		return fmt.Sprintf(`{
+		body := fmt.Sprintf(`{
 					"flow_id": "%s",
 					"identity_id": "%s",
 					"session_id": "%s",
-					"headers": %s,
 					"method": "%s",
 					"url": "%s",
 					"cookies": {
@@ -163,7 +175,14 @@ func TestWebHooks(t *testing.T) {
 						"Some-Cookie-3": "Third-Cookie-Value"
 					},
 					"transient_payload": %s
-				}`, f.GetID(), s.Identity.ID, s.ID, string(h), req.Method, "http://www.ory.sh/some_end_point", string(tp))
+				}`, f.GetID(), s.Identity.ID, s.ID, req.Method, "http://www.ory.sh/some_end_point", string(tp))
+		if len(req.Header) != 0 {
+			if ua := req.Header.Get("User-Agent"); ua != "" {
+				body, _ = sjson.Set(body, "headers.User-Agent", []string{ua})
+			}
+		}
+
+		return body
 	}
 
 	for _, tc := range []struct {
@@ -316,8 +335,10 @@ func TestWebHooks(t *testing.T) {
 							req := &http.Request{
 								Host: "www.ory.sh",
 								Header: map[string][]string{
-									"Some-Header": {"Some-Value"},
-									"Cookie":      {"Some-Cookie-1=Some-Cookie-Value; Some-Cookie-2=Some-other-Cookie-Value", "Some-Cookie-3=Third-Cookie-Value"},
+									"Some-Header":    {"Some-Value"},
+									"User-Agent":     {"Foo-Bar-Browser"},
+									"Invalid-Header": {"ignored"},
+									"Cookie":         {"Some-Cookie-1=Some-Cookie-Value; Some-Cookie-2=Some-other-Cookie-Value", "Some-Cookie-3=Third-Cookie-Value"},
 								},
 								RequestURI: "/some_end_point",
 								Method:     http.MethodPost,
@@ -365,6 +386,8 @@ func TestWebHooks(t *testing.T) {
 								vals := whr.Headers.Values(k)
 								assert.Equal(t, v, vals)
 							}
+							assert.NotZero(t, whr.Headers.Get("Ory-Webhook-Request-ID"))
+							assert.NotZero(t, whr.Headers.Get("Ory-Webhook-Trigger-ID"))
 
 							if method != "TRACE" {
 								// According to the HTTP spec any request method, but TRACE is allowed to
@@ -1144,8 +1167,6 @@ func TestWebhookEvents(t *testing.T) {
 		URL:    &url.URL{Path: "/some_end_point"},
 		Method: http.MethodPost,
 	}
-	s := &session.Session{ID: x.NewUUID(), Identity: &identity.Identity{ID: x.NewUUID()}}
-	_ = s
 	f := &login.Flow{ID: x.NewUUID()}
 
 	webhookReceiver := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -1153,15 +1174,31 @@ func TestWebhookEvents(t *testing.T) {
 			w.WriteHeader(200)
 			w.Write([]byte("ok"))
 		} else {
-			w.WriteHeader(400)
+			w.WriteHeader(500)
 			w.Write([]byte("fail"))
 		}
 	}))
 	t.Cleanup(webhookReceiver.Close)
 
+	getAttributes := func(attrs []attribute.KeyValue) (webhookID, triggerID, requestID string) {
+		for _, kv := range attrs {
+			switch semconv.AttributeKey(kv.Key) {
+			case events.AttributeKeyWebhookID:
+				webhookID = kv.Value.Emit()
+			case events.AttributeKeyWebhookTriggerID:
+				triggerID = kv.Value.Emit()
+			case events.AttributeKeyWebhookRequestID:
+				requestID = kv.Value.Emit()
+			}
+		}
+		return
+	}
+
 	t.Run("success", func(t *testing.T) {
+		whID := x.NewUUID()
 		wh := hook.NewWebHook(&whDeps, json.RawMessage(fmt.Sprintf(`
 		{
+			"id": %q,
 			"url": %q,
 			"method": "GET",
 			"body": "file://stub/test_body.jsonnet",
@@ -1169,7 +1206,7 @@ func TestWebhookEvents(t *testing.T) {
 				"ignore": false,
 				"parse": false
 			}
-		}`, webhookReceiver.URL+"/ok")))
+		}`, whID, webhookReceiver.URL+"/ok")))
 
 		recorder := tracetest.NewSpanRecorder()
 		tracer := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(recorder)).Tracer("test")
@@ -1183,31 +1220,37 @@ func TestWebhookEvents(t *testing.T) {
 		ended := recorder.Ended()
 		require.NotEmpty(t, ended)
 
-		i := slices.IndexFunc(ended, func(sp sdktrace.ReadOnlySpan) bool {
-			return sp.Name() == "selfservice.webhook"
-		})
+		i := slices.IndexFunc(ended, func(sp sdktrace.ReadOnlySpan) bool { return sp.Name() == "selfservice.webhook" })
 		require.GreaterOrEqual(t, i, 0)
 
-		events := ended[i].Events()
-		i = slices.IndexFunc(events, func(ev sdktrace.Event) bool {
-			return ev.Name == "WebhookDelivered"
-		})
+		evs := ended[i].Events()
+		i = slices.IndexFunc(evs, func(ev sdktrace.Event) bool { return ev.Name == events.WebhookDelivered.String() })
 		require.GreaterOrEqual(t, i, 0)
 
-		i = slices.IndexFunc(events, func(ev sdktrace.Event) bool {
-			return ev.Name == "WebhookSucceeded"
-		})
+		actualWhID, deliveredTriggerID, deliveredRequestID := getAttributes(evs[i].Attributes)
+		require.Equal(t, whID.String(), actualWhID)
+		require.NotEmpty(t, deliveredTriggerID)
+		require.NotEmpty(t, deliveredRequestID)
+		assert.NotEqual(t, deliveredTriggerID, deliveredRequestID)
+
+		i = slices.IndexFunc(evs, func(ev sdktrace.Event) bool { return ev.Name == events.WebhookSucceeded.String() })
 		require.GreaterOrEqual(t, i, 0)
 
-		i = slices.IndexFunc(events, func(ev sdktrace.Event) bool {
-			return ev.Name == "WebhookFailed"
-		})
+		actualWhID, succeededTriggerID, _ := getAttributes(evs[i].Attributes)
+		require.Equal(t, whID.String(), actualWhID)
+		require.NotEmpty(t, succeededTriggerID)
+
+		assert.Equal(t, deliveredTriggerID, succeededTriggerID)
+
+		i = slices.IndexFunc(evs, func(ev sdktrace.Event) bool { return ev.Name == events.WebhookFailed.String() })
 		require.Equal(t, -1, i)
 	})
 
 	t.Run("failed", func(t *testing.T) {
+		whID := x.NewUUID()
 		wh := hook.NewWebHook(&whDeps, json.RawMessage(fmt.Sprintf(`
 		{
+			"id": %q,
 			"url": %q,
 			"method": "GET",
 			"body": "file://stub/test_body.jsonnet",
@@ -1215,7 +1258,7 @@ func TestWebhookEvents(t *testing.T) {
 				"ignore": false,
 				"parse": false
 			}
-		}`, webhookReceiver.URL+"/fail")))
+		}`, whID, webhookReceiver.URL+"/fail")))
 
 		recorder := tracetest.NewSpanRecorder()
 		tracer := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(recorder)).Tracer("test")
@@ -1228,25 +1271,40 @@ func TestWebhookEvents(t *testing.T) {
 		ended := recorder.Ended()
 		require.NotEmpty(t, ended)
 
-		i := slices.IndexFunc(ended, func(sp sdktrace.ReadOnlySpan) bool {
-			return sp.Name() == "selfservice.webhook"
-		})
+		i := slices.IndexFunc(ended, func(sp sdktrace.ReadOnlySpan) bool { return sp.Name() == "selfservice.webhook" })
 		require.GreaterOrEqual(t, i, 0)
 
-		events := ended[i].Events()
-		i = slices.IndexFunc(events, func(ev sdktrace.Event) bool {
-			return ev.Name == "WebhookDelivered"
-		})
-		require.GreaterOrEqual(t, i, 0)
+		evs := ended[i].Events()
+
+		var deliveredEvents []sdktrace.Event
+		deliveredTriggerIDs := map[string]struct{}{}
+		deliveredRequestIDs := map[string]struct{}{}
+		for _, ev := range evs {
+			if ev.Name == events.WebhookDelivered.String() {
+				deliveredEvents = append(deliveredEvents, ev)
+				actualWhID, triggerID, requestID := getAttributes(ev.Attributes)
+				require.Equal(t, whID.String(), actualWhID)
+				require.NotEmpty(t, triggerID)
+				require.NotEmpty(t, requestID)
+				deliveredTriggerIDs[triggerID] = struct{}{}
+				deliveredRequestIDs[requestID] = struct{}{}
+			}
+		}
 
-		i = slices.IndexFunc(events, func(ev sdktrace.Event) bool {
-			return ev.Name == "WebhookFailed"
-		})
+		assert.Len(t, deliveredEvents, 3)
+		assert.Len(t, deliveredTriggerIDs, 1)
+		assert.Len(t, deliveredRequestIDs, 3)
+
+		i = slices.IndexFunc(evs, func(ev sdktrace.Event) bool { return ev.Name == "WebhookFailed" })
 		require.GreaterOrEqual(t, i, 0)
 
-		i = slices.IndexFunc(events, func(ev sdktrace.Event) bool {
-			return ev.Name == "WebhookSucceeded"
-		})
+		actualWhID, failedTriggerID, _ := getAttributes(evs[i].Attributes)
+		require.Equal(t, whID.String(), actualWhID)
+		require.NotEmpty(t, failedTriggerID)
+
+		assert.Contains(t, deliveredTriggerIDs, failedTriggerID)
+
+		i = slices.IndexFunc(evs, func(ev sdktrace.Event) bool { return ev.Name == "WebhookSucceeded" })
 		require.Equal(t, i, -1)
 	})
 
@@ -1279,18 +1337,18 @@ func TestWebhookEvents(t *testing.T) {
 		})
 		require.GreaterOrEqual(t, i, 0)
 
-		events := ended[i].Events()
-		i = slices.IndexFunc(events, func(ev sdktrace.Event) bool {
+		evs := ended[i].Events()
+		i = slices.IndexFunc(evs, func(ev sdktrace.Event) bool {
 			return ev.Name == "WebhookDelivered"
 		})
 		require.Equal(t, -1, i)
 
-		i = slices.IndexFunc(events, func(ev sdktrace.Event) bool {
+		i = slices.IndexFunc(evs, func(ev sdktrace.Event) bool {
 			return ev.Name == "WebhookFailed"
 		})
 		require.Equal(t, -1, i)
 
-		i = slices.IndexFunc(events, func(ev sdktrace.Event) bool {
+		i = slices.IndexFunc(evs, func(ev sdktrace.Event) bool {
 			return ev.Name == "WebhookSucceeded"
 		})
 		require.Equal(t, i, -1)
diff --git a/selfservice/strategy/code/.schema/login.schema.json b/selfservice/strategy/code/.schema/login.schema.json
index 1bcc36b12c88..22286b039149 100644
--- a/selfservice/strategy/code/.schema/login.schema.json
+++ b/selfservice/strategy/code/.schema/login.schema.json
@@ -4,10 +4,7 @@
   "type": "object",
   "properties": {
     "method": {
-      "type": "string",
-      "enum": [
-        "code"
-      ]
+      "type": "string"
     },
     "code": {
       "type": "string"
@@ -15,6 +12,9 @@
     "identifier": {
       "type": "string"
     },
+    "address": {
+      "type": "string"
+    },
     "resend": {
       "type": "string",
       "enum": [
diff --git a/selfservice/strategy/code/.schema/recovery.schema.json b/selfservice/strategy/code/.schema/recovery.schema.json
index 011503132baa..eb04bd359002 100644
--- a/selfservice/strategy/code/.schema/recovery.schema.json
+++ b/selfservice/strategy/code/.schema/recovery.schema.json
@@ -4,11 +4,7 @@
   "type": "object",
   "properties": {
     "method": {
-      "type": "string",
-      "enum": [
-        "code",
-        "link"
-      ]
+      "type": "string"
     },
     "code": {
       "type": "string"
diff --git a/selfservice/strategy/code/.schema/registration.schema.json b/selfservice/strategy/code/.schema/registration.schema.json
index 90f245c107c5..0cd5282eb9ee 100644
--- a/selfservice/strategy/code/.schema/registration.schema.json
+++ b/selfservice/strategy/code/.schema/registration.schema.json
@@ -4,10 +4,7 @@
   "type": "object",
   "properties": {
     "method": {
-      "type": "string",
-      "enum": [
-        "code"
-      ]
+      "type": "string"
     },
     "csrf_token": {
       "type": "string"
diff --git a/selfservice/strategy/code/.snapshots/TestAdminStrategy-case=form_should_not_contain_email_field_when_creating_recovery_code.json b/selfservice/strategy/code/.snapshots/TestAdminStrategy-case=form_should_not_contain_email_field_when_creating_recovery_code.json
index a9f46bedb5c4..736578d0e543 100644
--- a/selfservice/strategy/code/.snapshots/TestAdminStrategy-case=form_should_not_contain_email_field_when_creating_recovery_code.json
+++ b/selfservice/strategy/code/.snapshots/TestAdminStrategy-case=form_should_not_contain_email_field_when_creating_recovery_code.json
@@ -6,7 +6,9 @@
       "name": "code",
       "type": "text",
       "required": true,
+      "pattern": "[0-9]+",
       "disabled": false,
+      "maxlength": 6,
       "node_type": "input"
     },
     "messages": [],
@@ -31,8 +33,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     }
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=code_is_used_for_2fa_but_request_is_1fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=code_is_used_for_2fa_but_request_is_1fa.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=code_is_used_for_2fa_but_request_is_1fa.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=code_is_used_for_passwordless_login_and_request_is_1fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=code_is_used_for_passwordless_login_and_request_is_1fa.json
new file mode 100644
index 000000000000..8e9874d00cbf
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=code_is_used_for_passwordless_login_and_request_is_1fa.json
@@ -0,0 +1,54 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "text",
+      "value": "",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070004,
+        "text": "ID",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "code",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "code",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010015,
+        "text": "Send sign in code",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh-case=code_is_used_for_2fa_and_request_is_1fa_with_refresh.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh-case=code_is_used_for_2fa_and_request_is_1fa_with_refresh.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh-case=code_is_used_for_2fa_and_request_is_1fa_with_refresh.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh-case=code_is_used_for_passwordless_login_and_request_is_1fa_with_refresh.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh-case=code_is_used_for_passwordless_login_and_request_is_1fa_with_refresh.json
new file mode 100644
index 000000000000..8e9874d00cbf
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh-case=code_is_used_for_passwordless_login_and_request_is_1fa_with_refresh.json
@@ -0,0 +1,54 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "text",
+      "value": "",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070004,
+        "text": "ID",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "code",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "code",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010015,
+        "text": "Send sign in code",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_code_method-case=code_is_used_for_2fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_code_method-case=code_is_used_for_2fa.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_code_method-case=code_is_used_for_2fa.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_code_method-case=code_is_used_for_passwordless_login.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_code_method-case=code_is_used_for_passwordless_login.json
new file mode 100644
index 000000000000..66b84bf1a436
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_code_method-case=code_is_used_for_passwordless_login.json
@@ -0,0 +1,21 @@
+[
+  {
+    "type": "input",
+    "group": "code",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "code",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010015,
+        "text": "Send sign in code",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_code_method-case=code_is_used_for_2fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_code_method-case=code_is_used_for_2fa.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_code_method-case=code_is_used_for_2fa.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_code_method-case=code_is_used_for_passwordless_login.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_code_method-case=code_is_used_for_passwordless_login.json
new file mode 100644
index 000000000000..66b84bf1a436
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_code_method-case=code_is_used_for_passwordless_login.json
@@ -0,0 +1,21 @@
+[
+  {
+    "type": "input",
+    "group": "code",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "code",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010015,
+        "text": "Send sign in code",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=with_no_identity-case=code_is_used_for_2fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=with_no_identity-case=code_is_used_for_2fa.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=with_no_identity-case=code_is_used_for_2fa.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=with_no_identity-case=code_is_used_for_passwordless_login.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=with_no_identity-case=code_is_used_for_passwordless_login.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=with_no_identity-case=code_is_used_for_passwordless_login.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=code_is_used_for_2fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=code_is_used_for_2fa.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=code_is_used_for_2fa.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=code_is_used_for_passwordless_login.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=code_is_used_for_passwordless_login.json
new file mode 100644
index 000000000000..66b84bf1a436
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=code_is_used_for_passwordless_login.json
@@ -0,0 +1,21 @@
+[
+  {
+    "type": "input",
+    "group": "code",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "code",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010015,
+        "text": "Send sign in code",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=code_is_used_for_2fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=code_is_used_for_2fa.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=code_is_used_for_2fa.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=code_is_used_for_passwordless_login.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=code_is_used_for_passwordless_login.json
new file mode 100644
index 000000000000..8e9874d00cbf
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=code_is_used_for_passwordless_login.json
@@ -0,0 +1,54 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "text",
+      "value": "",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070004,
+        "text": "ID",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "code",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "code",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010015,
+        "text": "Send sign in code",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=code_is_used_for_2fa_and_request_is_2fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=code_is_used_for_2fa_and_request_is_2fa.json
new file mode 100644
index 000000000000..364b8abc331c
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=code_is_used_for_2fa_and_request_is_2fa.json
@@ -0,0 +1,15 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=code_is_used_for_passwordless_login_and_request_is_2fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=code_is_used_for_passwordless_login_and_request_is_2fa.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=code_is_used_for_passwordless_login_and_request_is_2fa.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-using_via-case=code_is_used_for_2fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-using_via-case=code_is_used_for_2fa.json
new file mode 100644
index 000000000000..0680486de62c
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-using_via-case=code_is_used_for_2fa.json
@@ -0,0 +1,38 @@
+[
+  {
+    "type": "input",
+    "group": "code",
+    "attributes": {
+      "name": "address",
+      "type": "submit",
+      "value": "populateloginmethodsecondfactor-code-mfa-via-2fa@ory.sh",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010023,
+        "text": "Send code to populateloginmethodsecondfactor-code-mfa-via-2fa@ory.sh",
+        "type": "info",
+        "context": {
+          "address": "populateloginmethodsecondfactor-code-mfa-via-2fa@ory.sh",
+          "channel": "email"
+        }
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-using_via-case=code_is_used_for_passwordless_login.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-using_via-case=code_is_used_for_passwordless_login.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-using_via-case=code_is_used_for_passwordless_login.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-without_via-case=code_is_used_for_2fa.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-without_via-case=code_is_used_for_2fa.json
new file mode 100644
index 000000000000..d050a31ef32d
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-without_via-case=code_is_used_for_2fa.json
@@ -0,0 +1,84 @@
+[
+  {
+    "type": "input",
+    "group": "code",
+    "attributes": {
+      "name": "address",
+      "type": "submit",
+      "value": "+4917655138291",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010023,
+        "text": "Send code to +4917655138291",
+        "type": "info",
+        "context": {
+          "address": "+4917655138291",
+          "channel": "sms"
+        }
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "code",
+    "attributes": {
+      "name": "address",
+      "type": "submit",
+      "value": "populateloginmethodsecondfactor-no-via-2fa-0@ory.sh",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010023,
+        "text": "Send code to populateloginmethodsecondfactor-no-via-2fa-0@ory.sh",
+        "type": "info",
+        "context": {
+          "address": "populateloginmethodsecondfactor-no-via-2fa-0@ory.sh",
+          "channel": "email"
+        }
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "code",
+    "attributes": {
+      "name": "address",
+      "type": "submit",
+      "value": "populateloginmethodsecondfactor-no-via-2fa-1@ory.sh",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010023,
+        "text": "Send code to populateloginmethodsecondfactor-no-via-2fa-1@ory.sh",
+        "type": "info",
+        "context": {
+          "address": "populateloginmethodsecondfactor-no-via-2fa-1@ory.sh",
+          "channel": "email"
+        }
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-without_via-case=code_is_used_for_passwordless_login.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-without_via-case=code_is_used_for_passwordless_login.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-without_via-case=code_is_used_for_passwordless_login.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh-case=code_is_used_for_2fa_and_request_is_2fa_with_refresh.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh-case=code_is_used_for_2fa_and_request_is_2fa_with_refresh.json
new file mode 100644
index 000000000000..364b8abc331c
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh-case=code_is_used_for_2fa_and_request_is_2fa_with_refresh.json
@@ -0,0 +1,15 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh-case=code_is_used_for_passwordless_login_and_request_is_2fa_with_refresh.json b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh-case=code_is_used_for_passwordless_login_and_request_is_2fa_with_refresh.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh-case=code_is_used_for_passwordless_login_and_request_is_2fa_with_refresh.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=verify_initial_payload.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=verify_initial_payload.json
index 14efb22f25a3..612c5c980dc2 100644
--- a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=verify_initial_payload.json
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=verify_initial_payload.json
@@ -30,49 +30,21 @@
       {
         "attributes": {
           "disabled": false,
-          "name": "identifier",
-          "node_type": "input",
-          "required": true,
-          "type": "text",
-          "value": ""
-        },
-        "group": "default",
-        "messages": [
-          {
-            "context": {
-              "masked_to": "fi****@ory.sh"
-            },
-            "id": 1010020,
-            "text": "We will send a code to fi****@ory.sh. To verify that this is your address please enter it here.",
-            "type": "info"
-          }
-        ],
-        "meta": {
-          "label": {
-            "context": {
-              "title": "Email"
-            },
-            "id": 1070002,
-            "text": "Email",
-            "type": "info"
-          }
-        },
-        "type": "input"
-      },
-      {
-        "attributes": {
-          "disabled": false,
-          "name": "method",
+          "name": "address",
           "node_type": "input",
           "type": "submit",
-          "value": "code"
+          "value": "fixed_mfa_test_browser@ory.sh"
         },
         "group": "code",
         "messages": [],
         "meta": {
           "label": {
-            "id": 1010019,
-            "text": "Continue with code",
+            "context": {
+              "address": "fixed_mfa_test_browser@ory.sh",
+              "channel": "email"
+            },
+            "id": 1010023,
+            "text": "Send code to fixed_mfa_test_browser@ory.sh",
             "type": "info"
           }
         },
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-email.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-email.json
new file mode 100644
index 000000000000..1d8d8153054e
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-email.json
@@ -0,0 +1,71 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "+4917613213110"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "+4917613213110",
+          "channel": "sms"
+        },
+        "id": 1010023,
+        "text": "Send code to +4917613213110",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-1browser@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-1browser@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-1browser@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-2browser@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-2browser@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-2browser@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-phone.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-phone.json
new file mode 100644
index 000000000000..1d8d8153054e
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-phone.json
@@ -0,0 +1,71 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "+4917613213110"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "+4917613213110",
+          "channel": "sms"
+        },
+        "id": 1010023,
+        "text": "Send code to +4917613213110",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-1browser@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-1browser@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-1browser@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-2browser@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-2browser@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-2browser@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=identifier-email.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=identifier-email.json
new file mode 100644
index 000000000000..1d8d8153054e
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Browser_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=identifier-email.json
@@ -0,0 +1,71 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "+4917613213110"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "+4917613213110",
+          "channel": "sms"
+        },
+        "id": 1010023,
+        "text": "Send code to +4917613213110",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-1browser@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-1browser@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-1browser@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-2browser@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-2browser@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-2browser@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=verify_initial_payload.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=verify_initial_payload.json
index 49f7d3a37cc1..b2dfa774866c 100644
--- a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=verify_initial_payload.json
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=verify_initial_payload.json
@@ -17,48 +17,20 @@
       {
         "attributes": {
           "disabled": false,
-          "name": "identifier",
+          "name": "address",
           "node_type": "input",
-          "required": true,
-          "type": "text"
-        },
-        "group": "default",
-        "messages": [
-          {
-            "context": {
-              "masked_to": "fi****@ory.sh"
-            },
-            "id": 1010020,
-            "text": "We will send a code to fi****@ory.sh. To verify that this is your address please enter it here.",
-            "type": "info"
-          }
-        ],
-        "meta": {
-          "label": {
-            "context": {
-              "title": "Email"
-            },
-            "id": 1070002,
-            "text": "Email",
-            "type": "info"
-          }
-        },
-        "type": "input"
-      },
-      {
-        "attributes": {
-          "disabled": false,
-          "name": "method",
-          "node_type": "input",
-          "type": "submit",
-          "value": "code"
+          "type": "submit"
         },
         "group": "code",
         "messages": [],
         "meta": {
           "label": {
-            "id": 1010019,
-            "text": "Continue with code",
+            "context": {
+              "address": "fixed_mfa_test_api@ory.sh",
+              "channel": "email"
+            },
+            "id": 1010023,
+            "text": "Send code to fixed_mfa_test_api@ory.sh",
             "type": "info"
           }
         },
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-email.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-email.json
new file mode 100644
index 000000000000..e3510d16393a
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-email.json
@@ -0,0 +1,71 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "+4917613213111"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "+4917613213111",
+          "channel": "sms"
+        },
+        "id": 1010023,
+        "text": "Send code to +4917613213111",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-1api@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-1api@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-1api@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-2api@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-2api@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-2api@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-phone.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-phone.json
new file mode 100644
index 000000000000..e3510d16393a
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-phone.json
@@ -0,0 +1,71 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "+4917613213111"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "+4917613213111",
+          "channel": "sms"
+        },
+        "id": 1010023,
+        "text": "Send code to +4917613213111",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-1api@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-1api@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-1api@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-2api@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-2api@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-2api@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=identifier-email.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=identifier-email.json
new file mode 100644
index 000000000000..e3510d16393a
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=Native_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=identifier-email.json
@@ -0,0 +1,71 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "+4917613213111"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "+4917613213111",
+          "channel": "sms"
+        },
+        "id": 1010023,
+        "text": "Send code to +4917613213111",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-1api@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-1api@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-1api@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-2api@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-2api@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-2api@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=verify_initial_payload.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=verify_initial_payload.json
index 14efb22f25a3..41c14e29d43d 100644
--- a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=verify_initial_payload.json
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=verify_initial_payload.json
@@ -30,49 +30,21 @@
       {
         "attributes": {
           "disabled": false,
-          "name": "identifier",
-          "node_type": "input",
-          "required": true,
-          "type": "text",
-          "value": ""
-        },
-        "group": "default",
-        "messages": [
-          {
-            "context": {
-              "masked_to": "fi****@ory.sh"
-            },
-            "id": 1010020,
-            "text": "We will send a code to fi****@ory.sh. To verify that this is your address please enter it here.",
-            "type": "info"
-          }
-        ],
-        "meta": {
-          "label": {
-            "context": {
-              "title": "Email"
-            },
-            "id": 1070002,
-            "text": "Email",
-            "type": "info"
-          }
-        },
-        "type": "input"
-      },
-      {
-        "attributes": {
-          "disabled": false,
-          "name": "method",
+          "name": "address",
           "node_type": "input",
           "type": "submit",
-          "value": "code"
+          "value": "fixed_mfa_test_spa@ory.sh"
         },
         "group": "code",
         "messages": [],
         "meta": {
           "label": {
-            "id": 1010019,
-            "text": "Continue with code",
+            "context": {
+              "address": "fixed_mfa_test_spa@ory.sh",
+              "channel": "email"
+            },
+            "id": 1010023,
+            "text": "Send code to fixed_mfa_test_spa@ory.sh",
             "type": "info"
           }
         },
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-email.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-email.json
new file mode 100644
index 000000000000..721c86a79617
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-email.json
@@ -0,0 +1,71 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "+4917613213112"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "+4917613213112",
+          "channel": "sms"
+        },
+        "id": 1010023,
+        "text": "Send code to +4917613213112",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-1spa@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-1spa@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-1spa@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-2spa@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-2spa@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-2spa@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-phone.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-phone.json
new file mode 100644
index 000000000000..721c86a79617
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=address-phone.json
@@ -0,0 +1,71 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "+4917613213112"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "+4917613213112",
+          "channel": "sms"
+        },
+        "id": 1010023,
+        "text": "Send code to +4917613213112",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-1spa@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-1spa@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-1spa@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-2spa@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-2spa@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-2spa@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=identifier-email.json b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=identifier-email.json
new file mode 100644
index 000000000000..721c86a79617
--- /dev/null
+++ b/selfservice/strategy/code/.snapshots/TestLoginCodeStrategy-test=SPA_client-suite=mfa-case=without_via_parameter_all_options_are_shown-field=identifier-email.json
@@ -0,0 +1,71 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "+4917613213112"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "+4917613213112",
+          "channel": "sms"
+        },
+        "id": 1010023,
+        "text": "Send code to +4917613213112",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-1spa@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-1spa@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-1spa@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "address",
+      "node_type": "input",
+      "type": "submit",
+      "value": "code-mfa-2spa@ory.sh"
+    },
+    "group": "code",
+    "messages": [],
+    "meta": {
+      "label": {
+        "context": {
+          "address": "code-mfa-2spa@ory.sh",
+          "channel": "email"
+        },
+        "id": 1010023,
+        "text": "Send code to code-mfa-2spa@ory.sh",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/code/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads.json b/selfservice/strategy/code/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads.json
index ec1092ad77a6..195ca691e981 100644
--- a/selfservice/strategy/code/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads.json
+++ b/selfservice/strategy/code/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads.json
@@ -43,8 +43,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/code/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads_after_submission.json b/selfservice/strategy/code/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads_after_submission.json
index dbf1dcd2cbb7..a5ab6784616a 100644
--- a/selfservice/strategy/code/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads_after_submission.json
+++ b/selfservice/strategy/code/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads_after_submission.json
@@ -21,6 +21,7 @@
       "required": true,
       "pattern": "[0-9]+",
       "disabled": false,
+      "maxlength": 6,
       "node_type": "input"
     },
     "messages": [],
@@ -58,8 +59,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     }
diff --git a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=api.json b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=api.json
index ec1092ad77a6..195ca691e981 100644
--- a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=api.json
+++ b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=api.json
@@ -43,8 +43,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=browser.json b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=browser.json
index ec1092ad77a6..195ca691e981 100644
--- a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=browser.json
+++ b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=browser.json
@@ -43,8 +43,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=spa.json b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=spa.json
index ec1092ad77a6..195ca691e981 100644
--- a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=spa.json
+++ b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads-type=spa.json
@@ -43,8 +43,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=api.json b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=api.json
index dbf1dcd2cbb7..a5ab6784616a 100644
--- a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=api.json
+++ b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=api.json
@@ -21,6 +21,7 @@
       "required": true,
       "pattern": "[0-9]+",
       "disabled": false,
+      "maxlength": 6,
       "node_type": "input"
     },
     "messages": [],
@@ -58,8 +59,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     }
diff --git a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=browser.json b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=browser.json
index dbf1dcd2cbb7..a5ab6784616a 100644
--- a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=browser.json
+++ b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=browser.json
@@ -21,6 +21,7 @@
       "required": true,
       "pattern": "[0-9]+",
       "disabled": false,
+      "maxlength": 6,
       "node_type": "input"
     },
     "messages": [],
@@ -58,8 +59,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     }
diff --git a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=spa.json b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=spa.json
index dbf1dcd2cbb7..a5ab6784616a 100644
--- a/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=spa.json
+++ b/selfservice/strategy/code/.snapshots/TestRecovery_WithContinueWith-description=should_set_all_the_correct_recovery_payloads_after_submission-type=spa.json
@@ -21,6 +21,7 @@
       "required": true,
       "pattern": "[0-9]+",
       "disabled": false,
+      "maxlength": 6,
       "node_type": "input"
     },
     "messages": [],
@@ -58,8 +59,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     }
diff --git a/selfservice/strategy/code/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads.json b/selfservice/strategy/code/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads.json
index 37f61ac9e827..01def57fd58f 100644
--- a/selfservice/strategy/code/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads.json
+++ b/selfservice/strategy/code/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads.json
@@ -30,8 +30,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/code/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads_after_submission.json b/selfservice/strategy/code/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads_after_submission.json
index 42456da54dc5..7e7096cd7358 100644
--- a/selfservice/strategy/code/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads_after_submission.json
+++ b/selfservice/strategy/code/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads_after_submission.json
@@ -44,8 +44,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     }
diff --git a/selfservice/strategy/code/code_login.go b/selfservice/strategy/code/code_login.go
index 689d52f0cb4f..820a1818a140 100644
--- a/selfservice/strategy/code/code_login.go
+++ b/selfservice/strategy/code/code_login.go
@@ -32,7 +32,7 @@ type LoginCode struct {
 
 	// AddressType represents the type of the address
 	// this can be an email address or a phone number.
-	AddressType identity.CodeAddressType `json:"-" db:"address_type"`
+	AddressType identity.CodeChannel `json:"-" db:"address_type"`
 
 	// CodeHMAC represents the HMACed value of the verification code
 	CodeHMAC string `json:"-" db:"code"`
@@ -94,7 +94,7 @@ type CreateLoginCodeParams struct {
 
 	// AddressType is the type of the address (email or phone number).
 	// required: true
-	AddressType identity.CodeAddressType
+	AddressType identity.CodeChannel
 
 	// Code represents the recovery code
 	// required: true
diff --git a/selfservice/strategy/code/code_registration.go b/selfservice/strategy/code/code_registration.go
index 4093480fb91e..4015474112dd 100644
--- a/selfservice/strategy/code/code_registration.go
+++ b/selfservice/strategy/code/code_registration.go
@@ -32,7 +32,7 @@ type RegistrationCode struct {
 
 	// AddressType represents the type of the address
 	// this can be an email address or a phone number.
-	AddressType identity.CodeAddressType `json:"-" db:"address_type"`
+	AddressType identity.CodeChannel `json:"-" db:"address_type"`
 
 	// CodeHMAC represents the HMACed value of the verification code
 	CodeHMAC string `json:"-" db:"code"`
@@ -93,7 +93,7 @@ type CreateRegistrationCodeParams struct {
 
 	// AddressType is the type of the address (email or phone number).
 	// required: true
-	AddressType identity.CodeAddressType
+	AddressType identity.CodeChannel
 
 	// Code represents the recovery code
 	// required: true
diff --git a/selfservice/strategy/code/code_sender.go b/selfservice/strategy/code/code_sender.go
index fdc5e8b38b2d..20e392836ce7 100644
--- a/selfservice/strategy/code/code_sender.go
+++ b/selfservice/strategy/code/code_sender.go
@@ -54,7 +54,7 @@ type (
 	}
 	Address struct {
 		To  string
-		Via identity.CodeAddressType
+		Via identity.CodeChannel
 	}
 )
 
@@ -87,7 +87,7 @@ func (s *Sender) SendCode(ctx context.Context, f flow.Flow, id *identity.Identit
 			code, err := s.deps.
 				RegistrationCodePersister().
 				CreateRegistrationCode(ctx, &CreateRegistrationCodeParams{
-					AddressType: identity.CodeAddressType(address.Via),
+					AddressType: address.Via,
 					RawCode:     rawCode,
 					ExpiresIn:   s.deps.Config().SelfServiceCodeMethodLifespan(ctx),
 					FlowID:      f.GetID(),
@@ -101,21 +101,35 @@ func (s *Sender) SendCode(ctx context.Context, f flow.Flow, id *identity.Identit
 				return err
 			}
 
-			emailModel := email.RegistrationCodeValidModel{
-				To:               address.To,
-				RegistrationCode: rawCode,
-				Traits:           model,
-				RequestURL:       f.GetRequestURL(),
-				TransientPayload: transientPayload,
-			}
-
 			s.deps.Audit().
 				WithField("registration_flow_id", code.FlowID).
 				WithField("registration_code_id", code.ID).
 				WithSensitiveField("registration_code", rawCode).
 				Info("Sending out registration email with code.")
 
-			if err := s.send(ctx, string(address.Via), email.NewRegistrationCodeValid(s.deps, &emailModel)); err != nil {
+			var t courier.Template
+			switch address.Via {
+			case identity.ChannelTypeEmail:
+				t = email.NewRegistrationCodeValid(s.deps, &email.RegistrationCodeValidModel{
+					To:               address.To,
+					RegistrationCode: rawCode,
+					Traits:           model,
+					RequestURL:       f.GetRequestURL(),
+					TransientPayload: transientPayload,
+					ExpiresInMinutes: int(s.deps.Config().SelfServiceCodeMethodLifespan(ctx).Minutes()),
+				})
+			case identity.ChannelTypeSMS:
+				t = sms.NewRegistrationCodeValid(s.deps, &sms.RegistrationCodeValidModel{
+					To:               address.To,
+					RegistrationCode: rawCode,
+					Identity:         model,
+					RequestURL:       f.GetRequestURL(),
+					TransientPayload: transientPayload,
+					ExpiresInMinutes: int(s.deps.Config().SelfServiceCodeMethodLifespan(ctx).Minutes()),
+				})
+			}
+
+			if err := s.send(ctx, string(address.Via), t); err != nil {
 				return errors.WithStack(err)
 			}
 
@@ -123,7 +137,7 @@ func (s *Sender) SendCode(ctx context.Context, f flow.Flow, id *identity.Identit
 			code, err := s.deps.
 				LoginCodePersister().
 				CreateLoginCode(ctx, &CreateLoginCodeParams{
-					AddressType: identity.CodeAddressType(address.Via),
+					AddressType: address.Via,
 					Address:     address.To,
 					RawCode:     rawCode,
 					ExpiresIn:   s.deps.Config().SelfServiceCodeMethodLifespan(ctx),
@@ -153,6 +167,7 @@ func (s *Sender) SendCode(ctx context.Context, f flow.Flow, id *identity.Identit
 					Identity:         model,
 					RequestURL:       f.GetRequestURL(),
 					TransientPayload: transientPayload,
+					ExpiresInMinutes: int(s.deps.Config().SelfServiceCodeMethodLifespan(ctx).Minutes()),
 				})
 			case identity.ChannelTypeSMS:
 				t = sms.NewLoginCodeValid(s.deps, &sms.LoginCodeValidModel{
@@ -161,6 +176,7 @@ func (s *Sender) SendCode(ctx context.Context, f flow.Flow, id *identity.Identit
 					Identity:         model,
 					RequestURL:       f.GetRequestURL(),
 					TransientPayload: transientPayload,
+					ExpiresInMinutes: int(s.deps.Config().SelfServiceCodeMethodLifespan(ctx).Minutes()),
 				})
 			}
 
@@ -266,6 +282,7 @@ func (s *Sender) SendRecoveryCodeTo(ctx context.Context, i *identity.Identity, c
 		Identity:         model,
 		RequestURL:       f.GetRequestURL(),
 		TransientPayload: transientPayload,
+		ExpiresInMinutes: int(s.deps.Config().SelfServiceCodeMethodLifespan(ctx).Minutes()),
 	}
 
 	return s.send(ctx, string(code.RecoveryAddress.Via), email.NewRecoveryCodeValid(s.deps, &emailModel))
@@ -371,6 +388,7 @@ func (s *Sender) SendVerificationCodeTo(ctx context.Context, f *verification.Flo
 			VerificationCode: codeString,
 			RequestURL:       f.GetRequestURL(),
 			TransientPayload: transientPayload,
+			ExpiresInMinutes: int(s.deps.Config().SelfServiceCodeMethodLifespan(ctx).Minutes()),
 		})
 	case identity.ChannelTypeSMS:
 		t = sms.NewVerificationCodeValid(s.deps, &sms.VerificationCodeValidModel{
@@ -379,6 +397,7 @@ func (s *Sender) SendVerificationCodeTo(ctx context.Context, f *verification.Flo
 			Identity:         model,
 			RequestURL:       f.GetRequestURL(),
 			TransientPayload: transientPayload,
+			ExpiresInMinutes: int(s.deps.Config().SelfServiceCodeMethodLifespan(ctx).Minutes()),
 		})
 	default:
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Expected email or sms but got %s", code.VerifiableAddress.Via))
diff --git a/selfservice/strategy/code/code_sender_test.go b/selfservice/strategy/code/code_sender_test.go
index e5ba75826eb5..4e306a78cf02 100644
--- a/selfservice/strategy/code/code_sender_test.go
+++ b/selfservice/strategy/code/code_sender_test.go
@@ -66,7 +66,7 @@ func TestSender(t *testing.T) {
 			require.Len(t, messages, 2)
 
 			assert.EqualValues(t, "tracked@ory.sh", messages[0].Recipient)
-			assert.Contains(t, messages[0].Subject, "Recover access to your account")
+			assert.Contains(t, messages[0].Subject, "Use code")
 
 			assert.Regexp(t, testhelpers.CodeRegex, messages[0].Body)
 
@@ -122,7 +122,7 @@ func TestSender(t *testing.T) {
 			require.Len(t, messages, 2)
 
 			assert.EqualValues(t, "tracked@ory.sh", messages[0].Recipient)
-			assert.Contains(t, messages[0].Subject, "Please verify your email address")
+			assert.Contains(t, messages[0].Subject, "Use code")
 
 			assert.Regexp(t, testhelpers.CodeRegex, messages[0].Body)
 
diff --git a/selfservice/strategy/code/strategy.go b/selfservice/strategy/code/strategy.go
index ee3ce353e4ae..85070509402c 100644
--- a/selfservice/strategy/code/strategy.go
+++ b/selfservice/strategy/code/strategy.go
@@ -6,8 +6,11 @@ package code
 import (
 	"context"
 	"net/http"
+	"sort"
 	"strings"
 
+	"github.com/samber/lo"
+
 	"github.com/pkg/errors"
 	"github.com/tidwall/gjson"
 
@@ -36,20 +39,21 @@ import (
 )
 
 var (
-	_ recovery.Strategy      = new(Strategy)
-	_ recovery.AdminHandler  = new(Strategy)
-	_ recovery.PublicHandler = new(Strategy)
+	_ recovery.Strategy      = (*Strategy)(nil)
+	_ recovery.AdminHandler  = (*Strategy)(nil)
+	_ recovery.PublicHandler = (*Strategy)(nil)
 )
 
 var (
-	_ verification.Strategy      = new(Strategy)
-	_ verification.AdminHandler  = new(Strategy)
-	_ verification.PublicHandler = new(Strategy)
+	_ verification.Strategy      = (*Strategy)(nil)
+	_ verification.AdminHandler  = (*Strategy)(nil)
+	_ verification.PublicHandler = (*Strategy)(nil)
 )
 
 var (
-	_ login.Strategy        = new(Strategy)
-	_ registration.Strategy = new(Strategy)
+	_ login.Strategy                    = (*Strategy)(nil)
+	_ registration.Strategy             = (*Strategy)(nil)
+	_ identity.ActiveCredentialsCounter = (*Strategy)(nil)
 )
 
 type (
@@ -64,6 +68,7 @@ type (
 		x.WriterProvider
 		x.LoggingProvider
 		x.TracingProvider
+		x.TransactionPersistenceProvider
 
 		config.Provider
 
@@ -121,6 +126,25 @@ type (
 	}
 )
 
+func (s *Strategy) CountActiveFirstFactorCredentials(ctx context.Context, cc map[identity.CredentialsType]identity.Credentials) (int, error) {
+	codeConfig := s.deps.Config().SelfServiceCodeStrategy(ctx)
+	if codeConfig.PasswordlessEnabled {
+		// Login with code for passwordless is enabled
+		return 1, nil
+	}
+
+	return 0, nil
+}
+
+func (s *Strategy) CountActiveMultiFactorCredentials(ctx context.Context, cc map[identity.CredentialsType]identity.Credentials) (int, error) {
+	codeConfig := s.deps.Config().SelfServiceCodeStrategy(ctx)
+	if codeConfig.MFAEnabled {
+		return 1, nil
+	}
+
+	return 0, nil
+}
+
 func NewStrategy(deps any) *Strategy {
 	return &Strategy{deps: deps.(strategyDependencies), dx: decoderx.NewHTTP()}
 }
@@ -180,19 +204,22 @@ func (s *Strategy) PopulateMethod(r *http.Request, f flow.Flow) error {
 	if f.GetType() == flow.TypeBrowser {
 		f.GetUI().SetCSRF(s.deps.GenerateCSRFToken(r))
 	}
+
 	return nil
 }
 
 func (s *Strategy) populateChooseMethodFlow(r *http.Request, f flow.Flow) error {
 	ctx := r.Context()
-	var codeMetaLabel *text.Message
 	switch f := f.(type) {
 	case *recovery.Flow, *verification.Flow:
 		f.GetUI().Nodes.Append(
 			node.NewInputField("email", nil, node.CodeGroup, node.InputAttributeTypeEmail, node.WithRequiredInputAttribute).
 				WithMetaLabel(text.NewInfoNodeInputEmail()),
 		)
-		codeMetaLabel = text.NewInfoNodeLabelSubmit()
+		f.GetUI().Nodes.Append(
+			node.NewInputField("method", s.ID(), node.CodeGroup, node.InputAttributeTypeSubmit).
+				WithMetaLabel(text.NewInfoNodeLabelContinue()),
+		)
 	case *login.Flow:
 		ds, err := s.deps.Config().DefaultIdentityTraitsSchemaURL(ctx)
 		if err != nil {
@@ -200,48 +227,80 @@ func (s *Strategy) populateChooseMethodFlow(r *http.Request, f flow.Flow) error
 		}
 		if f.RequestedAAL == identity.AuthenticatorAssuranceLevel2 {
 			via := r.URL.Query().Get("via")
-			if via == "" {
-				return errors.WithStack(herodot.ErrBadRequest.WithReason("AAL2 login via code requires the `via` query parameter"))
-			}
 
 			sess, err := s.deps.SessionManager().FetchFromRequest(r.Context(), r)
 			if err != nil {
 				return err
 			}
 
-			allSchemas, err := s.deps.IdentityTraitsSchemas(ctx)
-			if err != nil {
-				return err
-			}
-			iSchema, err := allSchemas.GetByID(sess.Identity.SchemaID)
-			if err != nil {
-				return err
-			}
-			identifierLabel, err := login.GetIdentifierLabelFromSchemaWithField(ctx, iSchema.RawURL, via)
-			if err != nil {
-				return err
+			// We need to load the identity's credentials.
+			if len(sess.Identity.Credentials) == 0 {
+				if err := s.deps.PrivilegedIdentityPool().HydrateIdentityAssociations(ctx, sess.Identity, identity.ExpandCredentials); err != nil {
+					return err
+				}
 			}
 
-			value := gjson.GetBytes(sess.Identity.Traits, via).String()
-			if value == "" {
-				return errors.WithStack(herodot.ErrBadRequest.WithReasonf("No value found for trait %s in the current identity", via))
-			}
+			// The via parameter lets us hint at the OTP address to use for 2fa.
+			if via == "" {
+				addresses, found, err := FindCodeAddressCandidates(sess.Identity, s.deps.Config().SelfServiceCodeMethodMissingCredentialFallbackEnabled(ctx))
+				if err != nil {
+					return err
+				} else if !found {
+					return nil
+				}
+
+				sort.SliceStable(addresses, func(i, j int) bool {
+					return addresses[i].To < addresses[j].To && addresses[i].Via < addresses[j].Via
+				})
+
+				for _, address := range addresses {
+					f.GetUI().Nodes.Append(node.NewInputField("address", address.To, node.CodeGroup, node.InputAttributeTypeSubmit).
+						WithMetaLabel(text.NewInfoSelfServiceLoginAAL2CodeAddress(string(address.Via), address.To)))
+				}
+			} else {
+				value := gjson.GetBytes(sess.Identity.Traits, via).String()
+				if value == "" {
+					return errors.WithStack(herodot.ErrBadRequest.WithReasonf("No value found for trait %s in the current identity.", via))
+				}
+
+				// TODO Remove this normalization once the via parameter is deprecated.
+				//
+				// Here we need to normalize the via parameter to the actual address. This is necessary because otherwise
+				// we won't find the address in the list of addresses.
+				//
+				// Since we don't know if the via parameter is an email address or a phone number, we need to normalize for both.
+				value = x.GracefulNormalization(value)
+
+				addresses, found, err := FindCodeAddressCandidates(sess.Identity, s.deps.Config().SelfServiceCodeMethodMissingCredentialFallbackEnabled(ctx))
+				if err != nil {
+					return err
+				} else if !found {
+					return nil
+				}
 
-			codeMetaLabel = text.NewInfoSelfServiceLoginCodeMFA()
-			idNode := node.NewInputField("identifier", "", node.DefaultGroup, node.InputAttributeTypeText, node.WithRequiredInputAttribute).WithMetaLabel(identifierLabel)
-			idNode.Messages.Add(text.NewInfoSelfServiceLoginCodeMFAHint(MaskAddress(value)))
-			f.GetUI().Nodes.Upsert(idNode)
+				address, found := lo.Find(addresses, func(item Address) bool {
+					return item.To == value
+				})
+				if !found {
+					return errors.WithStack(herodot.ErrBadRequest.WithReasonf("You can only reference a trait that matches a verification email address in the via parameter, or a registered credential."))
+				}
+
+				f.GetUI().Nodes.Append(node.NewInputField("address", address.To, node.CodeGroup, node.InputAttributeTypeSubmit).
+					WithMetaLabel(text.NewInfoSelfServiceLoginAAL2CodeAddress(string(address.Via), address.To)))
+			}
 		} else {
-			codeMetaLabel = text.NewInfoSelfServiceLoginCode()
 			identifierLabel, err := login.GetIdentifierLabelFromSchema(ctx, ds.String())
 			if err != nil {
 				return err
 			}
 
 			f.GetUI().Nodes.Upsert(node.NewInputField("identifier", "", node.DefaultGroup, node.InputAttributeTypeText, node.WithRequiredInputAttribute).WithMetaLabel(identifierLabel))
+			f.GetUI().Nodes.Append(
+				node.NewInputField("method", s.ID(), node.CodeGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoSelfServiceLoginCode()),
+			)
 		}
+
 	case *registration.Flow:
-		codeMetaLabel = text.NewInfoSelfServiceRegistrationRegisterCode()
 		ds, err := s.deps.Config().DefaultIdentityTraitsSchemaURL(ctx)
 		if err != nil {
 			return err
@@ -257,12 +316,12 @@ func (s *Strategy) populateChooseMethodFlow(r *http.Request, f flow.Flow) error
 		for _, n := range traitNodes {
 			f.GetUI().Nodes.Upsert(n)
 		}
-	}
-
-	methodButton := node.NewInputField("method", s.ID(), node.CodeGroup, node.InputAttributeTypeSubmit).
-		WithMetaLabel(codeMetaLabel)
 
-	f.GetUI().Nodes.Append(methodButton)
+		f.GetUI().Nodes.Append(
+			node.NewInputField("method", s.ID(), node.CodeGroup, node.InputAttributeTypeSubmit).
+				WithMetaLabel(text.NewInfoSelfServiceRegistrationRegisterCode()),
+		)
+	}
 
 	return nil
 }
@@ -294,20 +353,16 @@ func (s *Strategy) populateEmailSentFlow(ctx context.Context, f flow.Flow) error
 	case flow.LoginFlow:
 		route = login.RouteSubmitFlow
 		codeMetaLabel = text.NewInfoNodeLabelLoginCode()
-		message = text.NewLoginEmailWithCodeSent()
+		message = text.NewLoginCodeSent()
 
 		// preserve the login identifier that was submitted
 		// so we can retry the code flow with the same data
 		for _, n := range f.GetUI().Nodes {
-			if n.Group == node.DefaultGroup {
-				// we don't need the user to change the values here
-				// for better UX let's make them disabled
-				// when there are errors we won't hide the fields
-				if len(n.Messages) == 0 {
-					if input, ok := n.Attributes.(*node.InputAttributes); ok {
-						input.Type = "hidden"
-						n.Attributes = input
-					}
+			if n.ID() == "identifier" || n.ID() == "address" {
+				if input, ok := n.Attributes.(*node.InputAttributes); ok {
+					input.Type = "hidden"
+					n.Attributes = input
+					input.Name = "identifier"
 				}
 				freshNodes = append(freshNodes, n)
 			}
@@ -373,7 +428,7 @@ func (s *Strategy) populateEmailSentFlow(ctx context.Context, f flow.Flow) error
 	// code submit button
 	freshNodes.
 		Append(node.NewInputField("method", s.ID(), node.CodeGroup, node.InputAttributeTypeSubmit).
-			WithMetaLabel(text.NewInfoNodeLabelSubmit()))
+			WithMetaLabel(text.NewInfoNodeLabelContinue()))
 
 	if resendNode != nil {
 		freshNodes.Append(resendNode)
diff --git a/selfservice/strategy/code/strategy_login.go b/selfservice/strategy/code/strategy_login.go
index a9d7459f5c56..13e959299a5e 100644
--- a/selfservice/strategy/code/strategy_login.go
+++ b/selfservice/strategy/code/strategy_login.go
@@ -4,12 +4,19 @@
 package code
 
 import (
+	"cmp"
 	"context"
-	"database/sql"
 	"encoding/json"
 	"net/http"
 	"strings"
 
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/ory/kratos/driver/config"
+
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+	"github.com/ory/kratos/text"
+
 	"github.com/ory/x/sqlcon"
 
 	"github.com/pkg/errors"
@@ -29,7 +36,10 @@ import (
 	"github.com/ory/x/decoderx"
 )
 
-var _ login.Strategy = new(Strategy)
+var (
+	_ login.FormHydrator = new(Strategy)
+	_ login.Strategy     = new(Strategy)
+)
 
 // Update Login flow using the code method
 //
@@ -55,6 +65,10 @@ type updateLoginFlowWithCodeMethod struct {
 	// required: false
 	Identifier string `json:"identifier" form:"identifier"`
 
+	// Address is the address to send the code to, in case that there are multiple addresses. This field
+	// is only used in two-factor flows and is ineffective for passwordless flows.
+	Address string `json:"address" form:"address"`
+
 	// Resend is set when the user wants to resend the code
 	// required: false
 	Resend string `json:"resend" form:"resend"`
@@ -67,19 +81,15 @@ type updateLoginFlowWithCodeMethod struct {
 
 func (s *Strategy) RegisterLoginRoutes(*x.RouterPublic) {}
 
-func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context, amr session.AuthenticationMethods) session.AuthenticationMethod {
-	aal1Satisfied := lo.ContainsBy(amr, func(am session.AuthenticationMethod) bool {
-		return am.Method != identity.CredentialsTypeCodeAuth && am.AAL == identity.AuthenticatorAssuranceLevel1
-	})
-	if aal1Satisfied {
-		return session.AuthenticationMethod{
-			Method: identity.CredentialsTypeCodeAuth,
-			AAL:    identity.AuthenticatorAssuranceLevel2,
-		}
+func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context) session.AuthenticationMethod {
+	aal := identity.AuthenticatorAssuranceLevel1
+	if s.deps.Config().SelfServiceCodeStrategy(ctx).MFAEnabled {
+		aal = identity.AuthenticatorAssuranceLevel2
 	}
+
 	return session.AuthenticationMethod{
-		Method: identity.CredentialsTypeCodeAuth,
-		AAL:    identity.AuthenticatorAssuranceLevel1,
+		Method: s.ID(),
+		AAL:    aal,
 	}
 }
 
@@ -89,83 +99,111 @@ func (s *Strategy) HandleLoginError(r *http.Request, f *login.Flow, body *update
 	}
 
 	if f != nil {
-		email := ""
+		identifier := ""
 		if body != nil {
-			email = body.Identifier
+			identifier = cmp.Or(body.Address, body.Identifier)
 		}
 
-		ds, err := s.deps.Config().DefaultIdentityTraitsSchemaURL(r.Context())
-		if err != nil {
-			return err
-		}
-		identifierLabel, err := login.GetIdentifierLabelFromSchema(r.Context(), ds.String())
-		if err != nil {
-			return err
-		}
 		f.UI.SetCSRF(s.deps.GenerateCSRFToken(r))
-		f.UI.GetNodes().Upsert(
-			node.NewInputField("identifier", email, node.DefaultGroup, node.InputAttributeTypeText, node.WithRequiredInputAttribute).
-				WithMetaLabel(identifierLabel),
-		)
+		identifierNode := node.NewInputField("identifier", identifier, node.DefaultGroup, node.InputAttributeTypeHidden)
+
+		identifierNode.Attributes.SetValue(identifier)
+		f.UI.GetNodes().Upsert(identifierNode)
 	}
 
 	return err
 }
 
-func (s *Strategy) PopulateLoginMethod(r *http.Request, requestedAAL identity.AuthenticatorAssuranceLevel, lf *login.Flow) error {
-	return s.PopulateMethod(r, lf)
-}
-
 // findIdentityByIdentifier returns the identity and the code credential for the given identifier.
 // If the identity does not have a code credential, it will attempt to find
 // the identity through other credentials matching the identifier.
 // the fallback mechanism is used for migration purposes of old accounts that do not have a code credential.
-func (s *Strategy) findIdentityByIdentifier(ctx context.Context, identifier string) (_ *identity.Identity, isFallback bool, err error) {
-	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.strategy.findIdentityByIdentifier")
+func (s *Strategy) findIdentityByIdentifier(ctx context.Context, identifier string) (id *identity.Identity, cred *identity.Credentials, isFallback bool, err error) {
+	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.Strategy.findIdentityByIdentifier")
 	defer otelx.End(span, &err)
 
-	id, cred, err := s.deps.PrivilegedIdentityPool().FindByCredentialsIdentifier(ctx, s.ID(), identifier)
+	id, cred, err = s.deps.PrivilegedIdentityPool().FindByCredentialsIdentifier(ctx, s.ID(), identifier)
 	if errors.Is(err, sqlcon.ErrNoRows) {
 		// this is a migration for old identities that do not have a code credential
 		// we might be able to do a fallback login since we could not find a credential on this identifier
 		// Case insensitive because we only care about emails.
 		id, err := s.deps.PrivilegedIdentityPool().FindIdentityByCredentialIdentifier(ctx, identifier, false)
 		if err != nil {
-			return nil, false, errors.WithStack(schema.NewNoCodeAuthnCredentials())
+			return nil, nil, false, errors.WithStack(schema.NewNoCodeAuthnCredentials())
 		}
 
 		// we don't know if the user has verified the code yet, so we just return the identity
 		// and let the caller decide what to do with it
-		return id, true, nil
+		return id, nil, true, nil
 	} else if err != nil {
-		return nil, false, errors.WithStack(schema.NewNoCodeAuthnCredentials())
+		return nil, nil, false, errors.WithStack(schema.NewNoCodeAuthnCredentials())
 	}
 
 	if len(cred.Identifiers) == 0 {
-		return nil, false, errors.WithStack(schema.NewNoCodeAuthnCredentials())
+		return nil, nil, false, errors.WithStack(schema.NewNoCodeAuthnCredentials())
 	}
 
 	// we don't need the code credential, we just need to know that it exists
-	return id, false, nil
+	return id, cred, false, nil
 }
 
-func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, sess *session.Session) (_ *identity.Identity, err error) {
-	ctx, span := s.deps.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.code.strategy.Login")
-	defer otelx.End(span, &err)
+type decodedMethod struct {
+	Method  string `json:"method" form:"method"`
+	Address string `json:"address" form:"address"`
+}
 
-	if err := flow.MethodEnabledAndAllowedFromRequest(r, f.GetFlowName(), s.ID().String(), s.deps); err != nil {
-		return nil, err
+func (s *Strategy) methodEnabledAndAllowedFromRequest(r *http.Request, f *login.Flow) (*decodedMethod, error) {
+	var method decodedMethod
+
+	compiler, err := decoderx.HTTPRawJSONSchemaCompiler(loginMethodSchema)
+	if err != nil {
+		return nil, errors.WithStack(err)
 	}
 
-	var aal identity.AuthenticatorAssuranceLevel
+	if err := decoderx.NewHTTP().Decode(r, &method, compiler,
+		decoderx.HTTPKeepRequestBody(true),
+		decoderx.HTTPDecoderAllowedMethods("POST", "PUT", "PATCH", "GET"),
+		decoderx.HTTPDecoderSetValidatePayloads(false),
+		decoderx.HTTPDecoderJSONFollowsFormFormat()); err != nil {
+		return &method, errors.WithStack(err)
+	}
+
+	if err := flow.MethodEnabledAndAllowed(r.Context(), f.GetFlowName(), s.ID().String(), method.Method, s.deps); err != nil {
+		return &method, err
+	}
+
+	return &method, nil
+}
+
+func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, sess *session.Session) (_ *identity.Identity, err error) {
+	ctx, span := s.deps.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.code.Strategy.Login")
+	defer otelx.End(span, &err)
 
 	if s.deps.Config().SelfServiceCodeStrategy(ctx).PasswordlessEnabled {
-		aal = identity.AuthenticatorAssuranceLevel1
+		if err := login.CheckAAL(f, identity.AuthenticatorAssuranceLevel1); err != nil {
+			return nil, err
+		}
 	} else if s.deps.Config().SelfServiceCodeStrategy(ctx).MFAEnabled {
-		aal = identity.AuthenticatorAssuranceLevel2
+		if err := login.CheckAAL(f, identity.AuthenticatorAssuranceLevel2); err != nil {
+			return nil, err
+		}
+	} else {
+		return nil, errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 
-	if err := login.CheckAAL(f, aal); err != nil {
+	if p, err := s.methodEnabledAndAllowedFromRequest(r, f); errors.Is(err, flow.ErrStrategyNotResponsible) {
+		if !s.deps.Config().SelfServiceCodeStrategy(ctx).MFAEnabled {
+			span.SetAttributes(attribute.String("not_responsible_reason", "MFA is not enabled"))
+			return nil, err
+		}
+
+		if p == nil || len(p.Address) == 0 {
+			span.SetAttributes(attribute.String("not_responsible_reason", "method not set or address not set"))
+			return nil, err
+		}
+
+		// In this special case we only expect `address` to be set.
+	} else if err != nil {
 		return nil, err
 	}
 
@@ -195,7 +233,7 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 		}
 		return nil, nil
 	case flow.StateEmailSent:
-		i, err := s.loginVerifyCode(ctx, r, f, &p)
+		i, err := s.loginVerifyCode(ctx, f, &p, sess)
 		if err != nil {
 			return nil, s.HandleLoginError(r, f, &p, err)
 		}
@@ -207,40 +245,156 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 	return nil, s.HandleLoginError(r, f, &p, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unexpected flow state: %s", f.GetState())))
 }
 
-func (s *Strategy) loginSendCode(ctx context.Context, w http.ResponseWriter, r *http.Request, f *login.Flow, p *updateLoginFlowWithCodeMethod, sess *session.Session) (err error) {
-	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.strategy.loginSendCode")
+func (s *Strategy) findIdentifierInVerifiableAddress(i *identity.Identity, identifier string) (*Address, error) {
+	verifiableAddress, found := lo.Find(i.VerifiableAddresses, func(va identity.VerifiableAddress) bool {
+		return va.Value == identifier
+	})
+	if !found {
+		return nil, errors.WithStack(schema.NewUnknownAddressError())
+	}
+
+	// This should be fine for legacy cases because we use `UpgradeCredentials` to normalize all address types prior
+	// to calling this method.
+	parsed, err := identity.NewCodeChannel(verifiableAddress.Via)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Address{
+		To:  verifiableAddress.Value,
+		Via: parsed,
+	}, nil
+}
+
+func (s *Strategy) findIdentityForIdentifier(ctx context.Context, identifier string, requestedAAL identity.AuthenticatorAssuranceLevel, session *session.Session) (_ *identity.Identity, _ []Address, err error) {
+	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.Strategy.findIdentityForIdentifier")
+	span.SetAttributes(
+		attribute.String("flow.requested_aal", string(requestedAAL)),
+	)
+
 	defer otelx.End(span, &err)
 
-	if len(p.Identifier) == 0 {
-		return errors.WithStack(schema.NewRequiredError("#/identifier", "identifier"))
+	if len(identifier) == 0 {
+		return nil, nil, errors.WithStack(schema.NewRequiredError("#/identifier", "identifier"))
 	}
 
-	p.Identifier = maybeNormalizeEmail(p.Identifier)
+	identifier = x.GracefulNormalization(identifier)
 
 	var addresses []Address
-	var i *identity.Identity
-	if f.RequestedAAL > identity.AuthenticatorAssuranceLevel1 {
-		address, found := lo.Find(sess.Identity.VerifiableAddresses, func(va identity.VerifiableAddress) bool {
-			return va.Value == p.Identifier
-		})
-		if !found {
-			return errors.WithStack(schema.NewUnknownAddressError())
+
+	// Step 1: Get the identity
+	i, cred, isFallback, err := s.findIdentityByIdentifier(ctx, identifier)
+	if err != nil {
+		if requestedAAL == identity.AuthenticatorAssuranceLevel2 {
+			// When using two-factor auth, the identity used to not have any code credential associated. Therefore,
+			// we need to gracefully handle this flow.
+			//
+			// TODO this section should be removed at some point when we are sure that all identities have a code credential.
+			if codeCred := new(schema.ValidationError); errors.As(err, &codeCred) && codeCred.ValidationError.Message == "account does not exist or has not setup up sign in with code" {
+				fallbackAllowed := s.deps.Config().SelfServiceCodeMethodMissingCredentialFallbackEnabled(ctx)
+				span.SetAttributes(
+					attribute.Bool(config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, fallbackAllowed),
+				)
+
+				if !fallbackAllowed {
+					s.deps.Logger().Warn("The identity does not have a code credential but the fallback mechanism is disabled. Login failed.")
+					return nil, nil, errors.WithStack(schema.NewNoCodeAuthnCredentials())
+				}
+
+				address, err := s.findIdentifierInVerifiableAddress(session.Identity, identifier)
+				if err != nil {
+					return nil, nil, err
+				}
+
+				// We only end up here if the identity's identity schema does not have the `code` identifier extension defined.
+				// We know that this is the case for a couple of projects who use 2FA with the code credential.
+				//
+				// In those scenarios, the identity has no code credential, and the code credential will also not be created by
+				// the identity schema.
+				//
+				// To avoid future regressions, we will not perform an update on the identity here. Effectively, whenever
+				// the identity would be updated again (and the identity schema + extensions parsed), it would be likely
+				// that the code credentials are overwritten.
+				//
+				// So we accept that the identity in this case will simply not have code credentials, and we will rely on the
+				// fallback mechanism to authenticate the user.
+				return session.Identity, []Address{*address}, nil
+			} else if err != nil {
+				return nil, nil, err
+			}
 		}
-		i = sess.Identity
+		return nil, nil, err
+	} else if isFallback {
+		fallbackAllowed := s.deps.Config().SelfServiceCodeMethodMissingCredentialFallbackEnabled(ctx)
+		span.SetAttributes(
+			attribute.String("identity.id", i.ID.String()),
+			attribute.String("network.id", i.NID.String()),
+			attribute.Bool(config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, fallbackAllowed),
+		)
+
+		if !fallbackAllowed {
+			s.deps.Logger().Warn("The identity does not have a code credential but the fallback mechanism is disabled. Login failed.")
+			return nil, nil, errors.WithStack(schema.NewNoCodeAuthnCredentials())
+		}
+
+		// We don't have a code credential, but we can still login the user if they have a verified address.
+		// This is a migration path for old accounts that do not have a code credential.
 		addresses = []Address{{
-			To:  address.Value,
-			Via: address.Via,
+			To:  identifier,
+			Via: identity.CodeChannelEmail,
 		}}
+
+		// We only end up here if the identity's identity schema does not have the `code` identifier extension defined.
+		// We know that this is the case for a couple of projects who use 2FA with the code credential.
+		//
+		// In those scenarios, the identity has no code credential, and the code credential will also not be created by
+		// the identity schema.
+		//
+		// To avoid future regressions, we will not perform an update on the identity here. Effectively, whenever
+		// the identity would be updated again (and the identity schema + extensions parsed), it would be likely
+		// that the code credentials are overwritten.
+		//
+		// So we accept that the identity in this case will simply not have code credentials, and we will rely on the
+		// fallback mechanism to authenticate the user.
 	} else {
-		// Step 1: Get the identity
-		i, _, err = s.findIdentityByIdentifier(ctx, p.Identifier)
-		if err != nil {
-			return err
+		span.SetAttributes(
+			attribute.String("identity.id", i.ID.String()),
+			attribute.String("network.id", i.NID.String()),
+		)
+
+		var conf identity.CredentialsCode
+		if err := json.Unmarshal(cred.Config, &conf); err != nil {
+			return nil, nil, errors.WithStack(err)
 		}
-		addresses = []Address{{
-			To:  p.Identifier,
-			Via: identity.CodeAddressType(identity.AddressTypeEmail),
-		}}
+
+		for _, address := range conf.Addresses {
+			addresses = append(addresses, Address{
+				To:  address.Address,
+				Via: address.Channel,
+			})
+		}
+	}
+
+	return i, addresses, nil
+}
+
+func (s *Strategy) loginSendCode(ctx context.Context, w http.ResponseWriter, r *http.Request, f *login.Flow, p *updateLoginFlowWithCodeMethod, sess *session.Session) (err error) {
+	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.Strategy.loginSendCode")
+	defer otelx.End(span, &err)
+
+	p.Identifier = maybeNormalizeEmail(
+		cmp.Or(p.Identifier, p.Address),
+	)
+
+	i, addresses, err := s.findIdentityForIdentifier(ctx, p.Identifier, f.RequestedAAL, sess)
+	if err != nil {
+		return err
+	}
+
+	if address, found := lo.Find(addresses, func(item Address) bool {
+		return item.To == x.GracefulNormalization(p.Identifier)
+	}); found {
+		addresses = []Address{address}
 	}
 
 	// Step 2: Delete any previous login codes for this flow ID
@@ -285,8 +439,8 @@ func maybeNormalizeEmail(input string) string {
 	return input
 }
 
-func (s *Strategy) loginVerifyCode(ctx context.Context, r *http.Request, f *login.Flow, p *updateLoginFlowWithCodeMethod) (_ *identity.Identity, err error) {
-	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.strategy.loginVerifyCode")
+func (s *Strategy) loginVerifyCode(ctx context.Context, f *login.Flow, p *updateLoginFlowWithCodeMethod, sess *session.Session) (_ *identity.Identity, err error) {
+	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.Strategy.loginVerifyCode")
 	defer otelx.End(span, &err)
 
 	// we are in the second submission state of the flow
@@ -295,27 +449,21 @@ func (s *Strategy) loginVerifyCode(ctx context.Context, r *http.Request, f *logi
 		return nil, errors.WithStack(schema.NewRequiredError("#/code", "code"))
 	}
 
-	if len(p.Identifier) == 0 {
-		return nil, errors.WithStack(schema.NewRequiredError("#/identifier", "identifier"))
-	}
+	p.Identifier = maybeNormalizeEmail(
+		cmp.Or(
+			p.Address,
+			p.Identifier, // Older versions of Kratos required us to send the identifier here.
+		),
+	)
 
-	p.Identifier = maybeNormalizeEmail(p.Identifier)
-
-	isFallback := false
 	var i *identity.Identity
-	if f.RequestedAAL > identity.AuthenticatorAssuranceLevel1 {
-		// Don't require the code credential if the user already has a session (e.g. this is an MFA flow)
-		sess, err := s.deps.SessionManager().FetchFromRequest(ctx, r)
-		if err != nil {
-			return nil, err
-		}
+	if f.RequestedAAL == identity.AuthenticatorAssuranceLevel2 {
 		i = sess.Identity
 	} else {
-		// Step 1: Get the identity
-		i, isFallback, err = s.findIdentityByIdentifier(ctx, p.Identifier)
-		if err != nil {
-			return nil, err
-		}
+		i, _, err = s.findIdentityForIdentifier(ctx, p.Identifier, f.RequestedAAL, sess)
+	}
+	if err != nil {
+		return nil, err
 	}
 
 	loginCode, err := s.deps.LoginCodePersister().UseLoginCode(ctx, f.ID, i.ID, p.Code)
@@ -331,22 +479,6 @@ func (s *Strategy) loginVerifyCode(ctx context.Context, r *http.Request, f *logi
 		return nil, errors.WithStack(err)
 	}
 
-	// the code is correct, if the login happened through a different credential, we need to update the identity
-	if isFallback {
-		if err := i.SetCredentialsWithConfig(
-			s.ID(),
-			// p.Identifier was normalized prior.
-			identity.Credentials{Type: s.ID(), Identifiers: []string{p.Identifier}},
-			&identity.CredentialsCode{UsedAt: sql.NullTime{}},
-		); err != nil {
-			return nil, errors.WithStack(err)
-		}
-
-		if err := s.deps.PrivilegedIdentityPool().UpdateIdentity(ctx, i); err != nil {
-			return nil, errors.WithStack(err)
-		}
-	}
-
 	// Step 2: The code was correct
 	f.Active = identity.CredentialsTypeCodeAuth
 
@@ -358,6 +490,14 @@ func (s *Strategy) loginVerifyCode(ctx context.Context, r *http.Request, f *logi
 		return nil, errors.WithStack(err)
 	}
 
+	// Step 3: Verify the address
+	if err := s.verifyAddress(ctx, i, Address{
+		To:  loginCode.Address,
+		Via: loginCode.AddressType,
+	}); err != nil {
+		return nil, err
+	}
+
 	for idx := range i.VerifiableAddresses {
 		va := i.VerifiableAddresses[idx]
 		if !va.Verified && loginCode.Address == va.Value {
@@ -372,3 +512,66 @@ func (s *Strategy) loginVerifyCode(ctx context.Context, r *http.Request, f *logi
 
 	return i, nil
 }
+
+func (s *Strategy) verifyAddress(ctx context.Context, i *identity.Identity, verified Address) error {
+	for idx := range i.VerifiableAddresses {
+		va := i.VerifiableAddresses[idx]
+		if va.Verified {
+			continue
+		}
+
+		if verified.To != va.Value || string(verified.Via) != va.Via {
+			continue
+		}
+
+		va.Verified = true
+		va.Status = identity.VerifiableAddressStatusCompleted
+		if err := s.deps.PrivilegedIdentityPool().UpdateVerifiableAddress(ctx, &va); errors.Is(err, sqlcon.ErrNoRows) {
+			// This happens when the verified address does not yet exist, for example during registration. In this case we just skip.
+			continue
+		} else if err != nil {
+			return err
+		}
+		break
+	}
+
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodFirstFactorRefresh(r *http.Request, f *login.Flow) error {
+	return s.PopulateMethod(r, f)
+}
+
+func (s *Strategy) PopulateLoginMethodFirstFactor(r *http.Request, f *login.Flow) error {
+	return s.PopulateMethod(r, f)
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactor(r *http.Request, f *login.Flow) error {
+	return s.PopulateMethod(r, f)
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactorRefresh(r *http.Request, f *login.Flow) error {
+	return s.PopulateMethod(r, f)
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstCredentials(r *http.Request, f *login.Flow, opts ...login.FormHydratorModifier) error {
+	if !s.deps.Config().SelfServiceCodeStrategy(r.Context()).PasswordlessEnabled {
+		// We only return this if passwordless is disabled, because if it is enabled we can always sign in using this method.
+		return errors.WithStack(idfirst.ErrNoCredentialsFound)
+	}
+	o := login.NewFormHydratorOptions(opts)
+
+	// If the identity hint is nil and account enumeration mitigation is disabled, we return an error.
+	if o.IdentityHint == nil && !s.deps.Config().SecurityAccountEnumerationMitigate(r.Context()) {
+		return errors.WithStack(idfirst.ErrNoCredentialsFound)
+	}
+
+	f.GetUI().Nodes.Append(
+		node.NewInputField("method", s.ID(), node.CodeGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoSelfServiceLoginCode()),
+	)
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstIdentification(r *http.Request, f *login.Flow) error {
+	return nil
+}
diff --git a/selfservice/strategy/code/strategy_login_test.go b/selfservice/strategy/code/strategy_login_test.go
index 19cac6d38375..95952f45d7de 100644
--- a/selfservice/strategy/code/strategy_login_test.go
+++ b/selfservice/strategy/code/strategy_login_test.go
@@ -10,7 +10,20 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
+	"time"
+
+	"github.com/ory/kratos/courier"
+
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+
+	configtesthelpers "github.com/ory/kratos/driver/config/testhelpers"
+
+	"github.com/ory/kratos/driver"
+	"github.com/ory/kratos/selfservice/flow/login"
+
+	"github.com/ory/kratos/selfservice/flow"
 
 	"github.com/ory/x/ioutilx"
 	"github.com/ory/x/snapshotx"
@@ -32,6 +45,42 @@ import (
 	"github.com/ory/x/sqlxx"
 )
 
+func createIdentity(ctx context.Context, t *testing.T, reg driver.Registry, withoutCodeCredential bool, moreIdentifiers ...string) *identity.Identity {
+	t.Helper()
+	i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
+	i.NID = x.NewUUID()
+	email := testhelpers.RandomEmail()
+
+	ids := fmt.Sprintf(`"email":"%s"`, email)
+	for i, identifier := range moreIdentifiers {
+		ids = fmt.Sprintf(`%s,"email_%d":"%s"`, ids, i+1, identifier)
+	}
+
+	i.Traits = identity.Traits(fmt.Sprintf(`{"tos": true, %s}`, ids))
+
+	credentials := map[identity.CredentialsType]identity.Credentials{
+		identity.CredentialsTypePassword: {Identifiers: append([]string{email}, moreIdentifiers...), Type: identity.CredentialsTypePassword, Config: sqlxx.JSONRawMessage("{\"some\" : \"secret\"}")},
+		identity.CredentialsTypeOIDC:     {Type: identity.CredentialsTypeOIDC, Identifiers: append([]string{email}, moreIdentifiers...), Config: sqlxx.JSONRawMessage("{\"some\" : \"secret\"}")},
+		identity.CredentialsTypeWebAuthn: {Type: identity.CredentialsTypeWebAuthn, Identifiers: append([]string{email}, moreIdentifiers...), Config: sqlxx.JSONRawMessage("{\"some\" : \"secret\", \"user_handle\": \"rVIFaWRcTTuQLkXFmQWpgA==\"}")},
+	}
+	if !withoutCodeCredential {
+		credentials[identity.CredentialsTypeCodeAuth] = identity.Credentials{Type: identity.CredentialsTypeCodeAuth, Identifiers: append([]string{email}, moreIdentifiers...), Config: sqlxx.JSONRawMessage(`{"addresses":[{"channel":"email","address":"` + email + `"}]}`)}
+	}
+	i.Credentials = credentials
+
+	var va []identity.VerifiableAddress
+	for _, identifier := range moreIdentifiers {
+		va = append(va, identity.VerifiableAddress{Value: identifier, Verified: false, Status: identity.VerifiableAddressStatusCompleted})
+	}
+
+	va = append(va, identity.VerifiableAddress{Value: email, Verified: true, Status: identity.VerifiableAddressStatusCompleted})
+
+	i.VerifiableAddresses = va
+
+	require.NoError(t, reg.IdentityManager().Create(ctx, i))
+	return i
+}
+
 func TestLoginCodeStrategy(t *testing.T) {
 	ctx := context.Background()
 	conf, reg := internal.NewFastRegistryWithMocks(t)
@@ -46,41 +95,6 @@ func TestLoginCodeStrategy(t *testing.T) {
 
 	public, _, _, _ := testhelpers.NewKratosServerWithCSRFAndRouters(t, reg)
 
-	createIdentity := func(ctx context.Context, t *testing.T, withoutCodeCredential bool, moreIdentifiers ...string) *identity.Identity {
-		t.Helper()
-		i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
-		email := testhelpers.RandomEmail()
-
-		ids := fmt.Sprintf(`"email":"%s"`, email)
-		for i, identifier := range moreIdentifiers {
-			ids = fmt.Sprintf(`%s,"email_%d":"%s"`, ids, i+1, identifier)
-		}
-
-		i.Traits = identity.Traits(fmt.Sprintf(`{"tos": true, %s}`, ids))
-
-		credentials := map[identity.CredentialsType]identity.Credentials{
-			identity.CredentialsTypePassword: {Identifiers: append([]string{email}, moreIdentifiers...), Type: identity.CredentialsTypePassword, Config: sqlxx.JSONRawMessage("{\"some\" : \"secret\"}")},
-			identity.CredentialsTypeOIDC:     {Type: identity.CredentialsTypeOIDC, Identifiers: append([]string{email}, moreIdentifiers...), Config: sqlxx.JSONRawMessage("{\"some\" : \"secret\"}")},
-			identity.CredentialsTypeWebAuthn: {Type: identity.CredentialsTypeWebAuthn, Identifiers: append([]string{email}, moreIdentifiers...), Config: sqlxx.JSONRawMessage("{\"some\" : \"secret\", \"user_handle\": \"rVIFaWRcTTuQLkXFmQWpgA==\"}")},
-		}
-		if !withoutCodeCredential {
-			credentials[identity.CredentialsTypeCodeAuth] = identity.Credentials{Type: identity.CredentialsTypeCodeAuth, Identifiers: append([]string{email}, moreIdentifiers...), Config: sqlxx.JSONRawMessage("{\"address_type\": \"email\", \"used_at\": \"2023-07-26T16:59:06+02:00\"}")}
-		}
-		i.Credentials = credentials
-
-		var va []identity.VerifiableAddress
-		for _, identifier := range moreIdentifiers {
-			va = append(va, identity.VerifiableAddress{Value: identifier, Verified: false, Status: identity.VerifiableAddressStatusCompleted})
-		}
-
-		va = append(va, identity.VerifiableAddress{Value: email, Verified: true, Status: identity.VerifiableAddressStatusCompleted})
-
-		i.VerifiableAddresses = va
-
-		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(ctx, i))
-		return i
-	}
-
 	type state struct {
 		flowID        string
 		identity      *identity.Identity
@@ -99,11 +113,9 @@ func TestLoginCodeStrategy(t *testing.T) {
 		ApiTypeNative  ApiType = "api"
 	)
 
-	createLoginFlow := func(ctx context.Context, t *testing.T, public *httptest.Server, apiType ApiType, withoutCodeCredential bool, moreIdentifiers ...string) *state {
+	createLoginFlowWithIdentity := func(ctx context.Context, t *testing.T, public *httptest.Server, apiType ApiType, user *identity.Identity) *state {
 		t.Helper()
 
-		identity := createIdentity(ctx, t, withoutCodeCredential, moreIdentifiers...)
-
 		var client *http.Client
 		if apiType == ApiTypeNative {
 			client = &http.Client{}
@@ -130,24 +142,29 @@ func TestLoginCodeStrategy(t *testing.T) {
 			require.NotEmptyf(t, csrfToken, "could not find csrf_token in: %s", body)
 		}
 
-		loginEmail := gjson.Get(identity.Traits.String(), "email").String()
-		require.NotEmptyf(t, loginEmail, "could not find the email trait inside the identity: %s", identity.Traits.String())
-
 		return &state{
-			flowID:        clientInit.GetId(),
-			identity:      identity,
-			identityEmail: loginEmail,
-			client:        client,
-			testServer:    public,
+			flowID:     clientInit.GetId(),
+			identity:   user,
+			client:     client,
+			testServer: public,
 		}
 	}
 
+	createLoginFlow := func(ctx context.Context, t *testing.T, public *httptest.Server, apiType ApiType, withoutCodeCredential bool, moreIdentifiers ...string) *state {
+		t.Helper()
+		s := createLoginFlowWithIdentity(ctx, t, public, apiType, createIdentity(ctx, t, reg, withoutCodeCredential, moreIdentifiers...))
+		loginEmail := gjson.Get(s.identity.Traits.String(), "email").String()
+		require.NotEmptyf(t, loginEmail, "could not find the email trait inside the identity: %s", s.identity.Traits.String())
+		s.identityEmail = loginEmail
+		return s
+	}
+
 	type onSubmitAssertion func(t *testing.T, s *state, body string, res *http.Response)
 
 	submitLogin := func(ctx context.Context, t *testing.T, s *state, apiType ApiType, vals func(v *url.Values), mustHaveSession bool, submitAssertion onSubmitAssertion) *state {
 		t.Helper()
 
-		lf, resp, err := testhelpers.NewSDKCustomClient(s.testServer, s.client).FrontendApi.GetLoginFlow(ctx).Id(s.flowID).Execute()
+		lf, resp, err := testhelpers.NewSDKCustomClient(s.testServer, s.client).FrontendAPI.GetLoginFlow(ctx).Id(s.flowID).Execute()
 		require.NoError(t, err)
 		require.EqualValues(t, http.StatusOK, resp.StatusCode)
 
@@ -177,8 +194,8 @@ func TestLoginCodeStrategy(t *testing.T) {
 
 			resp, err = s.client.Do(req)
 			require.NoError(t, err)
-			require.EqualValues(t, http.StatusOK, resp.StatusCode)
 			body = string(ioutilx.MustReadAll(resp.Body))
+			require.EqualValues(t, http.StatusOK, resp.StatusCode, "%s", body)
 		} else {
 			// SPAs need to be informed that the login has not yet completed using status 400.
 			// Browser clients will redirect back to the login URL.
@@ -219,8 +236,8 @@ func TestLoginCodeStrategy(t *testing.T) {
 					v.Set("identifier", stringsx.ToUpperInitial(s.identityEmail))
 				}, false, nil)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Login to your account")
-				assert.Contains(t, message.Body, "please login to your account by entering the following code")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+				assert.Contains(t, message.Body, "Login to your account with the following code")
 
 				loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 				assert.NotEmpty(t, loginCode)
@@ -231,7 +248,7 @@ func TestLoginCodeStrategy(t *testing.T) {
 				}, true, nil)
 			})
 
-			t.Run("case=should be able to log in with code", func(t *testing.T) {
+			t.Run("case=should be able to log in with code sent to email", func(t *testing.T) {
 				// create login flow
 				s := createLoginFlow(ctx, t, public, tc.apiType, false)
 
@@ -240,16 +257,164 @@ func TestLoginCodeStrategy(t *testing.T) {
 					v.Set("identifier", s.identityEmail)
 				}, false, nil)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Login to your account")
-				assert.Contains(t, message.Body, "please login to your account by entering the following code")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+				assert.Contains(t, message.Body, "Login to your account with the following code")
 
 				loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 				assert.NotEmpty(t, loginCode)
 
 				// 3. Submit OTP
-				submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+				state := submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+					v.Set("code", loginCode)
+				}, true, nil)
+				if tc.apiType == ApiTypeSPA {
+					assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(state.body, "continue_with.0.action").String(), "%s", state.body)
+					assert.Contains(t, gjson.Get(state.body, "continue_with.0.redirect_browser_to").String(), conf.SelfServiceBrowserDefaultReturnTo(ctx).String(), "%s", state.body)
+				} else {
+					assert.Empty(t, gjson.Get(state.body, "continue_with").Array(), "%s", state.body)
+				}
+			})
+
+			t.Run("case=should be able to log in legacy cases", func(t *testing.T) {
+				run := func(t *testing.T, s *state) {
+					// submit email
+					s = submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+						v.Set("identifier", s.identityEmail)
+					}, false, nil)
+
+					t.Logf("s.body: %s", s.body)
+
+					message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+					assert.Contains(t, message.Body, "Login to your account with the following code")
+
+					loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
+					assert.NotEmpty(t, loginCode)
+
+					// 3. Submit OTP
+					state := submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+						v.Set("code", loginCode)
+					}, true, nil)
+					if tc.apiType == ApiTypeSPA {
+						assert.Contains(t, gjson.Get(state.body, "continue_with.0.redirect_browser_to").String(), conf.SelfServiceBrowserDefaultReturnTo(ctx).String(), "%s", state.body)
+					} else {
+						assert.Empty(t, gjson.Get(state.body, "continue_with").Array(), "%s", state.body)
+					}
+				}
+
+				initDefault := func(t *testing.T, cf string) *state {
+					i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
+					i.NID = x.NewUUID()
+
+					// valid fake phone number for libphonenumber
+					email := testhelpers.RandomEmail()
+					i.Traits = identity.Traits(fmt.Sprintf(`{"tos": true, "email": "%s"}`, email))
+					i.Credentials = map[identity.CredentialsType]identity.Credentials{
+						identity.CredentialsTypeCodeAuth: {
+							Type:        identity.CredentialsTypeCodeAuth,
+							Identifiers: []string{email},
+							Version:     0,
+							Config:      sqlxx.JSONRawMessage(cf),
+						},
+					}
+					require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentities(ctx, i)) // We explicitly bypass identity validation to test the legacy code path
+					s := createLoginFlowWithIdentity(ctx, t, public, tc.apiType, i)
+					s.identityEmail = email
+					return s
+				}
+
+				t.Run("case=should be able to send address type with spaces", func(t *testing.T) {
+					run(t,
+						initDefault(t, `{"address_type": "email                               ", "used_at": {"Time": "0001-01-01T00:00:00Z", "Valid": false}}`),
+					)
+				})
+
+				t.Run("case=should be able to send to empty address type", func(t *testing.T) {
+					run(t,
+						initDefault(t, `{"address_type": "", "used_at": {"Time": "0001-01-01T00:00:00Z", "Valid": false}}`),
+					)
+				})
+
+				t.Run("case=should be able to send to empty credentials config", func(t *testing.T) {
+					run(t,
+						initDefault(t, `{}`),
+					)
+				})
+
+				t.Run("case=should be able to send to identity with no credentials at all when fallback is enabled", func(t *testing.T) {
+					conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, true)
+					t.Cleanup(func() {
+						conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, nil)
+					})
+
+					i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
+					i.NID = x.NewUUID()
+					email := testhelpers.RandomEmail()
+					i.Traits = identity.Traits(fmt.Sprintf(`{"tos": true, "email": "%s"}`, email))
+					i.Credentials = map[identity.CredentialsType]identity.Credentials{
+						// This makes it possible for our code to find the identity identifier here.
+						identity.CredentialsTypePassword: {Type: identity.CredentialsTypePassword, Identifiers: []string{email}, Config: sqlxx.JSONRawMessage(`{}`)},
+					}
+
+					require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentities(ctx, i)) // We explicitly bypass identity validation to test the legacy code path
+					s := createLoginFlowWithIdentity(ctx, t, public, tc.apiType, i)
+					s.identityEmail = email
+					run(t, s)
+				})
+
+				t.Run("case=should fail to send to identity with no credentials at all when fallback is disabled", func(t *testing.T) {
+					conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, false)
+					t.Cleanup(func() {
+						conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, nil)
+					})
+
+					i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
+					i.NID = x.NewUUID()
+					email := testhelpers.RandomEmail()
+					i.Traits = identity.Traits(fmt.Sprintf(`{"tos": true, "email": "%s"}`, email))
+					require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentities(ctx, i)) // We explicitly bypass identity validation to test the legacy code path
+					s := createLoginFlowWithIdentity(ctx, t, public, tc.apiType, i)
+					s.identityEmail = email
+					// submit email
+					s = submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+						v.Set("identifier", s.identityEmail)
+					}, false, nil)
+					assert.Contains(t, s.body, "4000035", "Should not find the account")
+				})
+			})
+
+			t.Run("case=should be able to log in with code to sms and normalize the number", func(t *testing.T) {
+				i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
+				i.NID = x.NewUUID()
+
+				// valid fake phone number for libphonenumber
+				phone := "+1 (415) 55526-71"
+				i.Traits = identity.Traits(fmt.Sprintf(`{"tos": true, "phone_1": "%s"}`, phone))
+				require.NoError(t, reg.IdentityManager().Create(ctx, i))
+				t.Cleanup(func() {
+					require.NoError(t, reg.PrivilegedIdentityPool().DeleteIdentity(ctx, i.ID))
+				})
+
+				s := createLoginFlowWithIdentity(ctx, t, public, tc.apiType, i)
+
+				// submit email
+				s = submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+					v.Set("identifier", phone)
+				}, false, nil)
+
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, x.GracefulNormalization(phone), "Your login code is:")
+				loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
+				assert.NotEmpty(t, loginCode)
+
+				// 3. Submit OTP
+				state := submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
 					v.Set("code", loginCode)
 				}, true, nil)
+				if tc.apiType == ApiTypeSPA {
+					assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(state.body, "continue_with.0.action").String(), "%s", state.body)
+					assert.Contains(t, gjson.Get(state.body, "continue_with.0.redirect_browser_to").String(), conf.SelfServiceBrowserDefaultReturnTo(ctx).String(), "%s", state.body)
+				} else {
+					assert.Empty(t, gjson.Get(state.body, "continue_with").Array(), "%s", state.body)
+				}
 			})
 
 			t.Run("case=new identities automatically have login with code", func(t *testing.T) {
@@ -285,8 +450,8 @@ func TestLoginCodeStrategy(t *testing.T) {
 					v.Set("identifier", s.identityEmail)
 				}, false, nil)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Login to your account")
-				assert.Contains(t, message.Body, "please login to your account by entering the following code")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+				assert.Contains(t, message.Body, "Login to your account with the following code")
 
 				loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 				assert.NotEmpty(t, loginCode)
@@ -313,8 +478,8 @@ func TestLoginCodeStrategy(t *testing.T) {
 					v.Set("identifier", s.identityEmail)
 				}, false, nil)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Login to your account")
-				assert.Contains(t, message.Body, "please login to your account by entering the following code")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+				assert.Contains(t, message.Body, "Login to your account with the following code")
 
 				loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 				assert.NotEmpty(t, loginCode)
@@ -340,8 +505,8 @@ func TestLoginCodeStrategy(t *testing.T) {
 					v.Set("identifier", s.identityEmail)
 				}, false, nil)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Login to your account")
-				assert.Contains(t, message.Body, "please login to your account by entering the following code")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+				assert.Contains(t, message.Body, "Login to your account with the following code")
 
 				loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 				assert.NotEmpty(t, loginCode)
@@ -354,7 +519,7 @@ func TestLoginCodeStrategy(t *testing.T) {
 					if tc.apiType == ApiTypeBrowser {
 						require.EqualValues(t, http.StatusOK, resp.StatusCode)
 						require.EqualValues(t, conf.SelfServiceFlowLoginUI(ctx).Path, resp.Request.URL.Path)
-						lf, resp, err := testhelpers.NewSDKCustomClient(public, s.client).FrontendApi.GetLoginFlow(ctx).Id(s.flowID).Execute()
+						lf, resp, err := testhelpers.NewSDKCustomClient(public, s.client).FrontendAPI.GetLoginFlow(ctx).Id(s.flowID).Execute()
 						require.NoError(t, err)
 						require.EqualValues(t, http.StatusOK, resp.StatusCode)
 						body, err := json.Marshal(lf)
@@ -378,7 +543,7 @@ func TestLoginCodeStrategy(t *testing.T) {
 						require.EqualValues(t, http.StatusOK, resp.StatusCode)
 						require.EqualValues(t, conf.SelfServiceFlowLoginUI(ctx).Path, resp.Request.URL.Path)
 
-						lf, resp, err := testhelpers.NewSDKCustomClient(public, s.client).FrontendApi.GetLoginFlow(ctx).Id(s.flowID).Execute()
+						lf, resp, err := testhelpers.NewSDKCustomClient(public, s.client).FrontendAPI.GetLoginFlow(ctx).Id(s.flowID).Execute()
 						require.NoError(t, err)
 						require.EqualValues(t, http.StatusOK, resp.StatusCode)
 						body, err := json.Marshal(lf)
@@ -399,8 +564,8 @@ func TestLoginCodeStrategy(t *testing.T) {
 					v.Set("identifier", s.identityEmail)
 				}, false, nil)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Login to your account")
-				assert.Contains(t, message.Body, "please login to your account by entering the following code")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+				assert.Contains(t, message.Body, "Login to your account with the following code")
 				loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 				assert.NotEmpty(t, loginCode)
 
@@ -451,8 +616,8 @@ func TestLoginCodeStrategy(t *testing.T) {
 					v.Set("identifier", s.identityEmail)
 				}, false, nil)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Login to your account")
-				assert.Contains(t, message.Body, "please login to your account by entering the following code")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+				assert.Contains(t, message.Body, "Login to your account with the following code")
 				loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 				assert.NotEmpty(t, loginCode)
 
@@ -464,7 +629,7 @@ func TestLoginCodeStrategy(t *testing.T) {
 						// with browser clients we redirect back to the UI with a new flow id as a query parameter
 						require.Equal(t, http.StatusOK, resp.StatusCode)
 						require.Equal(t, conf.SelfServiceFlowLoginUI(ctx).Path, resp.Request.URL.Path)
-						lf, _, err := testhelpers.NewSDKCustomClient(public, s.client).FrontendApi.GetLoginFlow(ctx).Id(resp.Request.URL.Query().Get("flow")).Execute()
+						lf, _, err := testhelpers.NewSDKCustomClient(public, s.client).FrontendAPI.GetLoginFlow(ctx).Id(resp.Request.URL.Query().Get("flow")).Execute()
 						require.NoError(t, err)
 						require.EqualValues(t, http.StatusOK, resp.StatusCode)
 
@@ -487,8 +652,8 @@ func TestLoginCodeStrategy(t *testing.T) {
 					v.Set("identifier", s.identityEmail)
 				}, false, nil)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Login to your account")
-				assert.Contains(t, message.Body, "please login to your account by entering the following code")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+				assert.Contains(t, message.Body, "Login to your account with the following code")
 				loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 				assert.NotEmpty(t, loginCode)
 
@@ -498,8 +663,8 @@ func TestLoginCodeStrategy(t *testing.T) {
 					v.Set("identifier", s.identityEmail)
 				}, false, nil)
 
-				message = testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Login to your account")
-				assert.Contains(t, message.Body, "please login to your account by entering the following code")
+				message = testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+				assert.Contains(t, message.Body, "Login to your account with the following code")
 				loginCode2 := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 				assert.NotEmpty(t, loginCode2)
 
@@ -548,8 +713,8 @@ func TestLoginCodeStrategy(t *testing.T) {
 					v.Set("identifier", s.identityEmail)
 				}, false, nil)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, loginEmail, "Login to your account")
-				require.Contains(t, message.Body, "please login to your account by entering the following code")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, loginEmail, "Use code")
+				require.Contains(t, message.Body, "Login to your account with the following code")
 
 				loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 				require.NotEmpty(t, loginCode)
@@ -586,55 +751,284 @@ func TestLoginCodeStrategy(t *testing.T) {
 				})
 
 				t.Run("case=should be able to get AAL2 session", func(t *testing.T) {
-					t.Cleanup(testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/default.schema.json")) // doesn't have the code credential
-					identity := createIdentity(ctx, t, true)
+					run := func(t *testing.T, withoutCodeCredential bool, overrideCodeCredential *identity.Credentials, overrideAllCredentials map[identity.CredentialsType]identity.Credentials) (*state, *http.Client) {
+						user := createIdentity(ctx, t, reg, withoutCodeCredential)
+						if overrideCodeCredential != nil {
+							toUpdate := user.Credentials[identity.CredentialsTypeCodeAuth]
+							if overrideCodeCredential.Config != nil {
+								toUpdate.Config = overrideCodeCredential.Config
+							}
+							if overrideCodeCredential.Identifiers != nil {
+								toUpdate.Identifiers = overrideCodeCredential.Identifiers
+							}
+							user.Credentials[identity.CredentialsTypeCodeAuth] = toUpdate
+						}
+						if overrideAllCredentials != nil {
+							user.Credentials = overrideAllCredentials
+						}
+						require.NoError(t, reg.PrivilegedIdentityPool().UpdateIdentity(ctx, user))
+
+						var cl *http.Client
+						var f *oryClient.LoginFlow
+						if tc.apiType == ApiTypeNative {
+							cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, user)
+							f = testhelpers.InitializeLoginFlowViaAPI(t, cl, public, false, testhelpers.InitFlowWithAAL("aal2"), testhelpers.InitFlowWithVia("email"))
+						} else {
+							cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, ctx, reg, user)
+							f = testhelpers.InitializeLoginFlowViaBrowser(t, cl, public, false, tc.apiType == ApiTypeSPA, false, false, testhelpers.InitFlowWithAAL("aal2"), testhelpers.InitFlowWithVia("email"))
+						}
+
+						body, err := json.Marshal(f)
+						require.NoError(t, err)
+						require.Len(t, gjson.GetBytes(body, "ui.nodes.#(group==code)").Array(), 1, "%s", body)
+						require.Len(t, gjson.GetBytes(body, "ui.messages").Array(), 1, "%s", body)
+						require.EqualValues(t, gjson.GetBytes(body, "ui.messages.0.id").Int(), text.InfoSelfServiceLoginMFA, "%s", body)
+
+						s := &state{
+							flowID:        f.GetId(),
+							identity:      user,
+							client:        cl,
+							testServer:    public,
+							identityEmail: gjson.Get(user.Traits.String(), "email").String(),
+						}
+						s = submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+							v.Set("identifier", s.identityEmail)
+						}, false, nil)
+
+						message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Use code")
+						assert.Contains(t, message.Body, "Login to your account with the following code")
+						loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
+						assert.NotEmpty(t, loginCode)
+
+						return submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+							v.Set("code", loginCode)
+						}, true, nil), cl
+					}
+
+					t.Run("case=correct code credential without fallback works", func(t *testing.T) {
+						testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/code.identity.schema.json") // has code identifier
+						conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, false)   // fallback enabled
+
+						_, cl := run(t, true, nil, nil)
+						testhelpers.EnsureAAL(t, cl, public, "aal2", "code")
+					})
+
+					t.Run("case=disabling mfa does not lock out the users", func(t *testing.T) {
+						testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/code.identity.schema.json") // has code identifier
+
+						s, cl := run(t, true, nil, nil)
+						testhelpers.EnsureAAL(t, cl, public, "aal2", "code")
+
+						email := gjson.GetBytes(s.identity.Traits, "email").String()
+						s.identityEmail = email
+
+						// We change now disable code mfa and enable passwordless instead.
+						conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+".code.mfa_enabled", false)
+						conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+".code.passwordless_enabled", true)
+
+						t.Cleanup(func() {
+							conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+".code.passwordless_enabled", false)
+							conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+".code.mfa_enabled", true)
+						})
+
+						s = createLoginFlowWithIdentity(ctx, t, public, tc.apiType, s.identity)
+						s = submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+							v.Set("identifier", email)
+							v.Set("method", "code")
+						}, false, nil)
+
+						message := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Use code")
+						assert.Contains(t, message.Body, "Login to your account with the following code")
+						loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
+						assert.NotEmpty(t, loginCode)
+
+						loginResult := submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+							v.Set("code", loginCode)
+						}, true, nil)
+
+						if tc.apiType == ApiTypeNative {
+							assert.EqualValues(t, "aal1", gjson.Get(loginResult.body, "session.authenticator_assurance_level").String())
+							assert.EqualValues(t, "code", gjson.Get(loginResult.body, "session.authentication_methods.#(method==code).method").String())
+						} else {
+							// The user should be able to sign in correctly even though, probably, the internal state was aal2 for available AAL.
+							res, err := s.client.Get(public.URL + session.RouteWhoami)
+							require.NoError(t, err)
+							assert.EqualValues(t, http.StatusOK, res.StatusCode, loginResult.body)
+							sess := x.MustReadAll(res.Body)
+							require.NoError(t, res.Body.Close())
+
+							assert.EqualValues(t, "aal1", gjson.GetBytes(sess, "authenticator_assurance_level").String())
+							assert.EqualValues(t, "code", gjson.GetBytes(sess, "authentication_methods.#(method==code).method").String())
+						}
+					})
+
+					t.Run("case=missing code credential with fallback works when identity schema has the code identifier set", func(t *testing.T) {
+						testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/code.identity.schema.json") // has code identifier
+						conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, true)    // fallback enabled
+						t.Cleanup(func() {
+							conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, false)
+						})
+
+						_, cl := run(t, false, nil, nil)
+						testhelpers.EnsureAAL(t, cl, public, "aal2", "code")
+					})
+
+					t.Run("case=missing code credential with fallback works even when identity schema has no code identifier set", func(t *testing.T) {
+						testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/no-code.schema.json")    // missing the code identifier
+						conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, true) // fallback enabled
+						t.Cleanup(func() {
+							testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/code.identity.schema.json")
+							conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, false)
+						})
+
+						_, cl := run(t, false, nil, nil)
+						testhelpers.EnsureAAL(t, cl, public, "aal2", "code")
+					})
+
+					t.Run("case=missing code credential with fallback works even when identity schema has no code identifier set", func(t *testing.T) {
+						testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/no-code-id.schema.json") // missing the code identifier
+						conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, true) // fallback enabled
+						t.Cleanup(func() {
+							testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/code.identity.schema.json")
+							conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, false)
+						})
+
+						_, cl := run(t, true, &identity.Credentials{}, map[identity.CredentialsType]identity.Credentials{})
+						testhelpers.EnsureAAL(t, cl, public, "aal2", "code")
+					})
+
+					t.Run("case=legacy code credential with fallback works when identity schema has the code identifier not set", func(t *testing.T) {
+						testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/no-code.schema.json")    // has code identifier
+						conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, true) // fallback enabled
+						t.Cleanup(func() {
+							testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/code.identity.schema.json") // has code identifier
+							conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, false)
+						})
+
+						_, cl := run(t, false, &identity.Credentials{Config: []byte(`{"via":""}`)}, nil)
+						testhelpers.EnsureAAL(t, cl, public, "aal2", "code")
+					})
+
+					t.Run("case=legacy code credential with fallback works when identity schema has the code identifier not set", func(t *testing.T) {
+						testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/no-code.schema.json")    // has code identifier
+						conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, true) // fallback enabled
+						t.Cleanup(func() {
+							testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/code.identity.schema.json") // has code identifier
+							conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, false)
+						})
+
+						for k, credentialsConfig := range []string{
+							`{"address_type": "email                               ", "used_at": {"Time": "0001-01-01T00:00:00Z", "Valid": false}}`,
+							`{"address_type": "email", "used_at": {"Time": "0001-01-01T00:00:00Z", "Valid": false}}`,
+							`{"address_type": "", "used_at": {"Time": "0001-01-01T00:00:00Z", "Valid": false}}`,
+							`{"address_type": ""}`,
+							`{"address_type": "phone"}`,
+							`{}`,
+						} {
+							t.Run(fmt.Sprintf("config=%d", k), func(t *testing.T) {
+								_, cl := run(t, false, &identity.Credentials{Config: []byte(credentialsConfig)}, nil)
+								testhelpers.EnsureAAL(t, cl, public, "aal2", "code")
+							})
+						}
+					})
+				})
+
+				t.Run("case=without via parameter all options are shown", func(t *testing.T) {
+					testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/code-mfa.identity.schema.json")
+					conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, false)
+					t.Cleanup(func() {
+						testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/code.identity.schema.json")
+					})
+
 					var cl *http.Client
 					var f *oryClient.LoginFlow
+
+					user := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
+					user.NID = x.NewUUID()
+					email1 := "code-mfa-1" + string(tc.apiType) + "@ory.sh"
+					email2 := "code-mfa-2" + string(tc.apiType) + "@ory.sh"
+					phone1 := 4917613213110
 					if tc.apiType == ApiTypeNative {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, identity)
-						f = testhelpers.InitializeLoginFlowViaAPI(t, cl, public, false, testhelpers.InitFlowWithAAL("aal2"), testhelpers.InitFlowWithVia("email"))
-					} else {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, reg, identity)
-						f = testhelpers.InitializeLoginFlowViaBrowser(t, cl, public, false, tc.apiType == ApiTypeSPA, false, false, testhelpers.InitFlowWithAAL("aal2"), testhelpers.InitFlowWithVia("email"))
+						phone1 += 1
+					} else if tc.apiType == ApiTypeSPA {
+						phone1 += 2
 					}
+					user.Traits = identity.Traits(fmt.Sprintf(`{"email1":"%s","email2":"%s","phone1":"+%d"}`, email1, email2, phone1))
+					require.NoError(t, reg.IdentityManager().Create(ctx, user))
 
-					body, err := json.Marshal(f)
-					require.NoError(t, err)
-					require.Len(t, gjson.GetBytes(body, "ui.nodes.#(group==code)").Array(), 1)
-					require.Len(t, gjson.GetBytes(body, "ui.messages").Array(), 1, "%s", body)
-					require.EqualValues(t, gjson.GetBytes(body, "ui.messages.0.id").Int(), text.InfoSelfServiceLoginMFA, "%s", body)
+					run := func(t *testing.T, identifierField string, identifier string) {
+						if tc.apiType == ApiTypeNative {
+							cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, user)
+							f = testhelpers.InitializeLoginFlowViaAPI(t, cl, public, false, testhelpers.InitFlowWithAAL("aal2"))
+						} else {
+							cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, ctx, reg, user)
+							f = testhelpers.InitializeLoginFlowViaBrowser(t, cl, public, false, tc.apiType == ApiTypeSPA, false, false, testhelpers.InitFlowWithAAL("aal2"))
+						}
 
-					s := &state{
-						flowID:        f.GetId(),
-						identity:      identity,
-						client:        cl,
-						testServer:    public,
-						identityEmail: gjson.Get(identity.Traits.String(), "email").String(),
+						body, err := json.Marshal(f)
+						require.NoError(t, err)
+
+						snapshotx.SnapshotT(t, json.RawMessage(gjson.GetBytes(body, "ui.nodes.#(group==code)#").Raw))
+						require.Len(t, gjson.GetBytes(body, "ui.messages").Array(), 1, "%s", body)
+						require.EqualValues(t, gjson.GetBytes(body, "ui.messages.0.id").Int(), text.InfoSelfServiceLoginMFA, "%s", body)
+
+						s := &state{
+							flowID:        f.GetId(),
+							identity:      user,
+							client:        cl,
+							testServer:    public,
+							identityEmail: gjson.Get(user.Traits.String(), "email").String(),
+						}
+
+						s = submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+							v.Del("method")
+							v.Set(identifierField, identifier)
+						}, false, nil)
+
+						var message *courier.Message
+						if !strings.HasPrefix(identifier, "+") {
+							// email
+							message = testhelpers.CourierExpectMessage(ctx, t, reg, x.GracefulNormalization(identifier), "Use code")
+							assert.Contains(t, message.Body, "Login to your account with the following code")
+						} else {
+							// SMS
+							message = testhelpers.CourierExpectMessage(ctx, t, reg, x.GracefulNormalization(identifier), "Your login code is:")
+						}
+						loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
+						assert.NotEmpty(t, loginCode)
+
+						t.Logf("loginCode: %s", loginCode)
+
+						s = submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
+							v.Set("code", loginCode)
+							v.Set(identifierField, identifier)
+						}, true, nil)
+
+						testhelpers.EnsureAAL(t, cl, public, "aal2", "code")
 					}
-					s = submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
-						v.Set("identifier", s.identityEmail)
-					}, true, nil)
 
-					message := testhelpers.CourierExpectMessage(ctx, t, reg, s.identityEmail, "Login to your account")
-					assert.Contains(t, message.Body, "please login to your account by entering the following code")
-					loginCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
-					assert.NotEmpty(t, loginCode)
+					t.Run("field=identifier-email", func(t *testing.T) {
+						run(t, "identifier", email1)
+					})
 
-					s = submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
-						v.Set("code", loginCode)
-					}, true, nil)
+					t.Run("field=address-email", func(t *testing.T) {
+						run(t, "address", email2)
+					})
 
-					testhelpers.EnsureAAL(t, cl, public, "aal2", "code")
+					t.Run("field=address-phone", func(t *testing.T) {
+						run(t, "address", fmt.Sprintf("+%d", phone1))
+					})
 				})
+
 				t.Run("case=cannot use different identifier", func(t *testing.T) {
-					identity := createIdentity(ctx, t, false)
+					identity := createIdentity(ctx, t, reg, false)
 					var cl *http.Client
 					var f *oryClient.LoginFlow
 					if tc.apiType == ApiTypeNative {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, identity)
+						cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, identity)
 						f = testhelpers.InitializeLoginFlowViaAPI(t, cl, public, false, testhelpers.InitFlowWithAAL("aal2"), testhelpers.InitFlowWithVia("email"))
 					} else {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, reg, identity)
+						cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, ctx, reg, identity)
 						f = testhelpers.InitializeLoginFlowViaBrowser(t, cl, public, false, tc.apiType == ApiTypeSPA, false, false, testhelpers.InitFlowWithAAL("aal2"), testhelpers.InitFlowWithVia("email"))
 					}
 
@@ -654,21 +1048,21 @@ func TestLoginCodeStrategy(t *testing.T) {
 					email := testhelpers.RandomEmail()
 					s = submitLogin(ctx, t, s, tc.apiType, func(v *url.Values) {
 						v.Set("identifier", email)
-					}, true, nil)
+					}, false, nil)
 
-					require.Equal(t, "The address you entered does not match any known addresses in the current account.", gjson.Get(s.body, "ui.messages.0.text").String(), "%s", body)
+					require.Equal(t, "This account does not exist or has not setup sign in with code.", gjson.Get(s.body, "ui.messages.0.text").String(), "%s", body)
 				})
 
 				t.Run("case=verify initial payload", func(t *testing.T) {
 					fixedEmail := fmt.Sprintf("fixed_mfa_test_%s@ory.sh", tc.apiType)
-					identity := createIdentity(ctx, t, false, fixedEmail)
+					identity := createIdentity(ctx, t, reg, false, fixedEmail)
 					var cl *http.Client
 					var f *oryClient.LoginFlow
 					if tc.apiType == ApiTypeNative {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, identity)
+						cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, identity)
 						f = testhelpers.InitializeLoginFlowViaAPI(t, cl, public, false, testhelpers.InitFlowWithAAL("aal2"), testhelpers.InitFlowWithVia("email_1"))
 					} else {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, reg, identity)
+						cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, ctx, reg, identity)
 						f = testhelpers.InitializeLoginFlowViaBrowser(t, cl, public, false, tc.apiType == ApiTypeSPA, false, false, testhelpers.InitFlowWithAAL("aal2"), testhelpers.InitFlowWithVia("email_1"))
 					}
 
@@ -678,15 +1072,15 @@ func TestLoginCodeStrategy(t *testing.T) {
 				})
 
 				t.Run("case=using a non existing identity trait results in an error", func(t *testing.T) {
-					identity := createIdentity(ctx, t, false)
+					identity := createIdentity(ctx, t, reg, false)
 					var cl *http.Client
 					var res *http.Response
 					var err error
 					if tc.apiType == ApiTypeNative {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, identity)
+						cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, identity)
 						res, err = cl.Get(public.URL + "/self-service/login/api?aal=aal2&via=doesnt_exist")
 					} else {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, reg, identity)
+						cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, ctx, reg, identity)
 						res, err = cl.Get(public.URL + "/self-service/login/browser?aal=aal2&via=doesnt_exist")
 					}
 					require.NoError(t, err)
@@ -695,39 +1089,19 @@ func TestLoginCodeStrategy(t *testing.T) {
 					if tc.apiType == ApiTypeNative {
 						body = []byte(gjson.GetBytes(body, "error").Raw)
 					}
-					require.Equal(t, "Trait does not exist in identity schema", gjson.GetBytes(body, "reason").String(), "%s", body)
+					require.Equal(t, "No value found for trait doesnt_exist in the current identity.", gjson.GetBytes(body, "reason").String(), "%s", body)
 				})
 
-				t.Run("case=missing via parameter results results in an error", func(t *testing.T) {
-					identity := createIdentity(ctx, t, false)
-					var cl *http.Client
-					var res *http.Response
-					var err error
-					if tc.apiType == ApiTypeNative {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, identity)
-						res, err = cl.Get(public.URL + "/self-service/login/api?aal=aal2")
-					} else {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, reg, identity)
-						res, err = cl.Get(public.URL + "/self-service/login/browser?aal=aal2")
-					}
-					require.NoError(t, err)
-
-					body := ioutilx.MustReadAll(res.Body)
-					if tc.apiType == ApiTypeNative {
-						body = []byte(gjson.GetBytes(body, "error").Raw)
-					}
-					require.Equal(t, "AAL2 login via code requires the `via` query parameter", gjson.GetBytes(body, "reason").String(), "%s", body)
-				})
 				t.Run("case=unset trait in identity should lead to an error", func(t *testing.T) {
-					identity := createIdentity(ctx, t, false)
+					identity := createIdentity(ctx, t, reg, false)
 					var cl *http.Client
 					var res *http.Response
 					var err error
 					if tc.apiType == ApiTypeNative {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, identity)
+						cl = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, identity)
 						res, err = cl.Get(public.URL + "/self-service/login/api?aal=aal2&via=email_1")
 					} else {
-						cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, reg, identity)
+						cl = testhelpers.NewHTTPClientWithIdentitySessionCookieLocalhost(t, ctx, reg, identity)
 						res, err = cl.Get(public.URL + "/self-service/login/browser?aal=aal2&via=email_1")
 					}
 					require.NoError(t, err)
@@ -736,9 +1110,264 @@ func TestLoginCodeStrategy(t *testing.T) {
 					if tc.apiType == ApiTypeNative {
 						body = []byte(gjson.GetBytes(body, "error").Raw)
 					}
-					require.Equal(t, "No value found for trait email_1 in the current identity", gjson.GetBytes(body, "reason").String(), "%s", body)
+					require.Equal(t, "No value found for trait email_1 in the current identity.", gjson.GetBytes(body, "reason").String(), "%s", body)
 				})
 			})
 		})
 	}
 }
+
+func TestFormHydration(t *testing.T) {
+	ctx := context.Background()
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeCodeAuth), map[string]interface{}{
+		"enabled":              true,
+		"passwordless_enabled": true,
+	})
+	ctx = testhelpers.WithDefaultIdentitySchema(ctx, "file://./stub/code.identity.schema.json")
+
+	s, err := reg.AllLoginStrategies().Strategy(identity.CredentialsTypeCodeAuth)
+	require.NoError(t, err)
+	fh, ok := s.(login.FormHydrator)
+	require.True(t, ok)
+
+	toSnapshot := func(t *testing.T, f *login.Flow) {
+		t.Helper()
+		// The CSRF token has a unique value that messes with the snapshot - ignore it.
+		f.UI.Nodes.ResetNodes("csrf_token")
+		snapshotx.SnapshotT(t, f.UI.Nodes)
+	}
+	newFlow := func(ctx context.Context, t *testing.T) (*http.Request, *login.Flow) {
+		r := httptest.NewRequest("GET", "/self-service/login/browser", nil)
+		r = r.WithContext(ctx)
+		t.Helper()
+		f, err := login.NewFlow(conf, time.Minute, "csrf_token", r, flow.TypeBrowser)
+		require.NoError(t, err)
+		return r, f
+	}
+
+	passwordlessEnabled := configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeCodeAuth), map[string]interface{}{
+		"enabled":              true,
+		"passwordless_enabled": true,
+		"mfa_enabled":          false,
+	})
+
+	mfaEnabled := configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeCodeAuth), map[string]interface{}{
+		"enabled":              true,
+		"passwordless_enabled": false,
+		"mfa_enabled":          true,
+	})
+
+	toMFARequest := func(t *testing.T, r *http.Request, f *login.Flow, traits string) {
+		f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+		r.URL = &url.URL{Path: "/", RawQuery: "via=email"}
+		// I only fear god.
+		r.Header = testhelpers.NewHTTPClientWithArbitrarySessionTokenAndTraits(t, ctx, reg, []byte(traits)).Transport.(*testhelpers.TransportWithHeader).GetHeader()
+	}
+
+	t.Run("method=PopulateLoginMethodFirstFactor", func(t *testing.T) {
+		t.Run("case=code is used for 2fa but request is 1fa", func(t *testing.T) {
+			r, f := newFlow(mfaEnabled, t)
+			f.RequestedAAL = identity.AuthenticatorAssuranceLevel1
+			require.NoError(t, fh.PopulateLoginMethodFirstFactor(r, f))
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=code is used for passwordless login and request is 1fa", func(t *testing.T) {
+			r, f := newFlow(passwordlessEnabled, t)
+			f.RequestedAAL = identity.AuthenticatorAssuranceLevel1
+			require.NoError(t, fh.PopulateLoginMethodFirstFactor(r, f))
+			toSnapshot(t, f)
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodFirstFactorRefresh", func(t *testing.T) {
+		t.Run("case=code is used for passwordless login and request is 1fa with refresh", func(t *testing.T) {
+			r, f := newFlow(passwordlessEnabled, t)
+			f.RequestedAAL = identity.AuthenticatorAssuranceLevel1
+			f.Refresh = true
+			require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=code is used for 2fa and request is 1fa with refresh", func(t *testing.T) {
+			r, f := newFlow(mfaEnabled, t)
+			f.RequestedAAL = identity.AuthenticatorAssuranceLevel1
+			f.Refresh = true
+			require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+			toSnapshot(t, f)
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodSecondFactor", func(t *testing.T) {
+		t.Run("using via", func(t *testing.T) {
+			test := func(t *testing.T, ctx context.Context, email string) {
+				r, f := newFlow(ctx, t)
+				toMFARequest(t, r, f, `{"email":"`+email+`"}`)
+
+				// We still use the legacy hydrator under the hood here and thus need to set this correctly.
+				f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+				r.URL = &url.URL{Path: "/", RawQuery: "via=email"}
+
+				require.NoError(t, fh.PopulateLoginMethodSecondFactor(r, f))
+				toSnapshot(t, f)
+			}
+
+			t.Run("case=code is used for 2fa", func(t *testing.T) {
+				test(t, mfaEnabled, "PopulateLoginMethodSecondFactor-code-mfa-via-2fa@ory.sh")
+			})
+
+			t.Run("case=code is used for passwordless login", func(t *testing.T) {
+				test(t, passwordlessEnabled, "PopulateLoginMethodSecondFactor-code-mfa-via-passwordless@ory.sh")
+			})
+		})
+
+		t.Run("without via", func(t *testing.T) {
+			test := func(t *testing.T, ctx context.Context, traits string) {
+				r, f := newFlow(ctx, t)
+				toMFARequest(t, r, f, traits)
+
+				// We still use the legacy hydrator under the hood here and thus need to set this correctly.
+				f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+				r.URL = &url.URL{Path: "/"}
+
+				require.NoError(t, fh.PopulateLoginMethodSecondFactor(r, f))
+				toSnapshot(t, f)
+			}
+
+			t.Run("case=code is used for 2fa", func(t *testing.T) {
+				ctx = testhelpers.WithDefaultIdentitySchema(mfaEnabled, "file://./stub/code-mfa.identity.schema.json")
+				test(t, ctx, `{"email1":"PopulateLoginMethodSecondFactor-no-via-2fa-0@ory.sh","email2":"PopulateLoginMethodSecondFactor-no-via-2fa-1@ory.sh","phone1":"+4917655138291"}`)
+			})
+
+			t.Run("case=code is used for passwordless login", func(t *testing.T) {
+				ctx = testhelpers.WithDefaultIdentitySchema(passwordlessEnabled, "file://./stub/code-mfa.identity.schema.json")
+				test(t, ctx, `{"email1":"PopulateLoginMethodSecondFactor-no-via-passwordless-0@ory.sh","email2":"PopulateLoginMethodSecondFactor-no-via-passwordless-1@ory.sh","phone1":"+4917655138292"}`)
+			})
+		})
+
+		t.Run("case=code is used for 2fa and request is 2fa", func(t *testing.T) {
+			r, f := newFlow(mfaEnabled, t)
+			toMFARequest(t, r, f, `{"email":"foo@ory.sh"}`)
+			require.NoError(t, fh.PopulateLoginMethodSecondFactor(r, f))
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=code is used for passwordless login and request is 2fa", func(t *testing.T) {
+			r, f := newFlow(passwordlessEnabled, t)
+			toMFARequest(t, r, f, `{"email":"foo@ory.sh"}`)
+			require.NoError(t, fh.PopulateLoginMethodSecondFactor(r, f))
+			toSnapshot(t, f)
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodSecondFactorRefresh", func(t *testing.T) {
+		t.Run("case=code is used for 2fa and request is 2fa with refresh", func(t *testing.T) {
+			r, f := newFlow(mfaEnabled, t)
+			toMFARequest(t, r, f, `{"email":"foo@ory.sh"}`)
+			f.Refresh = true
+			require.NoError(t, fh.PopulateLoginMethodSecondFactorRefresh(r, f))
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=code is used for passwordless login and request is 2fa with refresh", func(t *testing.T) {
+			r, f := newFlow(passwordlessEnabled, t)
+			toMFARequest(t, r, f, `{"email":"foo@ory.sh"}`)
+			f.Refresh = true
+			require.NoError(t, fh.PopulateLoginMethodSecondFactorRefresh(r, f))
+			toSnapshot(t, f)
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstCredentials", func(t *testing.T) {
+		t.Run("case=no options", func(t *testing.T) {
+			t.Run("case=code is used for 2fa", func(t *testing.T) {
+				r, f := newFlow(mfaEnabled, t)
+				require.NoError(t, fh.PopulateLoginMethodFirstFactor(r, f))
+				toSnapshot(t, f)
+			})
+
+			t.Run("case=code is used for passwordless login", func(t *testing.T) {
+				r, f := newFlow(passwordlessEnabled, t)
+				require.NoError(t, fh.PopulateLoginMethodFirstFactor(r, f))
+				toSnapshot(t, f)
+			})
+		})
+
+		t.Run("case=WithIdentityHint", func(t *testing.T) {
+			t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+				t.Run("case=code is used for 2fa", func(t *testing.T) {
+					r, f := newFlow(
+						configtesthelpers.WithConfigValue(mfaEnabled, config.ViperKeySecurityAccountEnumerationMitigate, true),
+						t,
+					)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+
+				t.Run("case=code is used for passwordless login", func(t *testing.T) {
+					r, f := newFlow(
+						configtesthelpers.WithConfigValue(passwordlessEnabled, config.ViperKeySecurityAccountEnumerationMitigate, true),
+						t,
+					)
+					require.NoError(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")))
+					toSnapshot(t, f)
+				})
+			})
+
+			t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+				t.Run("case=with no identity", func(t *testing.T) {
+					t.Run("case=code is used for 2fa", func(t *testing.T) {
+						r, f := newFlow(mfaEnabled, t)
+						require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+						toSnapshot(t, f)
+					})
+
+					t.Run("case=code is used for passwordless login", func(t *testing.T) {
+						r, f := newFlow(passwordlessEnabled, t)
+						require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+						toSnapshot(t, f)
+					})
+				})
+				t.Run("case=identity has code method", func(t *testing.T) {
+					identifier := x.NewUUID().String()
+					id := createIdentity(ctx, t, reg, false, identifier)
+
+					t.Run("case=code is used for 2fa", func(t *testing.T) {
+						r, f := newFlow(mfaEnabled, t)
+						require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+						toSnapshot(t, f)
+					})
+
+					t.Run("case=code is used for passwordless login", func(t *testing.T) {
+						r, f := newFlow(passwordlessEnabled, t)
+						require.NoError(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)))
+						toSnapshot(t, f)
+					})
+				})
+
+				t.Run("case=identity does not have a code method", func(t *testing.T) {
+					id := identity.NewIdentity("default")
+
+					t.Run("case=code is used for 2fa", func(t *testing.T) {
+						r, f := newFlow(mfaEnabled, t)
+						require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+						toSnapshot(t, f)
+					})
+
+					t.Run("case=code is used for passwordless login", func(t *testing.T) {
+						r, f := newFlow(passwordlessEnabled, t)
+						require.NoError(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)))
+						toSnapshot(t, f)
+					})
+				})
+			})
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstIdentification", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodIdentifierFirstIdentification(r, f))
+		toSnapshot(t, f)
+	})
+}
diff --git a/selfservice/strategy/code/strategy_mfa.go b/selfservice/strategy/code/strategy_mfa.go
new file mode 100644
index 000000000000..89fe79c393e8
--- /dev/null
+++ b/selfservice/strategy/code/strategy_mfa.go
@@ -0,0 +1,57 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package code
+
+import (
+	"encoding/json"
+
+	"github.com/pkg/errors"
+	"github.com/samber/lo"
+
+	"github.com/ory/herodot"
+	"github.com/ory/kratos/identity"
+)
+
+func FindAllIdentifiers(i *identity.Identity) (result []Address) {
+	for _, a := range i.VerifiableAddresses {
+		if len(a.Via) == 0 || len(a.Value) == 0 {
+			continue
+		}
+
+		result = append(result, Address{Via: identity.CodeChannel(a.Via), To: a.Value})
+	}
+	return result
+}
+
+func FindCodeAddressCandidates(i *identity.Identity, fallbackEnabled bool) (result []Address, found bool, _ error) {
+	// If no hint was given, we show all OTP addresses from the credentials.
+	creds, ok := i.GetCredentials(identity.CredentialsTypeCodeAuth)
+	if !ok {
+		if !fallbackEnabled {
+			// Without a fallback and with no credentials found, we can't really do a lot and exit early.
+			return nil, false, nil
+		}
+
+		return FindAllIdentifiers(i), true, nil
+	} else {
+		var conf identity.CredentialsCode
+		if len(creds.Config) > 0 {
+			if err := json.Unmarshal(creds.Config, &conf); err != nil {
+				return nil, false, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to unmarshal credentials config: %s", err))
+			}
+		}
+
+		if len(conf.Addresses) == 0 {
+			if !fallbackEnabled {
+				// Without a fallback and with no credentials found, we can't really do a lot and exit early.
+				return nil, false, nil
+			}
+
+			return FindAllIdentifiers(i), true, nil
+		}
+		return lo.Map(conf.Addresses, func(item identity.CredentialsCodeAddress, _ int) Address {
+			return Address{Via: item.Channel, To: item.Address}
+		}), true, nil
+	}
+}
diff --git a/selfservice/strategy/code/strategy_mfa_test.go b/selfservice/strategy/code/strategy_mfa_test.go
new file mode 100644
index 000000000000..5a97b881b179
--- /dev/null
+++ b/selfservice/strategy/code/strategy_mfa_test.go
@@ -0,0 +1,161 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package code
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/ory/kratos/identity"
+)
+
+func TestFindAllIdentifiers(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    *identity.Identity
+		expected []Address
+	}{
+		{
+			name: "valid verifiable addresses",
+			input: &identity.Identity{
+				VerifiableAddresses: []identity.VerifiableAddress{
+					{Via: "email", Value: "user@example.com"},
+					{Via: "sms", Value: "+1234567890"},
+				},
+			},
+			expected: []Address{
+				{Via: identity.CodeChannel("email"), To: "user@example.com"},
+				{Via: identity.CodeChannel("sms"), To: "+1234567890"},
+			},
+		},
+		{
+			name: "empty verifiable addresses",
+			input: &identity.Identity{
+				VerifiableAddresses: []identity.VerifiableAddress{},
+			},
+		},
+		{
+			name: "verifiable address with empty fields",
+			input: &identity.Identity{
+				VerifiableAddresses: []identity.VerifiableAddress{
+					{Via: "", Value: ""},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := FindAllIdentifiers(tt.input)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestFindCodeAddressCandidates(t *testing.T) {
+	tests := []struct {
+		name            string
+		input           *identity.Identity
+		fallbackEnabled bool
+		expected        []Address
+		found           bool
+		wantErr         bool
+	}{
+		{
+			name: "valid credentials with addresses",
+			input: &identity.Identity{
+				Credentials: map[identity.CredentialsType]identity.Credentials{
+					identity.CredentialsTypeCodeAuth: {
+						Config: []byte(`{"addresses":[{"channel":"email","address":"user@example.com"},{"channel":"sms","address":"+1234567890"}]}`),
+					},
+				},
+			},
+			fallbackEnabled: false,
+			expected: []Address{
+				{Via: identity.CodeChannel("email"), To: "user@example.com"},
+				{Via: identity.CodeChannel("sms"), To: "+1234567890"},
+			},
+			found:   true,
+			wantErr: false,
+		},
+		{
+			name: "no credentials, fallback enabled",
+			input: &identity.Identity{
+				VerifiableAddresses: []identity.VerifiableAddress{
+					{Via: "email", Value: "user@example.com"},
+					{Via: "sms", Value: "+1234567890"},
+				},
+			},
+			fallbackEnabled: true,
+			expected: []Address{
+				{Via: identity.CodeChannel("email"), To: "user@example.com"},
+				{Via: identity.CodeChannel("sms"), To: "+1234567890"},
+			},
+			found:   true,
+			wantErr: false,
+		},
+		{
+			name: "no credentials, fallback disabled",
+			input: &identity.Identity{
+				VerifiableAddresses: []identity.VerifiableAddress{
+					{Via: "email", Value: "user@example.com"},
+					{Via: "sms", Value: "+1234567890"},
+				},
+			},
+			fallbackEnabled: false,
+			expected:        nil,
+			found:           false,
+			wantErr:         false,
+		},
+		{
+			name: "invalid credentials config",
+			input: &identity.Identity{
+				Credentials: map[identity.CredentialsType]identity.Credentials{
+					identity.CredentialsTypeCodeAuth: {
+						Config: []byte(`invalid`),
+					},
+				},
+			},
+			fallbackEnabled: false,
+			expected:        nil,
+			found:           false,
+			wantErr:         true,
+		},
+		{
+			name: "invalid credentials config, fallback enabled, verifiable addresses exist",
+			input: &identity.Identity{
+				Credentials: map[identity.CredentialsType]identity.Credentials{
+					identity.CredentialsTypeCodeAuth: {
+						Config: []byte(`invalid`),
+					},
+				},
+				VerifiableAddresses: []identity.VerifiableAddress{
+					{Via: "email", Value: "user@example.com"},
+					{Via: "sms", Value: "+1234567890"},
+				},
+			},
+			fallbackEnabled: true,
+			expected: []Address{
+				{Via: identity.CodeChannel("email"), To: "user@example.com"},
+				{Via: identity.CodeChannel("sms"), To: "+1234567890"},
+			},
+			found:   true,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, found, err := FindCodeAddressCandidates(tt.input, tt.fallbackEnabled)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tt.expected, result)
+				assert.Equal(t, tt.found, found)
+			}
+		})
+	}
+}
diff --git a/selfservice/strategy/code/strategy_recovery.go b/selfservice/strategy/code/strategy_recovery.go
index 758e81d04fd9..178a1906fdde 100644
--- a/selfservice/strategy/code/strategy_recovery.go
+++ b/selfservice/strategy/code/strategy_recovery.go
@@ -9,6 +9,8 @@ import (
 	"net/url"
 	"time"
 
+	"github.com/ory/x/pointerx"
+
 	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
@@ -43,7 +45,7 @@ func (s *Strategy) PopulateRecoveryMethod(r *http.Request, f *recovery.Flow) err
 	f.UI.
 		GetNodes().
 		Append(node.NewInputField("method", s.RecoveryStrategyID(), node.CodeGroup, node.InputAttributeTypeSubmit).
-			WithMetaLabel(text.NewInfoNodeLabelSubmit()))
+			WithMetaLabel(text.NewInfoNodeLabelContinue()))
 
 	return nil
 }
@@ -91,7 +93,7 @@ type updateRecoveryFlowWithCodeMethod struct {
 	TransientPayload json.RawMessage `json:"transient_payload,omitempty" form:"transient_payload"`
 }
 
-func (s Strategy) isCodeFlow(f *recovery.Flow) bool {
+func (s *Strategy) isCodeFlow(f *recovery.Flow) bool {
 	value, err := f.Active.Value()
 	if err != nil {
 		return false
@@ -100,11 +102,12 @@ func (s Strategy) isCodeFlow(f *recovery.Flow) bool {
 }
 
 func (s *Strategy) Recover(w http.ResponseWriter, r *http.Request, f *recovery.Flow) (err error) {
-	ctx, span := s.deps.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.code.strategy.Recover")
+	ctx, span := s.deps.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.code.Strategy.Recover")
 	span.SetAttributes(attribute.String("selfservice_flows_recovery_use", s.deps.Config().SelfServiceFlowRecoveryUse(ctx)))
 	defer otelx.End(span, &err)
 
 	if !s.isCodeFlow(f) {
+		span.SetAttributes(attribute.String("not_responsible_reason", "not code flow"))
 		return errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 
@@ -190,9 +193,9 @@ func (s *Strategy) recoveryIssueSession(w http.ResponseWriter, r *http.Request,
 		return s.retryRecoveryFlow(w, r, f.Type, RetryWithError(err))
 	}
 
-	sess, err := session.NewActiveSession(r, id, s.deps.Config(), time.Now().UTC(),
-		identity.CredentialsTypeRecoveryCode, identity.AuthenticatorAssuranceLevel1)
-	if err != nil {
+	sess := session.NewInactiveSession()
+	sess.CompletedLoginFor(identity.CredentialsTypeRecoveryCode, identity.AuthenticatorAssuranceLevel1)
+	if err := s.deps.SessionManager().ActivateSession(r, sess, id, time.Now().UTC()); err != nil {
 		return s.retryRecoveryFlow(w, r, f.Type, RetryWithError(err))
 	}
 
@@ -212,7 +215,7 @@ func (s *Strategy) recoveryIssueSession(w http.ResponseWriter, r *http.Request,
 		f.ContinueWith = append(f.ContinueWith, flow.NewContinueWithSetToken(sess.Token))
 	}
 
-	sf, err := s.deps.SettingsHandler().NewFlow(w, r, sess.Identity, f.Type)
+	sf, err := s.deps.SettingsHandler().NewFlow(ctx, w, r, sess.Identity, f.Type)
 	if err != nil {
 		return s.retryRecoveryFlow(w, r, f.Type, RetryWithError(err))
 	}
@@ -235,12 +238,13 @@ func (s *Strategy) recoveryIssueSession(w http.ResponseWriter, r *http.Request,
 	}
 
 	if s.deps.Config().UseContinueWithTransitions(ctx) {
+		redirectTo := sf.AppendTo(s.deps.Config().SelfServiceFlowSettingsUI(r.Context())).String()
 		switch {
 		case f.Type.IsAPI(), x.IsJSONRequest(r):
-			f.ContinueWith = append(f.ContinueWith, flow.NewContinueWithSettingsUI(sf))
+			f.ContinueWith = append(f.ContinueWith, flow.NewContinueWithSettingsUI(sf, redirectTo))
 			s.deps.Writer().Write(w, r, f)
 		default:
-			http.Redirect(w, r, sf.AppendTo(s.deps.Config().SelfServiceFlowSettingsUI(r.Context())).String(), http.StatusSeeOther)
+			http.Redirect(w, r, redirectTo, http.StatusSeeOther)
 		}
 	} else {
 		if x.IsJSONRequest(r) {
@@ -273,7 +277,8 @@ func (s *Strategy) recoveryUseCode(w http.ResponseWriter, r *http.Request, body
 		return s.retryRecoveryFlow(w, r, f.Type, RetryWithError(err))
 	}
 
-	recovered, err := s.deps.IdentityPool().GetIdentity(ctx, code.IdentityID, identity.ExpandDefault)
+	// Important to expand everything here, as we need the data for recovery.
+	recovered, err := s.deps.IdentityPool().GetIdentity(ctx, code.IdentityID, identity.ExpandEverything)
 	if err != nil {
 		return s.HandleRecoveryError(w, r, f, nil, err)
 	}
@@ -405,6 +410,7 @@ func (s *Strategy) recoveryHandleFormSubmission(w http.ResponseWriter, r *http.R
 	f.UI.Nodes.Append(node.NewInputField("code", nil, node.CodeGroup, node.InputAttributeTypeText, node.WithInputAttributes(func(a *node.InputAttributes) {
 		a.Required = true
 		a.Pattern = "[0-9]+"
+		a.MaxLength = CodeLength
 	})).
 		WithMetaLabel(text.NewInfoNodeLabelRecoveryCode()),
 	)
@@ -413,7 +419,7 @@ func (s *Strategy) recoveryHandleFormSubmission(w http.ResponseWriter, r *http.R
 	f.UI.
 		GetNodes().
 		Append(node.NewInputField("method", s.RecoveryStrategyID(), node.CodeGroup, node.InputAttributeTypeSubmit).
-			WithMetaLabel(text.NewInfoNodeLabelSubmit()))
+			WithMetaLabel(text.NewInfoNodeLabelContinue()))
 
 	f.UI.Nodes.Append(node.NewInputField("email", body.Email, node.CodeGroup, node.InputAttributeTypeSubmit).
 		WithMetaLabel(text.NewInfoNodeResendOTP()),
@@ -426,22 +432,14 @@ func (s *Strategy) recoveryHandleFormSubmission(w http.ResponseWriter, r *http.R
 }
 
 func (s *Strategy) markRecoveryAddressVerified(w http.ResponseWriter, r *http.Request, f *recovery.Flow, id *identity.Identity, recoveryAddress *identity.RecoveryAddress) error {
-	var address *identity.VerifiableAddress
-	for idx := range id.VerifiableAddresses {
-		va := id.VerifiableAddresses[idx]
-		if va.Value == recoveryAddress.Value {
-			address = &va
-			break
-		}
-	}
-
-	if address != nil && !address.Verified { // can it be that the address is nil?
-		address.Verified = true
-		verifiedAt := sqlxx.NullTime(time.Now().UTC())
-		address.VerifiedAt = &verifiedAt
-		address.Status = identity.VerifiableAddressStatusCompleted
-		if err := s.deps.PrivilegedIdentityPool().UpdateVerifiableAddress(r.Context(), address); err != nil {
-			return s.HandleRecoveryError(w, r, f, nil, err)
+	for k, v := range id.VerifiableAddresses {
+		if v.Value == recoveryAddress.Value {
+			id.VerifiableAddresses[k].Verified = true
+			id.VerifiableAddresses[k].VerifiedAt = pointerx.Ptr(sqlxx.NullTime(time.Now().UTC()))
+			id.VerifiableAddresses[k].Status = identity.VerifiableAddressStatusCompleted
+			if err := s.deps.PrivilegedIdentityPool().UpdateVerifiableAddress(r.Context(), &id.VerifiableAddresses[k]); err != nil {
+				return s.HandleRecoveryError(w, r, f, nil, err)
+			}
 		}
 	}
 
diff --git a/selfservice/strategy/code/strategy_recovery_admin.go b/selfservice/strategy/code/strategy_recovery_admin.go
index 028bb811bcaa..b64eb7b66e02 100644
--- a/selfservice/strategy/code/strategy_recovery_admin.go
+++ b/selfservice/strategy/code/strategy_recovery_admin.go
@@ -4,13 +4,16 @@
 package code
 
 import (
+	"context"
 	"net/http"
 	"net/url"
 	"time"
 
+	"github.com/gobuffalo/pop/v6"
 	"github.com/gofrs/uuid"
 	"github.com/julienschmidt/httprouter"
 	"github.com/pkg/errors"
+	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/herodot"
 	"github.com/ory/kratos/identity"
@@ -20,6 +23,7 @@ import (
 	"github.com/ory/kratos/text"
 	"github.com/ory/kratos/ui/node"
 	"github.com/ory/kratos/x"
+	"github.com/ory/kratos/x/events"
 	"github.com/ory/x/decoderx"
 	"github.com/ory/x/sqlcon"
 	"github.com/ory/x/urlx"
@@ -178,18 +182,17 @@ func (s *Strategy) createRecoveryCodeForIdentity(w http.ResponseWriter, r *http.
 	recoveryFlow.DangerousSkipCSRFCheck = true
 	recoveryFlow.State = flow.StateEmailSent
 	recoveryFlow.UI.Nodes = node.Nodes{}
-	recoveryFlow.UI.Nodes.Append(node.NewInputField("code", nil, node.CodeGroup, node.InputAttributeTypeText, node.WithRequiredInputAttribute).
+	recoveryFlow.UI.Nodes.Append(node.NewInputField("code", nil, node.CodeGroup, node.InputAttributeTypeText, node.WithRequiredInputAttribute, node.WithInputAttributes(func(a *node.InputAttributes) {
+		a.Pattern = "[0-9]+"
+		a.MaxLength = CodeLength
+	})).
 		WithMetaLabel(text.NewInfoNodeLabelRecoveryCode()),
 	)
+	rawCode := GenerateCode()
 
 	recoveryFlow.UI.Nodes.
 		Append(node.NewInputField("method", s.RecoveryStrategyID(), node.CodeGroup, node.InputAttributeTypeSubmit).
-			WithMetaLabel(text.NewInfoNodeLabelSubmit()))
-
-	if err := s.deps.RecoveryFlowPersister().CreateRecoveryFlow(ctx, recoveryFlow); err != nil {
-		s.deps.Writer().WriteError(w, r, err)
-		return
-	}
+			WithMetaLabel(text.NewInfoNodeLabelContinue()))
 
 	id, err := s.deps.IdentityPool().GetIdentity(ctx, p.IdentityID, identity.ExpandDefault)
 	if notFoundErr := sqlcon.ErrNoRows; errors.As(err, &notFoundErr) {
@@ -200,19 +203,31 @@ func (s *Strategy) createRecoveryCodeForIdentity(w http.ResponseWriter, r *http.
 		return
 	}
 
-	rawCode := GenerateCode()
+	if err := s.deps.TransactionalPersisterProvider().Transaction(ctx, func(ctx context.Context, c *pop.Connection) error {
+		if err := s.deps.RecoveryFlowPersister().CreateRecoveryFlow(ctx, recoveryFlow); err != nil {
+			return err
+		}
+
+		if _, err := s.deps.RecoveryCodePersister().CreateRecoveryCode(ctx, &CreateRecoveryCodeParams{
+			RawCode:    rawCode,
+			CodeType:   RecoveryCodeTypeAdmin,
+			ExpiresIn:  expiresIn,
+			FlowID:     recoveryFlow.ID,
+			IdentityID: id.ID,
+		}); err != nil {
+			return err
+		}
 
-	if _, err := s.deps.RecoveryCodePersister().CreateRecoveryCode(ctx, &CreateRecoveryCodeParams{
-		RawCode:    rawCode,
-		CodeType:   RecoveryCodeTypeAdmin,
-		ExpiresIn:  expiresIn,
-		FlowID:     recoveryFlow.ID,
-		IdentityID: id.ID,
+		return nil
 	}); err != nil {
 		s.deps.Writer().WriteError(w, r, err)
 		return
 	}
 
+	trace.SpanFromContext(r.Context()).AddEvent(
+		events.NewRecoveryInitiatedByAdmin(ctx, recoveryFlow.ID, id.ID, flowType.String(), "code"),
+	)
+
 	s.deps.Audit().
 		WithField("identity_id", id.ID).
 		WithSensitiveField("recovery_code", rawCode).
diff --git a/selfservice/strategy/code/strategy_recovery_admin_test.go b/selfservice/strategy/code/strategy_recovery_admin_test.go
index 882831b06b14..9a940ff8e31b 100644
--- a/selfservice/strategy/code/strategy_recovery_admin_test.go
+++ b/selfservice/strategy/code/strategy_recovery_admin_test.go
@@ -50,7 +50,7 @@ func TestAdminStrategy(t *testing.T) {
 
 	type createCodeParams = kratos.CreateRecoveryCodeForIdentityBody
 	createCode := func(params createCodeParams) (*kratos.RecoveryCodeForIdentity, *http.Response, error) {
-		return adminSDK.IdentityApi.
+		return adminSDK.IdentityAPI.
 			CreateRecoveryCodeForIdentity(context.Background()).
 			CreateRecoveryCodeForIdentityBody(params).Execute()
 	}
diff --git a/selfservice/strategy/code/strategy_recovery_test.go b/selfservice/strategy/code/strategy_recovery_test.go
index 98f3d9c7f21c..245c8420a03b 100644
--- a/selfservice/strategy/code/strategy_recovery_test.go
+++ b/selfservice/strategy/code/strategy_recovery_test.go
@@ -12,9 +12,12 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"sync"
 	"testing"
 	"time"
 
+	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
+
 	"github.com/davecgh/go-spew/spew"
 	"github.com/gofrs/uuid"
 	"github.com/stretchr/testify/assert"
@@ -240,8 +243,8 @@ func TestRecovery(t *testing.T) {
 			assert.Len(t, gjson.Get(recoverySubmissionResponse, "ui.messages").Array(), 1, "%s", recoverySubmissionResponse)
 			assertx.EqualAsJSON(t, text.NewRecoveryEmailWithCodeSent(), json.RawMessage(gjson.Get(recoverySubmissionResponse, "ui.messages.0").Raw))
 
-			message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
-			assert.Contains(t, message.Body, "please recover access to your account by entering the following code")
+			message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
+			assert.Contains(t, message.Body, "Recover access to your account by entering")
 
 			recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 			assert.NotEmpty(t, recoveryCode)
@@ -251,6 +254,15 @@ func TestRecovery(t *testing.T) {
 		}
 
 		t.Run("type=browser", func(t *testing.T) {
+			var wg sync.WaitGroup
+			wg.Add(1)
+			testhelpers.NewRecoveryAfterHookWebHookTarget(ctx, t, conf, func(t *testing.T, msg []byte) {
+				defer wg.Done()
+				assert.EqualValues(t, "recoverme1@ory.sh", gjson.GetBytes(msg, "identity.verifiable_addresses.0.value").String(), string(msg))
+				assert.EqualValues(t, true, gjson.GetBytes(msg, "identity.verifiable_addresses.0.verified").Bool(), string(msg))
+				assert.EqualValues(t, "completed", gjson.GetBytes(msg, "identity.verifiable_addresses.0.status").String(), string(msg))
+			})
+
 			client := testhelpers.NewClientWithCookies(t)
 			email := "recoverme1@ory.sh"
 			createIdentityToRecover(t, reg, email)
@@ -268,6 +280,8 @@ func TestRecovery(t *testing.T) {
 			require.NoError(t, res.Body.Close())
 			assert.Equal(t, "code_recovery", gjson.Get(body, "authentication_methods.0.method").String(), "%s", body)
 			assert.Equal(t, "aal1", gjson.Get(body, "authenticator_assurance_level").String(), "%s", body)
+
+			wg.Wait()
 		})
 
 		t.Run("type=spa", func(t *testing.T) {
@@ -314,7 +328,7 @@ func TestRecovery(t *testing.T) {
 			formPayload.Set("transient_payload", templatePayload)
 
 			body, _ := testhelpers.RecoveryMakeRequest(t, false, f, client, formPayload.Encode())
-			message := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Recover access to your account")
+			message := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Use code")
 			assert.Equal(t, templatePayload, gjson.GetBytes(message.TemplateData, "transient_payload").String(),
 				"should pass transient payload to email template")
 
@@ -520,10 +534,10 @@ func TestRecovery(t *testing.T) {
 				}
 				req := httptest.NewRequest("GET", "/sessions/whoami", nil)
 
-				session, err := session.NewActiveSession(
-					req,
-					&identity.Identity{ID: x.NewUUID(), State: identity.StateActive},
-					testhelpers.NewSessionLifespanProvider(time.Hour),
+				req.WithContext(confighelpers.WithConfigValue(ctx, config.ViperKeySessionLifespan, time.Hour))
+				session, err := testhelpers.NewActiveSession(req,
+					reg,
+					&identity.Identity{ID: x.NewUUID(), State: identity.StateActive, NID: x.NewUUID()},
 					time.Now(),
 					identity.CredentialsTypePassword,
 					identity.AuthenticatorAssuranceLevel1,
@@ -532,7 +546,7 @@ func TestRecovery(t *testing.T) {
 				require.NoError(t, err)
 
 				// Add the authentication to the request
-				client.Transport = testhelpers.NewTransportWithLogger(testhelpers.NewAuthorizedTransport(t, reg, session), t).RoundTripper
+				client.Transport = testhelpers.NewTransportWithLogger(testhelpers.NewAuthorizedTransport(t, ctx, reg, session), t).RoundTripper
 
 				v := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 				v.Set("email", "some-email@example.org")
@@ -605,7 +619,7 @@ func TestRecovery(t *testing.T) {
 				addr, err := reg.IdentityPool().FindVerifiableAddressByValue(context.Background(), identity.VerifiableAddressTypeEmail, email)
 				assert.NoError(t, err)
 
-				emailText := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Recover access to your account")
+				emailText := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Use code")
 				recoveryCode := testhelpers.CourierExpectCodeInMessage(t, emailText, 1)
 
 				// Deactivate the identity
@@ -632,7 +646,7 @@ func TestRecovery(t *testing.T) {
 		id := createIdentityToRecover(t, reg, email)
 
 		req := httptest.NewRequest("GET", "/sessions/whoami", nil)
-		sess, err := session.NewActiveSession(req, id, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+		sess, err := testhelpers.NewActiveSession(req, reg, id, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 		require.NoError(t, err)
 		require.NoError(t, reg.SessionPersister().UpsertSession(context.Background(), sess))
 
@@ -644,7 +658,7 @@ func TestRecovery(t *testing.T) {
 		actual := expectSuccessfulRecovery(t, cl, RecoveryClientTypeBrowser, func(v url.Values) {
 			v.Set("email", email)
 		})
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Recover access to your account")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Use code")
 		recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 		cl.CheckRedirect = func(req *http.Request, via []*http.Request) error {
@@ -705,7 +719,7 @@ func TestRecovery(t *testing.T) {
 					v.Set("email", recoveryEmail)
 				}, http.StatusOK)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 				recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 				form := withCSRFToken(t, testCase.ClientType, actual, url.Values{
@@ -724,7 +738,7 @@ func TestRecovery(t *testing.T) {
 
 				rs, res, err := testhelpers.
 					NewSDKCustomClient(public, c).
-					FrontendApi.GetRecoveryFlow(context.Background()).
+					FrontendAPI.GetRecoveryFlow(context.Background()).
 					Id(flowId).
 					Execute()
 
@@ -816,8 +830,8 @@ func TestRecovery(t *testing.T) {
 
 		initialFlowId := gjson.Get(body, "id")
 
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
-		assert.Contains(t, message.Body, "please recover access to your account by entering the following code")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
+		assert.Contains(t, message.Body, "Recover access to your account by entering")
 
 		recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
@@ -871,7 +885,7 @@ func TestRecovery(t *testing.T) {
 		assert.True(t, gjson.Get(body, "ui.nodes.#(attributes.name==code)").Exists())
 		assert.Equal(t, recoveryEmail, gjson.Get(body, "ui.nodes.#(attributes.name==email).attributes.value").String())
 
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 		recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 		submitRecoveryCode(t, c, body, RecoveryClientTypeBrowser, recoveryCode, http.StatusOK)
@@ -890,14 +904,14 @@ func TestRecovery(t *testing.T) {
 		require.NotEmpty(t, action)
 		assert.Equal(t, recoveryEmail, gjson.Get(body, "ui.nodes.#(attributes.name==email).attributes.value").String())
 
-		message1 := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+		message1 := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 		recoveryCode1 := testhelpers.CourierExpectCodeInMessage(t, message1, 1)
 
 		body = resendRecoveryCode(t, c, body, RecoveryClientTypeBrowser, http.StatusOK)
 		assert.True(t, gjson.Get(body, "ui.nodes.#(attributes.name==code)").Exists())
 		assert.Equal(t, recoveryEmail, gjson.Get(body, "ui.nodes.#(attributes.name==email).attributes.value").String())
 
-		message2 := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+		message2 := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 		recoveryCode2 := testhelpers.CourierExpectCodeInMessage(t, message2, 1)
 
 		body = submitRecoveryCode(t, c, body, RecoveryClientTypeBrowser, recoveryCode1, http.StatusOK)
@@ -941,7 +955,7 @@ func TestRecovery(t *testing.T) {
 			v.Set("email", recoveryEmail)
 		})
 
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 		recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 		action := gjson.Get(body, "ui.action").String()
@@ -973,7 +987,7 @@ func TestRecovery(t *testing.T) {
 			v.Set("email", recoveryEmail)
 		})
 
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 		recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 		action := gjson.Get(body, "ui.action").String()
@@ -988,7 +1002,7 @@ func TestRecovery(t *testing.T) {
 		body = submitRecoveryCode(t, cl, body, RecoveryClientTypeBrowser, recoveryCode, http.StatusSeeOther)
 		assert.NotEqual(t, gjson.Get(body, "id"), initialFlowId)
 
-		require.Len(t, cl.Jar.Cookies(urlx.ParseOrPanic(public.URL)), 1)
+		require.Len(t, cl.Jar.Cookies(urlx.ParseOrPanic(public.URL)), 1) // No session
 		cookies := spew.Sdump(cl.Jar.Cookies(urlx.ParseOrPanic(public.URL)))
 		assert.NotContains(t, cookies, "ory_kratos_session")
 	})
@@ -1115,8 +1129,8 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 			assert.Len(t, gjson.Get(recoverySubmissionResponse, "ui.messages").Array(), 1, "%s", recoverySubmissionResponse)
 			assertx.EqualAsJSON(t, text.NewRecoveryEmailWithCodeSent(), json.RawMessage(gjson.Get(recoverySubmissionResponse, "ui.messages.0").Raw))
 
-			message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
-			assert.Contains(t, message.Body, "please recover access to your account by entering the following code")
+			message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
+			assert.Contains(t, message.Body, "Recover access to your account by entering")
 
 			recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 			assert.NotEmpty(t, recoveryCode)
@@ -1360,11 +1374,12 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 					f = testhelpers.InitializeRecoveryFlowViaBrowser(t, client, isSPA, public, nil)
 				}
 				req := httptest.NewRequest("GET", "/sessions/whoami", nil)
+				req.WithContext(confighelpers.WithConfigValue(ctx, config.ViperKeySessionLifespan, time.Hour))
 
-				session, err := session.NewActiveSession(
+				session, err := testhelpers.NewActiveSession(
 					req,
-					&identity.Identity{ID: x.NewUUID(), State: identity.StateActive},
-					testhelpers.NewSessionLifespanProvider(time.Hour),
+					reg,
+					&identity.Identity{ID: x.NewUUID(), State: identity.StateActive, NID: x.NewUUID()},
 					time.Now(),
 					identity.CredentialsTypePassword,
 					identity.AuthenticatorAssuranceLevel1,
@@ -1373,7 +1388,7 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 				require.NoError(t, err)
 
 				// Add the authentication to the request
-				client.Transport = testhelpers.NewTransportWithLogger(testhelpers.NewAuthorizedTransport(t, reg, session), t).RoundTripper
+				client.Transport = testhelpers.NewTransportWithLogger(testhelpers.NewAuthorizedTransport(t, ctx, reg, session), t).RoundTripper
 
 				v := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 				v.Set("email", "some-email@example.org")
@@ -1432,7 +1447,7 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 				addr, err := reg.IdentityPool().FindVerifiableAddressByValue(context.Background(), identity.VerifiableAddressTypeEmail, email)
 				assert.NoError(t, err)
 
-				emailText := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Recover access to your account")
+				emailText := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Use code")
 				recoveryCode := testhelpers.CourierExpectCodeInMessage(t, emailText, 1)
 
 				// Deactivate the identity
@@ -1463,7 +1478,7 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 				email := testhelpers.RandomEmail()
 				id := createIdentityToRecover(t, reg, email)
 
-				otherSession, err := session.NewActiveSession(httptest.NewRequest("GET", "/sessions/whoami", nil), id, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+				otherSession, err := testhelpers.NewActiveSession(httptest.NewRequest("GET", "/sessions/whoami", nil), reg, id, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 				require.NoError(t, err)
 				require.NoError(t, reg.SessionPersister().UpsertSession(ctx, otherSession))
 
@@ -1475,7 +1490,7 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 				actual := submitRecoveryForm(t, cl, testCase.ClientType, func(v url.Values) {
 					v.Set("email", email)
 				}, http.StatusOK)
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Recover access to your account")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, email, "Use code")
 				recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 				submitCodeAndExpectRedirectToSettings(t, cl, testCase.ClientType, recoveryCode, actual)
@@ -1552,7 +1567,7 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 					v.Set("email", recoveryEmail)
 				}, http.StatusOK)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 				recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 				form := withCSRFToken(t, testCase.ClientType, actual, url.Values{
@@ -1571,7 +1586,7 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 
 				rs, res, err := testhelpers.
 					NewSDKCustomClient(public, c).
-					FrontendApi.GetRecoveryFlow(context.Background()).
+					FrontendAPI.GetRecoveryFlow(context.Background()).
 					Id(flowId).
 					Execute()
 
@@ -1628,7 +1643,7 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 				v.Set("email", recoveryEmail)
 			}, http.StatusOK)
 
-			message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+			message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 			recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 			action := gjson.Get(actual, "ui.action").String()
@@ -1741,8 +1756,8 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 
 				initialFlowId := gjson.Get(body, "id")
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
-				assert.Contains(t, message.Body, "please recover access to your account by entering the following code")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
+				assert.Contains(t, message.Body, "Recover access to your account by entering")
 
 				recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
@@ -1809,7 +1824,7 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 				assert.True(t, gjson.Get(body, "ui.nodes.#(attributes.name==code)").Exists())
 				assert.Equal(t, recoveryEmail, gjson.Get(body, "ui.nodes.#(attributes.name==email).attributes.value").String())
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 				recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 				submitCodeAndExpectRedirectToSettings(t, c, testCase.ClientType, recoveryCode, body)
@@ -1832,14 +1847,14 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 				require.NotEmpty(t, action)
 				assert.Equal(t, recoveryEmail, gjson.Get(body, "ui.nodes.#(attributes.name==email).attributes.value").String())
 
-				message1 := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+				message1 := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 				recoveryCode1 := testhelpers.CourierExpectCodeInMessage(t, message1, 1)
 
 				body = resendRecoveryCode(t, c, body, testCase.ClientType, http.StatusOK)
 				assert.True(t, gjson.Get(body, "ui.nodes.#(attributes.name==code)").Exists())
 				assert.Equal(t, recoveryEmail, gjson.Get(body, "ui.nodes.#(attributes.name==email).attributes.value").String())
 
-				message2 := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+				message2 := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 				recoveryCode2 := testhelpers.CourierExpectCodeInMessage(t, message2, 1)
 
 				body = submitRecoveryCode(t, c, body, testCase.ClientType, recoveryCode1, http.StatusOK)
@@ -1889,7 +1904,7 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 					v.Set("email", recoveryEmail)
 				}, http.StatusOK)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 				recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 				action := gjson.Get(body, "ui.action").String()
@@ -1917,7 +1932,7 @@ func TestRecovery_WithContinueWith(t *testing.T) {
 					v.Set("email", recoveryEmail)
 				}, http.StatusOK)
 
-				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
+				message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Use code")
 				recoveryCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 				action := gjson.Get(body, "ui.action").String()
@@ -1972,7 +1987,7 @@ func TestDisabledStrategy(t *testing.T) {
 			require.NoError(t, reg.IdentityManager().Create(context.Background(),
 				&id, identity.ManagerAllowWriteProtectedTraits))
 
-			rl, _, err := adminSDK.IdentityApi.
+			rl, _, err := adminSDK.IdentityAPI.
 				CreateRecoveryLinkForIdentity(context.Background()).
 				CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{IdentityId: id.ID.String()}).
 				Execute()
diff --git a/selfservice/strategy/code/strategy_registration.go b/selfservice/strategy/code/strategy_registration.go
index dca3054e0c8e..734d5540cdf1 100644
--- a/selfservice/strategy/code/strategy_registration.go
+++ b/selfservice/strategy/code/strategy_registration.go
@@ -5,9 +5,11 @@ package code
 
 import (
 	"context"
-	"database/sql"
 	"encoding/json"
 	"net/http"
+	"strings"
+
+	"github.com/tidwall/gjson"
 
 	"github.com/ory/herodot"
 	"github.com/ory/x/otelx"
@@ -91,30 +93,10 @@ func (s *Strategy) PopulateRegistrationMethod(r *http.Request, rf *registration.
 	return s.PopulateMethod(r, rf)
 }
 
-type options func(*identity.Identity) error
-
-func withCredentials(via identity.CodeAddressType, usedAt sql.NullTime) options {
-	return func(i *identity.Identity) error {
-		return i.SetCredentialsWithConfig(identity.CredentialsTypeCodeAuth, identity.Credentials{Type: identity.CredentialsTypePassword, Identifiers: []string{}}, &identity.CredentialsCode{AddressType: via, UsedAt: usedAt})
-	}
-}
-
-func (s *Strategy) handleIdentityTraits(ctx context.Context, f *registration.Flow, traits, transientPayload json.RawMessage, i *identity.Identity, opts ...options) error {
-	f.TransientPayload = transientPayload
-	if len(traits) == 0 {
-		traits = json.RawMessage("{}")
-	}
-
-	// we explicitly set the Code credentials type
-	i.Traits = identity.Traits(traits)
-	if err := i.SetCredentialsWithConfig(s.ID(), identity.Credentials{Type: s.ID(), Identifiers: []string{}}, &identity.CredentialsCode{UsedAt: sql.NullTime{}}); err != nil {
-		return err
-	}
-
-	for _, opt := range opts {
-		if err := opt(i); err != nil {
-			return err
-		}
+func (s *Strategy) validateTraits(ctx context.Context, traits json.RawMessage, i *identity.Identity) error {
+	i.Traits = []byte("{}")
+	if gjson.ValidBytes(traits) {
+		i.Traits = identity.Traits(traits)
 	}
 
 	// Validate the identity
@@ -125,22 +107,30 @@ func (s *Strategy) handleIdentityTraits(ctx context.Context, f *registration.Flo
 	return nil
 }
 
-func (s *Strategy) getCredentialsFromTraits(ctx context.Context, f *registration.Flow, i *identity.Identity, traits, transientPayload json.RawMessage) (*identity.Credentials, error) {
-	if err := s.handleIdentityTraits(ctx, f, traits, transientPayload, i); err != nil {
-		return nil, errors.WithStack(err)
+func (s *Strategy) validateAndGetCredentialsFromTraits(ctx context.Context, i *identity.Identity, traits json.RawMessage) (*identity.Credentials, *identity.CredentialsCode, error) {
+	if err := s.validateTraits(ctx, traits, i); err != nil {
+		return nil, nil, errors.WithStack(err)
 	}
 
 	cred, ok := i.GetCredentials(identity.CredentialsTypeCodeAuth)
 	if !ok {
-		return nil, errors.WithStack(schema.NewMissingIdentifierError())
-	} else if len(cred.Identifiers) == 0 {
-		return nil, errors.WithStack(schema.NewMissingIdentifierError())
+		return nil, nil, errors.WithStack(schema.NewMissingIdentifierError())
+	} else if len(strings.Join(cred.Identifiers, "")) == 0 {
+		return nil, nil, errors.WithStack(schema.NewMissingIdentifierError())
+	}
+
+	var conf identity.CredentialsCode
+	if len(cred.Config) > 0 {
+		if err := json.Unmarshal(cred.Config, &conf); err != nil {
+			return nil, nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to unmarshal credentials config: %s", err))
+		}
 	}
-	return cred, nil
+
+	return cred, &conf, nil
 }
 
 func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registration.Flow, i *identity.Identity) (err error) {
-	ctx, span := s.deps.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.code.strategy.Register")
+	ctx, span := s.deps.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.code.Strategy.Register")
 	defer otelx.End(span, &err)
 
 	if err := flow.MethodEnabledAndAllowedFromRequest(r, f.GetFlowName(), s.ID().String(), s.deps); err != nil {
@@ -174,7 +164,7 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registrat
 }
 
 func (s *Strategy) registrationSendEmail(ctx context.Context, w http.ResponseWriter, r *http.Request, f *registration.Flow, p *updateRegistrationFlowWithCodeMethod, i *identity.Identity) (err error) {
-	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.strategy.registrationSendEmail")
+	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.Strategy.registrationSendEmail")
 	defer otelx.End(span, &err)
 
 	if len(p.Traits) == 0 {
@@ -184,7 +174,7 @@ func (s *Strategy) registrationSendEmail(ctx context.Context, w http.ResponseWri
 	// Create the Registration code
 
 	// Step 1: validate the identity's traits
-	cred, err := s.getCredentialsFromTraits(ctx, f, i, p.Traits, p.TransientPayload)
+	_, conf, err := s.validateAndGetCredentialsFromTraits(ctx, i, p.Traits)
 	if err != nil {
 		return err
 	}
@@ -196,9 +186,10 @@ func (s *Strategy) registrationSendEmail(ctx context.Context, w http.ResponseWri
 
 	// Step 3: Get the identity email and send the code
 	var addresses []Address
-	for _, identifier := range cred.Identifiers {
-		addresses = append(addresses, Address{To: identifier, Via: identity.AddressTypeEmail})
+	for _, address := range conf.Addresses {
+		addresses = append(addresses, Address{To: address.Address, Via: address.Channel})
 	}
+
 	// kratos only supports `email` identifiers at the moment with the code method
 	// this is validated in the identity validation step above
 	if err := s.deps.CodeSender().SendCode(ctx, f, i, addresses...); err != nil {
@@ -232,7 +223,7 @@ func (s *Strategy) registrationSendEmail(ctx context.Context, w http.ResponseWri
 }
 
 func (s *Strategy) registrationVerifyCode(ctx context.Context, f *registration.Flow, p *updateRegistrationFlowWithCodeMethod, i *identity.Identity) (err error) {
-	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.strategy.registrationVerifyCode")
+	ctx, span := s.deps.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.code.Strategy.registrationVerifyCode")
 	defer otelx.End(span, &err)
 
 	if len(p.Code) == 0 {
@@ -246,7 +237,7 @@ func (s *Strategy) registrationVerifyCode(ctx context.Context, f *registration.F
 	// Step 1: Re-validate the identity's traits
 	// this is important since the client could have switched out the identity's traits
 	// this method also returns the credentials for a temporary identity
-	cred, err := s.getCredentialsFromTraits(ctx, f, i, p.Traits, p.TransientPayload)
+	cred, _, err := s.validateAndGetCredentialsFromTraits(ctx, i, p.Traits)
 	if err != nil {
 		return err
 	}
@@ -267,9 +258,12 @@ func (s *Strategy) registrationVerifyCode(ctx context.Context, f *registration.F
 		return errors.WithStack(err)
 	}
 
-	// Step 4: The code was correct, populate the Identity credentials and traits
-	if err := s.handleIdentityTraits(ctx, f, p.Traits, p.TransientPayload, i, withCredentials(registrationCode.AddressType, registrationCode.UsedAt)); err != nil {
-		return errors.WithStack(err)
+	// Step 4: Verify the address
+	if err := s.verifyAddress(ctx, i, Address{
+		To:  registrationCode.Address,
+		Via: registrationCode.AddressType,
+	}); err != nil {
+		return err
 	}
 
 	// since nothing has errored yet, we can assume that the code is correct
diff --git a/selfservice/strategy/code/strategy_registration_test.go b/selfservice/strategy/code/strategy_registration_test.go
index 27c645a94190..b5f0d6e02c9f 100644
--- a/selfservice/strategy/code/strategy_registration_test.go
+++ b/selfservice/strategy/code/strategy_registration_test.go
@@ -15,6 +15,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/ory/kratos/selfservice/flow"
+
 	"github.com/gobuffalo/pop/v6"
 	"github.com/gofrs/uuid"
 	"github.com/stretchr/testify/assert"
@@ -37,6 +39,7 @@ type state struct {
 	email          string
 	testServer     *httptest.Server
 	resultIdentity *identity.Identity
+	body           string
 }
 
 func TestRegistrationCodeStrategyDisabled(t *testing.T) {
@@ -162,7 +165,7 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 			s.email = testhelpers.RandomEmail()
 		}
 
-		rf, resp, err := testhelpers.NewSDKCustomClient(s.testServer, s.client).FrontendApi.GetRegistrationFlow(context.Background()).Id(s.flowID).Execute()
+		rf, resp, err := testhelpers.NewSDKCustomClient(s.testServer, s.client).FrontendAPI.GetRegistrationFlow(context.Background()).Id(s.flowID).Execute()
 		require.NoError(t, err)
 		require.EqualValues(t, http.StatusOK, resp.StatusCode)
 
@@ -172,6 +175,7 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 		values.Set("method", "code")
 
 		body, resp := testhelpers.RegistrationMakeRequest(t, apiType == ApiTypeNative, apiType == ApiTypeSPA, rf, s.client, testhelpers.EncodeFormAsJSON(t, apiType == ApiTypeNative, values))
+		s.body = body
 
 		if submitAssertion != nil {
 			submitAssertion(ctx, t, s, body, resp)
@@ -199,7 +203,7 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 	submitOTP := func(ctx context.Context, t *testing.T, reg *driver.RegistryDefault, s *state, vals func(v *url.Values), apiType ApiType, submitAssertion onSubmitAssertion) *state {
 		t.Helper()
 
-		rf, resp, err := testhelpers.NewSDKCustomClient(s.testServer, s.client).FrontendApi.GetRegistrationFlow(context.Background()).Id(s.flowID).Execute()
+		rf, resp, err := testhelpers.NewSDKCustomClient(s.testServer, s.client).FrontendAPI.GetRegistrationFlow(context.Background()).Id(s.flowID).Execute()
 		require.NoError(t, err)
 		require.EqualValues(t, http.StatusOK, resp.StatusCode)
 
@@ -213,13 +217,14 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 		vals(&values)
 
 		body, resp := testhelpers.RegistrationMakeRequest(t, apiType == ApiTypeNative, apiType == ApiTypeSPA, rf, s.client, testhelpers.EncodeFormAsJSON(t, apiType == ApiTypeNative, values))
+		s.body = body
 
 		if submitAssertion != nil {
 			submitAssertion(ctx, t, s, body, resp)
 			return s
 		}
 
-		require.Equal(t, http.StatusOK, resp.StatusCode)
+		require.Equal(t, http.StatusOK, resp.StatusCode, body)
 
 		verifiableAddress, err := reg.PrivilegedIdentityPool().FindVerifiableAddressByValue(ctx, identity.VerifiableAddressTypeEmail, s.email)
 		require.NoError(t, err)
@@ -240,7 +245,7 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 		t.Parallel()
 
 		ctx := context.Background()
-		_, reg, public := setup(ctx, t)
+		conf, reg, public := setup(ctx, t)
 
 		for _, tc := range []struct {
 			d       string
@@ -269,8 +274,8 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 					// 2. Submit Identifier (email)
 					state = registerNewUser(ctx, t, state, tc.apiType, nil)
 
-					message := testhelpers.CourierExpectMessage(ctx, t, reg, state.email, "Complete your account registration")
-					assert.Contains(t, message.Body, "please complete your account registration by entering the following code")
+					message := testhelpers.CourierExpectMessage(ctx, t, reg, state.email, "Use code")
+					assert.Contains(t, message.Body, "Complete your account registration with the following code")
 
 					registrationCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 					assert.NotEmpty(t, registrationCode)
@@ -279,6 +284,15 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 					state = submitOTP(ctx, t, reg, state, func(v *url.Values) {
 						v.Set("code", registrationCode)
 					}, tc.apiType, nil)
+
+					if tc.apiType == ApiTypeSPA {
+						assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(state.body, "continue_with.0.action").String(), "%s", state.body)
+						assert.Contains(t, gjson.Get(state.body, "continue_with.0.redirect_browser_to").String(), conf.SelfServiceBrowserDefaultReturnTo(ctx).String(), "%s", state.body)
+					} else if tc.apiType == ApiTypeSPA {
+						assert.Empty(t, gjson.Get(state.body, "continue_with").Array(), "%s", state.body)
+					} else if tc.apiType == ApiTypeNative {
+						assert.NotContains(t, gjson.Get(state.body, "continue_with").Raw, string(flow.ContinueWithActionRedirectBrowserToString), "%s", state.body)
+					}
 				})
 
 				t.Run("case=should normalize email address on sign up", func(t *testing.T) {
@@ -293,8 +307,8 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 					// 2. Submit Identifier (email)
 					state = registerNewUser(ctx, t, state, tc.apiType, nil)
 
-					message := testhelpers.CourierExpectMessage(ctx, t, reg, sourceMail, "Complete your account registration")
-					assert.Contains(t, message.Body, "please complete your account registration by entering the following code")
+					message := testhelpers.CourierExpectMessage(ctx, t, reg, sourceMail, "Use code")
+					assert.Contains(t, message.Body, "Complete your account registration with the following code")
 
 					registrationCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 					assert.NotEmpty(t, registrationCode)
@@ -334,11 +348,11 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 						require.NotEmpty(t, attr)
 
 						val := gjson.Get(attr, "#(attributes.type==hidden).attributes.value").String()
-						require.Equal(t, "code", val)
+						require.Equal(t, "code", val, body)
 					})
 
-					message := testhelpers.CourierExpectMessage(ctx, t, reg, s.email, "Complete your account registration")
-					assert.Contains(t, message.Body, "please complete your account registration by entering the following code")
+					message := testhelpers.CourierExpectMessage(ctx, t, reg, s.email, "Use code")
+					assert.Contains(t, message.Body, "Complete your account registration with the following code")
 
 					registrationCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 					assert.NotEmpty(t, registrationCode)
@@ -358,12 +372,12 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 						} else {
 							require.NotEmptyf(t, csrfToken, "expected to find the csrf_token but got %s", body)
 						}
-						require.Containsf(t, gjson.Get(body, "ui.messages").String(), "An email containing a code has been sent to the email address you provided.", "%s", body)
+						require.Containsf(t, gjson.Get(body, "ui.messages").String(), "A code has been sent to the address(es) you provided", "%s", body)
 					})
 
 					// get the new code from email
-					message = testhelpers.CourierExpectMessage(ctx, t, reg, s.email, "Complete your account registration")
-					assert.Contains(t, message.Body, "please complete your account registration by entering the following code")
+					message = testhelpers.CourierExpectMessage(ctx, t, reg, s.email, "Use code")
+					assert.Contains(t, message.Body, "Complete your account registration with the following code")
 
 					registrationCode2 := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 					assert.NotEmpty(t, registrationCode2)
@@ -396,8 +410,8 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 					// 2. Submit Identifier (email)
 					s = registerNewUser(ctx, t, s, tc.apiType, nil)
 
-					message := testhelpers.CourierExpectMessage(ctx, t, reg, s.email, "Complete your account registration")
-					assert.Contains(t, message.Body, "please complete your account registration by entering the following code")
+					message := testhelpers.CourierExpectMessage(ctx, t, reg, s.email, "Use code")
+					assert.Contains(t, message.Body, "Complete your account registration with the following code")
 
 					registrationCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 					assert.NotEmpty(t, registrationCode)
@@ -425,8 +439,8 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 					// 2. Submit Identifier (email)
 					s = registerNewUser(ctx, t, s, tc.apiType, nil)
 
-					message := testhelpers.CourierExpectMessage(ctx, t, reg, s.email, "Complete your account registration")
-					assert.Contains(t, message.Body, "please complete your account registration by entering the following code")
+					message := testhelpers.CourierExpectMessage(ctx, t, reg, s.email, "Use code")
+					assert.Contains(t, message.Body, "Complete your account registration")
 
 					registrationCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 					assert.NotEmpty(t, registrationCode)
@@ -512,8 +526,11 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 		} {
 			t.Run("test="+tc.d, func(t *testing.T) {
 				t.Run("case=should fail when schema does not contain the `code` extension", func(t *testing.T) {
-					testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/default.schema.json")
+					testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/no-code.schema.json")
+					conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, false)
+
 					t.Cleanup(func() {
+						conf.MustSet(ctx, config.ViperKeyCodeConfigMissingCredentialFallbackEnabled, true)
 						testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/code.identity.schema.json")
 					})
 
@@ -526,7 +543,7 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 							// we expect a redirect to the registration page with the flow id
 							require.Equal(t, http.StatusOK, resp.StatusCode)
 							require.Equal(t, conf.SelfServiceFlowRegistrationUI(ctx).Path, resp.Request.URL.Path)
-							rf, resp, err := testhelpers.NewSDKCustomClient(public, s.client).FrontendApi.GetRegistrationFlow(ctx).Id(resp.Request.URL.Query().Get("flow")).Execute()
+							rf, resp, err := testhelpers.NewSDKCustomClient(public, s.client).FrontendAPI.GetRegistrationFlow(ctx).Id(resp.Request.URL.Query().Get("flow")).Execute()
 							require.NoError(t, err)
 							require.Equal(t, http.StatusOK, resp.StatusCode)
 							body, err := json.Marshal(rf)
@@ -556,8 +573,8 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 					// 2. Submit Identifier (email)
 					state = registerNewUser(ctx, t, state, tc.apiType, nil)
 
-					message := testhelpers.CourierExpectMessage(ctx, t, reg, state.email, "Complete your account registration")
-					assert.Contains(t, message.Body, "please complete your account registration by entering the following code")
+					message := testhelpers.CourierExpectMessage(ctx, t, reg, state.email, "Use code")
+					assert.Contains(t, message.Body, "Complete your account registration with the following code")
 
 					registrationCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 					assert.NotEmpty(t, registrationCode)
@@ -580,8 +597,8 @@ func TestRegistrationCodeStrategy(t *testing.T) {
 					// 2. Submit Identifier (email)
 					s = registerNewUser(ctx, t, s, tc.apiType, nil)
 
-					message := testhelpers.CourierExpectMessage(ctx, t, reg, s.email, "Complete your account registration")
-					assert.Contains(t, message.Body, "please complete your account registration by entering the following code")
+					message := testhelpers.CourierExpectMessage(ctx, t, reg, s.email, "Use code")
+					assert.Contains(t, message.Body, "Complete your account registration with the following code")
 
 					registrationCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 					assert.NotEmpty(t, registrationCode)
diff --git a/selfservice/strategy/code/strategy_test.go b/selfservice/strategy/code/strategy_test.go
index 4561a280fb96..5edbef5ec718 100644
--- a/selfservice/strategy/code/strategy_test.go
+++ b/selfservice/strategy/code/strategy_test.go
@@ -5,8 +5,14 @@ package code_test
 
 import (
 	"context"
+	"fmt"
 	"testing"
 
+	"github.com/stretchr/testify/require"
+
+	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
+	"github.com/ory/kratos/internal"
+
 	"github.com/stretchr/testify/assert"
 
 	"github.com/ory/kratos/internal/testhelpers"
@@ -74,3 +80,123 @@ func TestMaskAddress(t *testing.T) {
 		})
 	}
 }
+
+func TestCountActiveCredentials(t *testing.T) {
+	_, reg := internal.NewFastRegistryWithMocks(t)
+	strategy := code.NewStrategy(reg)
+	ctx := context.Background()
+
+	t.Run("first factor", func(t *testing.T) {
+		for k, tc := range []struct {
+			in                  map[identity.CredentialsType]identity.Credentials
+			expected            int
+			passwordlessEnabled bool
+			enabled             bool
+		}{
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:   strategy.ID(),
+					Config: []byte{},
+				}},
+				passwordlessEnabled: false,
+				enabled:             true,
+				expected:            0,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:   strategy.ID(),
+					Config: []byte{},
+				}},
+				passwordlessEnabled: true,
+				enabled:             false,
+				expected:            1,
+			},
+			{
+				in:                  map[identity.CredentialsType]identity.Credentials{},
+				passwordlessEnabled: true,
+				enabled:             true,
+				expected:            1,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:   strategy.ID(),
+					Config: []byte(`{}`),
+				}},
+				passwordlessEnabled: true,
+				enabled:             true,
+				expected:            1,
+			},
+		} {
+			t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
+				ctx := confighelpers.WithConfigValue(ctx, "selfservice.methods.code.passwordless_enabled", tc.passwordlessEnabled)
+				ctx = confighelpers.WithConfigValue(ctx, "selfservice.methods.code.enabled", tc.enabled)
+
+				cc := map[identity.CredentialsType]identity.Credentials{}
+				for _, c := range tc.in {
+					cc[c.Type] = c
+				}
+
+				actual, err := strategy.CountActiveFirstFactorCredentials(ctx, cc)
+				require.NoError(t, err)
+				assert.Equal(t, tc.expected, actual)
+			})
+		}
+	})
+
+	t.Run("second factor", func(t *testing.T) {
+		for k, tc := range []struct {
+			in         map[identity.CredentialsType]identity.Credentials
+			expected   int
+			mfaEnabled bool
+			enabled    bool
+		}{
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:   strategy.ID(),
+					Config: []byte{},
+				}},
+				mfaEnabled: false,
+				enabled:    true,
+				expected:   0,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:   strategy.ID(),
+					Config: []byte{},
+				}},
+				mfaEnabled: true,
+				enabled:    false,
+				expected:   1,
+			},
+			{
+				in:         map[identity.CredentialsType]identity.Credentials{},
+				mfaEnabled: true,
+				enabled:    true,
+				expected:   1,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:   strategy.ID(),
+					Config: []byte(`{}`),
+				}},
+				mfaEnabled: true,
+				enabled:    true,
+				expected:   1,
+			},
+		} {
+			t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
+				ctx := confighelpers.WithConfigValue(ctx, "selfservice.methods.code.mfa_enabled", tc.mfaEnabled)
+				ctx = confighelpers.WithConfigValue(ctx, "selfservice.methods.code.enabled", tc.enabled)
+
+				cc := map[identity.CredentialsType]identity.Credentials{}
+				for _, c := range tc.in {
+					cc[c.Type] = c
+				}
+
+				actual, err := strategy.CountActiveMultiFactorCredentials(ctx, cc)
+				require.NoError(t, err)
+				assert.Equal(t, tc.expected, actual)
+			})
+		}
+	})
+}
diff --git a/selfservice/strategy/code/strategy_verification.go b/selfservice/strategy/code/strategy_verification.go
index 5b30e4c2f5ec..9cfb6eb74535 100644
--- a/selfservice/strategy/code/strategy_verification.go
+++ b/selfservice/strategy/code/strategy_verification.go
@@ -66,11 +66,15 @@ func (s *Strategy) decodeVerification(r *http.Request) (*updateVerificationFlowW
 }
 
 // handleVerificationError is a convenience function for handling all types of errors that may occur (e.g. validation error).
-func (s *Strategy) handleVerificationError(w http.ResponseWriter, r *http.Request, f *verification.Flow, body *updateVerificationFlowWithCodeMethod, err error) error {
+func (s *Strategy) handleVerificationError(r *http.Request, f *verification.Flow, body *updateVerificationFlowWithCodeMethod, err error) error {
 	if f != nil {
 		f.UI.SetCSRF(s.deps.GenerateCSRFToken(r))
+		email := ""
+		if body != nil {
+			email = body.Email
+		}
 		f.UI.GetNodes().Upsert(
-			node.NewInputField("email", body.Email, node.CodeGroup, node.InputAttributeTypeEmail, node.WithRequiredInputAttribute).WithMetaLabel(text.NewInfoNodeInputEmail()),
+			node.NewInputField("email", email, node.CodeGroup, node.InputAttributeTypeEmail, node.WithRequiredInputAttribute).WithMetaLabel(text.NewInfoNodeInputEmail()),
 		)
 	}
 
@@ -131,38 +135,38 @@ func (body *updateVerificationFlowWithCodeMethod) getMethod() verification.Verif
 }
 
 func (s *Strategy) Verify(w http.ResponseWriter, r *http.Request, f *verification.Flow) (err error) {
-	ctx, span := s.deps.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.code.strategy.Verify")
+	ctx, span := s.deps.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.code.Strategy.Verify")
 	span.SetAttributes(attribute.String("selfservice_flows_verification_use", s.deps.Config().SelfServiceFlowVerificationUse(ctx)))
 	defer otelx.End(span, &err)
 
 	body, err := s.decodeVerification(r)
 	if err != nil {
-		return s.handleVerificationError(w, r, nil, body, err)
+		return s.handleVerificationError(r, nil, body, err)
 	}
 
 	f.TransientPayload = body.TransientPayload
 
-	if err := flow.MethodEnabledAndAllowed(r.Context(), f.GetFlowName(), s.VerificationStrategyID(), string(body.getMethod()), s.deps); err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+	if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.VerificationStrategyID(), string(body.getMethod()), s.deps); err != nil {
+		return s.handleVerificationError(r, f, body, err)
 	}
 
 	if err := f.Valid(); err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+		return s.handleVerificationError(r, f, body, err)
 	}
 
 	switch f.State {
 	case flow.StateChooseMethod:
 		fallthrough
 	case flow.StateEmailSent:
-		return s.verificationHandleFormSubmission(w, r, f, body)
+		return s.verificationHandleFormSubmission(ctx, w, r, f, body)
 	case flow.StatePassedChallenge:
-		return s.retryVerificationFlowWithMessage(w, r, f.Type, text.NewErrorValidationVerificationRetrySuccess())
+		return s.retryVerificationFlowWithMessage(ctx, w, r, f.Type, text.NewErrorValidationVerificationRetrySuccess())
 	default:
-		return s.retryVerificationFlowWithMessage(w, r, f.Type, text.NewErrorValidationVerificationStateFailure())
+		return s.retryVerificationFlowWithMessage(ctx, w, r, f.Type, text.NewErrorValidationVerificationStateFailure())
 	}
 }
 
-func (s *Strategy) handleLinkClick(w http.ResponseWriter, r *http.Request, f *verification.Flow, code string) error {
+func (s *Strategy) handleLinkClick(ctx context.Context, w http.ResponseWriter, r *http.Request, f *verification.Flow, code string) error {
 	// Pre-fill the code
 	if codeField := f.UI.Nodes.Find("code"); codeField != nil {
 		codeField.Attributes.SetValue(code)
@@ -174,43 +178,43 @@ func (s *Strategy) handleLinkClick(w http.ResponseWriter, r *http.Request, f *ve
 	f.UI.SetCSRF(csrfToken)
 	f.CSRFToken = csrfToken
 
-	if err := s.deps.VerificationFlowPersister().UpdateVerificationFlow(r.Context(), f); err != nil {
+	if err := s.deps.VerificationFlowPersister().UpdateVerificationFlow(ctx, f); err != nil {
 		return err
 	}
 
 	// we always redirect to the browser UI here to allow API flows to complete aswell
 	// TODO: In the future, we might want to redirect to a custom URI scheme here, to allow to open an app on the device of
 	// the user to handle the flow directly.
-	http.Redirect(w, r, f.AppendTo(s.deps.Config().SelfServiceFlowVerificationUI(r.Context())).String(), http.StatusSeeOther)
+	http.Redirect(w, r, f.AppendTo(s.deps.Config().SelfServiceFlowVerificationUI(ctx)).String(), http.StatusSeeOther)
 
 	return errors.WithStack(flow.ErrCompletedByStrategy)
 }
 
-func (s *Strategy) verificationHandleFormSubmission(w http.ResponseWriter, r *http.Request, f *verification.Flow, body *updateVerificationFlowWithCodeMethod) error {
+func (s *Strategy) verificationHandleFormSubmission(ctx context.Context, w http.ResponseWriter, r *http.Request, f *verification.Flow, body *updateVerificationFlowWithCodeMethod) error {
 	if len(body.Code) > 0 {
 		if r.Method == http.MethodGet {
 			// Special case: in the code strategy we send out links as well, that contain the code
-			return s.handleLinkClick(w, r, f, body.Code)
+			return s.handleLinkClick(ctx, w, r, f, body.Code)
 		}
 
 		// If not GET: try to use the submitted code
-		return s.verificationUseCode(w, r, body.Code, f)
+		return s.verificationUseCode(ctx, w, r, body.Code, f)
 	} else if len(body.Email) == 0 {
 		// If no code and no email was provided, fail with a validation error
-		return s.handleVerificationError(w, r, f, body, schema.NewRequiredError("#/email", "email"))
+		return s.handleVerificationError(r, f, body, schema.NewRequiredError("#/email", "email"))
 	}
 
-	if err := flow.EnsureCSRF(s.deps, r, f.Type, s.deps.Config().DisableAPIFlowEnforcement(r.Context()), s.deps.GenerateCSRFToken, body.CSRFToken); err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+	if err := flow.EnsureCSRF(s.deps, r, f.Type, s.deps.Config().DisableAPIFlowEnforcement(ctx), s.deps.GenerateCSRFToken, body.CSRFToken); err != nil {
+		return s.handleVerificationError(r, f, body, err)
 	}
 
-	if err := s.deps.VerificationCodePersister().DeleteVerificationCodesOfFlow(r.Context(), f.ID); err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+	if err := s.deps.VerificationCodePersister().DeleteVerificationCodesOfFlow(ctx, f.ID); err != nil {
+		return s.handleVerificationError(r, f, body, err)
 	}
 
-	if err := s.deps.CodeSender().SendVerificationCode(r.Context(), f, identity.VerifiableAddressTypeEmail, body.Email); err != nil {
+	if err := s.deps.CodeSender().SendVerificationCode(ctx, f, identity.VerifiableAddressTypeEmail, body.Email); err != nil {
 		if !errors.Is(err, ErrUnknownAddress) {
-			return s.handleVerificationError(w, r, f, body, err)
+			return s.handleVerificationError(r, f, body, err)
 		}
 		// Continue execution
 	}
@@ -218,7 +222,7 @@ func (s *Strategy) verificationHandleFormSubmission(w http.ResponseWriter, r *ht
 	f.State = flow.StateEmailSent
 
 	if err := s.PopulateVerificationMethod(r, f); err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+		return s.handleVerificationError(r, f, body, err)
 	}
 
 	if body.Email != "" {
@@ -228,30 +232,30 @@ func (s *Strategy) verificationHandleFormSubmission(w http.ResponseWriter, r *ht
 		)
 	}
 
-	if err := s.deps.VerificationFlowPersister().UpdateVerificationFlow(r.Context(), f); err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+	if err := s.deps.VerificationFlowPersister().UpdateVerificationFlow(ctx, f); err != nil {
+		return s.handleVerificationError(r, f, body, err)
 	}
 
 	return nil
 }
 
-func (s *Strategy) verificationUseCode(w http.ResponseWriter, r *http.Request, codeString string, f *verification.Flow) error {
-	code, err := s.deps.VerificationCodePersister().UseVerificationCode(r.Context(), f.ID, codeString)
+func (s *Strategy) verificationUseCode(ctx context.Context, w http.ResponseWriter, r *http.Request, codeString string, f *verification.Flow) error {
+	code, err := s.deps.VerificationCodePersister().UseVerificationCode(ctx, f.ID, codeString)
 	if errors.Is(err, ErrCodeNotFound) {
 		f.UI.Messages.Clear()
 		f.UI.Messages.Add(text.NewErrorValidationVerificationCodeInvalidOrAlreadyUsed())
-		if err := s.deps.VerificationFlowPersister().UpdateVerificationFlow(r.Context(), f); err != nil {
-			return s.retryVerificationFlowWithError(w, r, f.Type, err)
+		if err := s.deps.VerificationFlowPersister().UpdateVerificationFlow(ctx, f); err != nil {
+			return s.retryVerificationFlowWithError(ctx, w, r, f.Type, err)
 		}
 
 		if x.IsBrowserRequest(r) {
-			http.Redirect(w, r, f.AppendTo(s.deps.Config().SelfServiceFlowVerificationUI(r.Context())).String(), http.StatusSeeOther)
+			http.Redirect(w, r, f.AppendTo(s.deps.Config().SelfServiceFlowVerificationUI(ctx)).String(), http.StatusSeeOther)
 		} else {
 			s.deps.Writer().Write(w, r, f)
 		}
 		return errors.WithStack(flow.ErrCompletedByStrategy)
 	} else if err != nil {
-		return s.retryVerificationFlowWithError(w, r, f.Type, err)
+		return s.retryVerificationFlowWithError(ctx, w, r, f.Type, err)
 	}
 
 	address := code.VerifiableAddress
@@ -259,16 +263,16 @@ func (s *Strategy) verificationUseCode(w http.ResponseWriter, r *http.Request, c
 	verifiedAt := sqlxx.NullTime(time.Now().UTC())
 	address.VerifiedAt = &verifiedAt
 	address.Status = identity.VerifiableAddressStatusCompleted
-	if err := s.deps.PrivilegedIdentityPool().UpdateVerifiableAddress(r.Context(), address); err != nil {
-		return s.retryVerificationFlowWithError(w, r, f.Type, err)
+	if err := s.deps.PrivilegedIdentityPool().UpdateVerifiableAddress(ctx, address); err != nil {
+		return s.retryVerificationFlowWithError(ctx, w, r, f.Type, err)
 	}
 
-	i, err := s.deps.IdentityPool().GetIdentity(r.Context(), code.VerifiableAddress.IdentityID, identity.ExpandDefault)
+	i, err := s.deps.IdentityPool().GetIdentity(ctx, code.VerifiableAddress.IdentityID, identity.ExpandDefault)
 	if err != nil {
-		return s.retryVerificationFlowWithError(w, r, f.Type, err)
+		return s.retryVerificationFlowWithError(ctx, w, r, f.Type, err)
 	}
 
-	returnTo := f.ContinueURL(r.Context(), s.deps.Config())
+	returnTo := f.ContinueURL(ctx, s.deps.Config())
 
 	f.UI = &container.Container{
 		Method: "GET",
@@ -284,18 +288,18 @@ func (s *Strategy) verificationUseCode(w http.ResponseWriter, r *http.Request, c
 		Append(node.NewAnchorField("continue", returnTo.String(), node.CodeGroup, text.NewInfoNodeLabelContinue()).
 			WithMetaLabel(text.NewInfoNodeLabelContinue()))
 
-	if err := s.deps.VerificationFlowPersister().UpdateVerificationFlow(r.Context(), f); err != nil {
-		return s.retryVerificationFlowWithError(w, r, flow.TypeBrowser, err)
+	if err := s.deps.VerificationFlowPersister().UpdateVerificationFlow(ctx, f); err != nil {
+		return s.retryVerificationFlowWithError(ctx, w, r, flow.TypeBrowser, err)
 	}
 
 	if err := s.deps.VerificationExecutor().PostVerificationHook(w, r, f, i); err != nil {
-		return s.retryVerificationFlowWithError(w, r, f.Type, err)
+		return s.retryVerificationFlowWithError(ctx, w, r, f.Type, err)
 	}
 
 	return nil
 }
 
-func (s *Strategy) retryVerificationFlowWithMessage(w http.ResponseWriter, r *http.Request, ft flow.Type, message *text.Message) error {
+func (s *Strategy) retryVerificationFlowWithMessage(ctx context.Context, w http.ResponseWriter, r *http.Request, ft flow.Type, message *text.Message) error {
 	s.deps.
 		Logger().
 		WithRequest(r).
@@ -303,27 +307,27 @@ func (s *Strategy) retryVerificationFlowWithMessage(w http.ResponseWriter, r *ht
 		Debug("A verification flow is being retried because a validation error occurred.")
 
 	f, err := verification.NewFlow(s.deps.Config(),
-		s.deps.Config().SelfServiceFlowVerificationRequestLifespan(r.Context()), s.deps.CSRFHandler().RegenerateToken(w, r), r, s, ft)
+		s.deps.Config().SelfServiceFlowVerificationRequestLifespan(ctx), s.deps.CSRFHandler().RegenerateToken(w, r), r, s, ft)
 	if err != nil {
-		return s.handleVerificationError(w, r, f, nil, err)
+		return s.handleVerificationError(r, f, nil, err)
 	}
 
 	f.UI.Messages.Add(message)
 
-	if err := s.deps.VerificationFlowPersister().CreateVerificationFlow(r.Context(), f); err != nil {
-		return s.handleVerificationError(w, r, f, nil, err)
+	if err := s.deps.VerificationFlowPersister().CreateVerificationFlow(ctx, f); err != nil {
+		return s.handleVerificationError(r, f, nil, err)
 	}
 
 	if x.IsJSONRequest(r) {
 		s.deps.Writer().WriteError(w, r, flow.NewFlowReplacedError(text.NewErrorSystemGeneric("An error occured, please use the new flow.")).WithFlow(f))
 	} else {
-		http.Redirect(w, r, f.AppendTo(s.deps.Config().SelfServiceFlowVerificationUI(r.Context())).String(), http.StatusSeeOther)
+		http.Redirect(w, r, f.AppendTo(s.deps.Config().SelfServiceFlowVerificationUI(ctx)).String(), http.StatusSeeOther)
 	}
 
 	return errors.WithStack(flow.ErrCompletedByStrategy)
 }
 
-func (s *Strategy) retryVerificationFlowWithError(w http.ResponseWriter, r *http.Request, ft flow.Type, verErr error) error {
+func (s *Strategy) retryVerificationFlowWithError(ctx context.Context, w http.ResponseWriter, r *http.Request, ft flow.Type, verErr error) error {
 	s.deps.
 		Logger().
 		WithRequest(r).
@@ -331,9 +335,9 @@ func (s *Strategy) retryVerificationFlowWithError(w http.ResponseWriter, r *http
 		Debug("A verification flow is being retried because an error occurred.")
 
 	f, err := verification.NewFlow(s.deps.Config(),
-		s.deps.Config().SelfServiceFlowVerificationRequestLifespan(r.Context()), s.deps.CSRFHandler().RegenerateToken(w, r), r, s, ft)
+		s.deps.Config().SelfServiceFlowVerificationRequestLifespan(ctx), s.deps.CSRFHandler().RegenerateToken(w, r), r, s, ft)
 	if err != nil {
-		return s.handleVerificationError(w, r, f, nil, err)
+		return s.handleVerificationError(r, f, nil, err)
 	}
 
 	var toReturn error
@@ -345,8 +349,8 @@ func (s *Strategy) retryVerificationFlowWithError(w http.ResponseWriter, r *http
 		return err
 	}
 
-	if err := s.deps.VerificationFlowPersister().CreateVerificationFlow(r.Context(), f); err != nil {
-		return s.handleVerificationError(w, r, f, nil, err)
+	if err := s.deps.VerificationFlowPersister().CreateVerificationFlow(ctx, f); err != nil {
+		return s.handleVerificationError(r, f, nil, err)
 	}
 
 	if x.IsJSONRequest(r) {
@@ -356,7 +360,7 @@ func (s *Strategy) retryVerificationFlowWithError(w http.ResponseWriter, r *http
 		}
 		s.deps.Writer().WriteError(w, r, toReturn)
 	} else {
-		http.Redirect(w, r, f.AppendTo(s.deps.Config().SelfServiceFlowVerificationUI(r.Context())).String(), http.StatusSeeOther)
+		http.Redirect(w, r, f.AppendTo(s.deps.Config().SelfServiceFlowVerificationUI(ctx)).String(), http.StatusSeeOther)
 	}
 
 	return errors.WithStack(flow.ErrCompletedByStrategy)
diff --git a/selfservice/strategy/code/strategy_verification_test.go b/selfservice/strategy/code/strategy_verification_test.go
index 322dc56eabd2..5bd8417d180d 100644
--- a/selfservice/strategy/code/strategy_verification_test.go
+++ b/selfservice/strategy/code/strategy_verification_test.go
@@ -285,8 +285,8 @@ func TestVerification(t *testing.T) {
 			v.Set("email", verificationEmail)
 		})
 
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
-		assert.Contains(t, message.Body, "please verify your account by entering the following code")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Use code")
+		assert.Contains(t, message.Body, "Verify your account with the following code")
 
 		code := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
@@ -310,8 +310,8 @@ func TestVerification(t *testing.T) {
 			assert.EqualValues(t, verificationEmail, gjson.Get(actual, "ui.nodes.#(attributes.name==email).attributes.value").String(), "%s", actual)
 			assertx.EqualAsJSON(t, text.NewVerificationEmailWithCodeSent(), json.RawMessage(gjson.Get(actual, "ui.messages.0").Raw))
 
-			message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
-			assert.Contains(t, message.Body, "please verify your account by entering the following code")
+			message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Use code")
+			assert.Contains(t, message.Body, "Verify your account with the following code")
 
 			verificationLink := testhelpers.CourierExpectLinkInMessage(t, message, 1)
 
@@ -374,7 +374,7 @@ func TestVerification(t *testing.T) {
 		}
 
 		expectSuccess(t, nil, false, false, values)
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Use code")
 		verificationLink := testhelpers.CourierExpectLinkInMessage(t, message, 1)
 		code := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
@@ -442,8 +442,8 @@ func TestVerification(t *testing.T) {
 			v.Set("email", verificationEmail)
 		})
 
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
-		assert.Contains(t, message.Body, "please verify your account by entering the following code")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Use code")
+		assert.Contains(t, message.Body, "Verify your account with the following code")
 
 		verificationLink := testhelpers.CourierExpectLinkInMessage(t, message, 1)
 
@@ -507,7 +507,7 @@ func TestVerification(t *testing.T) {
 			v.Set("email", verificationEmail)
 		})
 
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Use code")
 		_ = testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 		c := testhelpers.NewClientWithCookies(t)
@@ -516,7 +516,7 @@ func TestVerification(t *testing.T) {
 		assert.True(t, gjson.Get(body, "ui.nodes.#(attributes.name==code)").Exists())
 		assert.Equal(t, verificationEmail, gjson.Get(body, "ui.nodes.#(attributes.name==email).attributes.value").String())
 
-		message = testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
+		message = testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Use code")
 		verificationCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 		submitVerificationCode(t, body, c, verificationCode)
@@ -527,7 +527,7 @@ func TestVerification(t *testing.T) {
 			v.Set("email", verificationEmail)
 		})
 
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Use code")
 		firstCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 		c := testhelpers.NewClientWithCookies(t)
@@ -536,7 +536,7 @@ func TestVerification(t *testing.T) {
 		assert.True(t, gjson.Get(body, "ui.nodes.#(attributes.name==code)").Exists())
 		assert.Equal(t, verificationEmail, gjson.Get(body, "ui.nodes.#(attributes.name==email).attributes.value").String())
 
-		message = testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
+		message = testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Use code")
 		secondCode := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 		body, res := submitVerificationCode(t, body, c, firstCode)
@@ -587,7 +587,7 @@ func TestVerification(t *testing.T) {
 		body := expectSuccess(t, nil, true, false, func(v url.Values) {
 			v.Set("email", verificationEmail)
 		})
-		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
+		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Use code")
 		code := testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 		body, res := submitVerificationCode(t, body, c, code)
@@ -597,7 +597,7 @@ func TestVerification(t *testing.T) {
 		body = expectSuccess(t, nil, true, false, func(v url.Values) {
 			v.Set("email", verificationEmail)
 		})
-		message = testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
+		message = testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Use code")
 		code = testhelpers.CourierExpectCodeInMessage(t, message, 1)
 
 		body, res = submitVerificationCode(t, body, c, code)
diff --git a/selfservice/strategy/code/stub/code-mfa.identity.schema.json b/selfservice/strategy/code/stub/code-mfa.identity.schema.json
new file mode 100644
index 000000000000..9ccdaa4cc8ed
--- /dev/null
+++ b/selfservice/strategy/code/stub/code-mfa.identity.schema.json
@@ -0,0 +1,50 @@
+{
+  "$id": "https://example.com/person.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Person",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "email1": {
+          "type": "string",
+          "format": "email",
+          "ory.sh/kratos": {
+            "credentials": {
+              "code": {
+                "identifier": true,
+                "via": "email"
+              }
+            }
+          }
+        },
+        "email2": {
+          "type": "string",
+          "format": "email",
+          "ory.sh/kratos": {
+            "credentials": {
+              "code": {
+                "identifier": true,
+                "via": "email"
+              }
+            }
+          }
+        },
+        "phone1": {
+          "type": "string",
+          "format": "tel",
+          "ory.sh/kratos": {
+            "credentials": {
+              "code": {
+                "identifier": true,
+                "via": "sms"
+              }
+            }
+          }
+        }
+      },
+      "required": []
+    }
+  }
+}
diff --git a/selfservice/strategy/code/stub/code.identity.schema.json b/selfservice/strategy/code/stub/code.identity.schema.json
index a7a4e4448442..ecbeb33574c5 100644
--- a/selfservice/strategy/code/stub/code.identity.schema.json
+++ b/selfservice/strategy/code/stub/code.identity.schema.json
@@ -58,13 +58,29 @@
             }
           }
         },
+        "phone_1": {
+          "type": "string",
+          "format": "tel",
+          "title": "Phone",
+          "ory.sh/kratos": {
+            "credentials": {
+              "code": {
+                "identifier": true,
+                "via": "sms"
+              }
+            },
+            "verification": {
+              "via": "sms"
+            }
+          }
+        },
         "tos": {
           "type": "boolean",
           "title": "Tos",
           "description": "Please accept the terms and conditions"
         }
       },
-      "required": ["email", "tos"]
+      "required": []
     }
   }
 }
diff --git a/selfservice/strategy/code/stub/default.schema.json b/selfservice/strategy/code/stub/default.schema.json
index 8dc923266050..f13da2b4d1da 100644
--- a/selfservice/strategy/code/stub/default.schema.json
+++ b/selfservice/strategy/code/stub/default.schema.json
@@ -13,6 +13,10 @@
             "credentials": {
               "password": {
                 "identifier": true
+              },
+              "code": {
+                "identifier": true,
+                "via": "email"
               }
             },
             "verification": {
diff --git a/selfservice/strategy/code/stub/no-code-id.schema.json b/selfservice/strategy/code/stub/no-code-id.schema.json
new file mode 100644
index 000000000000..3d2dee0d0bd0
--- /dev/null
+++ b/selfservice/strategy/code/stub/no-code-id.schema.json
@@ -0,0 +1,26 @@
+{
+  "$id": "https://example.com/person.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Person",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string",
+          "ory.sh/kratos": {
+            "credentials": {
+            },
+            "verification": {
+              "via": "email"
+            },
+            "recovery": {
+              "via": "email"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/selfservice/strategy/code/stub/no-code.schema.json b/selfservice/strategy/code/stub/no-code.schema.json
new file mode 100644
index 000000000000..8dc923266050
--- /dev/null
+++ b/selfservice/strategy/code/stub/no-code.schema.json
@@ -0,0 +1,29 @@
+{
+  "$id": "https://example.com/person.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Person",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string",
+          "ory.sh/kratos": {
+            "credentials": {
+              "password": {
+                "identifier": true
+              }
+            },
+            "verification": {
+              "via": "email"
+            },
+            "recovery": {
+              "via": "email"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/selfservice/strategy/code/test/persistence.go b/selfservice/strategy/code/test/persistence.go
index d7600e9fbd9a..975e63eb6ecc 100644
--- a/selfservice/strategy/code/test/persistence.go
+++ b/selfservice/strategy/code/test/persistence.go
@@ -5,6 +5,9 @@ package code
 
 import (
 	"context"
+	"errors"
+	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -113,13 +116,27 @@ func TestPersister(ctx context.Context, p interface {
 				_, err := p.CreateRecoveryCode(ctx, dto)
 				require.NoError(t, err)
 
-				for i := 1; i <= 5; i++ {
-					_, err = p.UseRecoveryCode(ctx, f.ID, "i-do-not-exist")
-					require.Error(t, err)
+				var tooOften, wrongCode int32
+				var wg sync.WaitGroup
+				for range 50 {
+					wg.Add(1)
+					go func() {
+						defer wg.Done()
+						_, err := p.UseRecoveryCode(ctx, f.ID, "i-do-not-exist")
+						if !assert.Error(t, err) {
+							return
+						}
+						if errors.Is(err, code.ErrCodeSubmittedTooOften) {
+							atomic.AddInt32(&tooOften, 1)
+						} else {
+							atomic.AddInt32(&wrongCode, 1)
+						}
+					}()
 				}
+				wg.Wait()
 
-				_, err = p.UseRecoveryCode(ctx, f.ID, "i-do-not-exist")
-				require.ErrorIs(t, err, code.ErrCodeSubmittedTooOften)
+				require.EqualValues(t, 50, wrongCode+tooOften, "all 50 attempts made")
+				require.LessOrEqual(t, wrongCode, int32(5), "max. 5 attempts have gone past the duplication check")
 
 				// Submit again, just to be sure
 				_, err = p.UseRecoveryCode(ctx, f.ID, "i-do-not-exist")
diff --git a/selfservice/strategy/idfirst/.schema/login.schema.json b/selfservice/strategy/idfirst/.schema/login.schema.json
new file mode 100644
index 000000000000..9e8be40eff58
--- /dev/null
+++ b/selfservice/strategy/idfirst/.schema/login.schema.json
@@ -0,0 +1,21 @@
+{
+  "$id": "https://schemas.ory.sh/kratos/selfservice/strategy/identity_disovery/login.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "csrf_token": {
+      "type": "string"
+    },
+    "identifier": {
+      "type": "string",
+      "minLength": 1
+    },
+    "method": {
+      "type": "string"
+    },
+    "transient_payload": {
+      "type": "object",
+      "additionalProperties": true
+    }
+  }
+}
diff --git a/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier.json b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_password.json b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_password.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_password.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_password.json b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_password.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_password.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options.json b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json
new file mode 100644
index 000000000000..4517b39e7474
--- /dev/null
+++ b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json
@@ -0,0 +1,55 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "identifier_first",
+    "attributes": {
+      "name": "identifier",
+      "type": "text",
+      "value": "",
+      "required": true,
+      "autocomplete": "username webauthn",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070004,
+        "text": "ID",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "identifier_first",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "identifier_first",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070009,
+        "text": "Continue",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh.json b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/idfirst/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/idfirst/schema.go b/selfservice/strategy/idfirst/schema.go
new file mode 100644
index 000000000000..77a0d37f54d7
--- /dev/null
+++ b/selfservice/strategy/idfirst/schema.go
@@ -0,0 +1,11 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package idfirst
+
+import (
+	_ "embed"
+)
+
+//go:embed .schema/login.schema.json
+var loginSchema []byte
diff --git a/selfservice/strategy/idfirst/strategy.go b/selfservice/strategy/idfirst/strategy.go
new file mode 100644
index 000000000000..792fff7bed95
--- /dev/null
+++ b/selfservice/strategy/idfirst/strategy.go
@@ -0,0 +1,69 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package idfirst
+
+import (
+	"context"
+
+	"github.com/go-playground/validator/v10"
+
+	"github.com/ory/kratos/driver/config"
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/session"
+	"github.com/ory/kratos/ui/node"
+	"github.com/ory/kratos/x"
+	"github.com/ory/x/decoderx"
+)
+
+type dependencies interface {
+	x.LoggingProvider
+	x.WriterProvider
+	x.CSRFTokenGeneratorProvider
+	x.CSRFProvider
+	x.TracingProvider
+
+	config.Provider
+
+	identity.PrivilegedPoolProvider
+	login.StrategyProvider
+	login.FlowPersistenceProvider
+}
+
+type Strategy struct {
+	d  dependencies
+	v  *validator.Validate
+	hd *decoderx.HTTP
+}
+
+func NewStrategy(d any) *Strategy {
+	return &Strategy{
+		d:  d.(dependencies),
+		v:  validator.New(),
+		hd: decoderx.NewHTTP(),
+	}
+}
+
+func (s *Strategy) CountActiveFirstFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+	return 0, nil
+}
+
+func (s *Strategy) CountActiveMultiFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+	return 0, nil
+}
+
+func (s *Strategy) ID() identity.CredentialsType {
+	return identity.CredentialsType(node.IdentifierFirstGroup)
+}
+
+func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context) session.AuthenticationMethod {
+	return session.AuthenticationMethod{
+		Method: s.ID(),
+		AAL:    identity.NoAuthenticatorAssuranceLevel,
+	}
+}
+
+func (s *Strategy) NodeGroup() node.UiNodeGroup {
+	return node.IdentifierFirstGroup
+}
diff --git a/selfservice/strategy/idfirst/strategy_login.go b/selfservice/strategy/idfirst/strategy_login.go
new file mode 100644
index 000000000000..edf83c487442
--- /dev/null
+++ b/selfservice/strategy/idfirst/strategy_login.go
@@ -0,0 +1,200 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package idfirst
+
+import (
+	"net/http"
+
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/ory/x/otelx"
+
+	"github.com/ory/kratos/schema"
+
+	"github.com/pkg/errors"
+
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/selfservice/flow"
+	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/session"
+	"github.com/ory/kratos/text"
+	"github.com/ory/kratos/ui/node"
+	"github.com/ory/kratos/x"
+	"github.com/ory/x/decoderx"
+	"github.com/ory/x/sqlcon"
+)
+
+var (
+	_                     login.FormHydrator = new(Strategy)
+	_                     login.Strategy     = new(Strategy)
+	ErrNoCredentialsFound                    = errors.New("no credentials found")
+)
+
+func (s *Strategy) handleLoginError(r *http.Request, f *login.Flow, payload updateLoginFlowWithIdentifierFirstMethod, err error) error {
+	if f != nil {
+		f.UI.Nodes.SetValueAttribute("identifier", payload.Identifier)
+		if f.Type == flow.TypeBrowser {
+			f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
+		}
+	}
+
+	return err
+}
+
+func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, _ *session.Session) (_ *identity.Identity, err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.idfirst.Strategy.Login")
+	defer otelx.End(span, &err)
+
+	if !s.d.Config().SelfServiceLoginFlowIdentifierFirstEnabled(ctx) {
+		span.SetAttributes(attribute.String("not_responsible_reason", "strategy is not enabled"))
+		return nil, errors.WithStack(flow.ErrStrategyNotResponsible)
+	}
+
+	if err := login.CheckAAL(f, identity.AuthenticatorAssuranceLevel1); err != nil {
+		span.SetAttributes(attribute.String("not_responsible_reason", "requested AAL is not sufficient"))
+		return nil, err
+	}
+
+	var p updateLoginFlowWithIdentifierFirstMethod
+	if err := s.hd.Decode(r, &p,
+		decoderx.HTTPDecoderSetValidatePayloads(true),
+		decoderx.MustHTTPRawJSONSchemaCompiler(loginSchema),
+		decoderx.HTTPDecoderJSONFollowsFormFormat()); err != nil {
+		return nil, s.handleLoginError(r, f, p, err)
+	}
+	f.TransientPayload = p.TransientPayload
+
+	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+		return nil, s.handleLoginError(r, f, p, err)
+	}
+
+	var opts []login.FormHydratorModifier
+
+	// Look up the user by the identifier.
+	identityHint, err := s.d.PrivilegedIdentityPool().FindIdentityByCredentialIdentifier(ctx, p.Identifier,
+		// We are dealing with user input -> lookup should be case-insensitive.
+		false,
+	)
+	if errors.Is(err, sqlcon.ErrNoRows) {
+		// If the user is not found, we still want to potentially show the UI for some method. That's why we don't exit here.
+		// We have to mitigate account enumeration. So we continue without setting the identity hint.
+		//
+		// This will later be handled by `didPopulate`.
+	} else if err != nil {
+		// An error happened during lookup
+		return nil, s.handleLoginError(r, f, p, err)
+	} else if !s.d.Config().SecurityAccountEnumerationMitigate(ctx) {
+		// Hydrate credentials
+		if err := s.d.PrivilegedIdentityPool().HydrateIdentityAssociations(ctx, identityHint, identity.ExpandCredentials); err != nil {
+			return nil, s.handleLoginError(r, f, p, err)
+		}
+	}
+
+	f.UI.ResetMessages()
+	f.UI.Nodes.SetValueAttribute("identifier", p.Identifier)
+
+	// Add identity hint
+	opts = append(opts, login.WithIdentityHint(identityHint))
+	opts = append(opts, login.WithIdentifier(p.Identifier))
+
+	didPopulate := false
+	for _, ls := range s.d.LoginStrategies(ctx) {
+		populator, ok := ls.(login.FormHydrator)
+		if !ok {
+			continue
+		}
+
+		if err := populator.PopulateLoginMethodIdentifierFirstCredentials(r, f, opts...); errors.Is(err, login.ErrBreakLoginPopulate) {
+			didPopulate = true
+			break
+		} else if errors.Is(err, ErrNoCredentialsFound) {
+			// This strategy is not responsible for this flow. We do not set didPopulate to true if that happens.
+		} else if err != nil {
+			return nil, s.handleLoginError(r, f, p, err)
+		} else {
+			didPopulate = true
+		}
+	}
+
+	// If no strategy populated, it means that the account (very likely) does not exist. We show a user not found error,
+	// but only if account enumeration mitigation is disabled. Otherwise, we proceed to render the rest of the form.
+	if !didPopulate && !s.d.Config().SecurityAccountEnumerationMitigate(ctx) {
+		return nil, s.handleLoginError(r, f, p, errors.WithStack(schema.NewAccountNotFoundError()))
+	}
+
+	// We found credentials - hide the identifier.
+	f.UI.GetNodes().RemoveMatching(node.NewInputField("method", s.ID(), s.NodeGroup(), node.InputAttributeTypeSubmit))
+
+	// We set the identifier to hidden, so it's still available in the form but not visible to the user.
+	for k, n := range f.UI.Nodes {
+		if n.ID() != "identifier" {
+			continue
+		}
+
+		attrs, ok := f.UI.Nodes[k].Attributes.(*node.InputAttributes)
+		if !ok {
+			continue
+		}
+		attrs.Autocomplete = "username webauthn"
+
+		attrs.Type = node.InputAttributeTypeHidden
+		f.UI.Nodes[k].Attributes = attrs
+	}
+
+	f.Active = s.ID()
+	if err = s.d.LoginFlowPersister().UpdateLoginFlow(ctx, f); err != nil {
+		return nil, s.handleLoginError(r, f, p, err)
+	}
+
+	if x.IsJSONRequest(r) {
+		s.d.Writer().WriteCode(w, r, http.StatusBadRequest, f)
+	} else {
+		http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowLoginUI(ctx)).String(), http.StatusSeeOther)
+	}
+
+	return nil, flow.ErrCompletedByStrategy
+}
+
+func (s *Strategy) PopulateLoginMethodFirstFactorRefresh(r *http.Request, sr *login.Flow) error {
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodFirstFactor(r *http.Request, sr *login.Flow) error {
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactor(r *http.Request, sr *login.Flow) error {
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactorRefresh(r *http.Request, sr *login.Flow) error {
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstIdentification(r *http.Request, f *login.Flow) error {
+	f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
+
+	ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(r.Context())
+	if err != nil {
+		return err
+	}
+
+	identifierLabel, err := login.GetIdentifierLabelFromSchema(r.Context(), ds.String())
+	if err != nil {
+		return err
+	}
+
+	f.UI.SetNode(node.NewInputField("identifier", "", s.NodeGroup(), node.InputAttributeTypeText, node.WithInputAttributes(func(a *node.InputAttributes) {
+		a.Autocomplete = "username webauthn"
+		a.Required = true
+	})).WithMetaLabel(identifierLabel))
+	f.UI.GetNodes().Append(node.NewInputField("method", s.ID(), s.NodeGroup(), node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoNodeLabelContinue()))
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstCredentials(_ *http.Request, f *login.Flow, opts ...login.FormHydratorModifier) error {
+	return ErrNoCredentialsFound
+}
+
+func (s *Strategy) RegisterLoginRoutes(_ *x.RouterPublic) {}
diff --git a/selfservice/strategy/idfirst/strategy_login_test.go b/selfservice/strategy/idfirst/strategy_login_test.go
new file mode 100644
index 000000000000..d8c31bdeb786
--- /dev/null
+++ b/selfservice/strategy/idfirst/strategy_login_test.go
@@ -0,0 +1,594 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package idfirst_test
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/ory/kratos/selfservice/strategy/oidc"
+
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+
+	configtesthelpers "github.com/ory/kratos/driver/config/testhelpers"
+
+	"github.com/gofrs/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/tidwall/gjson"
+
+	kratos "github.com/ory/kratos/internal/httpclient"
+	"github.com/ory/kratos/text"
+	"github.com/ory/kratos/x"
+	"github.com/ory/x/assertx"
+	"github.com/ory/x/ioutilx"
+	"github.com/ory/x/urlx"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/driver/config"
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/internal"
+	"github.com/ory/kratos/internal/testhelpers"
+	"github.com/ory/kratos/selfservice/flow"
+	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/ui/node"
+	"github.com/ory/x/snapshotx"
+)
+
+//go:embed stub/default.schema.json
+var loginSchema []byte
+
+func TestCompleteLogin(t *testing.T) {
+	ctx := context.Background()
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+
+	// We enable the password method to test the identifier first strategy
+
+	// ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypePassword), map[string]interface{}{"enabled": true})
+	conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypePassword), map[string]interface{}{"enabled": true})
+
+	// ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceLoginFlowStyle, "identifier_first")
+	conf.MustSet(ctx, config.ViperKeySelfServiceLoginFlowStyle, "identifier_first")
+
+	router := x.NewRouterPublic()
+	publicTS, _ := testhelpers.NewKratosServerWithRouters(t, reg, router, x.NewRouterAdmin())
+
+	errTS := testhelpers.NewErrorTestServer(t, reg)
+	uiTS := testhelpers.NewLoginUIFlowEchoServer(t, reg)
+	redirTS := testhelpers.NewRedirSessionEchoTS(t, reg)
+
+	// Overwrite these two:
+	// ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceErrorUI, errTS.URL+"/error-ts")
+	conf.MustSet(ctx, config.ViperKeySelfServiceErrorUI, errTS.URL+"/error-ts")
+
+	// ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceLoginUI, uiTS.URL+"/login-ts")
+	conf.MustSet(ctx, config.ViperKeySelfServiceLoginUI, uiTS.URL+"/login-ts")
+
+	// ctx = testhelpers.WithDefaultIdentitySchemaFromRaw(ctx, loginSchema)
+	testhelpers.SetDefaultIdentitySchemaFromRaw(conf, loginSchema)
+
+	// ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySecretsDefault, []string{"not-a-secure-session-key"})
+	conf.MustSet(ctx, config.ViperKeySecretsDefault, []string{"not-a-secure-session-key"})
+
+	//ensureFieldsExist := func(t *testing.T, body []byte) {
+	//	registrationhelpers.CheckFormContent(t, body, "identifier",
+	//		"password",
+	//		"csrf_token")
+	//}
+
+	apiClient := testhelpers.NewDebugClient(t)
+
+	t.Run("case=should show the error ui because the request payload is malformed", func(t *testing.T) {
+		t.Run("type=api", func(t *testing.T) {
+			f := testhelpers.InitializeLoginFlowViaAPIWithContext(t, ctx, apiClient, publicTS, false)
+
+			body, res := testhelpers.LoginMakeRequestWithContext(t, ctx, true, false, f, apiClient, "14=)=!(%)$/ZP()GHIÖ")
+			assert.Contains(t, res.Request.URL.String(), publicTS.URL+login.RouteSubmitFlow)
+			assert.NotEmpty(t, gjson.Get(body, "id").String(), "%s", body)
+			assert.Contains(t, body, `Expected JSON sent in request body to be an object but got: Number`)
+		})
+
+		t.Run("type=browser", func(t *testing.T) {
+			browserClient := testhelpers.NewClientWithCookies(t)
+			f := testhelpers.InitializeLoginFlowViaBrowser(t, browserClient, publicTS, false, false, false, false, testhelpers.InitFlowWithContext(ctx))
+
+			body, res := testhelpers.LoginMakeRequestWithContext(t, ctx, false, false, f, browserClient, "14=)=!(%)$/ZP()GHIÖ")
+			assert.Contains(t, res.Request.URL.String(), uiTS.URL+"/login-ts")
+			assert.NotEmpty(t, gjson.Get(body, "id").String(), "%s", body)
+			assert.Contains(t, gjson.Get(body, "ui.messages.0.text").String(), "invalid URL escape", "%s", body)
+		})
+
+		t.Run("type=spa", func(t *testing.T) {
+			browserClient := testhelpers.NewClientWithCookies(t)
+			f := testhelpers.InitializeLoginFlowViaBrowser(t, browserClient, publicTS, false, true, false, false, testhelpers.InitFlowWithContext(ctx))
+
+			body, res := testhelpers.LoginMakeRequestWithContext(t, ctx, false, true, f, browserClient, "14=)=!(%)$/ZP()GHIÖ")
+			assert.Contains(t, res.Request.URL.String(), publicTS.URL+login.RouteSubmitFlow)
+			assert.NotEmpty(t, gjson.Get(body, "id").String(), "%s", body)
+			assert.Contains(t, gjson.Get(body, "ui.messages.0.text").String(), "invalid URL escape", "%s", body)
+		})
+	})
+
+	t.Run("case=should fail because identifier first can not handle AAL2", func(t *testing.T) {
+		f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false)
+
+		update, err := reg.LoginFlowPersister().GetLoginFlow(context.Background(), uuid.FromStringOrNil(f.Id))
+		require.NoError(t, err)
+		update.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+		require.NoError(t, reg.LoginFlowPersister().UpdateLoginFlow(context.Background(), update))
+
+		req, err := http.NewRequest("POST", f.Ui.Action, bytes.NewBufferString(`{"method":"identifier_first"}`))
+		require.NoError(t, err)
+		req.Header.Set("Accept", "application/json")
+		req.Header.Set("Content-Type", "application/json")
+
+		actual, res := testhelpers.MockMakeAuthenticatedRequest(t, reg, conf, router.Router, req)
+		assert.Contains(t, res.Request.URL.String(), publicTS.URL+login.RouteSubmitFlow)
+		assert.Equal(t, text.NewErrorValidationLoginNoStrategyFound().Text, gjson.GetBytes(actual, "ui.messages.0.text").String())
+	})
+
+	t.Run("should return an error because the request does not exist", func(t *testing.T) {
+		check := func(t *testing.T, actual string) {
+			assert.Equal(t, int64(http.StatusNotFound), gjson.Get(actual, "code").Int(), "%s", actual)
+			assert.Equal(t, "Not Found", gjson.Get(actual, "status").String(), "%s", actual)
+			assert.Contains(t, gjson.Get(actual, "message").String(), "Unable to locate the resource", "%s", actual)
+		}
+
+		fakeFlow := &kratos.LoginFlow{
+			Ui: kratos.UiContainer{
+				Action: publicTS.URL + login.RouteSubmitFlow + "?flow=" + x.NewUUID().String(),
+			},
+		}
+
+		t.Run("type=api", func(t *testing.T) {
+			actual, res := testhelpers.LoginMakeRequestWithContext(t, ctx, true, false, fakeFlow, apiClient, "{}")
+			assert.Len(t, res.Cookies(), 0)
+			assert.Contains(t, res.Request.URL.String(), publicTS.URL+login.RouteSubmitFlow)
+			check(t, gjson.Get(actual, "error").Raw)
+		})
+
+		t.Run("type=browser", func(t *testing.T) {
+			browserClient := testhelpers.NewClientWithCookies(t)
+			actual, res := testhelpers.LoginMakeRequestWithContext(t, ctx, false, false, fakeFlow, browserClient, "")
+			assert.Contains(t, res.Request.URL.String(), errTS.URL)
+			check(t, actual)
+		})
+
+		t.Run("type=api", func(t *testing.T) {
+			actual, res := testhelpers.LoginMakeRequestWithContext(t, ctx, false, true, fakeFlow, apiClient, "{}")
+			assert.Len(t, res.Cookies(), 0)
+			assert.Contains(t, res.Request.URL.String(), publicTS.URL+login.RouteSubmitFlow)
+			check(t, gjson.Get(actual, "error").Raw)
+		})
+	})
+
+	t.Run("case=should return an error because the request is expired", func(t *testing.T) {
+		conf.MustSet(ctx, config.ViperKeySelfServiceLoginRequestLifespan, time.Millisecond*30)
+		conf.MustSet(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+		t.Cleanup(func() {
+			conf.MustSet(ctx, config.ViperKeySelfServiceLoginRequestLifespan, time.Hour)
+			conf.MustSet(ctx, config.ViperKeySecurityAccountEnumerationMitigate, nil)
+		})
+
+		values := url.Values{
+			"csrf_token": {x.FakeCSRFToken},
+			"identifier": {"identifier"},
+			"method":     {"identifier_first"},
+		}
+
+		t.Run("type=api", func(t *testing.T) {
+			f := testhelpers.InitializeLoginFlowViaAPIWithContext(t, ctx, apiClient, publicTS, false)
+
+			time.Sleep(time.Millisecond * 60)
+			actual, res := testhelpers.LoginMakeRequestWithContext(t, ctx, true, false, f, apiClient, testhelpers.EncodeFormAsJSON(t, true, values))
+			assert.Contains(t, res.Request.URL.String(), publicTS.URL+login.RouteSubmitFlow)
+			assert.NotEqual(t, "00000000-0000-0000-0000-000000000000", gjson.Get(actual, "use_flow_id").String())
+			assertx.EqualAsJSONExcept(t, flow.NewFlowExpiredError(time.Now()), json.RawMessage(actual), []string{"use_flow_id", "since", "expired_at"}, "expired", "%s", actual)
+		})
+
+		t.Run("type=browser", func(t *testing.T) {
+			browserClient := testhelpers.NewClientWithCookies(t)
+			f := testhelpers.InitializeLoginFlowViaBrowser(t, browserClient, publicTS, false, false, false, false)
+
+			time.Sleep(time.Millisecond * 60)
+			actual, res := testhelpers.LoginMakeRequestWithContext(t, ctx, false, false, f, browserClient, values.Encode())
+			assert.Contains(t, res.Request.URL.String(), uiTS.URL+"/login-ts")
+			assert.NotEqual(t, f.Id, gjson.Get(actual, "id").String(), "%s", actual)
+			assert.Contains(t, gjson.Get(actual, "ui.messages.0.text").String(), "expired", "%s", actual)
+		})
+
+		t.Run("type=SPA", func(t *testing.T) {
+			browserClient := testhelpers.NewClientWithCookies(t)
+			f := testhelpers.InitializeLoginFlowViaBrowser(t, browserClient, publicTS, false, true, false, false)
+
+			time.Sleep(time.Millisecond * 60)
+			actual, res := testhelpers.LoginMakeRequestWithContext(t, ctx, false, true, f, apiClient, testhelpers.EncodeFormAsJSON(t, true, values))
+			assert.Contains(t, res.Request.URL.String(), publicTS.URL+login.RouteSubmitFlow)
+			assert.NotEqual(t, "00000000-0000-0000-0000-000000000000", gjson.Get(actual, "use_flow_id").String())
+			assertx.EqualAsJSONExcept(t, flow.NewFlowExpiredError(time.Now()), json.RawMessage(actual), []string{"use_flow_id", "since", "expired_at"}, "expired", "%s", actual)
+		})
+	})
+
+	t.Run("case=should have correct CSRF behavior", func(t *testing.T) {
+		conf.MustSet(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+		t.Cleanup(func() {
+			conf.MustSet(ctx, config.ViperKeySecurityAccountEnumerationMitigate, nil)
+		})
+
+		values := url.Values{
+			"method":     {"identifier_first"},
+			"csrf_token": {"invalid_token"},
+			"identifier": {"login-identifier-csrf-browser"},
+		}
+
+		t.Run("case=should fail because of missing CSRF token/type=browser", func(t *testing.T) {
+			browserClient := testhelpers.NewClientWithCookies(t)
+			f := testhelpers.InitializeLoginFlowViaBrowser(t, browserClient, publicTS, false, false, false, false)
+
+			actual, res := testhelpers.LoginMakeRequest(t, false, false, f, browserClient, values.Encode())
+			assert.EqualValues(t, http.StatusOK, res.StatusCode)
+			assertx.EqualAsJSON(t, x.ErrInvalidCSRFToken,
+				json.RawMessage(actual), "%s", actual)
+		})
+
+		t.Run("case=should fail because of missing CSRF token/type=spa", func(t *testing.T) {
+			browserClient := testhelpers.NewClientWithCookies(t)
+			f := testhelpers.InitializeLoginFlowViaBrowser(t, browserClient, publicTS, false, true, false, false)
+
+			actual, res := testhelpers.LoginMakeRequest(t, false, true, f, browserClient, values.Encode())
+			assert.EqualValues(t, http.StatusForbidden, res.StatusCode)
+			assertx.EqualAsJSON(t, x.ErrInvalidCSRFToken,
+				json.RawMessage(gjson.Get(actual, "error").Raw), "%s", actual)
+		})
+
+		t.Run("case=should pass even without CSRF token/type=api", func(t *testing.T) {
+			f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false)
+
+			actual, res := testhelpers.LoginMakeRequest(t, true, false, f, apiClient, testhelpers.EncodeFormAsJSON(t, true, values))
+			assert.EqualValues(t, http.StatusBadRequest, res.StatusCode)
+			assert.Contains(t, actual, "1010022")
+		})
+
+		t.Run("case=should fail with correct CSRF error cause/type=api", func(t *testing.T) {
+			for k, tc := range []struct {
+				mod func(http.Header)
+				exp string
+			}{
+				{
+					mod: func(h http.Header) {
+						h.Add("Cookie", "name=bar")
+					},
+					exp: "The HTTP Request Header included the \\\"Cookie\\\" key",
+				},
+				{
+					mod: func(h http.Header) {
+						h.Add("Origin", "www.bar.com")
+					},
+					exp: "The HTTP Request Header included the \\\"Origin\\\" key",
+				},
+			} {
+				t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
+					f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false)
+
+					req := testhelpers.NewRequest(t, true, "POST", f.Ui.Action, bytes.NewBufferString(testhelpers.EncodeFormAsJSON(t, true, values)))
+					tc.mod(req.Header)
+
+					res, err := apiClient.Do(req)
+					require.NoError(t, err)
+					defer res.Body.Close()
+
+					actual := string(ioutilx.MustReadAll(res.Body))
+					assert.EqualValues(t, http.StatusBadRequest, res.StatusCode)
+					assert.Contains(t, actual, tc.exp)
+				})
+			}
+		})
+	})
+
+	expectValidationError := func(t *testing.T, isAPI, refresh, isSPA bool, values func(url.Values)) string {
+		return testhelpers.SubmitLoginForm(t, isAPI, nil, publicTS, values,
+			isSPA, refresh,
+			testhelpers.ExpectStatusCode(isAPI || isSPA, http.StatusBadRequest, http.StatusOK),
+			testhelpers.ExpectURL(isAPI || isSPA, publicTS.URL+login.RouteSubmitFlow, conf.SelfServiceFlowLoginUI(ctx).String()))
+	}
+
+	t.Run("should return an error because the user does not exist", func(t *testing.T) {
+		// In this test we check if the account mitigation behaves correctly by enabling all login strategies EXCEPT
+		// for the passwordless code strategy. That is because this strategy always shows the login button.
+
+		testhelpers.StrategyEnable(t, conf, identity.CredentialsTypePassword.String(), true)
+
+		testhelpers.StrategyEnable(t, conf, identity.CredentialsTypeOIDC.String(), true)
+		conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeOIDC)+".config", &oidc.ConfigurationCollection{Providers: []oidc.Configuration{
+			{
+				ID:           "google",
+				Provider:     "google",
+				Label:        "Google",
+				ClientID:     "a",
+				ClientSecret: "b",
+				Mapper:       "file://",
+			},
+		}})
+
+		testhelpers.StrategyEnable(t, conf, identity.CredentialsTypeWebAuthn.String(), true)
+		conf.MustSet(ctx, config.ViperKeyWebAuthnPasswordless, true)
+		conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeWebAuthn)+".config.rp.display_name", "Ory Corp")
+		conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeWebAuthn)+".config.rp.id", "localhost")
+		conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeWebAuthn)+".config.rp.origin", "http://localhost:4455")
+
+		testhelpers.StrategyEnable(t, conf, identity.CredentialsTypePasskey.String(), true)
+		conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypePasskey)+".enabled", true)
+		conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypePasskey)+".config.rp.display_name", "Ory Corp")
+		conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypePasskey)+".config.rp.id", "localhost")
+		conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypePasskey)+".config.rp.origins", []string{"http://localhost:4455"})
+
+		t.Cleanup(func() {
+			conf.MustSet(ctx, "selfservice.methods.password", nil)
+			conf.MustSet(ctx, "selfservice.methods.oidc", nil)
+			conf.MustSet(ctx, "selfservice.methods.passkey", nil)
+			conf.MustSet(ctx, "selfservice.methods.webauthn", nil)
+			conf.MustSet(ctx, "selfservice.methods.code", nil)
+		})
+
+		t.Run("account enumeration mitigation enabled", func(t *testing.T) {
+			conf.MustSet(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+
+			t.Cleanup(func() {
+				conf.MustSet(ctx, config.ViperKeySecurityAccountEnumerationMitigate, nil)
+			})
+
+			check := func(t *testing.T, body string, isAPI bool) {
+				t.Logf("%s", body)
+				if !isAPI {
+					assert.Contains(t, body, fmt.Sprintf("%d", text.InfoSelfServiceLoginWebAuthn), "we do expect to see a webauthn trigger:\n%s", body)
+					assert.Contains(t, body, fmt.Sprintf("%d", text.InfoSelfServiceLoginPasskey), "we do expect to see a passkey trigger button:\n%s", body)
+				}
+
+				assert.Equal(t, "hidden", gjson.Get(body, "ui.nodes.#(attributes.name==identifier).attributes.type").String(), "identifier is hidden to appear that we found an identity even though we did not")
+
+				assert.NotContains(t, body, text.NewErrorValidationAccountNotFound().Text, "we do not expect to see an account not found error:\n%s", body)
+
+				assert.Contains(t, body, fmt.Sprintf("%d", text.InfoSelfServiceLoginPassword), "we do expect to see a password trigger:\n%s", body)
+
+				// We do expect to see the same social sign in buttons that were on the first page:
+				assert.Contains(t, body, fmt.Sprintf("%d", text.InfoSelfServiceLoginWith), "we do expect to see a oidc trigger:\n%s", body)
+				assert.Contains(t, body, "google", "we do expect to see a google trigger:\n%s", body)
+			}
+
+			values := func(v url.Values) {
+				v.Set("identifier", "identifier")
+				v.Set("method", "identifier_first")
+			}
+
+			t.Run("type=browser", func(t *testing.T) {
+				check(t, expectValidationError(t, false, false, false, values), false)
+			})
+
+			t.Run("type=SPA", func(t *testing.T) {
+				check(t, expectValidationError(t, false, false, true, values), false)
+			})
+
+			t.Run("type=api", func(t *testing.T) {
+				check(t, expectValidationError(t, true, false, false, values), true)
+			})
+		})
+
+		t.Run("account enumeration mitigation disabled", func(t *testing.T) {
+			conf.MustSet(ctx, config.ViperKeySecurityAccountEnumerationMitigate, false)
+			t.Cleanup(func() {
+				conf.MustSet(ctx, config.ViperKeySecurityAccountEnumerationMitigate, nil)
+			})
+
+			check := func(t *testing.T, body string) {
+				t.Logf("%s", body)
+
+				assert.NotEmpty(t, gjson.Get(body, "id").String(), "%s", body)
+				assert.Contains(t, gjson.Get(body, "ui.action").String(), publicTS.URL+login.RouteSubmitFlow, "%s", body)
+				assert.Contains(t, body, text.NewErrorValidationAccountNotFound().Text, "we do expect to see an error that the account does not exist: %s", body)
+
+				assert.Equal(t, "text", gjson.Get(body, "ui.nodes.#(attributes.name==identifier).attributes.type").String(), "identifier is not hidden and we can see the input field as well")
+
+				assert.NotContains(t, body, fmt.Sprintf("%d", text.InfoSelfServiceLoginPasskey), "we do not expect to see a passkey trigger button: %s", body)
+				assert.NotContains(t, body, fmt.Sprintf("%d", text.InfoSelfServiceLoginWebAuthn), "we do not expect to see a webauthn trigger: %s", body)
+				assert.NotContains(t, body, fmt.Sprintf("%d", text.InfoSelfServiceLoginPassword), "we do not expect to see a password trigger: %s", body)
+
+				assert.NotContains(t, body, fmt.Sprintf("%d", text.InfoSelfServiceLoginWith), "we do not expect to see a oidc trigger: %s", body)
+				assert.NotContains(t, body, "google", "we do not expect to see a google trigger: %s", body)
+			}
+
+			values := func(v url.Values) {
+				v.Set("identifier", "identifier")
+				v.Set("method", "identifier_first")
+			}
+
+			t.Run("type=browser", func(t *testing.T) {
+				check(t, expectValidationError(t, false, false, false, values))
+			})
+
+			t.Run("type=SPA", func(t *testing.T) {
+				check(t, expectValidationError(t, false, false, true, values))
+			})
+
+			t.Run("type=api", func(t *testing.T) {
+				check(t, expectValidationError(t, true, false, false, values))
+			})
+		})
+	})
+
+	t.Run("should pass with real request", func(t *testing.T) {
+		identifier, pwd := x.NewUUID().String(), "password"
+		createIdentity(ctx, reg, t, identifier, pwd)
+
+		firstValues := func(v url.Values) {
+			v.Set("identifier", identifier)
+			v.Set("method", "identifier_first")
+		}
+
+		secondValues := func(v url.Values) {
+			v.Set("identifier", identifier)
+			v.Set("password", pwd)
+			v.Set("method", "password")
+		}
+
+		t.Run("type=browser", func(t *testing.T) {
+			browserClient := testhelpers.NewClientWithCookies(t)
+
+			secondStep := testhelpers.SubmitLoginForm(t, false, browserClient, publicTS, firstValues,
+				true, false, http.StatusBadRequest, publicTS.URL+login.RouteSubmitFlow)
+			t.Logf("secondStep: %s", secondStep)
+			assert.Contains(t, secondStep, "current-password")
+			assert.Contains(t, secondStep, `"value":"password"`)
+
+			body := testhelpers.SubmitLoginForm(t, false, browserClient, publicTS, secondValues,
+				false, false, http.StatusOK, redirTS.URL)
+
+			assert.Equal(t, identifier, gjson.Get(body, "identity.traits.subject").String(), "%s", body)
+		})
+
+		t.Run("type=spa", func(t *testing.T) {
+			hc := testhelpers.NewClientWithCookies(t)
+
+			secondStep := testhelpers.SubmitLoginForm(t, false, hc, publicTS, firstValues,
+				true, false, http.StatusBadRequest, publicTS.URL+login.RouteSubmitFlow)
+			t.Logf("secondStep: %s", secondStep)
+			assert.Contains(t, secondStep, "current-password")
+			assert.Contains(t, secondStep, `"value":"password"`)
+
+			body := testhelpers.SubmitLoginForm(t, false, hc, publicTS, secondValues,
+				true, false, http.StatusOK, publicTS.URL+login.RouteSubmitFlow)
+
+			assert.Equal(t, identifier, gjson.Get(body, "session.identity.traits.subject").String(), "%s", body)
+			assert.Empty(t, gjson.Get(body, "session_token").String(), "%s", body)
+			assert.Empty(t, gjson.Get(body, "session.token").String(), "%s", body)
+
+			// Was the session cookie set?
+			require.NotEmpty(t, hc.Jar.Cookies(urlx.ParseOrPanic(publicTS.URL)), "%+v", hc.Jar)
+		})
+
+		t.Run("type=api", func(t *testing.T) {
+			secondStep := testhelpers.SubmitLoginForm(t, true, nil, publicTS, firstValues,
+				false, false, http.StatusBadRequest, publicTS.URL+login.RouteSubmitFlow)
+			t.Logf("secondStep: %s", secondStep)
+			assert.Contains(t, secondStep, "current-password")
+			assert.Contains(t, secondStep, `"value":"password"`)
+
+			body := testhelpers.SubmitLoginForm(t, true, nil, publicTS, secondValues,
+				false, false, http.StatusOK, publicTS.URL+login.RouteSubmitFlow)
+
+			assert.Equal(t, identifier, gjson.Get(body, "session.identity.traits.subject").String(), "%s", body)
+			st := gjson.Get(body, "session_token").String()
+			assert.NotEmpty(t, st, "%s", body)
+		})
+	})
+}
+
+func TestFormHydration(t *testing.T) {
+	ctx := context.Background()
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceLoginFlowStyle, "identifier_first")
+
+	ctx = testhelpers.WithDefaultIdentitySchema(ctx, "file://./stub/default.schema.json")
+	s, err := reg.AllLoginStrategies().Strategy(identity.CredentialsType(node.IdentifierFirstGroup))
+	require.NoError(t, err)
+	fh, ok := s.(login.FormHydrator)
+	require.True(t, ok)
+
+	toSnapshot := func(t *testing.T, f *login.Flow) {
+		t.Helper()
+		// The CSRF token has a unique value that messes with the snapshot - ignore it.
+		f.UI.Nodes.ResetNodes("csrf_token")
+		snapshotx.SnapshotT(t, f.UI.Nodes)
+	}
+	newFlow := func(ctx context.Context, t *testing.T) (*http.Request, *login.Flow) {
+		r := httptest.NewRequest("GET", "/self-service/login/browser", nil)
+		r = r.WithContext(ctx)
+		t.Helper()
+		f, err := login.NewFlow(conf, time.Minute, "csrf_token", r, flow.TypeBrowser)
+		require.NoError(t, err)
+		return r, f
+	}
+
+	t.Run("method=PopulateLoginMethodSecondFactor", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+		require.NoError(t, fh.PopulateLoginMethodSecondFactor(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodFirstFactor", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodFirstFactor(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodFirstFactorRefresh", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodRefresh", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodSecondFactorRefresh(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstCredentials", func(t *testing.T) {
+		t.Run("case=no options", func(t *testing.T) {
+			r, f := newFlow(ctx, t)
+			require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=WithIdentifier", func(t *testing.T) {
+			r, f := newFlow(ctx, t)
+			require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=WithIdentityHint", func(t *testing.T) {
+			t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+
+				id := identity.NewIdentity("default")
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+
+			t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, false)
+
+				t.Run("case=identity has password", func(t *testing.T) {
+					id := identity.NewIdentity("default")
+
+					r, f := newFlow(ctx, t)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+
+				t.Run("case=identity does not have a password", func(t *testing.T) {
+					id := identity.NewIdentity("default")
+					r, f := newFlow(ctx, t)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+			})
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstIdentification", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodIdentifierFirstIdentification(r, f))
+		toSnapshot(t, f)
+	})
+}
diff --git a/selfservice/strategy/idfirst/strategy_test.go b/selfservice/strategy/idfirst/strategy_test.go
new file mode 100644
index 000000000000..9a05358d25cf
--- /dev/null
+++ b/selfservice/strategy/idfirst/strategy_test.go
@@ -0,0 +1,90 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package idfirst_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/driver"
+	"github.com/ory/kratos/x"
+	"github.com/ory/x/sqlxx"
+
+	"github.com/ory/kratos/internal"
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+	"github.com/ory/kratos/ui/node"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/ory/kratos/identity"
+)
+
+func TestCountActiveFirstFactorCredentials(t *testing.T) {
+	_, reg := internal.NewFastRegistryWithMocks(t)
+	s := idfirst.NewStrategy(reg)
+	cc := make(map[identity.CredentialsType]identity.Credentials)
+
+	count, err := s.CountActiveFirstFactorCredentials(cc)
+	assert.NoError(t, err)
+	assert.Equal(t, 0, count)
+}
+
+func TestCountActiveMultiFactorCredentials(t *testing.T) {
+	_, reg := internal.NewFastRegistryWithMocks(t)
+	s := idfirst.NewStrategy(reg)
+	cc := make(map[identity.CredentialsType]identity.Credentials)
+
+	count, err := s.CountActiveMultiFactorCredentials(cc)
+	assert.NoError(t, err)
+	assert.Equal(t, 0, count)
+}
+
+func TestCompletedAuthenticationMethod(t *testing.T) {
+	_, reg := internal.NewFastRegistryWithMocks(t)
+	s := idfirst.NewStrategy(reg)
+	ctx := context.Background()
+
+	method := s.CompletedAuthenticationMethod(ctx)
+	assert.Equal(t, s.ID(), method.Method)
+	assert.Equal(t, identity.NoAuthenticatorAssuranceLevel, method.AAL)
+}
+
+func TestNodeGroup(t *testing.T) {
+	_, reg := internal.NewFastRegistryWithMocks(t)
+	s := idfirst.NewStrategy(reg)
+
+	group := s.NodeGroup()
+	assert.Equal(t, node.IdentifierFirstGroup, group)
+}
+
+func createIdentity(ctx context.Context, reg *driver.RegistryDefault, t *testing.T, identifier, password string) *identity.Identity {
+	p, _ := reg.Hasher(ctx).Generate(context.Background(), []byte(password))
+	iId := x.NewUUID()
+	id := &identity.Identity{
+		ID:     iId,
+		Traits: identity.Traits(fmt.Sprintf(`{"subject":"%s"}`, identifier)),
+		Credentials: map[identity.CredentialsType]identity.Credentials{
+			identity.CredentialsTypePassword: {
+				Type:        identity.CredentialsTypePassword,
+				Identifiers: []string{identifier},
+				Config:      sqlxx.JSONRawMessage(`{"hashed_password":"` + string(p) + `"}`),
+			},
+		},
+		VerifiableAddresses: []identity.VerifiableAddress{
+			{
+				ID:         x.NewUUID(),
+				Value:      identifier,
+				Verified:   false,
+				CreatedAt:  time.Now(),
+				IdentityID: iId,
+			},
+		},
+	}
+	require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), id))
+	return id
+}
diff --git a/selfservice/strategy/idfirst/stub/default.schema.json b/selfservice/strategy/idfirst/stub/default.schema.json
new file mode 100644
index 000000000000..8dc923266050
--- /dev/null
+++ b/selfservice/strategy/idfirst/stub/default.schema.json
@@ -0,0 +1,29 @@
+{
+  "$id": "https://example.com/person.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Person",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string",
+          "ory.sh/kratos": {
+            "credentials": {
+              "password": {
+                "identifier": true
+              }
+            },
+            "verification": {
+              "via": "email"
+            },
+            "recovery": {
+              "via": "email"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/selfservice/strategy/idfirst/types.go b/selfservice/strategy/idfirst/types.go
new file mode 100644
index 000000000000..a8838043782a
--- /dev/null
+++ b/selfservice/strategy/idfirst/types.go
@@ -0,0 +1,29 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package idfirst
+
+import "encoding/json"
+
+// Update Login Flow with Multi-Step Method
+//
+// swagger:model updateLoginFlowWithIdentifierFirstMethod
+type updateLoginFlowWithIdentifierFirstMethod struct {
+	// Method should be set to "password" when logging in using the identifier and password strategy.
+	//
+	// required: true
+	Method string `json:"method"`
+
+	// Sending the anti-csrf token is only required for browser login flows.
+	CSRFToken string `json:"csrf_token"`
+
+	// Identifier is the email or username of the user trying to log in.
+	//
+	// required: true
+	Identifier string `json:"identifier"`
+
+	// Transient data to pass along to any webhooks
+	//
+	// required: false
+	TransientPayload json.RawMessage `json:"transient_payload,omitempty" form:"transient_payload"`
+}
diff --git a/selfservice/strategy/link/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads.json b/selfservice/strategy/link/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads.json
index 3bb3cbbf3ef6..5ac9946936c8 100644
--- a/selfservice/strategy/link/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads.json
+++ b/selfservice/strategy/link/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads.json
@@ -43,8 +43,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/link/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads_after_submission.json b/selfservice/strategy/link/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads_after_submission.json
index 498575cfee1b..1a8d048fe37d 100644
--- a/selfservice/strategy/link/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads_after_submission.json
+++ b/selfservice/strategy/link/.snapshots/TestRecovery-description=should_set_all_the_correct_recovery_payloads_after_submission.json
@@ -45,8 +45,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     }
diff --git a/selfservice/strategy/link/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads.json b/selfservice/strategy/link/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads.json
index 3bb3cbbf3ef6..5ac9946936c8 100644
--- a/selfservice/strategy/link/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads.json
+++ b/selfservice/strategy/link/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads.json
@@ -43,8 +43,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/link/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads_after_submission.json b/selfservice/strategy/link/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads_after_submission.json
index 498575cfee1b..1a8d048fe37d 100644
--- a/selfservice/strategy/link/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads_after_submission.json
+++ b/selfservice/strategy/link/.snapshots/TestVerification-description=should_set_all_the_correct_verification_payloads_after_submission.json
@@ -45,8 +45,8 @@
     "messages": [],
     "meta": {
       "label": {
-        "id": 1070005,
-        "text": "Submit",
+        "id": 1070009,
+        "text": "Continue",
         "type": "info"
       }
     }
diff --git a/selfservice/strategy/link/sender.go b/selfservice/strategy/link/sender.go
index 41231a721b8b..c289b657e0a1 100644
--- a/selfservice/strategy/link/sender.go
+++ b/selfservice/strategy/link/sender.go
@@ -202,6 +202,7 @@ func (s *Sender) SendRecoveryTokenTo(ctx context.Context, f *recovery.Flow, i *i
 			Identity:         model,
 			RequestURL:       f.GetRequestURL(),
 			TransientPayload: transientPayload,
+			ExpiresInMinutes: int(s.r.Config().SelfServiceLinkMethodLifespan(ctx).Minutes()),
 		}))
 }
 
@@ -231,13 +232,14 @@ func (s *Sender) SendVerificationTokenTo(ctx context.Context, f *verification.Fl
 			"token": {token.Token},
 		}).String()
 
-	if err := s.send(ctx, string(address.Via), email.NewVerificationValid(s.r,
+	if err := s.send(ctx, address.Via, email.NewVerificationValid(s.r,
 		&email.VerificationValidModel{
 			To:               address.Value,
 			VerificationURL:  verificationUrl,
 			Identity:         model,
 			RequestURL:       f.GetRequestURL(),
 			TransientPayload: transientPayload,
+			ExpiresInMinutes: int(s.r.Config().SelfServiceLinkMethodLifespan(ctx).Minutes()),
 		})); err != nil {
 		return err
 	}
diff --git a/selfservice/strategy/link/strategy.go b/selfservice/strategy/link/strategy.go
index cdf8356cc4b3..5cb78378118b 100644
--- a/selfservice/strategy/link/strategy.go
+++ b/selfservice/strategy/link/strategy.go
@@ -43,6 +43,7 @@ type (
 		x.WriterProvider
 		x.LoggingProvider
 		x.TracingProvider
+		x.TransactionPersistenceProvider
 
 		config.Provider
 
diff --git a/selfservice/strategy/link/strategy_recovery.go b/selfservice/strategy/link/strategy_recovery.go
index 184399ca1002..4fbd6e15ff1d 100644
--- a/selfservice/strategy/link/strategy_recovery.go
+++ b/selfservice/strategy/link/strategy_recovery.go
@@ -4,23 +4,20 @@
 package link
 
 import (
+	context "context"
 	"encoding/json"
 	"net/http"
 	"net/url"
 	"time"
 
+	"github.com/gobuffalo/pop/v6"
 	"github.com/gofrs/uuid"
 	"github.com/julienschmidt/httprouter"
 	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/herodot"
-	"github.com/ory/x/decoderx"
-	"github.com/ory/x/otelx"
-	"github.com/ory/x/sqlcon"
-	"github.com/ory/x/sqlxx"
-	"github.com/ory/x/urlx"
-
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/schema"
 	"github.com/ory/kratos/selfservice/flow"
@@ -30,6 +27,13 @@ import (
 	"github.com/ory/kratos/text"
 	"github.com/ory/kratos/ui/node"
 	"github.com/ory/kratos/x"
+	"github.com/ory/kratos/x/events"
+	"github.com/ory/x/decoderx"
+	"github.com/ory/x/otelx"
+	"github.com/ory/x/pointerx"
+	"github.com/ory/x/sqlcon"
+	"github.com/ory/x/sqlxx"
+	"github.com/ory/x/urlx"
 )
 
 const (
@@ -56,7 +60,7 @@ func (s *Strategy) PopulateRecoveryMethod(r *http.Request, f *recovery.Flow) err
 		// v0.5: form.Field{Name: "email", Type: "email", Required: true},
 		node.NewInputField("email", nil, node.LinkGroup, node.InputAttributeTypeEmail, node.WithRequiredInputAttribute).WithMetaLabel(text.NewInfoNodeInputEmail()),
 	)
-	f.UI.GetNodes().Append(node.NewInputField("method", s.RecoveryStrategyID(), node.LinkGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoNodeLabelSubmit()))
+	f.UI.GetNodes().Append(node.NewInputField("method", s.RecoveryStrategyID(), node.LinkGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoNodeLabelContinue()))
 
 	return nil
 }
@@ -143,13 +147,15 @@ type recoveryLinkForIdentity struct {
 //	  404: errorGeneric
 //	  default: errorGeneric
 func (s *Strategy) createRecoveryLinkForIdentity(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+	ctx := r.Context()
+
 	var p createRecoveryLinkForIdentityBody
 	if err := s.dx.Decode(r, &p, decoderx.HTTPJSONDecoder()); err != nil {
 		s.d.Writer().WriteError(w, r, err)
 		return
 	}
 
-	expiresIn := s.d.Config().SelfServiceLinkMethodLifespan(r.Context())
+	expiresIn := s.d.Config().SelfServiceLinkMethodLifespan(ctx)
 	if len(p.ExpiresIn) > 0 {
 		var err error
 		expiresIn, err = time.ParseDuration(p.ExpiresIn)
@@ -170,12 +176,7 @@ func (s *Strategy) createRecoveryLinkForIdentity(w http.ResponseWriter, r *http.
 		return
 	}
 
-	if err := s.d.RecoveryFlowPersister().CreateRecoveryFlow(r.Context(), req); err != nil {
-		s.d.Writer().WriteError(w, r, err)
-		return
-	}
-
-	id, err := s.d.IdentityPool().GetIdentity(r.Context(), p.IdentityID, identity.ExpandDefault)
+	id, err := s.d.IdentityPool().GetIdentity(ctx, p.IdentityID, identity.ExpandDefault)
 	if errors.Is(err, sqlcon.ErrNoRows) {
 		s.d.Writer().WriteError(w, r, errors.WithStack(herodot.ErrBadRequest.WithReasonf("The requested identity id does not exist.").WithWrap(err)))
 		return
@@ -185,11 +186,21 @@ func (s *Strategy) createRecoveryLinkForIdentity(w http.ResponseWriter, r *http.
 	}
 
 	token := NewAdminRecoveryToken(id.ID, req.ID, expiresIn)
-	if err := s.d.RecoveryTokenPersister().CreateRecoveryToken(r.Context(), token); err != nil {
+	if err := s.d.TransactionalPersisterProvider().Transaction(ctx, func(ctx context.Context, c *pop.Connection) error {
+		if err := s.d.RecoveryFlowPersister().CreateRecoveryFlow(ctx, req); err != nil {
+			return err
+		}
+
+		return s.d.RecoveryTokenPersister().CreateRecoveryToken(ctx, token)
+	}); err != nil {
 		s.d.Writer().WriteError(w, r, err)
 		return
 	}
 
+	trace.SpanFromContext(ctx).AddEvent(
+		events.NewRecoveryInitiatedByAdmin(ctx, req.ID, id.ID, req.Type.String(), "link"),
+	)
+
 	s.d.Audit().
 		WithField("identity_id", id.ID).
 		WithSensitiveField("recovery_link_token", token).
@@ -198,7 +209,7 @@ func (s *Strategy) createRecoveryLinkForIdentity(w http.ResponseWriter, r *http.
 	s.d.Writer().Write(w, r, &recoveryLinkForIdentity{
 		ExpiresAt: req.ExpiresAt.UTC(),
 		RecoveryLink: urlx.CopyWithQuery(
-			urlx.AppendPaths(s.d.Config().SelfPublicURL(r.Context()), recovery.RouteSubmitFlow),
+			urlx.AppendPaths(s.d.Config().SelfPublicURL(ctx), recovery.RouteSubmitFlow),
 			url.Values{
 				"token": {token.Token},
 				"flow":  {req.ID.String()},
@@ -241,7 +252,7 @@ type updateRecoveryFlowWithLinkMethod struct {
 }
 
 func (s *Strategy) Recover(w http.ResponseWriter, r *http.Request, f *recovery.Flow) (err error) {
-	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.link.strategy.Recover")
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.link.Strategy.Recover")
 	span.SetAttributes(attribute.String("selfservice_flows_recovery_use", s.d.Config().SelfServiceFlowRecoveryUse(ctx)))
 	defer otelx.End(span, &err)
 
@@ -257,7 +268,7 @@ func (s *Strategy) Recover(w http.ResponseWriter, r *http.Request, f *recovery.F
 			return s.HandleRecoveryError(w, r, nil, body, err)
 		}
 
-		return s.recoveryUseToken(w, r, f.ID, body)
+		return s.recoveryUseToken(ctx, w, r, f.ID, body)
 	}
 
 	if _, err := s.d.SessionManager().FetchFromRequest(r.Context(), r); err == nil {
@@ -294,7 +305,7 @@ func (s *Strategy) Recover(w http.ResponseWriter, r *http.Request, f *recovery.F
 	}
 }
 
-func (s *Strategy) recoveryIssueSession(w http.ResponseWriter, r *http.Request, f *recovery.Flow, id *identity.Identity) error {
+func (s *Strategy) recoveryIssueSession(ctx context.Context, w http.ResponseWriter, r *http.Request, f *recovery.Flow, id *identity.Identity) error {
 	f.UI.Messages.Clear()
 	f.State = flow.StatePassedChallenge
 	f.SetCSRFToken(s.d.CSRFHandler().RegenerateToken(w, r))
@@ -306,8 +317,14 @@ func (s *Strategy) recoveryIssueSession(w http.ResponseWriter, r *http.Request,
 		return s.retryRecoveryFlowWithError(w, r, flow.TypeBrowser, err)
 	}
 
-	sess, err := session.NewActiveSession(r, id, s.d.Config(), time.Now().UTC(), identity.CredentialsTypeRecoveryLink, identity.AuthenticatorAssuranceLevel1)
-	if err != nil {
+	sess := session.NewInactiveSession()
+	sess.CompletedLoginFor(identity.CredentialsTypeRecoveryLink, identity.AuthenticatorAssuranceLevel1)
+	if err := s.d.SessionManager().ActivateSession(r, sess, id, time.Now().UTC()); err != nil {
+		return s.retryRecoveryFlowWithError(w, r, flow.TypeBrowser, err)
+	}
+
+	// Force load.
+	if err := s.d.PrivilegedIdentityPool().HydrateIdentityAssociations(ctx, sess.Identity, identity.ExpandEverything); err != nil {
 		return s.retryRecoveryFlowWithError(w, r, flow.TypeBrowser, err)
 	}
 
@@ -319,7 +336,7 @@ func (s *Strategy) recoveryIssueSession(w http.ResponseWriter, r *http.Request,
 		return s.retryRecoveryFlowWithError(w, r, flow.TypeBrowser, err)
 	}
 
-	sf, err := s.d.SettingsHandler().NewFlow(w, r, sess.Identity, flow.TypeBrowser)
+	sf, err := s.d.SettingsHandler().NewFlow(ctx, w, r, sess.Identity, flow.TypeBrowser)
 	if err != nil {
 		return s.retryRecoveryFlowWithError(w, r, flow.TypeBrowser, err)
 	}
@@ -344,7 +361,7 @@ func (s *Strategy) recoveryIssueSession(w http.ResponseWriter, r *http.Request,
 	return errors.WithStack(flow.ErrCompletedByStrategy)
 }
 
-func (s *Strategy) recoveryUseToken(w http.ResponseWriter, r *http.Request, fID uuid.UUID, body *recoverySubmitPayload) error {
+func (s *Strategy) recoveryUseToken(ctx context.Context, w http.ResponseWriter, r *http.Request, fID uuid.UUID, body *recoverySubmitPayload) error {
 	token, err := s.d.RecoveryTokenPersister().UseRecoveryToken(r.Context(), fID, body.Token)
 	if err != nil {
 		if errors.Is(err, sqlcon.ErrNoRows) {
@@ -375,7 +392,8 @@ func (s *Strategy) recoveryUseToken(w http.ResponseWriter, r *http.Request, fID
 		return s.retryRecoveryFlowWithError(w, r, flow.TypeBrowser, err)
 	}
 
-	recovered, err := s.d.IdentityPool().GetIdentity(r.Context(), token.IdentityID, identity.ExpandDefault)
+	// Important to expand everything here, as we need the data for recovery.
+	recovered, err := s.d.IdentityPool().GetIdentity(r.Context(), token.IdentityID, identity.ExpandEverything)
 	if err != nil {
 		return s.HandleRecoveryError(w, r, f, nil, err)
 	}
@@ -387,7 +405,7 @@ func (s *Strategy) recoveryUseToken(w http.ResponseWriter, r *http.Request, fID
 		}
 	}
 
-	return s.recoveryIssueSession(w, r, f, recovered)
+	return s.recoveryIssueSession(ctx, w, r, f, recovered)
 }
 
 func (s *Strategy) retryRecoveryFlowWithMessage(w http.ResponseWriter, r *http.Request, ft flow.Type, message *text.Message) error {
@@ -481,22 +499,14 @@ func (s *Strategy) recoveryHandleFormSubmission(w http.ResponseWriter, r *http.R
 }
 
 func (s *Strategy) markRecoveryAddressVerified(w http.ResponseWriter, r *http.Request, f *recovery.Flow, id *identity.Identity, recoveryAddress *identity.RecoveryAddress) error {
-	var address *identity.VerifiableAddress
-	for idx := range id.VerifiableAddresses {
-		va := id.VerifiableAddresses[idx]
-		if va.Value == recoveryAddress.Value {
-			address = &va
-			break
-		}
-	}
-
-	if address != nil && !address.Verified { // can it be that the address is nil?
-		address.Verified = true
-		verifiedAt := sqlxx.NullTime(time.Now().UTC())
-		address.VerifiedAt = &verifiedAt
-		address.Status = identity.VerifiableAddressStatusCompleted
-		if err := s.d.PrivilegedIdentityPool().UpdateVerifiableAddress(r.Context(), address); err != nil {
-			return s.HandleRecoveryError(w, r, f, nil, err)
+	for k, v := range id.VerifiableAddresses {
+		if v.Value == recoveryAddress.Value {
+			id.VerifiableAddresses[k].Verified = true
+			id.VerifiableAddresses[k].VerifiedAt = pointerx.Ptr(sqlxx.NullTime(time.Now().UTC()))
+			id.VerifiableAddresses[k].Status = identity.VerifiableAddressStatusCompleted
+			if err := s.d.PrivilegedIdentityPool().UpdateVerifiableAddress(r.Context(), &id.VerifiableAddresses[k]); err != nil {
+				return s.HandleRecoveryError(w, r, f, nil, err)
+			}
 		}
 	}
 
diff --git a/selfservice/strategy/link/strategy_recovery_test.go b/selfservice/strategy/link/strategy_recovery_test.go
index 7b56ca5f1728..f4b2ba07ee5c 100644
--- a/selfservice/strategy/link/strategy_recovery_test.go
+++ b/selfservice/strategy/link/strategy_recovery_test.go
@@ -11,9 +11,12 @@ import (
 	"net/http/httptest"
 	"net/url"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
+	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
+
 	"github.com/davecgh/go-spew/spew"
 	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
@@ -99,7 +102,7 @@ func TestAdminStrategy(t *testing.T) {
 	})
 
 	t.Run("description=should not be able to recover an account that does not exist", func(t *testing.T) {
-		_, _, err := adminSDK.IdentityApi.CreateRecoveryLinkForIdentity(context.Background()).CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
+		_, _, err := adminSDK.IdentityAPI.CreateRecoveryLinkForIdentity(context.Background()).CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
 			IdentityId: x.NewUUID().String(),
 		}).Execute()
 		require.IsType(t, err, new(kratos.GenericOpenAPIError), "%T", err)
@@ -112,7 +115,7 @@ func TestAdminStrategy(t *testing.T) {
 		require.NoError(t, reg.IdentityManager().Create(context.Background(),
 			&id, identity.ManagerAllowWriteProtectedTraits))
 
-		rl, _, err := adminSDK.IdentityApi.CreateRecoveryLinkForIdentity(context.Background()).CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
+		rl, _, err := adminSDK.IdentityAPI.CreateRecoveryLinkForIdentity(context.Background()).CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
 			IdentityId: id.ID.String(),
 			ExpiresIn:  pointerx.Ptr("100ms"),
 		}).Execute()
@@ -136,7 +139,7 @@ func TestAdminStrategy(t *testing.T) {
 		require.NoError(t, reg.IdentityManager().Create(context.Background(),
 			&id, identity.ManagerAllowWriteProtectedTraits))
 
-		rl, _, err := adminSDK.IdentityApi.CreateRecoveryLinkForIdentity(context.Background()).CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
+		rl, _, err := adminSDK.IdentityAPI.CreateRecoveryLinkForIdentity(context.Background()).CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
 			IdentityId: id.ID.String(),
 			ExpiresIn:  pointerx.Ptr("100ms"),
 		}).Execute()
@@ -166,7 +169,7 @@ func TestAdminStrategy(t *testing.T) {
 		require.NoError(t, reg.IdentityManager().Create(context.Background(),
 			&id, identity.ManagerAllowWriteProtectedTraits))
 
-		rl, _, err := adminSDK.IdentityApi.CreateRecoveryLinkForIdentity(context.Background()).CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
+		rl, _, err := adminSDK.IdentityAPI.CreateRecoveryLinkForIdentity(context.Background()).CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
 			IdentityId: id.ID.String(),
 		}).Execute()
 		require.NoError(t, err)
@@ -196,7 +199,7 @@ func TestAdminStrategy(t *testing.T) {
 		email := strings.ToLower(testhelpers.RandomEmail())
 		id := createIdentityToRecover(t, reg, email)
 
-		rl1, _, err := adminSDK.IdentityApi.
+		rl1, _, err := adminSDK.IdentityAPI.
 			CreateRecoveryLinkForIdentity(context.Background()).
 			CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
 				IdentityId: id.ID.String(),
@@ -206,7 +209,7 @@ func TestAdminStrategy(t *testing.T) {
 
 		checkLink(t, rl1, time.Now().Add(conf.SelfServiceFlowRecoveryRequestLifespan(ctx)+time.Second))
 
-		rl2, _, err := adminSDK.IdentityApi.
+		rl2, _, err := adminSDK.IdentityAPI.
 			CreateRecoveryLinkForIdentity(context.Background()).
 			CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
 				IdentityId: id.ID.String(),
@@ -251,6 +254,7 @@ func TestRecovery(t *testing.T) {
 	conf, reg := internal.NewFastRegistryWithMocks(t)
 	conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+".code.enabled", false)
 	conf.MustSet(ctx, config.ViperKeySelfServiceStrategyConfig+".link.enabled", true)
+	testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/default.schema.json")
 	initViper(t, conf)
 
 	_ = testhelpers.NewRecoveryUIFlowEchoServer(t, reg)
@@ -369,18 +373,18 @@ func TestRecovery(t *testing.T) {
 			v.Set("email", "some-email@example.org")
 			v.Set("method", "link")
 
-			authClient := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, reg)
+			authClient := testhelpers.NewHTTPClientWithArbitrarySessionToken(t, ctx, reg)
 			if isAPI {
 				req := httptest.NewRequest("GET", "/sessions/whoami", nil)
-				s, err := session.NewActiveSession(req,
-					&identity.Identity{ID: x.NewUUID(), State: identity.StateActive},
-					testhelpers.NewSessionLifespanProvider(time.Hour),
+				req.WithContext(confighelpers.WithConfigValue(ctx, config.ViperKeySessionLifespan, time.Hour))
+				s, err := testhelpers.NewActiveSession(req, reg,
+					&identity.Identity{ID: x.NewUUID(), State: identity.StateActive, NID: x.NewUUID()},
 					time.Now(),
 					identity.CredentialsTypePassword,
 					identity.AuthenticatorAssuranceLevel1,
 				)
 				require.NoError(t, err)
-				authClient = testhelpers.NewHTTPClientWithSessionCookieLocalhost(t, reg, s)
+				authClient = testhelpers.NewHTTPClientWithSessionCookieLocalhost(t, ctx, reg, s)
 			}
 
 			body, res := testhelpers.RecoveryMakeRequest(t, isAPI || isSPA, f, authClient, testhelpers.EncodeFormAsJSON(t, isAPI || isSPA, v))
@@ -503,7 +507,7 @@ func TestRecovery(t *testing.T) {
 			assertx.EqualAsJSON(t, text.NewRecoveryEmailSent(), json.RawMessage(gjson.Get(recoverySubmissionResponse, "ui.messages.0").Raw))
 
 			message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
-			assert.Contains(t, message.Body, "please recover access to your account by clicking the following link")
+			assert.Contains(t, message.Body, "Recover access to your account by clicking the following link")
 
 			recoveryLink := testhelpers.CourierExpectLinkInMessage(t, message, 1)
 
@@ -538,11 +542,22 @@ func TestRecovery(t *testing.T) {
 		}
 
 		t.Run("type=browser", func(t *testing.T) {
+			var wg sync.WaitGroup
+			wg.Add(1)
+			testhelpers.NewRecoveryAfterHookWebHookTarget(ctx, t, conf, func(t *testing.T, msg []byte) {
+				defer wg.Done()
+				assert.EqualValues(t, "recoverme1@ory.sh", gjson.GetBytes(msg, "identity.verifiable_addresses.0.value").String(), string(msg))
+				assert.EqualValues(t, true, gjson.GetBytes(msg, "identity.verifiable_addresses.0.verified").Bool(), string(msg))
+				assert.EqualValues(t, "completed", gjson.GetBytes(msg, "identity.verifiable_addresses.0.status").String(), string(msg))
+			})
+
 			email := "recoverme1@ory.sh"
 			createIdentityToRecover(t, reg, email)
 			check(t, expectSuccess(t, nil, false, false, func(v url.Values) {
 				v.Set("email", email)
 			}), email, "")
+
+			wg.Wait()
 		})
 
 		t.Run("description=should return browser to return url", func(t *testing.T) {
@@ -675,7 +690,7 @@ func TestRecovery(t *testing.T) {
 				v.Set("email", email)
 			}
 
-			cl := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+			cl := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 			check(t, expectSuccess(t, nil, false, false, values), email, cl, func(_ *http.Client, req *http.Request) (*http.Response, error) {
 				_, res := testhelpers.MockMakeAuthenticatedRequestWithClientAndID(t, reg, conf, publicRouter.Router, req, cl, id)
 				return res, nil
@@ -694,7 +709,7 @@ func TestRecovery(t *testing.T) {
 		id := createIdentityToRecover(t, reg, email)
 
 		req := httptest.NewRequest("GET", "/sessions/whoami", nil)
-		sess, err := session.NewActiveSession(req, id, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+		sess, err := testhelpers.NewActiveSession(req, reg, id, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 		require.NoError(t, err)
 		require.NoError(t, reg.SessionPersister().UpsertSession(context.Background(), sess))
 
@@ -738,7 +753,7 @@ func TestRecovery(t *testing.T) {
 		assert.Equal(t, http.StatusOK, res.StatusCode)
 		assert.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowRecoveryUI(ctx).String()+"?flow=")
 
-		rs, _, err := testhelpers.NewSDKCustomClient(public, c).FrontendApi.GetRecoveryFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
+		rs, _, err := testhelpers.NewSDKCustomClient(public, c).FrontendAPI.GetRecoveryFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
 		require.NoError(t, err)
 
 		require.Len(t, rs.Ui.Messages, 1)
@@ -785,7 +800,7 @@ func TestRecovery(t *testing.T) {
 		})
 
 		message := testhelpers.CourierExpectMessage(ctx, t, reg, recoveryEmail, "Recover access to your account")
-		assert.Contains(t, message.Body, "please recover access to your account by clicking the following link")
+		assert.Contains(t, message.Body, "Recover access to your account by clicking the following link")
 
 		recoveryLink := testhelpers.CourierExpectLinkInMessage(t, message, 1)
 
@@ -798,7 +813,7 @@ func TestRecovery(t *testing.T) {
 		assert.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowRecoveryUI(ctx).String())
 		assert.NotContains(t, res.Request.URL.String(), gjson.Get(body, "id").String())
 
-		rs, _, err := testhelpers.NewSDKCustomClient(public, c).FrontendApi.GetRecoveryFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
+		rs, _, err := testhelpers.NewSDKCustomClient(public, c).FrontendAPI.GetRecoveryFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
 		require.NoError(t, err)
 
 		require.Len(t, rs.Ui.Messages, 1)
@@ -896,7 +911,7 @@ func TestDisabledEndpoint(t *testing.T) {
 			require.NoError(t, reg.IdentityManager().Create(context.Background(),
 				&id, identity.ManagerAllowWriteProtectedTraits))
 
-			rl, _, err := adminSDK.IdentityApi.CreateRecoveryLinkForIdentity(context.Background()).CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
+			rl, _, err := adminSDK.IdentityAPI.CreateRecoveryLinkForIdentity(context.Background()).CreateRecoveryLinkForIdentityBody(kratos.CreateRecoveryLinkForIdentityBody{
 				IdentityId: id.ID.String(),
 			}).Execute()
 			assert.Nil(t, rl)
diff --git a/selfservice/strategy/link/strategy_verification.go b/selfservice/strategy/link/strategy_verification.go
index a2a72ea9a277..7dee3f85a8a8 100644
--- a/selfservice/strategy/link/strategy_verification.go
+++ b/selfservice/strategy/link/strategy_verification.go
@@ -32,10 +32,10 @@ func (s *Strategy) VerificationStrategyID() string {
 	return string(verification.VerificationStrategyLink)
 }
 
-func (s *Strategy) RegisterPublicVerificationRoutes(public *x.RouterPublic) {
+func (s *Strategy) RegisterPublicVerificationRoutes(_ *x.RouterPublic) {
 }
 
-func (s *Strategy) RegisterAdminVerificationRoutes(admin *x.RouterAdmin) {
+func (s *Strategy) RegisterAdminVerificationRoutes(_ *x.RouterAdmin) {
 }
 
 func (s *Strategy) PopulateVerificationMethod(r *http.Request, f *verification.Flow) error {
@@ -44,7 +44,7 @@ func (s *Strategy) PopulateVerificationMethod(r *http.Request, f *verification.F
 		// v0.5: form.Field{Name: "email", Type: "email", Required: true}
 		node.NewInputField("email", nil, node.LinkGroup, node.InputAttributeTypeEmail, node.WithRequiredInputAttribute).WithMetaLabel(text.NewInfoNodeInputEmail()),
 	)
-	f.UI.GetNodes().Append(node.NewInputField("method", s.VerificationStrategyID(), node.LinkGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoNodeLabelSubmit()))
+	f.UI.GetNodes().Append(node.NewInputField("method", s.VerificationStrategyID(), node.LinkGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoNodeLabelContinue()))
 	return nil
 }
 
@@ -79,12 +79,16 @@ func (s *Strategy) decodeVerification(r *http.Request) (*verificationSubmitPaylo
 }
 
 // handleVerificationError is a convenience function for handling all types of errors that may occur (e.g. validation error).
-func (s *Strategy) handleVerificationError(w http.ResponseWriter, r *http.Request, f *verification.Flow, body *verificationSubmitPayload, err error) error {
+func (s *Strategy) handleVerificationError(r *http.Request, f *verification.Flow, body *verificationSubmitPayload, err error) error {
 	if f != nil {
 		f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
+		email := ""
+		if body != nil {
+			email = body.Email
+		}
 		f.UI.GetNodes().Upsert(
 			// v0.5: form.Field{Name: "email", Type: "email", Required: true, Value: body.Body.Email}
-			node.NewInputField("email", body.Email, node.LinkGroup, node.InputAttributeTypeEmail, node.WithRequiredInputAttribute).WithMetaLabel(text.NewInfoNodeInputEmail()),
+			node.NewInputField("email", email, node.LinkGroup, node.InputAttributeTypeEmail, node.WithRequiredInputAttribute).WithMetaLabel(text.NewInfoNodeInputEmail()),
 		)
 	}
 
@@ -125,63 +129,59 @@ type updateVerificationFlowWithLinkMethod struct {
 }
 
 func (s *Strategy) Verify(w http.ResponseWriter, r *http.Request, f *verification.Flow) (err error) {
-	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.link.strategy.Verify")
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.link.Strategy.Verify")
 	span.SetAttributes(attribute.String("selfservice_flows_verification_use", s.d.Config().SelfServiceFlowVerificationUse(ctx)))
 	defer otelx.End(span, &err)
-	r = r.WithContext(ctx)
 
 	body, err := s.decodeVerification(r)
 	if err != nil {
-		return s.handleVerificationError(w, r, nil, body, err)
+		return s.handleVerificationError(r, nil, body, err)
 	}
 	f.TransientPayload = body.TransientPayload
 
 	if len(body.Token) > 0 {
-		if err := flow.MethodEnabledAndAllowed(r.Context(), f.GetFlowName(), s.VerificationStrategyID(), s.VerificationStrategyID(), s.d); err != nil {
-			return s.handleVerificationError(w, r, nil, body, err)
+		if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.VerificationStrategyID(), s.VerificationStrategyID(), s.d); err != nil {
+			return s.handleVerificationError(r, nil, body, err)
 		}
 
-		return s.verificationUseToken(w, r, body, f)
+		return s.verificationUseToken(ctx, w, r, body, f)
 	}
 
-	if err := flow.MethodEnabledAndAllowed(r.Context(), f.GetFlowName(), s.VerificationStrategyID(), body.Method, s.d); err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+	if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.VerificationStrategyID(), body.Method, s.d); err != nil {
+		return s.handleVerificationError(r, f, body, err)
 	}
 
 	if err := f.Valid(); err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+		return s.handleVerificationError(r, f, body, err)
 	}
 
 	switch f.State {
-	case flow.StateChooseMethod:
-		fallthrough
-	case flow.StateEmailSent:
-		// Do nothing (continue with execution after this switch statement)
-		return s.verificationHandleFormSubmission(w, r, f)
+	case flow.StateChooseMethod, flow.StateEmailSent:
+		return s.verificationHandleFormSubmission(ctx, r, f)
 	case flow.StatePassedChallenge:
-		return s.retryVerificationFlowWithMessage(w, r, f.Type, text.NewErrorValidationVerificationRetrySuccess())
+		return s.retryVerificationFlowWithMessage(ctx, w, r, f.Type, text.NewErrorValidationVerificationRetrySuccess())
 	default:
-		return s.retryVerificationFlowWithMessage(w, r, f.Type, text.NewErrorValidationVerificationStateFailure())
+		return s.retryVerificationFlowWithMessage(ctx, w, r, f.Type, text.NewErrorValidationVerificationStateFailure())
 	}
 }
 
-func (s *Strategy) verificationHandleFormSubmission(w http.ResponseWriter, r *http.Request, f *verification.Flow) error {
+func (s *Strategy) verificationHandleFormSubmission(ctx context.Context, r *http.Request, f *verification.Flow) error {
 	body, err := s.decodeVerification(r)
 	if err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+		return s.handleVerificationError(r, f, body, err)
 	}
 
 	if len(body.Email) == 0 {
-		return s.handleVerificationError(w, r, f, body, schema.NewRequiredError("#/email", "email"))
+		return s.handleVerificationError(r, f, body, schema.NewRequiredError("#/email", "email"))
 	}
 
-	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, body.CSRFToken); err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, body.CSRFToken); err != nil {
+		return s.handleVerificationError(r, f, body, err)
 	}
 
-	if err := s.d.LinkSender().SendVerificationLink(r.Context(), f, identity.VerifiableAddressTypeEmail, body.Email); err != nil {
+	if err := s.d.LinkSender().SendVerificationLink(ctx, f, identity.VerifiableAddressTypeEmail, body.Email); err != nil {
 		if !errors.Is(err, ErrUnknownAddress) {
-			return s.handleVerificationError(w, r, f, body, err)
+			return s.handleVerificationError(r, f, body, err)
 		}
 		// Continue execution
 	}
@@ -195,25 +195,25 @@ func (s *Strategy) verificationHandleFormSubmission(w http.ResponseWriter, r *ht
 	f.Active = sqlxx.NullString(s.NodeGroup())
 	f.State = flow.StateEmailSent
 	f.UI.Messages.Set(text.NewVerificationEmailSent())
-	if err := s.d.VerificationFlowPersister().UpdateVerificationFlow(r.Context(), f); err != nil {
-		return s.handleVerificationError(w, r, f, body, err)
+	if err := s.d.VerificationFlowPersister().UpdateVerificationFlow(ctx, f); err != nil {
+		return s.handleVerificationError(r, f, body, err)
 	}
 
 	return nil
 }
 
-func (s *Strategy) verificationUseToken(w http.ResponseWriter, r *http.Request, body *verificationSubmitPayload, f *verification.Flow) error {
-	token, err := s.d.VerificationTokenPersister().UseVerificationToken(r.Context(), f.ID, body.Token)
+func (s *Strategy) verificationUseToken(ctx context.Context, w http.ResponseWriter, r *http.Request, body *verificationSubmitPayload, f *verification.Flow) error {
+	token, err := s.d.VerificationTokenPersister().UseVerificationToken(ctx, f.ID, body.Token)
 	if err != nil {
 		if errors.Is(err, sqlcon.ErrNoRows) {
-			return s.retryVerificationFlowWithMessage(w, r, flow.TypeBrowser, text.NewErrorValidationVerificationTokenInvalidOrAlreadyUsed())
+			return s.retryVerificationFlowWithMessage(ctx, w, r, flow.TypeBrowser, text.NewErrorValidationVerificationTokenInvalidOrAlreadyUsed())
 		}
 
-		return s.retryVerificationFlowWithError(w, r, flow.TypeBrowser, err)
+		return s.retryVerificationFlowWithError(ctx, w, r, flow.TypeBrowser, err)
 	}
 
 	if err := token.Valid(); err != nil {
-		return s.retryVerificationFlowWithError(w, r, flow.TypeBrowser, err)
+		return s.retryVerificationFlowWithError(ctx, w, r, flow.TypeBrowser, err)
 	}
 
 	address := token.VerifiableAddress
@@ -221,16 +221,16 @@ func (s *Strategy) verificationUseToken(w http.ResponseWriter, r *http.Request,
 	verifiedAt := sqlxx.NullTime(time.Now().UTC())
 	address.VerifiedAt = &verifiedAt
 	address.Status = identity.VerifiableAddressStatusCompleted
-	if err := s.d.PrivilegedIdentityPool().UpdateVerifiableAddress(r.Context(), address); err != nil {
-		return s.retryVerificationFlowWithError(w, r, flow.TypeBrowser, err)
+	if err := s.d.PrivilegedIdentityPool().UpdateVerifiableAddress(ctx, address); err != nil {
+		return s.retryVerificationFlowWithError(ctx, w, r, flow.TypeBrowser, err)
 	}
 
-	i, err := s.d.IdentityPool().GetIdentity(r.Context(), token.VerifiableAddress.IdentityID, identity.ExpandDefault)
+	i, err := s.d.IdentityPool().GetIdentity(ctx, token.VerifiableAddress.IdentityID, identity.ExpandDefault)
 	if err != nil {
-		return s.retryVerificationFlowWithError(w, r, flow.TypeBrowser, err)
+		return s.retryVerificationFlowWithError(ctx, w, r, flow.TypeBrowser, err)
 	}
 
-	returnTo := f.ContinueURL(r.Context(), s.d.Config())
+	returnTo := f.ContinueURL(ctx, s.d.Config())
 
 	f.UI.
 		Nodes.
@@ -251,66 +251,66 @@ func (s *Strategy) verificationUseToken(w http.ResponseWriter, r *http.Request,
 		Append(node.NewAnchorField("continue", returnTo.String(), node.LinkGroup, text.NewInfoNodeLabelContinue()).
 			WithMetaLabel(text.NewInfoNodeLabelContinue()))
 
-	if err := s.d.VerificationFlowPersister().UpdateVerificationFlow(r.Context(), f); err != nil {
-		return s.retryVerificationFlowWithError(w, r, flow.TypeBrowser, err)
+	if err := s.d.VerificationFlowPersister().UpdateVerificationFlow(ctx, f); err != nil {
+		return s.retryVerificationFlowWithError(ctx, w, r, flow.TypeBrowser, err)
 	}
 
 	if err := s.d.VerificationExecutor().PostVerificationHook(w, r, f, i); err != nil {
-		return s.retryVerificationFlowWithError(w, r, flow.TypeBrowser, err)
+		return s.retryVerificationFlowWithError(ctx, w, r, flow.TypeBrowser, err)
 	}
 
 	return nil
 }
 
-func (s *Strategy) retryVerificationFlowWithMessage(w http.ResponseWriter, r *http.Request, ft flow.Type, message *text.Message) error {
+func (s *Strategy) retryVerificationFlowWithMessage(ctx context.Context, w http.ResponseWriter, r *http.Request, ft flow.Type, message *text.Message) error {
 	s.d.Logger().WithRequest(r).WithField("message", message).Debug("A verification flow is being retried because a validation error occurred.")
 
 	f, err := verification.NewFlow(s.d.Config(),
-		s.d.Config().SelfServiceFlowVerificationRequestLifespan(r.Context()), s.d.CSRFHandler().RegenerateToken(w, r), r, s, ft)
+		s.d.Config().SelfServiceFlowVerificationRequestLifespan(ctx), s.d.CSRFHandler().RegenerateToken(w, r), r, s, ft)
 	if err != nil {
-		return s.handleVerificationError(w, r, f, nil, err)
+		return s.handleVerificationError(r, f, nil, err)
 	}
 
 	f.UI.Messages.Add(message)
-	if err := s.d.VerificationFlowPersister().CreateVerificationFlow(r.Context(), f); err != nil {
-		return s.handleVerificationError(w, r, f, nil, err)
+	if err := s.d.VerificationFlowPersister().CreateVerificationFlow(ctx, f); err != nil {
+		return s.handleVerificationError(r, f, nil, err)
 	}
 
 	if ft == flow.TypeBrowser {
-		http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowVerificationUI(r.Context())).String(), http.StatusSeeOther)
+		http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowVerificationUI(ctx)).String(), http.StatusSeeOther)
 	} else {
-		http.Redirect(w, r, urlx.CopyWithQuery(urlx.AppendPaths(s.d.Config().SelfPublicURL(r.Context()),
+		http.Redirect(w, r, urlx.CopyWithQuery(urlx.AppendPaths(s.d.Config().SelfPublicURL(ctx),
 			verification.RouteGetFlow), url.Values{"id": {f.ID.String()}}).String(), http.StatusSeeOther)
 	}
 
 	return errors.WithStack(flow.ErrCompletedByStrategy)
 }
 
-func (s *Strategy) retryVerificationFlowWithError(w http.ResponseWriter, r *http.Request, ft flow.Type, verErr error) error {
+func (s *Strategy) retryVerificationFlowWithError(ctx context.Context, w http.ResponseWriter, r *http.Request, ft flow.Type, verErr error) error {
 	s.d.Logger().WithRequest(r).WithError(verErr).Debug("A verification flow is being retried because an error occurred.")
 
 	f, err := verification.NewFlow(s.d.Config(),
-		s.d.Config().SelfServiceFlowVerificationRequestLifespan(r.Context()), s.d.CSRFHandler().RegenerateToken(w, r), r, s, ft)
+		s.d.Config().SelfServiceFlowVerificationRequestLifespan(ctx), s.d.CSRFHandler().RegenerateToken(w, r), r, s, ft)
 	if err != nil {
-		return s.handleVerificationError(w, r, f, nil, err)
+		return s.handleVerificationError(r, f, nil, err)
 	}
 
 	if expired := new(flow.ExpiredError); errors.As(verErr, &expired) {
-		return s.retryVerificationFlowWithMessage(w, r, ft, text.NewErrorValidationVerificationFlowExpired(expired.ExpiredAt))
+		return s.retryVerificationFlowWithMessage(ctx, w, r, ft, text.NewErrorValidationVerificationFlowExpired(expired.ExpiredAt))
 	} else {
 		if err := f.UI.ParseError(node.LinkGroup, verErr); err != nil {
 			return err
 		}
 	}
 
-	if err := s.d.VerificationFlowPersister().CreateVerificationFlow(r.Context(), f); err != nil {
-		return s.handleVerificationError(w, r, f, nil, err)
+	if err := s.d.VerificationFlowPersister().CreateVerificationFlow(ctx, f); err != nil {
+		return s.handleVerificationError(r, f, nil, err)
 	}
 
 	if ft == flow.TypeBrowser {
-		http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowVerificationUI(r.Context())).String(), http.StatusSeeOther)
+		http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowVerificationUI(ctx)).String(), http.StatusSeeOther)
 	} else {
-		http.Redirect(w, r, urlx.CopyWithQuery(urlx.AppendPaths(s.d.Config().SelfPublicURL(r.Context()),
+		http.Redirect(w, r, urlx.CopyWithQuery(urlx.AppendPaths(s.d.Config().SelfPublicURL(ctx),
 			verification.RouteGetFlow), url.Values{"id": {f.ID.String()}}).String(), http.StatusSeeOther)
 	}
 
diff --git a/selfservice/strategy/link/strategy_verification_test.go b/selfservice/strategy/link/strategy_verification_test.go
index 84ee51ae9dd1..ae0e20021338 100644
--- a/selfservice/strategy/link/strategy_verification_test.go
+++ b/selfservice/strategy/link/strategy_verification_test.go
@@ -211,7 +211,7 @@ func TestVerification(t *testing.T) {
 		assert.Equal(t, http.StatusOK, res.StatusCode)
 		assert.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowVerificationUI(ctx).String()+"?flow=")
 
-		sr, _, err := testhelpers.NewSDKCustomClient(public, c).FrontendApi.GetVerificationFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
+		sr, _, err := testhelpers.NewSDKCustomClient(public, c).FrontendAPI.GetVerificationFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
 		require.NoError(t, err)
 
 		require.Len(t, sr.Ui.Messages, 1)
@@ -248,7 +248,7 @@ func TestVerification(t *testing.T) {
 		})
 
 		message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
-		assert.Contains(t, message.Body, "Hi, please verify your account by clicking the following link")
+		assert.Contains(t, message.Body, "Verify your account by opening the following link")
 
 		verificationLink := testhelpers.CourierExpectLinkInMessage(t, message, 1)
 
@@ -263,7 +263,7 @@ func TestVerification(t *testing.T) {
 		assert.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowVerificationUI(ctx).String())
 		assert.NotContains(t, res.Request.URL.String(), gjson.Get(body, "id").String())
 
-		sr, _, err := testhelpers.NewSDKCustomClient(public, c).FrontendApi.GetVerificationFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
+		sr, _, err := testhelpers.NewSDKCustomClient(public, c).FrontendAPI.GetVerificationFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
 		require.NoError(t, err)
 
 		require.Len(t, sr.Ui.Messages, 1)
@@ -283,7 +283,7 @@ func TestVerification(t *testing.T) {
 			assertx.EqualAsJSON(t, text.NewVerificationEmailSent(), json.RawMessage(gjson.Get(actual, "ui.messages.0").Raw))
 
 			message := testhelpers.CourierExpectMessage(ctx, t, reg, verificationEmail, "Please verify your email address")
-			assert.Contains(t, message.Body, "please verify your account by clicking the following link")
+			assert.Contains(t, message.Body, "Verify your account by opening the following link")
 
 			verificationLink := testhelpers.CourierExpectLinkInMessage(t, message, 1)
 
diff --git a/selfservice/strategy/lookup/login.go b/selfservice/strategy/lookup/login.go
index 2eda9b5796c8..2668774a62d2 100644
--- a/selfservice/strategy/lookup/login.go
+++ b/selfservice/strategy/lookup/login.go
@@ -8,6 +8,10 @@ import (
 	"net/http"
 	"time"
 
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/ory/x/otelx"
+
 	"github.com/ory/x/sqlcon"
 
 	"github.com/ory/x/sqlxx"
@@ -88,8 +92,12 @@ type updateLoginFlowWithLookupSecretMethod struct {
 	Code string `json:"lookup_secret"`
 }
 
-func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, sess *session.Session) (i *identity.Identity, err error) {
+func (s *Strategy) Login(_ http.ResponseWriter, r *http.Request, f *login.Flow, sess *session.Session) (i *identity.Identity, err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.lookup.Strategy.Login")
+	defer otelx.End(span, &err)
+
 	if err := login.CheckAAL(f, identity.AuthenticatorAssuranceLevel2); err != nil {
+		span.SetAttributes(attribute.String("not_responsible_reason", "requested AAL is not AAL2"))
 		return nil, err
 	}
 
@@ -105,11 +113,11 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 		return nil, s.handleLoginError(r, f, err)
 	}
 
-	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 		return nil, s.handleLoginError(r, f, err)
 	}
 
-	i, c, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(r.Context(), s.ID(), sess.IdentityID.String())
+	i, c, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(ctx, s.ID(), sess.IdentityID.String())
 	if errors.Is(err, sqlcon.ErrNoRows) {
 		return nil, s.handleLoginError(r, f, errors.WithStack(schema.NewNoLookupDefined()))
 	} else if err != nil {
@@ -137,25 +145,30 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 		return nil, s.handleLoginError(r, f, errors.WithStack(schema.NewErrorValidationLookupInvalid()))
 	}
 
-	toUpdate, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), sess.IdentityID)
+	// We can't use a transaction here because HydrateIdentityAssociations (used by update) does not support transactions.
+	toUpdate, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, sess.IdentityID)
 	if err != nil {
-		return nil, err
+		return nil, s.handleLoginError(r, f, err)
 	}
 
 	encoded, err := json.Marshal(&o)
 	if err != nil {
-		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrInternalServerError.WithReason("Unable to encoded updated lookup secrets.").WithDebug(err.Error())))
+		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrInternalServerError.WithReason("Unable to encode updated lookup secrets.").WithDebug(err.Error())))
 	}
 
 	c.Config = encoded
 	toUpdate.SetCredentials(s.ID(), *c)
 
-	if err := s.d.PrivilegedIdentityPool().UpdateIdentity(r.Context(), toUpdate); err != nil {
+	// We can't use a transaction here because HydrateIdentityAssociations (used by update) does not support transactions.
+	if err := s.d.IdentityManager().Update(ctx, toUpdate,
+		// We need to allow write protected traits because we are updating the lookup secrets.
+		identity.ManagerAllowWriteProtectedTraits,
+	); err != nil {
 		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrInternalServerError.WithReason("Unable to update identity.").WithDebug(err.Error())))
 	}
 
 	f.Active = s.ID()
-	if err = s.d.LoginFlowPersister().UpdateLoginFlow(r.Context(), f); err != nil {
+	if err = s.d.LoginFlowPersister().UpdateLoginFlow(ctx, f); err != nil {
 		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrInternalServerError.WithReason("Could not update flow.").WithDebug(err.Error())))
 	}
 
diff --git a/selfservice/strategy/lookup/login_test.go b/selfservice/strategy/lookup/login_test.go
index c4896962c660..c746d744f059 100644
--- a/selfservice/strategy/lookup/login_test.go
+++ b/selfservice/strategy/lookup/login_test.go
@@ -14,6 +14,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/selfservice/flow"
+
 	"github.com/gofrs/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -55,7 +57,7 @@ func TestCompleteLogin(t *testing.T) {
 	t.Run("case=lookup payload is set when identity has lookup", func(t *testing.T) {
 		id, _ := createIdentity(t, reg)
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 		testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{"0.attributes.value"})
 	})
@@ -63,7 +65,7 @@ func TestCompleteLogin(t *testing.T) {
 	t.Run("case=lookup payload is not set when identity has no lookup", func(t *testing.T) {
 		id := createIdentityWithoutLookup(t, reg)
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 		assertx.EqualAsJSON(t, nil, f.Ui.Nodes)
 	})
@@ -71,7 +73,7 @@ func TestCompleteLogin(t *testing.T) {
 	t.Run("case=lookup payload is not set when identity has no lookup", func(t *testing.T) {
 		id := createIdentityWithoutLookup(t, reg)
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 		assertx.EqualAsJSON(t, nil, f.Ui.Nodes)
 	})
@@ -86,7 +88,7 @@ func TestCompleteLogin(t *testing.T) {
 	}
 
 	doAPIFlow := func(t *testing.T, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		return doAPIFlowWithClient(t, v, id, apiClient, false)
 	}
 
@@ -99,7 +101,7 @@ func TestCompleteLogin(t *testing.T) {
 	}
 
 	doBrowserFlow := func(t *testing.T, spa bool, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 		return doBrowserFlowWithClient(t, spa, v, id, browserClient, false)
 	}
 
@@ -235,30 +237,35 @@ func TestCompleteLogin(t *testing.T) {
 		}
 
 		t.Run("type=api", func(t *testing.T) {
-			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 			body, res := doAPIFlowWithClient(t, payload("key-0"), id, apiClient, false)
 			check(t, false, body, res, "key-0", 2)
 			// We can still use another key
 			body, res = doAPIFlowWithClient(t, payload("key-2"), id, apiClient, true)
 			check(t, false, body, res, "key-2", 3)
+			assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
 		})
 
 		t.Run("type=browser", func(t *testing.T) {
-			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 			body, res := doBrowserFlowWithClient(t, false, payload("key-3"), id, browserClient, false)
 			check(t, true, body, res, "key-3", 2)
 			// We can still use another key
 			body, res = doBrowserFlowWithClient(t, false, payload("key-5"), id, browserClient, true)
 			check(t, true, body, res, "key-5", 3)
+			assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
 		})
 
 		t.Run("type=spa", func(t *testing.T) {
-			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 			body, res := doBrowserFlowWithClient(t, true, payload("key-6"), id, browserClient, false)
 			check(t, false, body, res, "key-6", 2)
 			// We can still use another key
 			body, res = doBrowserFlowWithClient(t, true, payload("key-8"), id, browserClient, true)
 			check(t, false, body, res, "key-8", 3)
+
+			assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(body, "continue_with.0.action").String(), "%s", body)
+			assert.Contains(t, gjson.Get(body, "continue_with.0.redirect_browser_to").String(), conf.SelfServiceBrowserDefaultReturnTo(ctx).String(), "%s", body)
 		})
 	})
 
diff --git a/selfservice/strategy/lookup/settings.go b/selfservice/strategy/lookup/settings.go
index 1136d4d83414..08ed97f85453 100644
--- a/selfservice/strategy/lookup/settings.go
+++ b/selfservice/strategy/lookup/settings.go
@@ -9,6 +9,10 @@ import (
 	"net/http"
 	"time"
 
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/ory/x/otelx"
+
 	"github.com/tidwall/gjson"
 	"github.com/tidwall/sjson"
 
@@ -97,33 +101,37 @@ func (p *updateSettingsFlowWithLookupMethod) SetFlowID(rid uuid.UUID) {
 	p.Flow = rid.String()
 }
 
-func (s *Strategy) Settings(w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (*settings.UpdateContext, error) {
+func (s *Strategy) Settings(ctx context.Context, w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (_ *settings.UpdateContext, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.lookup.Strategy.Settings")
+	defer otelx.End(span, &err)
+
 	var p updateSettingsFlowWithLookupMethod
 	ctxUpdate, err := settings.PrepareUpdate(s.d, w, r, f, ss, settings.ContinuityKey(s.SettingsStrategyID()), &p)
 	if errors.Is(err, settings.ErrContinuePreviousAction) {
-		return ctxUpdate, s.continueSettingsFlow(w, r, ctxUpdate, &p)
+		return ctxUpdate, s.continueSettingsFlow(ctx, r, ctxUpdate, p)
 	} else if err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, p, err)
 	}
 
 	if err := s.decodeSettingsFlow(r, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, p, err)
 	}
 
 	if p.RegenerateLookup || p.RevealLookup || p.ConfirmLookup || p.DisableLookup {
 		// This method has only two submit buttons
 		p.Method = s.SettingsStrategyID()
-		if err := flow.MethodEnabledAndAllowed(r.Context(), f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
-			return nil, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
+			return nil, s.handleSettingsError(w, r, ctxUpdate, p, err)
 		}
 	} else {
+		span.SetAttributes(attribute.String("not_responsible_reason", "neither reveal, regenerate, confirm, nor disable was set"))
 		return nil, errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 
 	// This does not come from the payload!
 	p.Flow = ctxUpdate.Flow.ID.String()
-	if err := s.continueSettingsFlow(w, r, ctxUpdate, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+	if err := s.continueSettingsFlow(ctx, r, ctxUpdate, p); err != nil {
+		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, p, err)
 	}
 
 	return ctxUpdate, nil
@@ -141,20 +149,17 @@ func (s *Strategy) decodeSettingsFlow(r *http.Request, dest interface{}) error {
 	)
 }
 
-func (s *Strategy) continueSettingsFlow(
-	w http.ResponseWriter, r *http.Request,
-	ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithLookupMethod,
-) error {
+func (s *Strategy) continueSettingsFlow(ctx context.Context, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithLookupMethod) error {
 	if p.ConfirmLookup || p.RevealLookup || p.RegenerateLookup || p.DisableLookup {
-		if err := flow.MethodEnabledAndAllowed(r.Context(), flow.SettingsFlow, s.SettingsStrategyID(), s.SettingsStrategyID(), s.d); err != nil {
+		if err := flow.MethodEnabledAndAllowed(ctx, flow.SettingsFlow, s.SettingsStrategyID(), s.SettingsStrategyID(), s.d); err != nil {
 			return err
 		}
 
-		if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+		if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 			return err
 		}
 
-		if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(r.Context())).Before(time.Now()) {
+		if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(ctx)).Before(time.Now()) {
 			return errors.WithStack(settings.NewFlowNeedsReAuth())
 		}
 	} else {
@@ -162,16 +167,16 @@ func (s *Strategy) continueSettingsFlow(
 	}
 
 	if p.ConfirmLookup {
-		return s.continueSettingsFlowConfirm(w, r, ctxUpdate, p)
+		return s.continueSettingsFlowConfirm(ctx, ctxUpdate)
 	} else if p.RevealLookup {
-		if err := s.continueSettingsFlowReveal(w, r, ctxUpdate, p); err != nil {
+		if err := s.continueSettingsFlowReveal(ctx, ctxUpdate); err != nil {
 			return err
 		}
 		return flow.ErrStrategyAsksToReturnToUI
 	} else if p.DisableLookup {
-		return s.continueSettingsFlowDisable(w, r, ctxUpdate, p)
+		return s.continueSettingsFlowDisable(ctx, ctxUpdate)
 	} else if p.RegenerateLookup {
-		if err := s.continueSettingsFlowRegenerate(w, r, ctxUpdate, p); err != nil {
+		if err := s.continueSettingsFlowRegenerate(ctx, ctxUpdate); err != nil {
 			return err
 		}
 		// regen
@@ -181,8 +186,8 @@ func (s *Strategy) continueSettingsFlow(
 	return errors.New("ended up in unexpected state")
 }
 
-func (s *Strategy) continueSettingsFlowDisable(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithLookupMethod) error {
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.Identity.ID)
+func (s *Strategy) continueSettingsFlowDisable(ctx context.Context, ctxUpdate *settings.UpdateContext) error {
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.Identity.ID)
 	if err != nil {
 		return err
 	}
@@ -203,7 +208,7 @@ func (s *Strategy) continueSettingsFlowDisable(w http.ResponseWriter, r *http.Re
 		return err
 	}
 
-	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(r.Context(), ctxUpdate.Flow); err != nil {
+	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(ctx, ctxUpdate.Flow); err != nil {
 		return err
 	}
 
@@ -211,8 +216,8 @@ func (s *Strategy) continueSettingsFlowDisable(w http.ResponseWriter, r *http.Re
 	return nil
 }
 
-func (s *Strategy) continueSettingsFlowReveal(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithLookupMethod) error {
-	hasLookup, err := s.identityHasLookup(r.Context(), ctxUpdate.Session.IdentityID)
+func (s *Strategy) continueSettingsFlowReveal(ctx context.Context, ctxUpdate *settings.UpdateContext) error {
+	hasLookup, err := s.identityHasLookup(ctx, ctxUpdate.Session.Identity)
 	if err != nil {
 		return err
 	}
@@ -221,7 +226,7 @@ func (s *Strategy) continueSettingsFlowReveal(w http.ResponseWriter, r *http.Req
 		return errors.WithStack(herodot.ErrBadRequest.WithReasonf("Can not reveal lookup codes because you have none."))
 	}
 
-	_, cred, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(r.Context(), s.ID(), ctxUpdate.Session.IdentityID.String())
+	_, cred, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(ctx, s.ID(), ctxUpdate.Session.IdentityID.String())
 	if err != nil {
 		return err
 	}
@@ -244,14 +249,14 @@ func (s *Strategy) continueSettingsFlowReveal(w http.ResponseWriter, r *http.Req
 		return err
 	}
 
-	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(r.Context(), ctxUpdate.Flow); err != nil {
+	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(ctx, ctxUpdate.Flow); err != nil {
 		return err
 	}
 
 	return nil
 }
 
-func (s *Strategy) continueSettingsFlowRegenerate(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithLookupMethod) error {
+func (s *Strategy) continueSettingsFlowRegenerate(ctx context.Context, ctxUpdate *settings.UpdateContext) error {
 	codes := make([]identity.RecoveryCode, numCodes)
 	for k := range codes {
 		codes[k] = identity.RecoveryCode{Code: randx.MustString(8, randx.AlphaLowerNum)}
@@ -270,14 +275,14 @@ func (s *Strategy) continueSettingsFlowRegenerate(w http.ResponseWriter, r *http
 		return err
 	}
 
-	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(r.Context(), ctxUpdate.Flow); err != nil {
+	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(ctx, ctxUpdate.Flow); err != nil {
 		return err
 	}
 
 	return nil
 }
 
-func (s *Strategy) continueSettingsFlowConfirm(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithLookupMethod) error {
+func (s *Strategy) continueSettingsFlowConfirm(ctx context.Context, ctxUpdate *settings.UpdateContext) error {
 	codes := gjson.GetBytes(ctxUpdate.Flow.InternalContext, flow.PrefixInternalContextKey(s.ID(), InternalContextKeyRegenerated)).Array()
 	if len(codes) != numCodes {
 		return errors.WithStack(herodot.ErrBadRequest.WithReasonf("You must (re-)generate recovery backup codes before you can save them."))
@@ -293,7 +298,7 @@ func (s *Strategy) continueSettingsFlowConfirm(w http.ResponseWriter, r *http.Re
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to encode totp options to JSON: %s", err))
 	}
 
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.Identity.ID)
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.Identity.ID)
 	if err != nil {
 		return err
 	}
@@ -309,12 +314,12 @@ func (s *Strategy) continueSettingsFlowConfirm(w http.ResponseWriter, r *http.Re
 		return err
 	}
 
-	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(r.Context(), ctxUpdate.Flow); err != nil {
+	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(ctx, ctxUpdate.Flow); err != nil {
 		return err
 	}
 
 	// Since we added the method, it also means that we have authenticated it
-	if err := s.d.SessionManager().SessionAddAuthenticationMethods(r.Context(), ctxUpdate.Session.ID, session.AuthenticationMethod{
+	if err := s.d.SessionManager().SessionAddAuthenticationMethods(ctx, ctxUpdate.Session.ID, session.AuthenticationMethod{
 		Method: s.ID(),
 		AAL:    identity.AuthenticatorAssuranceLevel2,
 	}); err != nil {
@@ -325,13 +330,14 @@ func (s *Strategy) continueSettingsFlowConfirm(w http.ResponseWriter, r *http.Re
 	return nil
 }
 
-func (s *Strategy) identityHasLookup(ctx context.Context, id uuid.UUID) (bool, error) {
-	confidential, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, id)
-	if err != nil {
-		return false, err
+func (s *Strategy) identityHasLookup(ctx context.Context, id *identity.Identity) (bool, error) {
+	if len(id.Credentials) == 0 {
+		if err := s.d.PrivilegedIdentityPool().HydrateIdentityAssociations(ctx, id, identity.ExpandCredentials); err != nil {
+			return false, err
+		}
 	}
 
-	count, err := s.CountActiveMultiFactorCredentials(confidential.Credentials)
+	count, err := s.CountActiveMultiFactorCredentials(ctx, id.Credentials)
 	if err != nil {
 		return false, err
 	}
@@ -339,10 +345,12 @@ func (s *Strategy) identityHasLookup(ctx context.Context, id uuid.UUID) (bool, e
 	return count > 0, nil
 }
 
-func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity, f *settings.Flow) error {
+func (s *Strategy) PopulateSettingsMethod(ctx context.Context, r *http.Request, id *identity.Identity, f *settings.Flow) (err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.lookup.Strategy.PopulateSettingsMethod")
+	defer otelx.End(span, &err)
 	f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
 
-	hasLookup, err := s.identityHasLookup(r.Context(), id.ID)
+	hasLookup, err := s.identityHasLookup(ctx, id)
 	if err != nil {
 		return err
 	}
@@ -357,7 +365,7 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 	return nil
 }
 
-func (s *Strategy) handleSettingsError(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithLookupMethod, err error) error {
+func (s *Strategy) handleSettingsError(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithLookupMethod, err error) error {
 	// Do not pause flow if the flow type is an API flow as we can't save cookies in those flows.
 	if e := new(settings.FlowNeedsReAuth); errors.As(err, &e) && ctxUpdate.Flow != nil && ctxUpdate.Flow.Type == flow.TypeBrowser {
 		if err := s.d.ContinuityManager().Pause(r.Context(), w, r, settings.ContinuityKey(s.SettingsStrategyID()), settings.ContinuityOptions(p, ctxUpdate.GetSessionIdentity())...); err != nil {
diff --git a/selfservice/strategy/lookup/settings_test.go b/selfservice/strategy/lookup/settings_test.go
index fce2be4c0974..52b08786fd5a 100644
--- a/selfservice/strategy/lookup/settings_test.go
+++ b/selfservice/strategy/lookup/settings_test.go
@@ -111,7 +111,7 @@ func TestCompleteSettings(t *testing.T) {
 	conf.MustSet(ctx, config.ViperKeySecretsDefault, []string{"not-a-secure-session-key"})
 
 	doAPIFlow := func(t *testing.T, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 		values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 		v(values)
@@ -120,7 +120,7 @@ func TestCompleteSettings(t *testing.T) {
 	}
 
 	doBrowserFlow := func(t *testing.T, spa bool, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, spa, publicTS)
 		values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 		v(values)
@@ -129,7 +129,7 @@ func TestCompleteSettings(t *testing.T) {
 
 	t.Run("case=hide recovery codes behind reveal button and show disable button", func(t *testing.T) {
 		id, _ := createIdentity(t, reg)
-		browserClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		browserClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 
 		t.Run("case=spa", func(t *testing.T) {
 			f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, true, publicTS)
@@ -142,7 +142,7 @@ func TestCompleteSettings(t *testing.T) {
 		})
 
 		t.Run("case=api", func(t *testing.T) {
-			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 			f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 			testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{"0.attributes.value"})
 		})
@@ -150,7 +150,7 @@ func TestCompleteSettings(t *testing.T) {
 
 	t.Run("case=button for regeneration is displayed when identity has no recovery codes yet", func(t *testing.T) {
 		id := createIdentityWithoutLookup(t, reg)
-		browserClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		browserClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 
 		t.Run("case=spa", func(t *testing.T) {
 			f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, true, publicTS)
@@ -163,7 +163,7 @@ func TestCompleteSettings(t *testing.T) {
 		})
 
 		t.Run("case=api", func(t *testing.T) {
-			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 			f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 			testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{"0.attributes.value"})
 		})
@@ -389,7 +389,7 @@ func TestCompleteSettings(t *testing.T) {
 
 				t.Run("type=api", func(t *testing.T) {
 					id, _ := createIdentity(t, reg)
-					apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+					apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 					f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 					values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 
@@ -398,7 +398,7 @@ func TestCompleteSettings(t *testing.T) {
 
 					payloadConfirm(values)
 					actual, res := testhelpers.SettingsMakeRequest(t, true, false, f, apiClient, testhelpers.EncodeFormAsJSON(t, true, values))
-					assert.Equal(t, http.StatusOK, res.StatusCode)
+					require.Equal(t, http.StatusOK, res.StatusCode)
 
 					assert.Contains(t, res.Request.URL.String(), publicTS.URL+settings.RouteSubmitFlow)
 					assert.EqualValues(t, flow.StateSuccess, json.RawMessage(gjson.Get(actual, "state").String()))
@@ -410,7 +410,7 @@ func TestCompleteSettings(t *testing.T) {
 				runBrowser := func(t *testing.T, spa bool) {
 					id, _ := createIdentity(t, reg)
 
-					browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+					browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 					f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, spa, publicTS)
 					values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 
@@ -423,8 +423,11 @@ func TestCompleteSettings(t *testing.T) {
 
 					if spa {
 						assert.Contains(t, res.Request.URL.String(), publicTS.URL+settings.RouteSubmitFlow)
+						assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(actual, "continue_with.0.action").String(), "%s", actual)
+						assert.Contains(t, gjson.Get(actual, "continue_with.0.redirect_browser_to").String(), uiTS.URL, "%s", actual)
 					} else {
 						assert.Contains(t, res.Request.URL.String(), uiTS.URL)
+						assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
 					}
 
 					assert.EqualValues(t, flow.StateSuccess, json.RawMessage(gjson.Get(actual, "state").String()))
@@ -480,7 +483,7 @@ func TestCompleteSettings(t *testing.T) {
 
 				t.Run("type=api", func(t *testing.T) {
 					id, _ := createIdentity(t, reg)
-					apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+					apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 					f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 					values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 
@@ -498,7 +501,7 @@ func TestCompleteSettings(t *testing.T) {
 				runBrowser := func(t *testing.T, spa bool) {
 					id, _ := createIdentity(t, reg)
 
-					browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+					browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 					f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, spa, publicTS)
 					values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 
@@ -508,8 +511,11 @@ func TestCompleteSettings(t *testing.T) {
 
 					if spa {
 						assert.Contains(t, res.Request.URL.String(), publicTS.URL+settings.RouteSubmitFlow)
+						assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(actual, "continue_with.0.action").String(), "%s", actual)
+						assert.Contains(t, gjson.Get(actual, "continue_with.0.redirect_browser_to").String(), uiTS.URL, "%s", actual)
 					} else {
 						assert.Contains(t, res.Request.URL.String(), uiTS.URL)
+						assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
 					}
 
 					assert.EqualValues(t, flow.StateSuccess, json.RawMessage(gjson.Get(actual, "state").String()))
diff --git a/selfservice/strategy/lookup/strategy.go b/selfservice/strategy/lookup/strategy.go
index e8f12cac9948..ffd1081cee0f 100644
--- a/selfservice/strategy/lookup/strategy.go
+++ b/selfservice/strategy/lookup/strategy.go
@@ -34,6 +34,8 @@ type lookupStrategyDependencies interface {
 	x.WriterProvider
 	x.CSRFTokenGeneratorProvider
 	x.CSRFProvider
+	x.TransactionPersistenceProvider
+	x.TracingProvider
 
 	config.Provider
 
@@ -61,6 +63,7 @@ type lookupStrategyDependencies interface {
 
 	identity.PrivilegedPoolProvider
 	identity.ValidationProvider
+	identity.ManagementProvider
 
 	session.HandlerProvider
 	session.ManagementProvider
@@ -78,15 +81,15 @@ func NewStrategy(d any) *Strategy {
 	}
 }
 
-func (s *Strategy) CountActiveFirstFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveFirstFactorCredentials(_ context.Context, _ map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	return 0, nil
 }
 
-func (s *Strategy) CountActiveMultiFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveMultiFactorCredentials(_ context.Context, cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	for _, c := range cc {
 		if c.Type == s.ID() && len(c.Config) > 0 {
 			var conf identity.CredentialsLookupConfig
-			if err = json.Unmarshal(c.Config, &conf); err != nil {
+			if err := json.Unmarshal(c.Config, &conf); err != nil {
 				return 0, errors.WithStack(err)
 			}
 
@@ -106,7 +109,7 @@ func (s *Strategy) NodeGroup() node.UiNodeGroup {
 	return node.LookupGroup
 }
 
-func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context, _ session.AuthenticationMethods) session.AuthenticationMethod {
+func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context) session.AuthenticationMethod {
 	return session.AuthenticationMethod{
 		Method: s.ID(),
 		AAL:    identity.AuthenticatorAssuranceLevel2,
diff --git a/selfservice/strategy/lookup/strategy_test.go b/selfservice/strategy/lookup/strategy_test.go
index f9674ab2805e..5c8cf126f59d 100644
--- a/selfservice/strategy/lookup/strategy_test.go
+++ b/selfservice/strategy/lookup/strategy_test.go
@@ -21,7 +21,7 @@ func TestCountActiveFirstFactorCredentials(t *testing.T) {
 	strategy := lookup.NewStrategy(reg)
 
 	t.Run("first factor", func(t *testing.T) {
-		actual, err := strategy.CountActiveFirstFactorCredentials(nil)
+		actual, err := strategy.CountActiveFirstFactorCredentials(nil, nil)
 		require.NoError(t, err)
 		assert.Equal(t, 0, actual)
 	})
@@ -66,7 +66,7 @@ func TestCountActiveFirstFactorCredentials(t *testing.T) {
 			},
 		} {
 			t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
-				actual, err := strategy.CountActiveMultiFactorCredentials(tc.in)
+				actual, err := strategy.CountActiveMultiFactorCredentials(nil, tc.in)
 				require.NoError(t, err)
 				assert.Equal(t, tc.expected, actual)
 			})
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json
new file mode 100644
index 000000000000..2939b127e281
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json
@@ -0,0 +1,38 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "oidc",
+    "attributes": {
+      "name": "provider",
+      "type": "submit",
+      "value": "test-provider",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010002,
+        "text": "Sign in with test-provider",
+        "type": "info",
+        "context": {
+          "provider": "test-provider",
+          "provider_id": "test-provider"
+        }
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json
new file mode 100644
index 000000000000..2939b127e281
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json
@@ -0,0 +1,38 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "oidc",
+    "attributes": {
+      "name": "provider",
+      "type": "submit",
+      "value": "test-provider",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010002,
+        "text": "Sign in with test-provider",
+        "type": "info",
+        "context": {
+          "provider": "test-provider",
+          "provider_id": "test-provider"
+        }
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_oidc.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_oidc.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_oidc.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_oidc.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_oidc.json
new file mode 100644
index 000000000000..a2c08bd8d1b9
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_oidc.json
@@ -0,0 +1,25 @@
+[
+  {
+    "type": "input",
+    "group": "oidc",
+    "attributes": {
+      "name": "provider",
+      "type": "submit",
+      "value": "test-provider",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010002,
+        "text": "Sign in with test-provider",
+        "type": "info",
+        "context": {
+          "provider": "test-provider",
+          "provider_id": "test-provider"
+        }
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json
new file mode 100644
index 000000000000..2939b127e281
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json
@@ -0,0 +1,38 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "oidc",
+    "attributes": {
+      "name": "provider",
+      "type": "submit",
+      "value": "test-provider",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010002,
+        "text": "Sign in with test-provider",
+        "type": "info",
+        "context": {
+          "provider": "test-provider",
+          "provider_id": "test-provider"
+        }
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh.json
new file mode 100644
index 000000000000..9ce35531c24a
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh.json
@@ -0,0 +1,37 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "oidc",
+    "attributes": {
+      "name": "provider",
+      "type": "submit",
+      "value": "test-provider",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010002,
+        "text": "Sign in with test-provider",
+        "type": "info",
+        "context": {
+          "provider": "test-provider"
+        }
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh.json b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh.json
new file mode 100644
index 000000000000..364b8abc331c
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh.json
@@ -0,0 +1,15 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=githuber.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=githuber.json
index 19da7fb7f971..48d0280aff04 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=githuber.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=githuber.json
@@ -153,10 +153,10 @@
     "meta": {
       "label": {
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         },
         "id": 1050003,
-        "text": "Unlink ory",
+        "text": "Unlink Ory",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=multiuser.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=multiuser.json
index dd0dc9e5f179..3b534e240899 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=multiuser.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=multiuser.json
@@ -153,10 +153,10 @@
     "meta": {
       "label": {
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         },
         "id": 1050003,
-        "text": "Unlink ory",
+        "text": "Unlink Ory",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=password.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=password.json
index 55909b7380a6..94db74f27534 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=password.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-case=should_adjust_linkable_providers_based_on_linked_credentials-agent=password.json
@@ -153,10 +153,10 @@
     "meta": {
       "label": {
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         },
         "id": 1050002,
-        "text": "Link ory",
+        "text": "Link Ory",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=fetch.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=fetch.json
index b775cb07f8b3..37108bfe985a 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=fetch.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=fetch.json
@@ -153,10 +153,10 @@
     "meta": {
       "label": {
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         },
         "id": 1050003,
-        "text": "Unlink ory",
+        "text": "Unlink Ory",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=original.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=original.json
index 19da7fb7f971..48d0280aff04 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=original.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=original.json
@@ -153,10 +153,10 @@
     "meta": {
       "label": {
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         },
         "id": 1050003,
-        "text": "Unlink ory",
+        "text": "Unlink Ory",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=response.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=response.json
index cda03ca13acb..fc364efa9d90 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=response.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection-flow=response.json
@@ -154,10 +154,10 @@
     "meta": {
       "label": {
         "id": 1050003,
-        "text": "Unlink ory",
+        "text": "Unlink Ory",
         "type": "info",
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         }
       }
     }
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection_even_if_user_does_not_have_oidc_credentials_yet.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection_even_if_user_does_not_have_oidc_credentials_yet.json
index 1763aae80238..cc010fb2c206 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection_even_if_user_does_not_have_oidc_credentials_yet.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_link_a_connection_even_if_user_does_not_have_oidc_credentials_yet.json
@@ -153,10 +153,10 @@
     "meta": {
       "label": {
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         },
         "id": 1050002,
-        "text": "Link ory",
+        "text": "Link Ory",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_not_be_able_to_link_a_connection_which_already_exists.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_not_be_able_to_link_a_connection_which_already_exists.json
index a8b9407aab8a..ddaaf6905c12 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_not_be_able_to_link_a_connection_which_already_exists.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=link-case=should_not_be_able_to_link_a_connection_which_already_exists.json
@@ -154,10 +154,10 @@
     "meta": {
       "label": {
         "id": 1050003,
-        "text": "Unlink ory",
+        "text": "Unlink Ory",
         "type": "info",
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         }
       }
     }
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_a_connection_not_yet_linked-flow=fetch.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_a_connection_not_yet_linked-flow=fetch.json
index 19da7fb7f971..48d0280aff04 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_a_connection_not_yet_linked-flow=fetch.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_a_connection_not_yet_linked-flow=fetch.json
@@ -153,10 +153,10 @@
     "meta": {
       "label": {
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         },
         "id": 1050003,
-        "text": "Unlink ory",
+        "text": "Unlink Ory",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_a_connection_not_yet_linked-flow=json.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_a_connection_not_yet_linked-flow=json.json
index a8b9407aab8a..ddaaf6905c12 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_a_connection_not_yet_linked-flow=json.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_a_connection_not_yet_linked-flow=json.json
@@ -154,10 +154,10 @@
     "meta": {
       "label": {
         "id": 1050003,
-        "text": "Unlink ory",
+        "text": "Unlink Ory",
         "type": "info",
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         }
       }
     }
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_an_non-existing_connection-flow=fetch.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_an_non-existing_connection-flow=fetch.json
index 19da7fb7f971..48d0280aff04 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_an_non-existing_connection-flow=fetch.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_an_non-existing_connection-flow=fetch.json
@@ -153,10 +153,10 @@
     "meta": {
       "label": {
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         },
         "id": 1050003,
-        "text": "Unlink ory",
+        "text": "Unlink Ory",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_an_non-existing_connection-flow=json.json b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_an_non-existing_connection-flow=json.json
index a8b9407aab8a..ddaaf6905c12 100644
--- a/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_an_non-existing_connection-flow=json.json
+++ b/selfservice/strategy/oidc/.snapshots/TestSettingsStrategy-suite=unlink-case=should_not_be_able_to_unlink_an_non-existing_connection-flow=json.json
@@ -154,10 +154,10 @@
     "meta": {
       "label": {
         "id": 1050003,
-        "text": "Unlink ory",
+        "text": "Unlink Ory",
         "type": "info",
         "context": {
-          "provider": "ory"
+          "provider": "Ory"
         }
       }
     }
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_login.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_login.json
new file mode 100644
index 000000000000..cfcda57ec4e1
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_login.json
@@ -0,0 +1,254 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "autoPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with autoPKCE",
+            "type": "info",
+            "context": {
+              "provider": "autoPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "claimsViaUserInfo",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with claimsViaUserInfo",
+            "type": "info",
+            "context": {
+              "provider": "claimsViaUserInfo"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "forcePKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with forcePKCE",
+            "type": "info",
+            "context": {
+              "provider": "forcePKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "invalid-issuer",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with invalid-issuer",
+            "type": "info",
+            "context": {
+              "provider": "invalid-issuer"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "neverPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with neverPKCE",
+            "type": "info",
+            "context": {
+              "provider": "neverPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "secondProvider",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with secondProvider",
+            "type": "info",
+            "context": {
+              "provider": "secondProvider"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "valid2",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with valid2",
+            "type": "info",
+            "context": {
+              "provider": "valid2"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-oidc-strategy-lh-false@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "password",
+          "type": "password",
+          "required": true,
+          "autocomplete": "current-password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070001,
+            "text": "Password",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "method",
+          "type": "submit",
+          "value": "password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010022,
+            "text": "Sign in with password",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-oidc-strategy-lh-false@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-oidc-strategy-lh-false@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": [],
+          "available_providers": [],
+          "duplicateIdentifier": "email-exist-with-oidc-strategy-lh-false@ory.sh",
+          "duplicate_identifier": "email-exist-with-oidc-strategy-lh-false@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration.json
new file mode 100644
index 000000000000..cfcda57ec4e1
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration.json
@@ -0,0 +1,254 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "autoPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with autoPKCE",
+            "type": "info",
+            "context": {
+              "provider": "autoPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "claimsViaUserInfo",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with claimsViaUserInfo",
+            "type": "info",
+            "context": {
+              "provider": "claimsViaUserInfo"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "forcePKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with forcePKCE",
+            "type": "info",
+            "context": {
+              "provider": "forcePKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "invalid-issuer",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with invalid-issuer",
+            "type": "info",
+            "context": {
+              "provider": "invalid-issuer"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "neverPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with neverPKCE",
+            "type": "info",
+            "context": {
+              "provider": "neverPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "secondProvider",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with secondProvider",
+            "type": "info",
+            "context": {
+              "provider": "secondProvider"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "valid2",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with valid2",
+            "type": "info",
+            "context": {
+              "provider": "valid2"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-oidc-strategy-lh-false@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "password",
+          "type": "password",
+          "required": true,
+          "autocomplete": "current-password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070001,
+            "text": "Password",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "method",
+          "type": "submit",
+          "value": "password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010022,
+            "text": "Sign in with password",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-oidc-strategy-lh-false@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-oidc-strategy-lh-false@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": [],
+          "available_providers": [],
+          "duplicateIdentifier": "email-exist-with-oidc-strategy-lh-false@ory.sh",
+          "duplicate_identifier": "email-exist-with-oidc-strategy-lh-false@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration_id_first_strategy_enabled.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration_id_first_strategy_enabled.json
new file mode 100644
index 000000000000..cfcda57ec4e1
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration_id_first_strategy_enabled.json
@@ -0,0 +1,254 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "autoPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with autoPKCE",
+            "type": "info",
+            "context": {
+              "provider": "autoPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "claimsViaUserInfo",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with claimsViaUserInfo",
+            "type": "info",
+            "context": {
+              "provider": "claimsViaUserInfo"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "forcePKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with forcePKCE",
+            "type": "info",
+            "context": {
+              "provider": "forcePKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "invalid-issuer",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with invalid-issuer",
+            "type": "info",
+            "context": {
+              "provider": "invalid-issuer"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "neverPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with neverPKCE",
+            "type": "info",
+            "context": {
+              "provider": "neverPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "secondProvider",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with secondProvider",
+            "type": "info",
+            "context": {
+              "provider": "secondProvider"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "valid2",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with valid2",
+            "type": "info",
+            "context": {
+              "provider": "valid2"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-oidc-strategy-lh-false@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "password",
+          "type": "password",
+          "required": true,
+          "autocomplete": "current-password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070001,
+            "text": "Password",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "method",
+          "type": "submit",
+          "value": "password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010022,
+            "text": "Sign in with password",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-oidc-strategy-lh-false@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-oidc-strategy-lh-false@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": [],
+          "available_providers": [],
+          "duplicateIdentifier": "email-exist-with-oidc-strategy-lh-false@ory.sh",
+          "duplicate_identifier": "email-exist-with-oidc-strategy-lh-false@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_login.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_login.json
new file mode 100644
index 000000000000..5fbb69e1fcc6
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_login.json
@@ -0,0 +1,254 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "autoPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with autoPKCE",
+            "type": "info",
+            "context": {
+              "provider": "autoPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "claimsViaUserInfo",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with claimsViaUserInfo",
+            "type": "info",
+            "context": {
+              "provider": "claimsViaUserInfo"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "forcePKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with forcePKCE",
+            "type": "info",
+            "context": {
+              "provider": "forcePKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "invalid-issuer",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with invalid-issuer",
+            "type": "info",
+            "context": {
+              "provider": "invalid-issuer"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "neverPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with neverPKCE",
+            "type": "info",
+            "context": {
+              "provider": "neverPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "secondProvider",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with secondProvider",
+            "type": "info",
+            "context": {
+              "provider": "secondProvider"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "valid2",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with valid2",
+            "type": "info",
+            "context": {
+              "provider": "valid2"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-password-strategy-lh-false@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "password",
+          "type": "password",
+          "required": true,
+          "autocomplete": "current-password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070001,
+            "text": "Password",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "method",
+          "type": "submit",
+          "value": "password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010022,
+            "text": "Sign in with password",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-password-strategy-lh-false@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-password-strategy-lh-false@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": [],
+          "available_providers": [],
+          "duplicateIdentifier": "email-exist-with-password-strategy-lh-false@ory.sh",
+          "duplicate_identifier": "email-exist-with-password-strategy-lh-false@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration.json
new file mode 100644
index 000000000000..5fbb69e1fcc6
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration.json
@@ -0,0 +1,254 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "autoPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with autoPKCE",
+            "type": "info",
+            "context": {
+              "provider": "autoPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "claimsViaUserInfo",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with claimsViaUserInfo",
+            "type": "info",
+            "context": {
+              "provider": "claimsViaUserInfo"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "forcePKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with forcePKCE",
+            "type": "info",
+            "context": {
+              "provider": "forcePKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "invalid-issuer",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with invalid-issuer",
+            "type": "info",
+            "context": {
+              "provider": "invalid-issuer"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "neverPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with neverPKCE",
+            "type": "info",
+            "context": {
+              "provider": "neverPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "secondProvider",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with secondProvider",
+            "type": "info",
+            "context": {
+              "provider": "secondProvider"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "valid2",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with valid2",
+            "type": "info",
+            "context": {
+              "provider": "valid2"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-password-strategy-lh-false@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "password",
+          "type": "password",
+          "required": true,
+          "autocomplete": "current-password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070001,
+            "text": "Password",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "method",
+          "type": "submit",
+          "value": "password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010022,
+            "text": "Sign in with password",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-password-strategy-lh-false@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-password-strategy-lh-false@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": [],
+          "available_providers": [],
+          "duplicateIdentifier": "email-exist-with-password-strategy-lh-false@ory.sh",
+          "duplicate_identifier": "email-exist-with-password-strategy-lh-false@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration_id_first_strategy_enabled.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration_id_first_strategy_enabled.json
new file mode 100644
index 000000000000..5fbb69e1fcc6
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=false-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration_id_first_strategy_enabled.json
@@ -0,0 +1,254 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "autoPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with autoPKCE",
+            "type": "info",
+            "context": {
+              "provider": "autoPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "claimsViaUserInfo",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with claimsViaUserInfo",
+            "type": "info",
+            "context": {
+              "provider": "claimsViaUserInfo"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "forcePKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with forcePKCE",
+            "type": "info",
+            "context": {
+              "provider": "forcePKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "invalid-issuer",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with invalid-issuer",
+            "type": "info",
+            "context": {
+              "provider": "invalid-issuer"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "neverPKCE",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with neverPKCE",
+            "type": "info",
+            "context": {
+              "provider": "neverPKCE"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "secondProvider",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with secondProvider",
+            "type": "info",
+            "context": {
+              "provider": "secondProvider"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "valid2",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with valid2",
+            "type": "info",
+            "context": {
+              "provider": "valid2"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-password-strategy-lh-false@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "password",
+          "type": "password",
+          "required": true,
+          "autocomplete": "current-password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070001,
+            "text": "Password",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "method",
+          "type": "submit",
+          "value": "password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010022,
+            "text": "Sign in with password",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-password-strategy-lh-false@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-password-strategy-lh-false@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": [],
+          "available_providers": [],
+          "duplicateIdentifier": "email-exist-with-password-strategy-lh-false@ory.sh",
+          "duplicate_identifier": "email-exist-with-password-strategy-lh-false@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_login.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_login.json
new file mode 100644
index 000000000000..77bef5d097ae
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_login.json
@@ -0,0 +1,83 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "secondProvider",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with secondProvider",
+            "type": "info",
+            "context": {
+              "provider": "secondProvider"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-oidc-strategy-lh-true@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-oidc-strategy-lh-true@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-oidc-strategy-lh-true@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": ["oidc"],
+          "available_providers": ["secondProvider"],
+          "duplicateIdentifier": "email-exist-with-oidc-strategy-lh-true@ory.sh",
+          "duplicate_identifier": "email-exist-with-oidc-strategy-lh-true@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration.json
new file mode 100644
index 000000000000..77bef5d097ae
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration.json
@@ -0,0 +1,83 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "secondProvider",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with secondProvider",
+            "type": "info",
+            "context": {
+              "provider": "secondProvider"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-oidc-strategy-lh-true@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-oidc-strategy-lh-true@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-oidc-strategy-lh-true@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": ["oidc"],
+          "available_providers": ["secondProvider"],
+          "duplicateIdentifier": "email-exist-with-oidc-strategy-lh-true@ory.sh",
+          "duplicate_identifier": "email-exist-with-oidc-strategy-lh-true@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration_id_first_strategy_enabled.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration_id_first_strategy_enabled.json
new file mode 100644
index 000000000000..77bef5d097ae
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_oidc_credentials-case=should_fail_registration_id_first_strategy_enabled.json
@@ -0,0 +1,83 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "oidc",
+        "attributes": {
+          "name": "provider",
+          "type": "submit",
+          "value": "secondProvider",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010018,
+            "text": "Confirm with secondProvider",
+            "type": "info",
+            "context": {
+              "provider": "secondProvider"
+            }
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-oidc-strategy-lh-true@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-oidc-strategy-lh-true@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-oidc-strategy-lh-true@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": ["oidc"],
+          "available_providers": ["secondProvider"],
+          "duplicateIdentifier": "email-exist-with-oidc-strategy-lh-true@ory.sh",
+          "duplicate_identifier": "email-exist-with-oidc-strategy-lh-true@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_login.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_login.json
new file mode 100644
index 000000000000..93317c6e479a
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_login.json
@@ -0,0 +1,100 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-password-strategy-lh-true@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "password",
+          "type": "password",
+          "required": true,
+          "autocomplete": "current-password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070001,
+            "text": "Password",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "method",
+          "type": "submit",
+          "value": "password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010022,
+            "text": "Sign in with password",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-password-strategy-lh-true@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-password-strategy-lh-true@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": ["password"],
+          "available_providers": [],
+          "duplicateIdentifier": "email-exist-with-password-strategy-lh-true@ory.sh",
+          "duplicate_identifier": "email-exist-with-password-strategy-lh-true@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration.json
new file mode 100644
index 000000000000..93317c6e479a
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration.json
@@ -0,0 +1,100 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-password-strategy-lh-true@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "password",
+          "type": "password",
+          "required": true,
+          "autocomplete": "current-password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070001,
+            "text": "Password",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "method",
+          "type": "submit",
+          "value": "password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010022,
+            "text": "Sign in with password",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-password-strategy-lh-true@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-password-strategy-lh-true@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": ["password"],
+          "available_providers": [],
+          "duplicateIdentifier": "email-exist-with-password-strategy-lh-true@ory.sh",
+          "duplicate_identifier": "email-exist-with-password-strategy-lh-true@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration_id_first_strategy_enabled.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration_id_first_strategy_enabled.json
new file mode 100644
index 000000000000..93317c6e479a
--- /dev/null
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-login-hints-enabled=true-case=should_fail_to_register_and_return_fresh_login_flow_if_email_is_already_being_used_by_password_credentials-case=should_fail_registration_id_first_strategy_enabled.json
@@ -0,0 +1,100 @@
+{
+  "organization_id": null,
+  "type": "browser",
+  "active": "oidc",
+  "ui": {
+    "method": "POST",
+    "nodes": [
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "csrf_token",
+          "type": "hidden",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {}
+      },
+      {
+        "type": "input",
+        "group": "default",
+        "attributes": {
+          "name": "identifier",
+          "type": "hidden",
+          "value": "email-exist-with-password-strategy-lh-true@ory.sh",
+          "required": true,
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070004,
+            "text": "ID",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "password",
+          "type": "password",
+          "required": true,
+          "autocomplete": "current-password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1070001,
+            "text": "Password",
+            "type": "info"
+          }
+        }
+      },
+      {
+        "type": "input",
+        "group": "password",
+        "attributes": {
+          "name": "method",
+          "type": "submit",
+          "value": "password",
+          "disabled": false,
+          "node_type": "input"
+        },
+        "messages": [],
+        "meta": {
+          "label": {
+            "id": 1010022,
+            "text": "Sign in with password",
+            "type": "info"
+          }
+        }
+      }
+    ],
+    "messages": [
+      {
+        "id": 1010016,
+        "text": "You tried to sign in with \"email-exist-with-password-strategy-lh-true@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"email-exist-with-password-strategy-lh-true@ory.sh\" at \"generic\" as another way to sign in.",
+        "type": "info",
+        "context": {
+          "available_credential_types": ["password"],
+          "available_providers": [],
+          "duplicateIdentifier": "email-exist-with-password-strategy-lh-true@ory.sh",
+          "duplicate_identifier": "email-exist-with-password-strategy-lh-true@ory.sh",
+          "provider": "generic"
+        }
+      }
+    ]
+  },
+  "refresh": false,
+  "requested_aal": "aal1",
+  "state": "choose_method"
+}
+
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-method=TestPopulateLoginMethod.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-method=TestPopulateLoginMethod.json
deleted file mode 100644
index bacf802cd191..000000000000
--- a/selfservice/strategy/oidc/.snapshots/TestStrategy-method=TestPopulateLoginMethod.json
+++ /dev/null
@@ -1,106 +0,0 @@
-{
-  "method": "POST",
-  "nodes": [
-    {
-      "type": "input",
-      "group": "default",
-      "attributes": {
-        "name": "csrf_token",
-        "type": "hidden",
-        "required": true,
-        "disabled": false,
-        "node_type": "input"
-      },
-      "messages": [],
-      "meta": {}
-    },
-    {
-      "type": "input",
-      "group": "oidc",
-      "attributes": {
-        "name": "provider",
-        "type": "submit",
-        "value": "valid",
-        "disabled": false,
-        "node_type": "input"
-      },
-      "messages": [],
-      "meta": {
-        "label": {
-          "id": 1010002,
-          "text": "Sign in with valid",
-          "type": "info",
-          "context": {
-            "provider": "valid"
-          }
-        }
-      }
-    },
-    {
-      "type": "input",
-      "group": "oidc",
-      "attributes": {
-        "name": "provider",
-        "type": "submit",
-        "value": "secondProvider",
-        "disabled": false,
-        "node_type": "input"
-      },
-      "messages": [],
-      "meta": {
-        "label": {
-          "id": 1010002,
-          "text": "Sign in with secondProvider",
-          "type": "info",
-          "context": {
-            "provider": "secondProvider"
-          }
-        }
-      }
-    },
-    {
-      "type": "input",
-      "group": "oidc",
-      "attributes": {
-        "name": "provider",
-        "type": "submit",
-        "value": "claimsViaUserInfo",
-        "disabled": false,
-        "node_type": "input"
-      },
-      "messages": [],
-      "meta": {
-        "label": {
-          "id": 1010002,
-          "text": "Sign in with claimsViaUserInfo",
-          "type": "info",
-          "context": {
-            "provider": "claimsViaUserInfo"
-          }
-        }
-      }
-    },
-    {
-      "type": "input",
-      "group": "oidc",
-      "attributes": {
-        "name": "provider",
-        "type": "submit",
-        "value": "invalid-issuer",
-        "disabled": false,
-        "node_type": "input"
-      },
-      "messages": [],
-      "meta": {
-        "label": {
-          "id": 1010002,
-          "text": "Sign in with invalid-issuer",
-          "type": "info",
-          "context": {
-            "provider": "invalid-issuer"
-          }
-        }
-      }
-    }
-  ]
-}
diff --git a/selfservice/strategy/oidc/.snapshots/TestStrategy-method=TestPopulateSignUpMethod.json b/selfservice/strategy/oidc/.snapshots/TestStrategy-method=TestPopulateSignUpMethod.json
index 6b0a9ba98cf8..2177c514d3fd 100644
--- a/selfservice/strategy/oidc/.snapshots/TestStrategy-method=TestPopulateSignUpMethod.json
+++ b/selfservice/strategy/oidc/.snapshots/TestStrategy-method=TestPopulateSignUpMethod.json
@@ -31,7 +31,31 @@
           "text": "Sign up with valid",
           "type": "info",
           "context": {
-            "provider": "valid"
+            "provider": "valid",
+            "provider_id": "valid"
+          }
+        }
+      }
+    },
+    {
+      "type": "input",
+      "group": "oidc",
+      "attributes": {
+        "name": "provider",
+        "type": "submit",
+        "value": "valid2",
+        "disabled": false,
+        "node_type": "input"
+      },
+      "messages": [],
+      "meta": {
+        "label": {
+          "id": 1040002,
+          "text": "Sign up with valid2",
+          "type": "info",
+          "context": {
+            "provider": "valid2",
+            "provider_id": "valid2"
           }
         }
       }
@@ -53,7 +77,8 @@
           "text": "Sign up with secondProvider",
           "type": "info",
           "context": {
-            "provider": "secondProvider"
+            "provider": "secondProvider",
+            "provider_id": "secondProvider"
           }
         }
       }
@@ -75,7 +100,77 @@
           "text": "Sign up with claimsViaUserInfo",
           "type": "info",
           "context": {
-            "provider": "claimsViaUserInfo"
+            "provider": "claimsViaUserInfo",
+            "provider_id": "claimsViaUserInfo"
+          }
+        }
+      }
+    },
+    {
+      "type": "input",
+      "group": "oidc",
+      "attributes": {
+        "name": "provider",
+        "type": "submit",
+        "value": "neverPKCE",
+        "disabled": false,
+        "node_type": "input"
+      },
+      "messages": [],
+      "meta": {
+        "label": {
+          "id": 1040002,
+          "text": "Sign up with neverPKCE",
+          "type": "info",
+          "context": {
+            "provider": "neverPKCE",
+            "provider_id": "neverPKCE"
+          }
+        }
+      }
+    },
+    {
+      "type": "input",
+      "group": "oidc",
+      "attributes": {
+        "name": "provider",
+        "type": "submit",
+        "value": "autoPKCE",
+        "disabled": false,
+        "node_type": "input"
+      },
+      "messages": [],
+      "meta": {
+        "label": {
+          "id": 1040002,
+          "text": "Sign up with autoPKCE",
+          "type": "info",
+          "context": {
+            "provider": "autoPKCE",
+            "provider_id": "autoPKCE"
+          }
+        }
+      }
+    },
+    {
+      "type": "input",
+      "group": "oidc",
+      "attributes": {
+        "name": "provider",
+        "type": "submit",
+        "value": "forcePKCE",
+        "disabled": false,
+        "node_type": "input"
+      },
+      "messages": [],
+      "meta": {
+        "label": {
+          "id": 1040002,
+          "text": "Sign up with forcePKCE",
+          "type": "info",
+          "context": {
+            "provider": "forcePKCE",
+            "provider_id": "forcePKCE"
           }
         }
       }
@@ -97,7 +192,8 @@
           "text": "Sign up with invalid-issuer",
           "type": "info",
           "context": {
-            "provider": "invalid-issuer"
+            "provider": "invalid-issuer",
+            "provider_id": "invalid-issuer"
           }
         }
       }
diff --git a/selfservice/strategy/oidc/form.go b/selfservice/strategy/oidc/form.go
index 69c86012fbf2..ff3f8cab4846 100644
--- a/selfservice/strategy/oidc/form.go
+++ b/selfservice/strategy/oidc/form.go
@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"encoding/json"
 
-	"github.com/imdario/mergo"
+	"dario.cat/mergo"
 
 	"github.com/ory/kratos/identity"
 )
diff --git a/selfservice/strategy/oidc/nodes.go b/selfservice/strategy/oidc/nodes.go
index e60dd6324d1a..3dc725e0d967 100644
--- a/selfservice/strategy/oidc/nodes.go
+++ b/selfservice/strategy/oidc/nodes.go
@@ -8,10 +8,10 @@ import (
 	"github.com/ory/kratos/ui/node"
 )
 
-func NewLinkNode(provider string) *node.Node {
-	return node.NewInputField("link", provider, node.OpenIDConnectGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoSelfServiceSettingsUpdateLinkOIDC(provider))
+func NewLinkNode(providerID, providerLabel string) *node.Node {
+	return node.NewInputField("link", providerID, node.OpenIDConnectGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoSelfServiceSettingsUpdateLinkOIDC(providerLabel))
 }
 
-func NewUnlinkNode(provider string) *node.Node {
-	return node.NewInputField("unlink", provider, node.OpenIDConnectGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoSelfServiceSettingsUpdateUnlinkOIDC(provider))
+func NewUnlinkNode(providerID, providerLabel string) *node.Node {
+	return node.NewInputField("unlink", providerID, node.OpenIDConnectGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoSelfServiceSettingsUpdateUnlinkOIDC(providerLabel))
 }
diff --git a/selfservice/strategy/oidc/pkce.go b/selfservice/strategy/oidc/pkce.go
new file mode 100644
index 000000000000..2b397c8702b7
--- /dev/null
+++ b/selfservice/strategy/oidc/pkce.go
@@ -0,0 +1,79 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc
+
+import (
+	"context"
+	"slices"
+
+	gooidc "github.com/coreos/go-oidc/v3/oidc"
+	"github.com/pkg/errors"
+	"golang.org/x/oauth2"
+
+	oidcv1 "github.com/ory/kratos/gen/oidc/v1"
+	"github.com/ory/kratos/x"
+)
+
+type pkceDependencies interface {
+	x.LoggingProvider
+	x.HTTPClientProvider
+}
+
+func PKCEChallenge(s *oidcv1.State) []oauth2.AuthCodeOption {
+	if s.GetPkceVerifier() == "" {
+		return nil
+	}
+	return []oauth2.AuthCodeOption{oauth2.S256ChallengeOption(s.GetPkceVerifier())}
+}
+
+func PKCEVerifier(s *oidcv1.State) []oauth2.AuthCodeOption {
+	if s.GetPkceVerifier() == "" {
+		return nil
+	}
+	return []oauth2.AuthCodeOption{oauth2.VerifierOption(s.GetPkceVerifier())}
+}
+
+func maybePKCE(ctx context.Context, d pkceDependencies, _p Provider) (verifier string) {
+	if _p.Config().PKCE == "never" {
+		return ""
+	}
+
+	p, ok := _p.(OAuth2Provider)
+	if !ok {
+		return ""
+	}
+
+	if p.Config().PKCE != "force" {
+		// autodiscover PKCE support
+		pkceSupported, err := discoverPKCE(ctx, d, p)
+		if err != nil {
+			d.Logger().WithError(err).Warnf("Failed to autodiscover PKCE support for provider %q. Continuing without PKCE.", p.Config().ID)
+			return ""
+		}
+		if !pkceSupported {
+			d.Logger().Infof("Provider %q does not advertise support for PKCE. Continuing without PKCE.", p.Config().ID)
+			return ""
+		}
+	}
+	return oauth2.GenerateVerifier()
+}
+
+func discoverPKCE(ctx context.Context, d pkceDependencies, p OAuth2Provider) (pkceSupported bool, err error) {
+	if p.Config().IssuerURL == "" {
+		return false, errors.New("Issuer URL must be set to autodiscover PKCE support")
+	}
+
+	ctx = gooidc.ClientContext(ctx, d.HTTPClient(ctx).HTTPClient)
+	gp, err := gooidc.NewProvider(ctx, p.Config().IssuerURL)
+	if err != nil {
+		return false, errors.Wrap(err, "failed to initialize provider")
+	}
+	var claims struct {
+		CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported"`
+	}
+	if err := gp.Claims(&claims); err != nil {
+		return false, errors.Wrap(err, "failed to deserialize provider claims")
+	}
+	return slices.Contains(claims.CodeChallengeMethodsSupported, "S256"), nil
+}
diff --git a/selfservice/strategy/oidc/pkce_test.go b/selfservice/strategy/oidc/pkce_test.go
new file mode 100644
index 000000000000..24ef31c5d251
--- /dev/null
+++ b/selfservice/strategy/oidc/pkce_test.go
@@ -0,0 +1,89 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc_test
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/internal"
+	"github.com/ory/kratos/selfservice/strategy/oidc"
+	"github.com/ory/kratos/x"
+)
+
+func TestPKCESupport(t *testing.T) {
+	supported := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintf(w, `{"issuer": "http://%s", "code_challenge_methods_supported":["S256"]}`, r.Host)
+	}))
+	t.Cleanup(supported.Close)
+	notSupported := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintf(w, `{"issuer": "http://%s", "code_challenge_methods_supported": ["plain"]}`, r.Host)
+	}))
+	t.Cleanup(notSupported.Close)
+
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	_ = conf
+	strat := oidc.NewStrategy(reg)
+
+	for _, tc := range []struct {
+		c    *oidc.Configuration
+		pkce bool
+	}{
+		{c: &oidc.Configuration{IssuerURL: supported.URL, PKCE: "force"}, pkce: true},
+		{c: &oidc.Configuration{IssuerURL: supported.URL, PKCE: "never"}, pkce: false},
+		{c: &oidc.Configuration{IssuerURL: supported.URL, PKCE: "auto"}, pkce: true},
+		{c: &oidc.Configuration{IssuerURL: supported.URL, PKCE: ""}, pkce: true}, // same as auto
+
+		{c: &oidc.Configuration{IssuerURL: notSupported.URL, PKCE: "force"}, pkce: true},
+		{c: &oidc.Configuration{IssuerURL: notSupported.URL, PKCE: "never"}, pkce: false},
+		{c: &oidc.Configuration{IssuerURL: notSupported.URL, PKCE: "auto"}, pkce: false},
+		{c: &oidc.Configuration{IssuerURL: notSupported.URL, PKCE: ""}, pkce: false}, // same as auto
+
+		{c: &oidc.Configuration{IssuerURL: "", PKCE: "force"}, pkce: true},
+		{c: &oidc.Configuration{IssuerURL: "", PKCE: "never"}, pkce: false},
+		{c: &oidc.Configuration{IssuerURL: "", PKCE: "auto"}, pkce: false},
+		{c: &oidc.Configuration{IssuerURL: "", PKCE: ""}, pkce: false}, // same as auto
+
+	} {
+		provider := oidc.NewProviderGenericOIDC(tc.c, reg)
+
+		stateParam, pkce, err := strat.GenerateState(context.Background(), provider, x.NewUUID())
+		require.NoError(t, err)
+		require.NotEmpty(t, stateParam)
+
+		state, err := oidc.DecryptState(context.Background(), reg.Cipher(context.Background()), stateParam)
+		require.NoError(t, err)
+
+		if tc.pkce {
+			require.NotEmpty(t, pkce)
+			require.NotEmpty(t, oidc.PKCEVerifier(state))
+		} else {
+			require.Empty(t, pkce)
+			require.Empty(t, oidc.PKCEVerifier(state))
+		}
+	}
+
+	t.Run("OAuth1", func(t *testing.T) {
+		for _, provider := range []oidc.Provider{
+			oidc.NewProviderX(&oidc.Configuration{IssuerURL: supported.URL, PKCE: "force"}, reg),
+			oidc.NewProviderX(&oidc.Configuration{IssuerURL: supported.URL, PKCE: "never"}, reg),
+			oidc.NewProviderX(&oidc.Configuration{IssuerURL: supported.URL, PKCE: "auto"}, reg),
+		} {
+			stateParam, pkce, err := strat.GenerateState(context.Background(), provider, x.NewUUID())
+			require.NoError(t, err)
+			require.NotEmpty(t, stateParam)
+			assert.Empty(t, pkce)
+
+			state, err := oidc.DecryptState(context.Background(), reg.Cipher(context.Background()), stateParam)
+			require.NoError(t, err)
+			assert.Empty(t, oidc.PKCEVerifier(state))
+		}
+	})
+}
diff --git a/selfservice/strategy/oidc/provider.go b/selfservice/strategy/oidc/provider.go
index 30ea305a22ed..8d2e5edad189 100644
--- a/selfservice/strategy/oidc/provider.go
+++ b/selfservice/strategy/oidc/provider.go
@@ -20,24 +20,24 @@ import (
 	"github.com/ory/kratos/x"
 )
 
-type Provider interface {
-	Config() *Configuration
-}
-
-type OAuth2Provider interface {
-	Provider
-	AuthCodeURLOptions(r ider) []oauth2.AuthCodeOption
-	OAuth2(ctx context.Context) (*oauth2.Config, error)
-	Claims(ctx context.Context, exchange *oauth2.Token, query url.Values) (*Claims, error)
-}
-
-type OAuth1Provider interface {
-	Provider
-	OAuth1(ctx context.Context) *oauth1.Config
-	AuthURL(ctx context.Context, state string) (string, error)
-	Claims(ctx context.Context, token *oauth1.Token) (*Claims, error)
-	ExchangeToken(ctx context.Context, req *http.Request) (*oauth1.Token, error)
-}
+type (
+	Provider interface {
+		Config() *Configuration
+	}
+	OAuth2Provider interface {
+		Provider
+		AuthCodeURLOptions(r ider) []oauth2.AuthCodeOption
+		OAuth2(ctx context.Context) (*oauth2.Config, error)
+		Claims(ctx context.Context, exchange *oauth2.Token, query url.Values) (*Claims, error)
+	}
+	OAuth1Provider interface {
+		Provider
+		OAuth1(ctx context.Context) *oauth1.Config
+		AuthURL(ctx context.Context, state string) (string, error)
+		Claims(ctx context.Context, token *oauth1.Token) (*Claims, error)
+		ExchangeToken(ctx context.Context, req *http.Request) (*oauth1.Token, error)
+	}
+)
 
 type OAuth2TokenExchanger interface {
 	Exchange(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error)
@@ -51,21 +51,22 @@ type NonceValidationSkipper interface {
 	CanSkipNonce(*Claims) bool
 }
 
-// ConvertibleBoolean is used as Apple casually sends the email_verified field as a string.
 type Claims struct {
-	Issuer              string                 `json:"iss,omitempty"`
-	Subject             string                 `json:"sub,omitempty"`
-	Name                string                 `json:"name,omitempty"`
-	GivenName           string                 `json:"given_name,omitempty"`
-	FamilyName          string                 `json:"family_name,omitempty"`
-	LastName            string                 `json:"last_name,omitempty"`
-	MiddleName          string                 `json:"middle_name,omitempty"`
-	Nickname            string                 `json:"nickname,omitempty"`
-	PreferredUsername   string                 `json:"preferred_username,omitempty"`
-	Profile             string                 `json:"profile,omitempty"`
-	Picture             string                 `json:"picture,omitempty"`
-	Website             string                 `json:"website,omitempty"`
-	Email               string                 `json:"email,omitempty"`
+	Issuer            string `json:"iss,omitempty"`
+	Subject           string `json:"sub,omitempty"`
+	Object            string `json:"oid,omitempty"`
+	Name              string `json:"name,omitempty"`
+	GivenName         string `json:"given_name,omitempty"`
+	FamilyName        string `json:"family_name,omitempty"`
+	LastName          string `json:"last_name,omitempty"`
+	MiddleName        string `json:"middle_name,omitempty"`
+	Nickname          string `json:"nickname,omitempty"`
+	PreferredUsername string `json:"preferred_username,omitempty"`
+	Profile           string `json:"profile,omitempty"`
+	Picture           string `json:"picture,omitempty"`
+	Website           string `json:"website,omitempty"`
+	Email             string `json:"email,omitempty"`
+	// ConvertibleBoolean is used as Apple casually sends the email_verified field as a string.
 	EmailVerified       x.ConvertibleBoolean   `json:"email_verified,omitempty"`
 	Gender              string                 `json:"gender,omitempty"`
 	Birthdate           string                 `json:"birthdate,omitempty"`
diff --git a/selfservice/strategy/oidc/provider_apple.go b/selfservice/strategy/oidc/provider_apple.go
index 706a7150c5e4..7706eda9d9af 100644
--- a/selfservice/strategy/oidc/provider_apple.go
+++ b/selfservice/strategy/oidc/provider_apple.go
@@ -25,6 +25,8 @@ type ProviderApple struct {
 	JWKSUrl string
 }
 
+var _ OAuth2Provider = (*ProviderApple)(nil)
+
 func NewProviderApple(
 	config *Configuration,
 	reg Dependencies,
diff --git a/selfservice/strategy/oidc/provider_auth0.go b/selfservice/strategy/oidc/provider_auth0.go
index a4c9ee46e1ab..50f4c03fc45b 100644
--- a/selfservice/strategy/oidc/provider_auth0.go
+++ b/selfservice/strategy/oidc/provider_auth0.go
@@ -29,6 +29,8 @@ type ProviderAuth0 struct {
 	*ProviderGenericOIDC
 }
 
+var _ OAuth2Provider = (*ProviderAuth0)(nil)
+
 func NewProviderAuth0(
 	config *Configuration,
 	reg Dependencies,
diff --git a/selfservice/strategy/oidc/provider_config.go b/selfservice/strategy/oidc/provider_config.go
index f7ae28a7322c..810721e3b202 100644
--- a/selfservice/strategy/oidc/provider_config.go
+++ b/selfservice/strategy/oidc/provider_config.go
@@ -5,14 +5,13 @@ package oidc
 
 import (
 	"encoding/json"
+	"maps"
 	"net/url"
 	"strings"
 
 	"github.com/pkg/errors"
-	"golang.org/x/exp/maps"
 
 	"github.com/ory/herodot"
-
 	"github.com/ory/x/urlx"
 )
 
@@ -28,6 +27,7 @@ type Configuration struct {
 	// - gitlab
 	// - microsoft
 	// - discord
+	// - salesforce
 	// - slack
 	// - facebook
 	// - auth0
@@ -121,9 +121,23 @@ type Configuration struct {
 	// endpoint to get the claims) or `id_token` (takes the claims from the id
 	// token). It defaults to `id_token`.
 	ClaimsSource string `json:"claims_source"`
+
+	// PKCE controls if the OpenID Connect OAuth2 flow should use PKCE (Proof Key for Code Exchange).
+	// Possible values are: `auto` (default), `never`, `force`.
+	// - `auto`: PKCE is used if the provider supports it. Requires setting `issuer_url`.
+	// - `never`: Disable PKCE entirely for this provider, even if the provider advertises support for it.
+	// - `force`: Always use PKCE, even if the provider does not advertise support for it. OAuth2 flows will fail if the provider does not support PKCE.
+	// IMPORTANT: If you set this to `force`, you must whitelist a different return URL for your OAuth2 client in the provider's configuration.
+	// Instead of <base-url>/self-service/methods/oidc/callback/<provider>, you must use <base-url>/self-service/methods/oidc/callback
+	// (Note the missing <provider> path segment and no trailing slash).
+	PKCE string `json:"pkce"`
 }
 
 func (p Configuration) Redir(public *url.URL) string {
+	if p.PKCE == "force" {
+		return urlx.AppendPaths(public, RouteCallbackGeneric).String()
+	}
+
 	if p.OrganizationID != "" {
 		route := RouteOrganizationCallback
 		route = strings.Replace(route, ":provider", p.ID, 1)
@@ -151,6 +165,7 @@ var supportedProviders = map[string]func(config *Configuration, reg Dependencies
 	"gitlab":      NewProviderGitLab,
 	"microsoft":   NewProviderMicrosoft,
 	"discord":     NewProviderDiscord,
+	"salesforce":  NewProviderSalesforce,
 	"slack":       NewProviderSlack,
 	"facebook":    NewProviderFacebook,
 	"auth0":       NewProviderAuth0,
@@ -165,11 +180,11 @@ var supportedProviders = map[string]func(config *Configuration, reg Dependencies
 	"patreon":     NewProviderPatreon,
 	"lark":        NewProviderLark,
 	"x":           NewProviderX,
+	"jackson":     NewProviderJackson,
 }
 
 func (c ConfigurationCollection) Provider(id string, reg Dependencies) (Provider, error) {
-	for k := range c.Providers {
-		p := c.Providers[k]
+	for _, p := range c.Providers {
 		if p.ID == id {
 			if f, ok := supportedProviders[p.Provider]; ok {
 				return f(&p, reg), nil
diff --git a/selfservice/strategy/oidc/provider_dingtalk.go b/selfservice/strategy/oidc/provider_dingtalk.go
index 12abffe85942..466c7d76406d 100644
--- a/selfservice/strategy/oidc/provider_dingtalk.go
+++ b/selfservice/strategy/oidc/provider_dingtalk.go
@@ -25,6 +25,8 @@ type ProviderDingTalk struct {
 	reg    Dependencies
 }
 
+var _ OAuth2Provider = (*ProviderDingTalk)(nil)
+
 func NewProviderDingTalk(
 	config *Configuration,
 	reg Dependencies,
diff --git a/selfservice/strategy/oidc/provider_discord.go b/selfservice/strategy/oidc/provider_discord.go
index 99bea24d5770..97c64a4b414e 100644
--- a/selfservice/strategy/oidc/provider_discord.go
+++ b/selfservice/strategy/oidc/provider_discord.go
@@ -19,6 +19,8 @@ import (
 	"github.com/ory/x/stringsx"
 )
 
+var _ OAuth2Provider = (*ProviderDiscord)(nil)
+
 type ProviderDiscord struct {
 	config *Configuration
 	reg    Dependencies
diff --git a/selfservice/strategy/oidc/provider_facebook.go b/selfservice/strategy/oidc/provider_facebook.go
index abf9806cce05..a7d2ec689eaf 100644
--- a/selfservice/strategy/oidc/provider_facebook.go
+++ b/selfservice/strategy/oidc/provider_facebook.go
@@ -24,6 +24,8 @@ import (
 	"github.com/ory/herodot"
 )
 
+var _ OAuth2Provider = (*ProviderFacebook)(nil)
+
 type ProviderFacebook struct {
 	*ProviderGenericOIDC
 }
@@ -41,9 +43,9 @@ func NewProviderFacebook(
 	}
 }
 
-func (g *ProviderFacebook) generateAppSecretProof(ctx context.Context, exchange *oauth2.Token) string {
+func (g *ProviderFacebook) generateAppSecretProof(token *oauth2.Token) string {
 	secret := g.config.ClientSecret
-	data := exchange.AccessToken
+	data := token.AccessToken
 
 	h := hmac.New(sha256.New, []byte(secret))
 	h.Write([]byte(data))
@@ -62,19 +64,24 @@ func (g *ProviderFacebook) OAuth2(ctx context.Context) (*oauth2.Config, error) {
 	return g.oauth2ConfigFromEndpoint(ctx, endpoint), nil
 }
 
-func (g *ProviderFacebook) Claims(ctx context.Context, exchange *oauth2.Token, query url.Values) (*Claims, error) {
+func (g *ProviderFacebook) Claims(ctx context.Context, token *oauth2.Token, query url.Values) (*Claims, error) {
 	o, err := g.OAuth2(ctx)
 	if err != nil {
 		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
 	}
 
-	appSecretProof := g.generateAppSecretProof(ctx, exchange)
+	appSecretProof := g.generateAppSecretProof(token)
+	// Do not use the versioned Graph API here. If you do, it will break once the version is deprecated. See also:
+	//
+	// When you use https://graph.facebook.com/me without specifying a version, Facebook defaults to the oldest
+	// available version your app supports. This behavior ensures backward compatibility but can lead to unintended
+	// issues if that version becomes deprecated.
 	u, err := url.Parse(fmt.Sprintf("https://graph.facebook.com/me?fields=id,name,first_name,last_name,middle_name,email,picture,birthday,gender&appsecret_proof=%s", appSecretProof))
 	if err != nil {
 		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
 	}
 
-	ctx, client := httpx.SetOAuth2(ctx, g.reg.HTTPClient(ctx), o, exchange)
+	ctx, client := httpx.SetOAuth2(ctx, g.reg.HTTPClient(ctx), o, token)
 	req, err := retryablehttp.NewRequestWithContext(ctx, "GET", u.String(), nil)
 	if err != nil {
 		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
diff --git a/selfservice/strategy/oidc/provider_generic_oidc.go b/selfservice/strategy/oidc/provider_generic_oidc.go
index 3282061cb3a7..0a84e067e7c3 100644
--- a/selfservice/strategy/oidc/provider_generic_oidc.go
+++ b/selfservice/strategy/oidc/provider_generic_oidc.go
@@ -6,17 +6,16 @@ package oidc
 import (
 	"context"
 	"net/url"
+	"slices"
 
+	gooidc "github.com/coreos/go-oidc/v3/oidc"
 	"github.com/pkg/errors"
 	"golang.org/x/oauth2"
 
-	gooidc "github.com/coreos/go-oidc/v3/oidc"
-
 	"github.com/ory/herodot"
-	"github.com/ory/x/stringslice"
 )
 
-var _ Provider = new(ProviderGenericOIDC)
+var _ OAuth2Provider = (*ProviderGenericOIDC)(nil)
 
 type ProviderGenericOIDC struct {
 	p      *gooidc.Provider
@@ -71,7 +70,7 @@ func getJWKSURL(provider *gooidc.Provider) (string, error) {
 
 func (g *ProviderGenericOIDC) oauth2ConfigFromEndpoint(ctx context.Context, endpoint oauth2.Endpoint) *oauth2.Config {
 	scope := g.config.Scope
-	if !stringslice.Has(scope, gooidc.ScopeOpenID) {
+	if !slices.Contains(scope, gooidc.ScopeOpenID) {
 		scope = append(scope, gooidc.ScopeOpenID)
 	}
 
diff --git a/selfservice/strategy/oidc/provider_github.go b/selfservice/strategy/oidc/provider_github.go
index fe1d2bc371d1..650778cd1506 100644
--- a/selfservice/strategy/oidc/provider_github.go
+++ b/selfservice/strategy/oidc/provider_github.go
@@ -23,6 +23,8 @@ import (
 	"github.com/ory/herodot"
 )
 
+var _ OAuth2Provider = (*ProviderGitHub)(nil)
+
 type ProviderGitHub struct {
 	config *Configuration
 	reg    Dependencies
diff --git a/selfservice/strategy/oidc/provider_github_app.go b/selfservice/strategy/oidc/provider_github_app.go
index 95801ce59e47..83cfd9bdb882 100644
--- a/selfservice/strategy/oidc/provider_github_app.go
+++ b/selfservice/strategy/oidc/provider_github_app.go
@@ -15,7 +15,7 @@ import (
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/github"
 
-	ghapi "github.com/google/go-github/v27/github"
+	ghapi "github.com/google/go-github/v38/github"
 
 	"github.com/ory/herodot"
 )
@@ -86,7 +86,7 @@ func (g *ProviderGitHubApp) Claims(ctx context.Context, exchange *oauth2.Token,
 
 	for k, e := range emails {
 		// If it is the primary email or it's the last email (no primary email set?), set the email.
-		if e.GetPrimary() || k == len(emails) {
+		if e.GetPrimary() || k == len(emails)-1 {
 			claims.Email = e.GetEmail()
 			claims.EmailVerified = x.ConvertibleBoolean(e.GetVerified())
 			break
diff --git a/selfservice/strategy/oidc/provider_gitlab.go b/selfservice/strategy/oidc/provider_gitlab.go
index 9ef55b4beef7..a0cf7508c944 100644
--- a/selfservice/strategy/oidc/provider_gitlab.go
+++ b/selfservice/strategy/oidc/provider_gitlab.go
@@ -25,6 +25,8 @@ const (
 	defaultEndpoint = "https://gitlab.com"
 )
 
+var _ OAuth2Provider = (*ProviderGitLab)(nil)
+
 type ProviderGitLab struct {
 	*ProviderGenericOIDC
 }
diff --git a/selfservice/strategy/oidc/provider_google.go b/selfservice/strategy/oidc/provider_google.go
index e27832692faa..4e009b318380 100644
--- a/selfservice/strategy/oidc/provider_google.go
+++ b/selfservice/strategy/oidc/provider_google.go
@@ -12,6 +12,8 @@ import (
 	"github.com/ory/x/stringslice"
 )
 
+var _ OAuth2Provider = (*ProviderGoogle)(nil)
+
 type ProviderGoogle struct {
 	*ProviderGenericOIDC
 	JWKSUrl string
diff --git a/selfservice/strategy/oidc/provider_jackson.go b/selfservice/strategy/oidc/provider_jackson.go
new file mode 100644
index 000000000000..f83a88306e62
--- /dev/null
+++ b/selfservice/strategy/oidc/provider_jackson.go
@@ -0,0 +1,57 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc
+
+import (
+	"context"
+	"strings"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+
+	"github.com/ory/x/urlx"
+)
+
+type ProviderJackson struct {
+	*ProviderGenericOIDC
+}
+
+func NewProviderJackson(
+	config *Configuration,
+	reg Dependencies,
+) Provider {
+	return &ProviderJackson{
+		ProviderGenericOIDC: &ProviderGenericOIDC{
+			config: config,
+			reg:    reg,
+		},
+	}
+}
+
+func (j *ProviderJackson) setProvider(ctx context.Context) {
+	if j.ProviderGenericOIDC.p == nil {
+		internalHost := strings.TrimSuffix(j.config.TokenURL, "/api/oauth/token")
+		config := oidc.ProviderConfig{
+			IssuerURL:     j.config.IssuerURL,
+			AuthURL:       j.config.AuthURL,
+			TokenURL:      j.config.TokenURL,
+			DeviceAuthURL: "",
+			UserInfoURL:   internalHost + "/api/oauth/userinfo",
+			JWKSURL:       internalHost + "/oauth/jwks",
+			Algorithms:    []string{"RS256"},
+		}
+		j.ProviderGenericOIDC.p = config.NewProvider(j.withHTTPClientContext(ctx))
+	}
+}
+
+func (j *ProviderJackson) OAuth2(ctx context.Context) (*oauth2.Config, error) {
+	j.setProvider(ctx)
+	endpoint := j.ProviderGenericOIDC.p.Endpoint()
+	config := j.oauth2ConfigFromEndpoint(ctx, endpoint)
+	config.RedirectURL = urlx.AppendPaths(
+		j.reg.Config().SAMLRedirectURIBase(ctx),
+		"/self-service/methods/saml/callback/"+j.config.ID).String()
+
+	return config, nil
+}
diff --git a/selfservice/strategy/oidc/provider_jackson_test.go b/selfservice/strategy/oidc/provider_jackson_test.go
new file mode 100644
index 000000000000..4c8bfa0bbf55
--- /dev/null
+++ b/selfservice/strategy/oidc/provider_jackson_test.go
@@ -0,0 +1,36 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc_test
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/internal"
+	"github.com/ory/kratos/selfservice/strategy/oidc"
+)
+
+func TestProviderJackson(t *testing.T) {
+	_, reg := internal.NewVeryFastRegistryWithoutDB(t)
+
+	j := oidc.NewProviderJackson(&oidc.Configuration{
+		Provider:  "jackson",
+		IssuerURL: "https://www.jackson.com/oauth",
+		AuthURL:   "https://www.jackson.com/oauth/auth",
+		TokenURL:  "https://www.jackson.com/api/oauth/token",
+		Mapper:    "file://./stub/hydra.schema.json",
+		Scope:     []string{"email", "profile"},
+		ID:        "some-id",
+	}, reg)
+	assert.NotNil(t, j)
+
+	c, err := j.(oidc.OAuth2Provider).OAuth2(context.Background())
+	require.NoError(t, err)
+
+	assert.True(t, strings.HasSuffix(c.RedirectURL, "/self-service/methods/saml/callback/some-id"))
+}
diff --git a/selfservice/strategy/oidc/provider_lark.go b/selfservice/strategy/oidc/provider_lark.go
index 52902dc20e8c..d66d5c0b2230 100644
--- a/selfservice/strategy/oidc/provider_lark.go
+++ b/selfservice/strategy/oidc/provider_lark.go
@@ -16,6 +16,8 @@ import (
 	"github.com/ory/x/httpx"
 )
 
+var _ OAuth2Provider = (*ProviderLark)(nil)
+
 type ProviderLark struct {
 	*ProviderGenericOIDC
 }
diff --git a/selfservice/strategy/oidc/provider_linkedin.go b/selfservice/strategy/oidc/provider_linkedin.go
index 03a3db3e490d..475dd738b29f 100644
--- a/selfservice/strategy/oidc/provider_linkedin.go
+++ b/selfservice/strategy/oidc/provider_linkedin.go
@@ -63,6 +63,8 @@ const (
 	IntrospectionURL string = "https://www.linkedin.com/oauth/v2/introspectToken"
 )
 
+var _ OAuth2Provider = (*ProviderLinkedIn)(nil)
+
 type ProviderLinkedIn struct {
 	config *Configuration
 	reg    Dependencies
diff --git a/selfservice/strategy/oidc/provider_microsoft.go b/selfservice/strategy/oidc/provider_microsoft.go
index d69206ec4d87..408a11096573 100644
--- a/selfservice/strategy/oidc/provider_microsoft.go
+++ b/selfservice/strategy/oidc/provider_microsoft.go
@@ -9,20 +9,19 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/hashicorp/go-retryablehttp"
-
-	"github.com/ory/x/httpx"
-
+	gooidc "github.com/coreos/go-oidc/v3/oidc"
 	"github.com/gofrs/uuid"
 	"github.com/golang-jwt/jwt/v4"
-
-	gooidc "github.com/coreos/go-oidc/v3/oidc"
+	"github.com/hashicorp/go-retryablehttp"
 	"github.com/pkg/errors"
 	"golang.org/x/oauth2"
 
 	"github.com/ory/herodot"
+	"github.com/ory/x/httpx"
 )
 
+var _ OAuth2Provider = (*ProviderMicrosoft)(nil)
+
 type ProviderMicrosoft struct {
 	*ProviderGenericOIDC
 }
@@ -40,7 +39,7 @@ func NewProviderMicrosoft(
 }
 
 func (m *ProviderMicrosoft) OAuth2(ctx context.Context) (*oauth2.Config, error) {
-	if len(strings.TrimSpace(m.config.Tenant)) == 0 {
+	if strings.TrimSpace(m.config.Tenant) == "" {
 		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("No Tenant specified for the `microsoft` oidc provider %s", m.config.ID))
 	}
 
@@ -53,7 +52,7 @@ func (m *ProviderMicrosoft) OAuth2(ctx context.Context) (*oauth2.Config, error)
 	return m.oauth2ConfigFromEndpoint(ctx, endpoint), nil
 }
 
-func (m *ProviderMicrosoft) Claims(ctx context.Context, exchange *oauth2.Token, query url.Values) (*Claims, error) {
+func (m *ProviderMicrosoft) Claims(ctx context.Context, exchange *oauth2.Token, _ url.Values) (*Claims, error) {
 	raw, ok := exchange.Extra("id_token").(string)
 	if !ok || len(raw) == 0 {
 		return nil, errors.WithStack(ErrIDTokenMissing)
@@ -117,6 +116,10 @@ func (m *ProviderMicrosoft) updateSubject(ctx context.Context, claims *Claims, e
 		claims.Subject = user.ID
 	}
 
+	if m.config.SubjectSource == "oid" {
+		claims.Subject = claims.Object
+	}
+
 	return claims, nil
 }
 
diff --git a/selfservice/strategy/oidc/provider_netid.go b/selfservice/strategy/oidc/provider_netid.go
index dfe83c958433..d936bf1b361c 100644
--- a/selfservice/strategy/oidc/provider_netid.go
+++ b/selfservice/strategy/oidc/provider_netid.go
@@ -8,11 +8,10 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/url"
+	"slices"
 
 	gooidc "github.com/coreos/go-oidc/v3/oidc"
 
-	"github.com/ory/x/stringslice"
-
 	"github.com/hashicorp/go-retryablehttp"
 	"github.com/pkg/errors"
 	"golang.org/x/oauth2"
@@ -28,6 +27,8 @@ const (
 	defaultBrokerHost   = "broker.netid.de"
 )
 
+var _ OAuth2Provider = (*ProviderNetID)(nil)
+
 type ProviderNetID struct {
 	*ProviderGenericOIDC
 }
@@ -37,7 +38,7 @@ func NewProviderNetID(
 	reg Dependencies,
 ) Provider {
 	config.IssuerURL = fmt.Sprintf("%s://%s/", defaultBrokerScheme, defaultBrokerHost)
-	if !stringslice.Has(config.Scope, gooidc.ScopeOpenID) {
+	if !slices.Contains(config.Scope, gooidc.ScopeOpenID) {
 		config.Scope = append(config.Scope, gooidc.ScopeOpenID)
 	}
 
diff --git a/selfservice/strategy/oidc/provider_patreon.go b/selfservice/strategy/oidc/provider_patreon.go
index 745dc8fcc199..d89e1e2a3ebc 100644
--- a/selfservice/strategy/oidc/provider_patreon.go
+++ b/selfservice/strategy/oidc/provider_patreon.go
@@ -18,6 +18,8 @@ import (
 	"github.com/ory/herodot"
 )
 
+var _ OAuth2Provider = (*ProviderPatreon)(nil)
+
 type ProviderPatreon struct {
 	config *Configuration
 	reg    Dependencies
diff --git a/selfservice/strategy/oidc/provider_salesforce.go b/selfservice/strategy/oidc/provider_salesforce.go
new file mode 100644
index 000000000000..04d514ccdf22
--- /dev/null
+++ b/selfservice/strategy/oidc/provider_salesforce.go
@@ -0,0 +1,144 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/url"
+	"path"
+	"time"
+
+	"github.com/ory/x/httpx"
+	"github.com/ory/x/stringsx"
+
+	"github.com/tidwall/sjson"
+
+	"github.com/hashicorp/go-retryablehttp"
+
+	"github.com/pkg/errors"
+	"github.com/tidwall/gjson"
+	"golang.org/x/oauth2"
+
+	"github.com/ory/herodot"
+)
+
+var _ OAuth2Provider = (*ProviderSalesforce)(nil)
+
+type ProviderSalesforce struct {
+	*ProviderGenericOIDC
+}
+
+func NewProviderSalesforce(
+	config *Configuration,
+	reg Dependencies,
+) Provider {
+	return &ProviderSalesforce{
+		ProviderGenericOIDC: &ProviderGenericOIDC{
+			config: config,
+			reg:    reg,
+		},
+	}
+}
+
+func (g *ProviderSalesforce) oauth2(ctx context.Context) (*oauth2.Config, error) {
+	endpoint, err := url.Parse(g.config.IssuerURL)
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+
+	authUrl := *endpoint
+	tokenUrl := *endpoint
+
+	authUrl.Path = path.Join(authUrl.Path, "/services/oauth2/authorize")
+	tokenUrl.Path = path.Join(tokenUrl.Path, "/services/oauth2/token")
+
+	c := &oauth2.Config{
+		ClientID:     g.config.ClientID,
+		ClientSecret: g.config.ClientSecret,
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  authUrl.String(),
+			TokenURL: tokenUrl.String(),
+		},
+		Scopes:      g.config.Scope,
+		RedirectURL: g.config.Redir(g.reg.Config().OIDCRedirectURIBase(ctx)),
+	}
+
+	return c, nil
+}
+
+func (g *ProviderSalesforce) OAuth2(ctx context.Context) (*oauth2.Config, error) {
+	return g.oauth2(ctx)
+}
+
+func (g *ProviderSalesforce) Claims(ctx context.Context, exchange *oauth2.Token, query url.Values) (*Claims, error) {
+	o, err := g.OAuth2(ctx)
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+
+	u, err := url.Parse(g.config.IssuerURL)
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+	u.Path = path.Join(u.Path, "/services/oauth2/userinfo")
+
+	ctx, client := httpx.SetOAuth2(ctx, g.reg.HTTPClient(ctx), o, exchange)
+	req, err := retryablehttp.NewRequestWithContext(ctx, "GET", u.String(), nil)
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+
+	req.Header.Add("Content-Type", "application/json")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+	defer resp.Body.Close()
+
+	if err := logUpstreamError(g.reg.Logger(), resp); err != nil {
+		return nil, err
+	}
+
+	// Once Salesforce fixes this bug, all this workaround can be removed.
+	b, err := io.ReadAll(io.LimitReader(resp.Body, 1024*1024))
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+
+	b, err = salesforceUpdatedAtWorkaround(b)
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+
+	// Once we get here, we know that if there is an updated_at field in the json, it is the correct type.
+	var claims Claims
+	if err := json.Unmarshal(b, &claims); err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+
+	claims.Issuer = stringsx.Coalesce(claims.Issuer, g.config.IssuerURL)
+	return &claims, nil
+}
+
+// There is a bug in the response from Salesforce. The updated_at field may be a string and not an int64.
+// https://help.salesforce.com/s/articleView?id=sf.remoteaccess_using_userinfo_endpoint.htm&type=5
+// We work around this by reading the json generically (as map[string]inteface{} and looking at the updated_at field
+// if it exists. If it's the wrong type (string), we fill out the claims by hand.
+func salesforceUpdatedAtWorkaround(body []byte) ([]byte, error) {
+	// Force updatedAt to be an int if given as a string in the response.
+	if updatedAtField := gjson.GetBytes(body, "updated_at"); updatedAtField.Exists() && updatedAtField.Type == gjson.String {
+		t, err := time.Parse(time.RFC3339, updatedAtField.String())
+		if err != nil {
+			return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("bad time format in updated_at"))
+		}
+		body, err = sjson.SetBytes(body, "updated_at", t.Unix())
+		if err != nil {
+			return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+		}
+	}
+	return body, nil
+}
diff --git a/selfservice/strategy/oidc/provider_salesforce_unit_test.go b/selfservice/strategy/oidc/provider_salesforce_unit_test.go
new file mode 100644
index 000000000000..81638fb18050
--- /dev/null
+++ b/selfservice/strategy/oidc/provider_salesforce_unit_test.go
@@ -0,0 +1,33 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSalesforceUpdatedAtWorkaround(t *testing.T) {
+	actual, err := salesforceUpdatedAtWorkaround([]byte("{}"))
+	require.NoError(t, err)
+	assert.Equal(t, "{}", string(actual))
+
+	actual, err = salesforceUpdatedAtWorkaround([]byte(`{"updated_at":1234}`))
+	require.NoError(t, err)
+	assert.Equal(t, `{"updated_at":1234}`, string(actual))
+
+	timestamp := time.Date(2020, time.January, 1, 0, 0, 0, 0, time.UTC)
+	input, err := json.Marshal(map[string]interface{}{
+		"updated_at": timestamp,
+	})
+	require.NoError(t, err)
+	actual, err = salesforceUpdatedAtWorkaround(input)
+	require.NoError(t, err)
+	assert.Equal(t, fmt.Sprintf(`{"updated_at":%d}`, timestamp.Unix()), string(actual))
+}
diff --git a/selfservice/strategy/oidc/provider_slack.go b/selfservice/strategy/oidc/provider_slack.go
index 7c7e26c99da4..0faed2220ae5 100644
--- a/selfservice/strategy/oidc/provider_slack.go
+++ b/selfservice/strategy/oidc/provider_slack.go
@@ -19,6 +19,8 @@ import (
 	"github.com/slack-go/slack"
 )
 
+var _ OAuth2Provider = (*ProviderSlack)(nil)
+
 type ProviderSlack struct {
 	config *Configuration
 	reg    Dependencies
diff --git a/selfservice/strategy/oidc/provider_spotify.go b/selfservice/strategy/oidc/provider_spotify.go
index 366105c94d0e..2c01d0764b3c 100644
--- a/selfservice/strategy/oidc/provider_spotify.go
+++ b/selfservice/strategy/oidc/provider_spotify.go
@@ -23,6 +23,8 @@ import (
 	"github.com/ory/herodot"
 )
 
+var _ OAuth2Provider = (*ProviderSpotify)(nil)
+
 type ProviderSpotify struct {
 	config *Configuration
 	reg    Dependencies
diff --git a/selfservice/strategy/oidc/provider_test.go b/selfservice/strategy/oidc/provider_test.go
index a5733d2e95f8..208421ad2ab0 100644
--- a/selfservice/strategy/oidc/provider_test.go
+++ b/selfservice/strategy/oidc/provider_test.go
@@ -32,13 +32,13 @@ func NewTestProvider(c *Configuration, reg Dependencies) Provider {
 	}
 }
 
-func RegisterTestProvider(id string) func() {
+func RegisterTestProvider(t *testing.T, id string) {
 	supportedProviders[id] = func(c *Configuration, reg Dependencies) Provider {
 		return NewTestProvider(c, reg)
 	}
-	return func() {
+	t.Cleanup(func() {
 		delete(supportedProviders, id)
-	}
+	})
 }
 
 var _ IDTokenVerifier = new(TestProvider)
diff --git a/selfservice/strategy/oidc/provider_userinfo_test.go b/selfservice/strategy/oidc/provider_userinfo_test.go
index 97456dfc404d..9eb27914541e 100644
--- a/selfservice/strategy/oidc/provider_userinfo_test.go
+++ b/selfservice/strategy/oidc/provider_userinfo_test.go
@@ -89,6 +89,16 @@ func TestProviderClaimsRespectsErrorCodes(t *testing.T) {
 				Provider:  "auth0",
 			}, reg),
 		},
+		{
+			name:             "salesforce",
+			userInfoHandler:  defaultUserinfoHandler,
+			userInfoEndpoint: "https://www.salesforce.com/services/oauth2/userinfo",
+			provider: oidc.NewProviderSalesforce(&oidc.Configuration{
+				IssuerURL: "https://www.salesforce.com",
+				ID:        "salesforce",
+				Provider:  "salesforce",
+			}, reg),
+		},
 		{
 			name:             "netid",
 			userInfoHandler:  defaultUserinfoHandler,
@@ -339,14 +349,13 @@ func TestProviderClaimsRespectsErrorCodes(t *testing.T) {
 				}
 
 				httpmock.RegisterResponder("GET", tc.userInfoEndpoint, func(req *http.Request) (*http.Response, error) {
-					resp, err := httpmock.NewJsonResponse(455, map[string]interface{}{})
-					return resp, err
+					return httpmock.NewJsonResponse(455, map[string]interface{}{})
 				})
 
 				_, err := tc.provider.(oidc.OAuth2Provider).Claims(ctx, token, url.Values{})
 				var he *herodot.DefaultError
 				require.ErrorAs(t, err, &he)
-				assert.Equal(t, "OpenID Connect provider returned a 455 status code but 200 is expected.", he.Reason())
+				assert.Equal(t, "OpenID Connect provider returned a 455 status code but 200 is expected.", he.Reason(), "%+v", err)
 			})
 
 			t.Run("call is successful", func(t *testing.T) {
diff --git a/selfservice/strategy/oidc/provider_vk.go b/selfservice/strategy/oidc/provider_vk.go
index 2a3513b6e050..c60711504fd3 100644
--- a/selfservice/strategy/oidc/provider_vk.go
+++ b/selfservice/strategy/oidc/provider_vk.go
@@ -19,6 +19,8 @@ import (
 	"github.com/ory/herodot"
 )
 
+var _ OAuth2Provider = (*ProviderVK)(nil)
+
 type ProviderVK struct {
 	config *Configuration
 	reg    Dependencies
diff --git a/selfservice/strategy/oidc/provider_x.go b/selfservice/strategy/oidc/provider_x.go
index f58dbd48182f..ca2acb6c5e25 100644
--- a/selfservice/strategy/oidc/provider_x.go
+++ b/selfservice/strategy/oidc/provider_x.go
@@ -18,7 +18,6 @@ import (
 	"github.com/ory/herodot"
 )
 
-var _ Provider = (*ProviderX)(nil)
 var _ OAuth1Provider = (*ProviderX)(nil)
 
 const xUserInfoBase = "https://api.twitter.com/1.1/account/verify_credentials.json"
diff --git a/selfservice/strategy/oidc/provider_yandex.go b/selfservice/strategy/oidc/provider_yandex.go
index 07b30caee52b..9b11b8fbcf5e 100644
--- a/selfservice/strategy/oidc/provider_yandex.go
+++ b/selfservice/strategy/oidc/provider_yandex.go
@@ -17,6 +17,8 @@ import (
 	"github.com/ory/herodot"
 )
 
+var _ OAuth2Provider = (*ProviderYandex)(nil)
+
 type ProviderYandex struct {
 	config *Configuration
 	reg    Dependencies
diff --git a/selfservice/strategy/oidc/state.go b/selfservice/strategy/oidc/state.go
new file mode 100644
index 000000000000..ce8cb17bc653
--- /dev/null
+++ b/selfservice/strategy/oidc/state.go
@@ -0,0 +1,63 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc
+
+import (
+	"context"
+	"crypto/sha512"
+	"crypto/subtle"
+
+	"github.com/gofrs/uuid"
+	"golang.org/x/oauth2"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/ory/herodot"
+	"github.com/ory/kratos/cipher"
+	oidcv1 "github.com/ory/kratos/gen/oidc/v1"
+	"github.com/ory/kratos/x"
+)
+
+func encryptState(ctx context.Context, c cipher.Cipher, state *oidcv1.State) (ciphertext string, err error) {
+	m, err := proto.Marshal(state)
+	if err != nil {
+		return "", herodot.ErrInternalServerError.WithReasonf("Unable to marshal state: %s", err)
+	}
+	return c.Encrypt(ctx, m)
+}
+
+func DecryptState(ctx context.Context, c cipher.Cipher, ciphertext string) (*oidcv1.State, error) {
+	plaintext, err := c.Decrypt(ctx, ciphertext)
+	if err != nil {
+		return nil, herodot.ErrBadRequest.WithReasonf("Unable to decrypt state: %s", err)
+	}
+	var state oidcv1.State
+	if err := proto.Unmarshal(plaintext, &state); err != nil {
+		return nil, herodot.ErrBadRequest.WithReasonf("Unable to unmarshal state: %s", err)
+	}
+	return &state, nil
+}
+
+func (s *Strategy) GenerateState(ctx context.Context, p Provider, flowID uuid.UUID) (stateParam string, pkce []oauth2.AuthCodeOption, err error) {
+	state := oidcv1.State{
+		FlowId:                         flowID.Bytes(),
+		SessionTokenExchangeCodeSha512: x.NewUUID().Bytes(),
+		ProviderId:                     p.Config().ID,
+		PkceVerifier:                   maybePKCE(ctx, s.d, p),
+	}
+	if code, hasCode, _ := s.d.SessionTokenExchangePersister().CodeForFlow(ctx, flowID); hasCode {
+		sum := sha512.Sum512([]byte(code.InitCode))
+		state.SessionTokenExchangeCodeSha512 = sum[:]
+	}
+
+	param, err := encryptState(ctx, s.d.Cipher(ctx), &state)
+	if err != nil {
+		return "", nil, herodot.ErrInternalServerError.WithReason("Unable to encrypt state").WithWrap(err)
+	}
+	return param, PKCEChallenge(&state), nil
+}
+
+func codeMatches(s *oidcv1.State, code string) bool {
+	sum := sha512.Sum512([]byte(code))
+	return subtle.ConstantTimeCompare(s.GetSessionTokenExchangeCodeSha512(), sum[:]) == 1
+}
diff --git a/selfservice/strategy/oidc/state_test.go b/selfservice/strategy/oidc/state_test.go
new file mode 100644
index 000000000000..bf0366571a6b
--- /dev/null
+++ b/selfservice/strategy/oidc/state_test.go
@@ -0,0 +1,46 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/cipher"
+	"github.com/ory/kratos/internal"
+	"github.com/ory/kratos/selfservice/strategy/oidc"
+	"github.com/ory/kratos/x"
+)
+
+func TestGenerateState(t *testing.T) {
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	_ = conf
+	strat := oidc.NewStrategy(reg)
+	ctx := context.Background()
+	ciph := reg.Cipher(ctx)
+	_, ok := ciph.(*cipher.Noop)
+	require.False(t, ok)
+
+	flowID := x.NewUUID()
+
+	stateParam, pkce, err := strat.GenerateState(ctx, &testProvider{}, flowID)
+	require.NoError(t, err)
+	require.NotEmpty(t, stateParam)
+	assert.Empty(t, pkce)
+
+	state, err := oidc.DecryptState(ctx, ciph, stateParam)
+	require.NoError(t, err)
+	assert.Equal(t, flowID.Bytes(), state.FlowId)
+	assert.Empty(t, oidc.PKCEVerifier(state))
+	assert.Equal(t, "test-provider", state.ProviderId)
+}
+
+type testProvider struct{}
+
+func (t *testProvider) Config() *oidc.Configuration {
+	return &oidc.Configuration{ID: "test-provider", PKCE: "never"}
+}
diff --git a/selfservice/strategy/oidc/strategy.go b/selfservice/strategy/oidc/strategy.go
index 6515d06367ee..06af7be1ce58 100644
--- a/selfservice/strategy/oidc/strategy.go
+++ b/selfservice/strategy/oidc/strategy.go
@@ -6,47 +6,28 @@ package oidc
 import (
 	"bytes"
 	"context"
-	"crypto/sha512"
-	"encoding/base64"
 	"encoding/json"
-	"fmt"
+	"maps"
 	"net/http"
 	"net/url"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 
-	"golang.org/x/exp/maps"
-
-	"github.com/ory/x/urlx"
-
-	"go.opentelemetry.io/otel/attribute"
-	"golang.org/x/oauth2"
-
-	"github.com/ory/kratos/cipher"
-	"github.com/ory/kratos/selfservice/flowhelpers"
-	"github.com/ory/kratos/selfservice/sessiontokenexchange"
-	"github.com/ory/x/jsonnetsecure"
-	"github.com/ory/x/otelx"
-
-	"github.com/ory/kratos/text"
-
-	"github.com/ory/kratos/ui/container"
-	"github.com/ory/x/decoderx"
-	"github.com/ory/x/stringsx"
-
-	"github.com/ory/kratos/ui/node"
-
 	"github.com/gofrs/uuid"
 	"github.com/julienschmidt/httprouter"
 	"github.com/pkg/errors"
 	"github.com/tidwall/gjson"
-
-	"github.com/ory/x/jsonx"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+	"golang.org/x/oauth2"
 
 	"github.com/ory/herodot"
+	"github.com/ory/kratos/cipher"
 	"github.com/ory/kratos/continuity"
 	"github.com/ory/kratos/driver/config"
+	oidcv1 "github.com/ory/kratos/gen/oidc/v1"
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/schema"
 	"github.com/ory/kratos/selfservice/errorx"
@@ -54,10 +35,19 @@ import (
 	"github.com/ory/kratos/selfservice/flow/login"
 	"github.com/ory/kratos/selfservice/flow/registration"
 	"github.com/ory/kratos/selfservice/flow/settings"
-
+	"github.com/ory/kratos/selfservice/sessiontokenexchange"
 	"github.com/ory/kratos/selfservice/strategy"
 	"github.com/ory/kratos/session"
+	"github.com/ory/kratos/text"
+	"github.com/ory/kratos/ui/container"
+	"github.com/ory/kratos/ui/node"
 	"github.com/ory/kratos/x"
+	"github.com/ory/x/decoderx"
+	"github.com/ory/x/jsonnetsecure"
+	"github.com/ory/x/otelx"
+	"github.com/ory/x/sqlxx"
+	"github.com/ory/x/stringsx"
+	"github.com/ory/x/urlx"
 )
 
 const (
@@ -65,6 +55,7 @@ const (
 
 	RouteAuth                 = RouteBase + "/auth/:flow"
 	RouteCallback             = RouteBase + "/callback/:provider"
+	RouteCallbackGeneric      = RouteBase + "/callback"
 	RouteOrganizationCallback = RouteBase + "/organization/:organization/callback/:provider"
 )
 
@@ -119,17 +110,20 @@ type Dependencies interface {
 
 func isForced(req interface{}) bool {
 	f, ok := req.(interface {
-		IsForced() bool
+		IsRefresh() bool
 	})
-	return ok && f.IsForced()
+	return ok && f.IsRefresh()
 }
 
 // Strategy implements selfservice.LoginStrategy, selfservice.RegistrationStrategy and selfservice.SettingsStrategy.
 // It supports login, registration and settings via OpenID Providers.
 type Strategy struct {
-	d         Dependencies
-	validator *schema.Validator
-	dec       *decoderx.HTTP
+	d                           Dependencies
+	validator                   *schema.Validator
+	dec                         *decoderx.HTTP
+	credType                    identity.CredentialsType
+	handleUnknownProviderError  func(err error) error
+	handleMethodNotAllowedError func(err error) error
 }
 
 type AuthCodeContainer struct {
@@ -139,43 +133,7 @@ type AuthCodeContainer struct {
 	TransientPayload json.RawMessage `json:"transient_payload"`
 }
 
-type State struct {
-	FlowID string
-	Data   []byte
-}
-
-func (s *State) String() string {
-	return base64.RawURLEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", s.FlowID, s.Data)))
-}
-
-func generateState(flowID string) *State {
-	return &State{
-		FlowID: flowID,
-		Data:   x.NewUUID().Bytes(),
-	}
-}
-
-func (s *State) setCode(code string) {
-	s.Data = sha512.New().Sum([]byte(code))
-}
-
-func (s *State) codeMatches(code string) bool {
-	return bytes.Equal(s.Data, sha512.New().Sum([]byte(code)))
-}
-
-func parseState(s string) (*State, error) {
-	raw, err := base64.RawURLEncoding.DecodeString(s)
-	if err != nil {
-		return nil, err
-	}
-	if id, data, ok := bytes.Cut(raw, []byte(":")); !ok {
-		return nil, errors.New("state has invalid format")
-	} else {
-		return &State{FlowID: string(id), Data: data}, nil
-	}
-}
-
-func (s *Strategy) CountActiveFirstFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveFirstFactorCredentials(_ context.Context, cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	for _, c := range cc {
 		if c.Type == s.ID() && gjson.ValidBytes(c.Config) {
 			var conf identity.CredentialsOIDC
@@ -200,7 +158,7 @@ func (s *Strategy) CountActiveFirstFactorCredentials(cc map[identity.Credentials
 	return
 }
 
-func (s *Strategy) CountActiveMultiFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveMultiFactorCredentials(_ context.Context, _ map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	return 0, nil
 }
 
@@ -209,6 +167,9 @@ func (s *Strategy) setRoutes(r *x.RouterPublic) {
 	if handle, _, _ := r.Lookup("GET", RouteCallback); handle == nil {
 		r.GET(RouteCallback, wrappedHandleCallback)
 	}
+	if handle, _, _ := r.Lookup("GET", RouteCallbackGeneric); handle == nil {
+		r.GET(RouteCallbackGeneric, wrappedHandleCallback)
+	}
 
 	// Apple can use the POST request method when calling the callback
 	if handle, _, _ := r.Lookup("POST", RouteCallback); handle == nil {
@@ -244,15 +205,42 @@ func (s *Strategy) redirectToGET(w http.ResponseWriter, r *http.Request, _ httpr
 	http.Redirect(w, r, dest.String(), http.StatusFound)
 }
 
-func NewStrategy(d any) *Strategy {
-	return &Strategy{
-		d:         d.(Dependencies),
-		validator: schema.NewValidator(),
+type NewStrategyOpt func(s *Strategy)
+
+// ForCredentialType overrides the credentials type for this strategy.
+func ForCredentialType(ct identity.CredentialsType) NewStrategyOpt {
+	return func(s *Strategy) { s.credType = ct }
+}
+
+// WithUnknownProviderHandler overrides the error returned when the provider
+// cannot be found.
+func WithUnknownProviderHandler(handler func(error) error) NewStrategyOpt {
+	return func(s *Strategy) { s.handleUnknownProviderError = handler }
+}
+
+// WithHandleMethodNotAllowedError overrides the error returned when method is
+// not allowed.
+func WithHandleMethodNotAllowedError(handler func(error) error) NewStrategyOpt {
+	return func(s *Strategy) { s.handleMethodNotAllowedError = handler }
+}
+
+func NewStrategy(d any, opts ...NewStrategyOpt) *Strategy {
+	s := &Strategy{
+		d:                           d.(Dependencies),
+		validator:                   schema.NewValidator(),
+		credType:                    identity.CredentialsTypeOIDC,
+		handleUnknownProviderError:  func(err error) error { return err },
+		handleMethodNotAllowedError: func(err error) error { return err },
 	}
+	for _, opt := range opts {
+		opt(s)
+	}
+
+	return s
 }
 
 func (s *Strategy) ID() identity.CredentialsType {
-	return identity.CredentialsTypeOIDC
+	return s.credType
 }
 
 func (s *Strategy) validateFlow(ctx context.Context, r *http.Request, rid uuid.UUID) (flow.Flow, error) {
@@ -290,7 +278,7 @@ func (s *Strategy) validateFlow(ctx context.Context, r *http.Request, rid uuid.U
 	return ar, err // this must return the error
 }
 
-func (s *Strategy) ValidateCallback(w http.ResponseWriter, r *http.Request) (flow.Flow, *AuthCodeContainer, error) {
+func (s *Strategy) ValidateCallback(w http.ResponseWriter, r *http.Request, ps httprouter.Params) (flow.Flow, *oidcv1.State, *AuthCodeContainer, error) {
 	var (
 		codeParam  = stringsx.Coalesce(r.URL.Query().Get("code"), r.URL.Query().Get("authCode"))
 		stateParam = r.URL.Query().Get("state")
@@ -298,21 +286,36 @@ func (s *Strategy) ValidateCallback(w http.ResponseWriter, r *http.Request) (flo
 	)
 
 	if stateParam == "" {
-		return nil, nil, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the OpenID Provider did not return the state query parameter.`))
+		return nil, nil, nil, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the OpenID Provider did not return the state query parameter.`))
 	}
-	state, err := parseState(stateParam)
+	state, err := DecryptState(r.Context(), s.d.Cipher(r.Context()), stateParam)
 	if err != nil {
-		return nil, nil, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the state parameter was invalid.`))
+		return nil, nil, nil, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the state parameter is invalid.`))
+	}
+
+	if providerFromURL := ps.ByName("provider"); providerFromURL != "" {
+		// We're serving an OIDC callback URL with provider in the URL.
+		if state.ProviderId == "" {
+			// provider in URL, but not in state: compatiblity mode, remove this fallback later
+			state.ProviderId = providerFromURL
+		} else if state.ProviderId != providerFromURL {
+			// provider in state, but URL with different provider -> something's fishy
+			return nil, nil, nil, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow: provider mismatch between internal state and URL.`))
+		}
+	}
+	if state.ProviderId == "" {
+		// weird: provider neither in the state nor in the URL
+		return nil, nil, nil, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow: provider could not be retrieved from state nor URL.`))
 	}
 
-	f, err := s.validateFlow(r.Context(), r, x.ParseUUID(state.FlowID))
+	f, err := s.validateFlow(r.Context(), r, uuid.FromBytesOrNil(state.FlowId))
 	if err != nil {
-		return nil, nil, err
+		return nil, state, nil, err
 	}
 
 	tokenCode, hasSessionTokenCode, err := s.d.SessionTokenExchangePersister().CodeForFlow(r.Context(), f.GetID())
 	if err != nil {
-		return nil, nil, err
+		return nil, state, nil, err
 	}
 
 	cntnr := AuthCodeContainer{}
@@ -321,29 +324,29 @@ func (s *Strategy) ValidateCallback(w http.ResponseWriter, r *http.Request) (flo
 			continuity.WithPayload(&cntnr),
 			continuity.WithExpireInsteadOfDelete(time.Minute),
 		); err != nil {
-			return nil, nil, err
+			return nil, state, nil, err
 		}
 		if stateParam != cntnr.State {
-			return nil, &cntnr, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the query state parameter does not match the state parameter from the session cookie.`))
+			return nil, state, &cntnr, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the query state parameter does not match the state parameter from the session cookie.`))
 		}
 	} else {
 		// We need to validate the tokenCode here
-		if !state.codeMatches(tokenCode.InitCode) {
-			return nil, &cntnr, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the query state parameter does not match the state parameter from the code.`))
+		if !codeMatches(state, tokenCode.InitCode) {
+			return nil, state, &cntnr, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the query state parameter does not match the state parameter from the code.`))
 		}
 		cntnr.State = stateParam
-		cntnr.FlowID = state.FlowID
+		cntnr.FlowID = uuid.FromBytesOrNil(state.FlowId).String()
 	}
 
 	if errorParam != "" {
-		return f, &cntnr, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the OpenID Provider returned error "%s": %s`, r.URL.Query().Get("error"), r.URL.Query().Get("error_description")))
+		return f, state, &cntnr, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the OpenID Provider returned error "%s": %s`, r.URL.Query().Get("error"), r.URL.Query().Get("error_description")))
 	}
 
 	if codeParam == "" {
-		return f, &cntnr, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the OpenID Provider did not return the code query parameter.`))
+		return f, state, &cntnr, errors.WithStack(herodot.ErrBadRequest.WithReasonf(`Unable to complete OpenID Connect flow because the OpenID Provider did not return the code query parameter.`))
 	}
 
-	return f, &cntnr, nil
+	return f, state, &cntnr, nil
 }
 
 func registrationOrLoginFlowID(flow any) (uuid.UUID, bool) {
@@ -357,9 +360,7 @@ func registrationOrLoginFlowID(flow any) (uuid.UUID, bool) {
 	}
 }
 
-func (s *Strategy) alreadyAuthenticated(w http.ResponseWriter, r *http.Request, f interface{}) (bool, error) {
-	ctx := r.Context()
-
+func (s *Strategy) alreadyAuthenticated(ctx context.Context, w http.ResponseWriter, r *http.Request, f interface{}) (bool, error) {
 	if sess, _ := s.d.SessionManager().FetchFromRequest(ctx, r); sess != nil {
 		if _, ok := f.(*settings.Flow); ok {
 			// ignore this if it's a settings flow
@@ -390,34 +391,33 @@ func (s *Strategy) alreadyAuthenticated(w http.ResponseWriter, r *http.Request,
 func (s *Strategy) HandleCallback(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
 	var (
 		code = stringsx.Coalesce(r.URL.Query().Get("code"), r.URL.Query().Get("authCode"))
-		pid  = ps.ByName("provider")
 		err  error
 	)
 
 	ctx := context.WithValue(r.Context(), httprouter.ParamsKey, ps)
-	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "strategy.oidc.ExchangeCode")
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "strategy.oidc.HandleCallback")
 	defer otelx.End(span, &err)
 	r = r.WithContext(ctx)
 
-	req, cntnr, err := s.ValidateCallback(w, r)
+	req, state, cntnr, err := s.ValidateCallback(w, r, ps)
 	if err != nil {
 		if req != nil {
-			s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, err))
+			s.forwardError(ctx, w, r, req, s.handleError(ctx, w, r, req, state.ProviderId, nil, err))
 		} else {
-			s.d.SelfServiceErrorManager().Forward(r.Context(), w, r, s.handleError(w, r, nil, pid, nil, err))
+			s.d.SelfServiceErrorManager().Forward(ctx, w, r, s.handleError(ctx, w, r, nil, "", nil, err))
 		}
 		return
 	}
 
-	if authenticated, err := s.alreadyAuthenticated(w, r, req); err != nil {
-		s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, err))
+	if authenticated, err := s.alreadyAuthenticated(ctx, w, r, req); err != nil {
+		s.forwardError(ctx, w, r, req, s.handleError(ctx, w, r, req, state.ProviderId, nil, err))
 	} else if authenticated {
 		return
 	}
 
-	provider, err := s.provider(r.Context(), r, pid)
+	provider, err := s.provider(ctx, state.ProviderId)
 	if err != nil {
-		s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, err))
+		s.forwardError(ctx, w, r, req, s.handleError(ctx, w, r, req, state.ProviderId, nil, err))
 		return
 	}
 
@@ -425,150 +425,118 @@ func (s *Strategy) HandleCallback(w http.ResponseWriter, r *http.Request, ps htt
 	var et *identity.CredentialsOIDCEncryptedTokens
 	switch p := provider.(type) {
 	case OAuth2Provider:
-		token, err := s.ExchangeCode(r.Context(), provider, code)
+		token, err := s.exchangeCode(ctx, p, code, PKCEVerifier(state))
 		if err != nil {
-			s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, err))
+			s.forwardError(ctx, w, r, req, s.handleError(ctx, w, r, req, state.ProviderId, nil, err))
 			return
 		}
 
-		et, err = s.encryptOAuth2Tokens(r.Context(), token)
+		et, err = s.encryptOAuth2Tokens(ctx, token)
 		if err != nil {
-			s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, err))
+			s.forwardError(ctx, w, r, req, s.handleError(ctx, w, r, req, state.ProviderId, nil, err))
 			return
 		}
 
-		claims, err = p.Claims(r.Context(), token, r.URL.Query())
+		claims, err = p.Claims(ctx, token, r.URL.Query())
 		if err != nil {
-			s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, err))
+			s.forwardError(ctx, w, r, req, s.handleError(ctx, w, r, req, state.ProviderId, nil, err))
 			return
 		}
 	case OAuth1Provider:
-		token, err := p.ExchangeToken(r.Context(), r)
+		token, err := p.ExchangeToken(ctx, r)
 		if err != nil {
-			s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, err))
+			s.forwardError(ctx, w, r, req, s.handleError(ctx, w, r, req, state.ProviderId, nil, err))
 			return
 		}
 
-		claims, err = p.Claims(r.Context(), token)
+		claims, err = p.Claims(ctx, token)
 		if err != nil {
-			s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, err))
+			s.forwardError(ctx, w, r, req, s.handleError(ctx, w, r, req, state.ProviderId, nil, err))
 			return
 		}
 	}
 
 	if err = claims.Validate(); err != nil {
-		s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, err))
+		s.forwardError(ctx, w, r, req, s.handleError(ctx, w, r, req, state.ProviderId, nil, err))
 		return
 	}
 
-	span.SetAttributes(attribute.StringSlice("claims", maps.Keys(claims.RawClaims)))
+	span.SetAttributes(attribute.StringSlice("claims", slices.Collect(maps.Keys(claims.RawClaims))))
 
 	switch a := req.(type) {
 	case *login.Flow:
+		a.Active = s.ID()
 		a.TransientPayload = cntnr.TransientPayload
-		if ff, err := s.processLogin(w, r, a, et, claims, provider, cntnr); err != nil {
+		if ff, err := s.processLogin(ctx, w, r, a, et, claims, provider, cntnr); err != nil {
 			if errors.Is(err, flow.ErrCompletedByStrategy) {
 				return
 			}
 			if ff != nil {
-				s.forwardError(w, r, ff, err)
+				s.forwardError(ctx, w, r, ff, err)
 				return
 			}
-			s.forwardError(w, r, a, err)
+			s.forwardError(ctx, w, r, a, err)
 		}
 		return
 	case *registration.Flow:
+		a.Active = s.ID()
 		a.TransientPayload = cntnr.TransientPayload
-		if ff, err := s.processRegistration(w, r, a, et, claims, provider, cntnr, ""); err != nil {
+		if ff, err := s.processRegistration(ctx, w, r, a, et, claims, provider, cntnr); err != nil {
 			if ff != nil {
-				s.forwardError(w, r, ff, err)
+				s.forwardError(ctx, w, r, ff, err)
 				return
 			}
-			s.forwardError(w, r, a, err)
+			s.forwardError(ctx, w, r, a, err)
 		}
 		return
 	case *settings.Flow:
+		a.Active = sqlxx.NullString(s.ID())
 		a.TransientPayload = cntnr.TransientPayload
-		sess, err := s.d.SessionManager().FetchFromRequest(r.Context(), r)
+		sess, err := s.d.SessionManager().FetchFromRequest(ctx, r)
 		if err != nil {
-			s.forwardError(w, r, a, s.handleError(w, r, a, pid, nil, err))
+			s.forwardError(ctx, w, r, a, s.handleError(ctx, w, r, a, state.ProviderId, nil, err))
 			return
 		}
-		if err := s.linkProvider(w, r, &settings.UpdateContext{Session: sess, Flow: a}, et, claims, provider); err != nil {
-			s.forwardError(w, r, a, s.handleError(w, r, a, pid, nil, err))
+		if err := s.linkProvider(ctx, w, r, &settings.UpdateContext{Session: sess, Flow: a}, et, claims, provider); err != nil {
+			s.forwardError(ctx, w, r, a, s.handleError(ctx, w, r, a, state.ProviderId, nil, err))
 			return
 		}
 		return
 	default:
-		s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, errors.WithStack(x.PseudoPanic.
+		s.forwardError(ctx, w, r, req, s.handleError(ctx, w, r, req, state.ProviderId, nil, errors.WithStack(x.PseudoPanic.
 			WithDetailf("cause", "Unexpected type in OpenID Connect flow: %T", a))))
 		return
 	}
 }
 
-func (s *Strategy) ExchangeCode(ctx context.Context, provider Provider, code string) (token *oauth2.Token, err error) {
-	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "strategy.oidc.ExchangeCode")
+func (s *Strategy) exchangeCode(ctx context.Context, provider OAuth2Provider, code string, opts []oauth2.AuthCodeOption) (token *oauth2.Token, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "strategy.oidc.exchangeCode", trace.WithAttributes(
+		attribute.String("provider_id", provider.Config().ID),
+		attribute.String("provider_label", provider.Config().Label)))
 	defer otelx.End(span, &err)
-	span.SetAttributes(attribute.String("provider_id", provider.Config().ID))
-	span.SetAttributes(attribute.String("provider_label", provider.Config().Label))
 
-	switch p := provider.(type) {
-	case OAuth2Provider:
-		te, ok := provider.(OAuth2TokenExchanger)
-		if !ok {
-			te, err = p.OAuth2(ctx)
-			if err != nil {
-				return nil, err
-			}
+	te, ok := provider.(OAuth2TokenExchanger)
+	if !ok {
+		te, err = provider.OAuth2(ctx)
+		if err != nil {
+			return nil, err
 		}
-
-		client := s.d.HTTPClient(ctx)
-		ctx = context.WithValue(ctx, oauth2.HTTPClient, client.HTTPClient)
-		token, err = te.Exchange(ctx, code)
-		return token, err
-	default:
-		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("The chosen provider is not capable of exchanging an OAuth 2.0 code for an access token."))
 	}
+
+	client := s.d.HTTPClient(ctx)
+	ctx = context.WithValue(ctx, oauth2.HTTPClient, client.HTTPClient)
+	token, err = te.Exchange(ctx, code, opts...)
+	return token, err
 }
 
-func (s *Strategy) populateMethod(r *http.Request, f flow.Flow, message func(provider string) *text.Message) error {
+func (s *Strategy) populateMethod(r *http.Request, f flow.Flow, message func(provider string, providerId string) *text.Message) error {
 	conf, err := s.Config(r.Context())
 	if err != nil {
 		return err
 	}
 
-	providers := conf.Providers
-
-	if lf, ok := f.(*login.Flow); ok && lf.IsForced() {
-		if _, id, c := flowhelpers.GuessForcedLoginIdentifier(r, s.d, lf, s.ID()); id != nil {
-			if c == nil {
-				// no OIDC credentials, don't add any providers
-				providers = nil
-			} else {
-				var credentials identity.CredentialsOIDC
-				if err := json.Unmarshal(c.Config, &credentials); err != nil {
-					// failed to read OIDC credentials, don't add any providers
-					providers = nil
-				} else {
-					// add only providers that can actually be used to log in as this identity
-					providers = make([]Configuration, 0, len(conf.Providers))
-					for i := range conf.Providers {
-						for j := range credentials.Providers {
-							if conf.Providers[i].ID == credentials.Providers[j].Provider {
-								providers = append(providers, conf.Providers[i])
-								break
-							}
-						}
-					}
-				}
-			}
-		}
-	}
-
-	// does not need sorting because there is only one field
-	c := f.GetUI()
-	c.SetCSRF(s.d.GenerateCSRFToken(r))
-	AddProviders(c, providers, message)
+	f.GetUI().SetCSRF(s.d.GenerateCSRFToken(r))
+	AddProviders(f.GetUI(), conf.Providers, message)
 
 	return nil
 }
@@ -577,8 +545,8 @@ func (s *Strategy) Config(ctx context.Context) (*ConfigurationCollection, error)
 	var c ConfigurationCollection
 
 	conf := s.d.Config().SelfServiceStrategy(ctx, string(s.ID())).Config
-	if err := jsonx.
-		NewStrictDecoder(bytes.NewBuffer(conf)).
+	if err := json.
+		NewDecoder(bytes.NewBuffer(conf)).
 		Decode(&c); err != nil {
 		s.d.Logger().WithError(err).WithField("config", conf)
 		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to decode OpenID Connect Provider configuration: %s", err))
@@ -587,17 +555,17 @@ func (s *Strategy) Config(ctx context.Context) (*ConfigurationCollection, error)
 	return &c, nil
 }
 
-func (s *Strategy) provider(ctx context.Context, r *http.Request, id string) (Provider, error) {
+func (s *Strategy) provider(ctx context.Context, id string) (Provider, error) {
 	if c, err := s.Config(ctx); err != nil {
 		return nil, err
 	} else if provider, err := c.Provider(id, s.d); err != nil {
-		return nil, err
+		return nil, s.handleUnknownProviderError(err)
 	} else {
 		return provider, nil
 	}
 }
 
-func (s *Strategy) forwardError(w http.ResponseWriter, r *http.Request, f flow.Flow, err error) {
+func (s *Strategy) forwardError(ctx context.Context, w http.ResponseWriter, r *http.Request, f flow.Flow, err error) {
 	switch ff := f.(type) {
 	case *login.Flow:
 		s.d.LoginFlowErrorHandler().WriteFlowError(w, r, ff, s.NodeGroup(), err)
@@ -605,16 +573,16 @@ func (s *Strategy) forwardError(w http.ResponseWriter, r *http.Request, f flow.F
 		s.d.RegistrationFlowErrorHandler().WriteFlowError(w, r, ff, s.NodeGroup(), err)
 	case *settings.Flow:
 		var i *identity.Identity
-		if sess, err := s.d.SessionManager().FetchFromRequest(r.Context(), r); err == nil {
+		if sess, err := s.d.SessionManager().FetchFromRequest(ctx, r); err == nil {
 			i = sess.Identity
 		}
-		s.d.SettingsFlowErrorHandler().WriteFlowError(w, r, s.NodeGroup(), ff, i, err)
+		s.d.SettingsFlowErrorHandler().WriteFlowError(ctx, w, r, s.NodeGroup(), ff, i, err)
 	default:
 		panic(errors.Errorf("unexpected type: %T", ff))
 	}
 }
 
-func (s *Strategy) handleError(w http.ResponseWriter, r *http.Request, f flow.Flow, providerID string, traits []byte, err error) error {
+func (s *Strategy) handleError(ctx context.Context, w http.ResponseWriter, r *http.Request, f flow.Flow, usedProviderID string, traits []byte, err error) error {
 	switch rf := f.(type) {
 	case *login.Flow:
 		return err
@@ -634,50 +602,28 @@ func (s *Strategy) handleError(w http.ResponseWriter, r *http.Request, f flow.Fl
 				rf.UI.Messages.Add(text.NewErrorValidationDuplicateCredentialsOnOIDCLink())
 			}
 
-			lf, err := s.registrationToLogin(w, r, rf, providerID)
+			lf, err := s.registrationToLogin(ctx, w, r, rf)
 			if err != nil {
 				return err
 			}
 			// return a new login flow with the error message embedded in the login flow.
 			var redirectURL *url.URL
 			if lf.Type == flow.TypeAPI {
-				returnTo := s.d.Config().SelfServiceBrowserDefaultReturnTo(r.Context())
+				returnTo := s.d.Config().SelfServiceBrowserDefaultReturnTo(ctx)
 				if redirecter, ok := f.(flow.FlowWithRedirect); ok {
-					secureReturnTo, err := x.SecureRedirectTo(r, returnTo, redirecter.SecureRedirectToOpts(r.Context(), s.d)...)
+					secureReturnTo, err := x.SecureRedirectTo(r, returnTo, redirecter.SecureRedirectToOpts(ctx, s.d)...)
 					if err == nil {
 						returnTo = secureReturnTo
 					}
 				}
 				redirectURL = lf.AppendTo(returnTo)
 			} else {
-				redirectURL = lf.AppendTo(s.d.Config().SelfServiceFlowLoginUI(r.Context()))
+				redirectURL = lf.AppendTo(s.d.Config().SelfServiceFlowLoginUI(ctx))
 			}
 			if dc, err := flow.DuplicateCredentials(lf); err == nil && dc != nil {
 				redirectURL = urlx.CopyWithQuery(redirectURL, url.Values{"no_org_ui": {"true"}})
-
-				for i, n := range lf.UI.Nodes {
-					if n.Meta == nil || n.Meta.Label == nil {
-						continue
-					}
-					switch n.Meta.Label.ID {
-					case text.InfoSelfServiceLogin:
-						lf.UI.Nodes[i].Meta.Label = text.NewInfoLoginAndLink()
-					case text.InfoSelfServiceLoginWith:
-						p := gjson.GetBytes(n.Meta.Label.Context, "provider").String()
-						lf.UI.Nodes[i].Meta.Label = text.NewInfoLoginWithAndLink(p)
-					}
-				}
-
-				newLoginURL := s.d.Config().SelfServiceFlowLoginUI(r.Context()).String()
-				providerLabel := providerID
-				provider, _ := s.provider(r.Context(), r, providerID)
-				if provider != nil && provider.Config() != nil {
-					providerLabel = provider.Config().Label
-				}
-				lf.UI.Messages.Add(text.NewInfoLoginLinkMessage(dc.DuplicateIdentifier, providerLabel, newLoginURL))
-
-				err := s.d.LoginFlowPersister().UpdateLoginFlow(r.Context(), lf)
-				if err != nil {
+				s.populateAccountLinkingUI(ctx, lf, usedProviderID, dc.DuplicateIdentifier, dup.AvailableCredentials(), dup.AvailableOIDCProviders())
+				if err := s.d.LoginFlowPersister().UpdateLoginFlow(ctx, lf); err != nil {
 					return err
 				}
 			}
@@ -690,15 +636,15 @@ func (s *Strategy) handleError(w http.ResponseWriter, r *http.Request, f flow.Fl
 
 		// Adds the "Continue" button
 		rf.UI.SetCSRF(s.d.GenerateCSRFToken(r))
-		AddProvider(rf.UI, providerID, text.NewInfoRegistrationContinue())
+		AddProvider(rf.UI, usedProviderID, text.NewInfoRegistrationContinue())
 
 		if traits != nil {
-			ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(r.Context())
+			ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(ctx)
 			if err != nil {
 				return err
 			}
 
-			traitNodes, err := container.NodesFromJSONSchema(r.Context(), node.OpenIDConnectGroup, ds.String(), "", nil)
+			traitNodes, err := container.NodesFromJSONSchema(ctx, node.OpenIDConnectGroup, ds.String(), "", nil)
 			if err != nil {
 				return err
 			}
@@ -715,18 +661,88 @@ func (s *Strategy) handleError(w http.ResponseWriter, r *http.Request, f flow.Fl
 	return err
 }
 
+func (s *Strategy) populateAccountLinkingUI(ctx context.Context, lf *login.Flow, usedProviderID string, duplicateIdentifier string, availableCredentials []string, availableProviders []string) {
+	newLoginURL := s.d.Config().SelfServiceFlowLoginUI(ctx).String()
+	usedProviderLabel := usedProviderID
+	provider, _ := s.provider(ctx, usedProviderID)
+	if provider != nil && provider.Config() != nil {
+		usedProviderLabel = provider.Config().Label
+		if usedProviderLabel == "" {
+			usedProviderLabel = provider.Config().Provider
+		}
+	}
+	loginHintsEnabled := s.d.Config().SelfServiceFlowRegistrationLoginHints(ctx)
+	nodes := []*node.Node{}
+	for _, n := range lf.UI.Nodes {
+		// We don't want to touch nodes unecessary nodes
+		if n.Meta == nil || n.Meta.Label == nil || n.Group == node.DefaultGroup {
+			nodes = append(nodes, n)
+			continue
+		}
+
+		// Skip the provider that was used to get here (in case they used an OIDC provider)
+		pID := gjson.GetBytes(n.Meta.Label.Context, "provider_id").String()
+		if n.Group == node.OpenIDConnectGroup {
+			if pID == usedProviderID {
+				continue
+			}
+			// Hide any provider that is not available for the user
+			if loginHintsEnabled && !slices.Contains(availableProviders, pID) {
+				continue
+			}
+		}
+
+		// Replace some labels to make it easier for the user to understand what's going on.
+		switch n.Meta.Label.ID {
+		case text.InfoSelfServiceLogin:
+			n.Meta.Label = text.NewInfoLoginAndLink()
+		case text.InfoSelfServiceLoginWith:
+			p := gjson.GetBytes(n.Meta.Label.Context, "provider").String()
+			n.Meta.Label = text.NewInfoLoginWithAndLink(p)
+		}
+
+		// This can happen, if login hints are disabled. In that case, we need to make sure to show all credential options.
+		// It could in theory also happen due to a mis-configuration, and in that case, we should make sure to not delete the entire flow.
+		if !loginHintsEnabled {
+			nodes = append(nodes, n)
+		} else {
+			// Hide nodes from credentials that are not relevant for the user
+			for _, ct := range availableCredentials {
+				if ct == string(n.Group) {
+					nodes = append(nodes, n)
+					break
+				}
+			}
+		}
+	}
+
+	// Hide the "primary" identifier field present for Password, webauthn or passwordless, as we already know the identifier
+	identifierNode := lf.UI.Nodes.Find("identifier")
+	if identifierNode != nil {
+		if attributes, ok := identifierNode.Attributes.(*node.InputAttributes); ok {
+			attributes.Type = node.InputAttributeTypeHidden
+			attributes.SetValue(duplicateIdentifier)
+			identifierNode.Attributes = attributes
+		}
+	}
+
+	lf.UI.Nodes = nodes
+	lf.UI.Messages.Clear()
+	lf.UI.Messages.Add(text.NewInfoLoginLinkMessage(duplicateIdentifier, usedProviderLabel, newLoginURL, availableCredentials, availableProviders))
+}
+
 func (s *Strategy) NodeGroup() node.UiNodeGroup {
 	return node.OpenIDConnectGroup
 }
 
-func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context, _ session.AuthenticationMethods) session.AuthenticationMethod {
+func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context) session.AuthenticationMethod {
 	return session.AuthenticationMethod{
 		Method: s.ID(),
 		AAL:    identity.AuthenticatorAssuranceLevel1,
 	}
 }
 
-func (s *Strategy) processIDToken(w http.ResponseWriter, r *http.Request, provider Provider, idToken, idTokenNonce string) (*Claims, error) {
+func (s *Strategy) processIDToken(r *http.Request, provider Provider, idToken, idTokenNonce string) (*Claims, error) {
 	verifier, ok := provider.(IDTokenVerifier)
 	if !ok {
 		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("The provider %s does not support id_token verification", provider.Config().Provider))
@@ -799,17 +815,19 @@ func (s *Strategy) linkCredentials(ctx context.Context, i *identity.Identity, to
 	return nil
 }
 
-func getAuthRedirectURL(ctx context.Context, provider Provider, req ider, state *State, upstreamParameters map[string]string) (codeURL string, err error) {
+func getAuthRedirectURL(ctx context.Context, provider Provider, req ider, state string, upstreamParameters map[string]string, opts []oauth2.AuthCodeOption) (codeURL string, err error) {
 	switch p := provider.(type) {
 	case OAuth2Provider:
 		c, err := p.OAuth2(ctx)
 		if err != nil {
 			return "", err
 		}
+		opts = append(opts, UpstreamParameters(upstreamParameters)...)
+		opts = append(opts, p.AuthCodeURLOptions(req)...)
 
-		return c.AuthCodeURL(state.String(), append(UpstreamParameters(upstreamParameters), p.AuthCodeURLOptions(req)...)...), nil
+		return c.AuthCodeURL(state, opts...), nil
 	case OAuth1Provider:
-		return p.AuthURL(ctx, state.String())
+		return p.AuthURL(ctx, state)
 	default:
 		return "", errors.WithStack(herodot.ErrInternalServerError.WithReasonf("The provider %s does not support the OAuth 2.0 or OAuth 1.0 protocol", provider.Config().Provider))
 	}
diff --git a/selfservice/strategy/oidc/strategy_helper_test.go b/selfservice/strategy/oidc/strategy_helper_test.go
index 7b39729cc6af..2b542cb20e57 100644
--- a/selfservice/strategy/oidc/strategy_helper_test.go
+++ b/selfservice/strategy/oidc/strategy_helper_test.go
@@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -76,19 +77,43 @@ func (token *idTokenClaims) MarshalJSON() ([]byte, error) {
 	})
 }
 
-func createClient(t *testing.T, remote string, redir string) (id, secret string) {
+func createClient(t *testing.T, remote string, redir []string) (id, secret string) {
 	require.NoError(t, resilience.Retry(logrusx.New("", ""), time.Second*10, time.Minute*2, func() error {
 		var b bytes.Buffer
 		require.NoError(t, json.NewEncoder(&b).Encode(&struct {
-			Scope         string   `json:"scope"`
-			GrantTypes    []string `json:"grant_types"`
-			ResponseTypes []string `json:"response_types"`
-			RedirectURIs  []string `json:"redirect_uris"`
+			Scope                   string   `json:"scope"`
+			GrantTypes              []string `json:"grant_types"`
+			ResponseTypes           []string `json:"response_types"`
+			RedirectURIs            []string `json:"redirect_uris"`
+			TokenEndpointAuthMethod string   `json:"token_endpoint_auth_method"`
 		}{
 			GrantTypes:    []string{"authorization_code", "refresh_token"},
 			ResponseTypes: []string{"code"},
 			Scope:         "offline offline_access openid",
-			RedirectURIs:  []string{redir},
+			RedirectURIs:  redir,
+
+			// This is a workaround to prevent golang.org/x/oauth2 from
+			// swallowing the actual error messages from failed token exchanges.
+			//
+			// The library first attempts to use the Authorization header to
+			// pass Client ID+secret during token exchange (client_secret_basic
+			// in Hydra terminology). If that fails (with any error), it tries
+			// again with the Client ID+secret passed in the HTTP POST body
+			// (client_secret_post in Hydra). If that also fails, this second
+			// error is returned.
+			//
+			// Now, if the the client was indeed configured to use
+			// client_secret_basic, but the token exchange fails for another
+			// reason, the error message will be swallowed and replaced with
+			// "invalid_client".
+			//
+			// Manually setting this to client_secret_post means that during
+			// tests, all token exchanges will first fail with `invalid_client`
+			// and then be retried with the correct method. This is the only way
+			// to get the actual error message from the server, however.
+			//
+			// https://github.com/golang/oauth2/blob/5fd42413edb3b1699004a31b72e485e0e4ba1b13/internal/token.go#L227-L242
+			TokenEndpointAuthMethod: "client_secret_post",
 		}))
 
 		res, err := http.Post(remote+"/admin/clients", "application/json", &b)
@@ -179,17 +204,12 @@ func newHydraIntegration(t *testing.T, remote *string, subject *string, claims *
 	parsed, err := url.ParseRequestURI(addr)
 	require.NoError(t, err)
 
-	//#nosec G112
-	server := &http.Server{Addr: ":" + parsed.Port(), Handler: router}
-	go func(t *testing.T) {
-		if err := server.ListenAndServe(); err != http.ErrServerClosed {
-			require.NoError(t, err)
-		} else if err == nil {
-			require.NoError(t, server.Close())
-		}
-	}(t)
+	listener, err := net.Listen("tcp", ":"+parsed.Port())
+	require.NoError(t, err, "port busy?")
+	server := &http.Server{Handler: router}
+	go server.Serve(listener)
 	t.Cleanup(func() {
-		require.NoError(t, server.Close())
+		assert.NoError(t, server.Close())
 	})
 	return server, addr
 }
@@ -317,7 +337,7 @@ func newOIDCProvider(
 	id string,
 	opts ...func(*oidc.Configuration),
 ) oidc.Configuration {
-	clientID, secret := createClient(t, hydraAdmin, kratos.URL+oidc.RouteBase+"/callback/"+id)
+	clientID, secret := createClient(t, hydraAdmin, []string{kratos.URL + oidc.RouteBase + "/callback/" + id, kratos.URL + oidc.RouteCallbackGeneric})
 
 	cfg := oidc.Configuration{
 		Provider:     "generic",
diff --git a/selfservice/strategy/oidc/strategy_login.go b/selfservice/strategy/oidc/strategy_login.go
index 42b948ec7c11..392009ec2241 100644
--- a/selfservice/strategy/oidc/strategy_login.go
+++ b/selfservice/strategy/oidc/strategy_login.go
@@ -5,50 +5,41 @@ package oidc
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"net/http"
 	"strings"
 	"time"
 
-	"github.com/julienschmidt/httprouter"
-
-	"github.com/ory/kratos/session"
-
-	"github.com/ory/kratos/ui/node"
-	"github.com/ory/x/otelx"
-	"github.com/ory/x/sqlcon"
-
-	"github.com/ory/kratos/selfservice/flow/registration"
-
-	"github.com/ory/kratos/text"
-
-	"github.com/ory/kratos/continuity"
-
 	"github.com/pkg/errors"
+	"go.opentelemetry.io/otel/attribute"
 
 	"github.com/ory/herodot"
-
+	"github.com/ory/kratos/continuity"
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/selfservice/flow/registration"
+	"github.com/ory/kratos/selfservice/flowhelpers"
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+	"github.com/ory/kratos/session"
+	"github.com/ory/kratos/text"
+	"github.com/ory/kratos/ui/node"
 	"github.com/ory/kratos/x"
+	"github.com/ory/x/otelx"
+	"github.com/ory/x/sqlcon"
+	"github.com/ory/x/stringsx"
 )
 
-var _ login.Strategy = new(Strategy)
+var (
+	_ login.FormHydrator = new(Strategy)
+	_ login.Strategy     = new(Strategy)
+)
 
 func (s *Strategy) RegisterLoginRoutes(r *x.RouterPublic) {
 	s.setRoutes(r)
 }
 
-func (s *Strategy) PopulateLoginMethod(r *http.Request, requestedAAL identity.AuthenticatorAssuranceLevel, l *login.Flow) error {
-	// This strategy can only solve AAL1
-	if requestedAAL > identity.AuthenticatorAssuranceLevel1 {
-		return nil
-	}
-
-	return s.populateMethod(r, l, text.NewInfoLoginWith)
-}
-
 // Update Login Flow with OpenID Connect Method
 //
 // swagger:model updateLoginFlowWithOidcMethod
@@ -91,6 +82,7 @@ type UpdateLoginFlowWithOidcMethod struct {
 	//
 	// Supported providers are
 	// - Apple
+	// - Google
 	// required: false
 	IDToken string `json:"id_token,omitempty"`
 
@@ -106,8 +98,11 @@ type UpdateLoginFlowWithOidcMethod struct {
 	TransientPayload json.RawMessage `json:"transient_payload,omitempty" form:"transient_payload"`
 }
 
-func (s *Strategy) processLogin(w http.ResponseWriter, r *http.Request, loginFlow *login.Flow, token *identity.CredentialsOIDCEncryptedTokens, claims *Claims, provider Provider, container *AuthCodeContainer) (*registration.Flow, error) {
-	i, c, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(r.Context(), identity.CredentialsTypeOIDC, identity.OIDCUniqueID(provider.Config().ID, claims.Subject))
+func (s *Strategy) processLogin(ctx context.Context, w http.ResponseWriter, r *http.Request, loginFlow *login.Flow, token *identity.CredentialsOIDCEncryptedTokens, claims *Claims, provider Provider, container *AuthCodeContainer) (_ *registration.Flow, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.oidc.Strategy.processLogin")
+	defer otelx.End(span, &err)
+
+	i, c, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(ctx, s.ID(), identity.OIDCUniqueID(provider.Config().ID, claims.Subject))
 	if err != nil {
 		if errors.Is(err, sqlcon.ErrNoRows) {
 			// If no account was found we're "manually" creating a new registration flow and redirecting the browser
@@ -138,12 +133,12 @@ func (s *Strategy) processLogin(w http.ResponseWriter, r *http.Request, loginFlo
 
 			registrationFlow, err := s.d.RegistrationHandler().NewRegistrationFlow(w, r, loginFlow.Type, opts...)
 			if err != nil {
-				return nil, s.handleError(w, r, loginFlow, provider.Config().ID, nil, err)
+				return nil, s.handleError(ctx, w, r, loginFlow, provider.Config().ID, nil, err)
 			}
 
-			err = s.d.SessionTokenExchangePersister().MoveToNewFlow(r.Context(), loginFlow.ID, registrationFlow.ID)
+			err = s.d.SessionTokenExchangePersister().MoveToNewFlow(ctx, loginFlow.ID, registrationFlow.ID)
 			if err != nil {
-				return nil, s.handleError(w, r, loginFlow, provider.Config().ID, nil, err)
+				return nil, s.handleError(ctx, w, r, loginFlow, provider.Config().ID, nil, err)
 			}
 
 			registrationFlow.OrganizationID = loginFlow.OrganizationID
@@ -151,51 +146,54 @@ func (s *Strategy) processLogin(w http.ResponseWriter, r *http.Request, loginFlo
 			registrationFlow.RawIDTokenNonce = loginFlow.RawIDTokenNonce
 			registrationFlow.RequestURL, err = x.TakeOverReturnToParameter(loginFlow.RequestURL, registrationFlow.RequestURL)
 			registrationFlow.TransientPayload = loginFlow.TransientPayload
+			registrationFlow.Active = s.ID()
+
 			if err != nil {
-				return nil, s.handleError(w, r, loginFlow, provider.Config().ID, nil, err)
+				return nil, s.handleError(ctx, w, r, loginFlow, provider.Config().ID, nil, err)
 			}
 
-			if _, err := s.processRegistration(w, r, registrationFlow, token, claims, provider, container, loginFlow.IDToken); err != nil {
+			if _, err := s.processRegistration(ctx, w, r, registrationFlow, token, claims, provider, container); err != nil {
 				return registrationFlow, err
 			}
 
 			return nil, nil
 		}
 
-		return nil, s.handleError(w, r, loginFlow, provider.Config().ID, nil, err)
+		return nil, s.handleError(ctx, w, r, loginFlow, provider.Config().ID, nil, err)
 	}
 
 	var oidcCredentials identity.CredentialsOIDC
 	if err := json.NewDecoder(bytes.NewBuffer(c.Config)).Decode(&oidcCredentials); err != nil {
-		return nil, s.handleError(w, r, loginFlow, provider.Config().ID, nil, errors.WithStack(herodot.ErrInternalServerError.WithReason("The password credentials could not be decoded properly").WithDebug(err.Error())))
+		return nil, s.handleError(ctx, w, r, loginFlow, provider.Config().ID, nil, errors.WithStack(herodot.ErrInternalServerError.WithReason("The password credentials could not be decoded properly").WithDebug(err.Error())))
 	}
 
 	sess := session.NewInactiveSession()
-	sess.CompletedLoginForWithProvider(s.ID(), identity.AuthenticatorAssuranceLevel1, provider.Config().ID,
-		httprouter.ParamsFromContext(r.Context()).ByName("organization"))
+	sess.CompletedLoginForWithProvider(s.ID(), identity.AuthenticatorAssuranceLevel1, provider.Config().ID, provider.Config().OrganizationID)
+
 	for _, c := range oidcCredentials.Providers {
 		if c.Subject == claims.Subject && c.Provider == provider.Config().ID {
 			if err = s.d.LoginHookExecutor().PostLoginHook(w, r, node.OpenIDConnectGroup, loginFlow, i, sess, provider.Config().ID); err != nil {
-				return nil, s.handleError(w, r, loginFlow, provider.Config().ID, nil, err)
+				return nil, s.handleError(ctx, w, r, loginFlow, provider.Config().ID, nil, err)
 			}
 			return nil, nil
 		}
 	}
 
-	return nil, s.handleError(w, r, loginFlow, provider.Config().ID, nil, errors.WithStack(herodot.ErrInternalServerError.WithReason("Unable to find matching OpenID Connect Credentials.").WithDebugf(`Unable to find credentials that match the given provider "%s" and subject "%s".`, provider.Config().ID, claims.Subject)))
+	return nil, s.handleError(ctx, w, r, loginFlow, provider.Config().ID, nil, errors.WithStack(herodot.ErrInternalServerError.WithReason("Unable to find matching OpenID Connect Credentials.").WithDebugf(`Unable to find credentials that match the given provider "%s" and subject "%s".`, provider.Config().ID, claims.Subject)))
 }
 
 func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, _ *session.Session) (i *identity.Identity, err error) {
-	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.oidc.strategy.Login")
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.oidc.Strategy.Login")
 	defer otelx.End(span, &err)
 
 	if err := login.CheckAAL(f, identity.AuthenticatorAssuranceLevel1); err != nil {
+		span.SetAttributes(attribute.String("not_responsible_reason", "requested AAL is not AAL1"))
 		return nil, err
 	}
 
 	var p UpdateLoginFlowWithOidcMethod
-	if err := s.newLinkDecoder(&p, r); err != nil {
-		return nil, s.handleError(w, r, f, "", nil, err)
+	if err := s.newLinkDecoder(ctx, &p, r); err != nil {
+		return nil, s.handleError(ctx, w, r, f, "", nil, err)
 	}
 
 	f.IDToken = p.IDToken
@@ -204,6 +202,7 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 
 	pid := p.Provider // this can come from both url query and post body
 	if pid == "" {
+		span.SetAttributes(attribute.String("not_responsible_reason", "provider ID missing"))
 		return nil, errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 
@@ -214,62 +213,63 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 			WithField("provider", p.Provider).
 			WithField("method", p.Method).
 			Warn("The payload includes a `provider` field but is using a method other than `oidc`. Therefore, social sign in will not be executed.")
+		span.SetAttributes(attribute.String("not_responsible_reason", "method is not oidc"))
 		return nil, errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 
 	if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.SettingsStrategyID(), s.SettingsStrategyID(), s.d); err != nil {
-		return nil, s.handleError(w, r, f, pid, nil, err)
+		return nil, s.handleError(ctx, w, r, f, pid, nil, s.handleMethodNotAllowedError(err))
 	}
 
-	provider, err := s.provider(ctx, r, pid)
+	provider, err := s.provider(ctx, pid)
 	if err != nil {
-		return nil, s.handleError(w, r, f, pid, nil, err)
+		return nil, s.handleError(ctx, w, r, f, pid, nil, err)
 	}
 
 	req, err := s.validateFlow(ctx, r, f.ID)
 	if err != nil {
-		return nil, s.handleError(w, r, f, pid, nil, err)
+		return nil, s.handleError(ctx, w, r, f, pid, nil, err)
 	}
 
-	if authenticated, err := s.alreadyAuthenticated(w, r, req); err != nil {
-		return nil, s.handleError(w, r, f, pid, nil, err)
+	if authenticated, err := s.alreadyAuthenticated(ctx, w, r, req); err != nil {
+		return nil, s.handleError(ctx, w, r, f, pid, nil, err)
 	} else if authenticated {
 		return i, nil
 	}
 
 	if p.IDToken != "" {
-		claims, err := s.processIDToken(w, r, provider, p.IDToken, p.IDTokenNonce)
+		claims, err := s.processIDToken(r, provider, p.IDToken, p.IDTokenNonce)
 		if err != nil {
-			return nil, s.handleError(w, r, f, pid, nil, err)
+			return nil, s.handleError(ctx, w, r, f, pid, nil, err)
 		}
-		_, err = s.processLogin(w, r, f, nil, claims, provider, &AuthCodeContainer{
+		_, err = s.processLogin(ctx, w, r, f, nil, claims, provider, &AuthCodeContainer{
 			FlowID: f.ID.String(),
 			Traits: p.Traits,
 		})
 		if err != nil {
-			return nil, s.handleError(w, r, f, pid, nil, err)
+			return nil, s.handleError(ctx, w, r, f, pid, nil, err)
 		}
 		return nil, errors.WithStack(flow.ErrCompletedByStrategy)
 	}
 
-	state := generateState(f.ID.String())
-	if code, hasCode, _ := s.d.SessionTokenExchangePersister().CodeForFlow(ctx, f.ID); hasCode {
-		state.setCode(code.InitCode)
+	state, pkce, err := s.GenerateState(ctx, provider, f.ID)
+	if err != nil {
+		return nil, s.handleError(ctx, w, r, f, pid, nil, err)
 	}
 	if err := s.d.ContinuityManager().Pause(ctx, w, r, sessionName,
 		continuity.WithPayload(&AuthCodeContainer{
-			State:            state.String(),
+			State:            state,
 			FlowID:           f.ID.String(),
 			Traits:           p.Traits,
 			TransientPayload: f.TransientPayload,
 		}),
 		continuity.WithLifespan(time.Minute*30)); err != nil {
-		return nil, s.handleError(w, r, f, pid, nil, err)
+		return nil, s.handleError(ctx, w, r, f, pid, nil, err)
 	}
 
 	f.Active = s.ID()
 	if err = s.d.LoginFlowPersister().UpdateLoginFlow(ctx, f); err != nil {
-		return nil, s.handleError(w, r, f, pid, nil, errors.WithStack(herodot.ErrInternalServerError.WithReason("Could not update flow").WithDebug(err.Error())))
+		return nil, s.handleError(ctx, w, r, f, pid, nil, errors.WithStack(herodot.ErrInternalServerError.WithReason("Could not update flow").WithDebug(err.Error())))
 	}
 
 	var up map[string]string
@@ -277,9 +277,9 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 		return nil, err
 	}
 
-	codeURL, err := getAuthRedirectURL(ctx, provider, f, state, up)
+	codeURL, err := getAuthRedirectURL(ctx, provider, f, state, up, pkce)
 	if err != nil {
-		return nil, s.handleError(w, r, f, pid, nil, err)
+		return nil, s.handleError(ctx, w, r, f, pid, nil, err)
 	}
 
 	if x.IsJSONRequest(r) {
@@ -290,3 +290,100 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 
 	return nil, errors.WithStack(flow.ErrCompletedByStrategy)
 }
+
+func (s *Strategy) PopulateLoginMethodFirstFactorRefresh(r *http.Request, lf *login.Flow) error {
+	conf, err := s.Config(r.Context())
+	if err != nil {
+		return err
+	}
+
+	var providers []Configuration
+	_, id, c := flowhelpers.GuessForcedLoginIdentifier(r, s.d, lf, s.ID())
+	if id == nil || c == nil {
+		providers = nil
+	} else {
+		var credentials identity.CredentialsOIDC
+		if err := json.Unmarshal(c.Config, &credentials); err != nil {
+			// failed to read OIDC credentials, don't add any providers
+			providers = nil
+		} else {
+			// add only providers that can actually be used to log in as this identity
+			providers = make([]Configuration, 0, len(conf.Providers))
+			for i := range conf.Providers {
+				for j := range credentials.Providers {
+					if conf.Providers[i].ID == credentials.Providers[j].Provider {
+						providers = append(providers, conf.Providers[i])
+						break
+					}
+				}
+			}
+		}
+	}
+
+	lf.UI.SetCSRF(s.d.GenerateCSRFToken(r))
+	AddProviders(lf.UI, providers, text.NewInfoLoginWith)
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodFirstFactor(r *http.Request, f *login.Flow) error {
+	return s.populateMethod(r, f, text.NewInfoLoginWith)
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactor(r *http.Request, sr *login.Flow) error {
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactorRefresh(r *http.Request, sr *login.Flow) error {
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstCredentials(r *http.Request, f *login.Flow, mods ...login.FormHydratorModifier) (err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.oidc.Strategy.PopulateLoginMethodIdentifierFirstCredentials")
+	defer otelx.End(span, &err)
+
+	conf, err := s.Config(ctx)
+	if err != nil {
+		return err
+	}
+
+	o := login.NewFormHydratorOptions(mods)
+
+	var linked []Provider
+	if o.IdentityHint != nil {
+		var err error
+		// If we have an identity hint we check if the identity has any providers configured.
+		if linked, err = s.linkedProviders(conf, o.IdentityHint); err != nil {
+			return err
+		}
+	}
+
+	if len(linked) == 0 {
+		// If we found no credentials:
+		if s.d.Config().SecurityAccountEnumerationMitigate(ctx) {
+			// We found no credentials but do not want to leak that we know that. So we return early and do not
+			// modify the initial provider list.
+			return nil
+		}
+
+		// We found no credentials. We remove all the providers and tell the strategy that we found nothing.
+		f.GetUI().UnsetNode("provider")
+		return idfirst.ErrNoCredentialsFound
+	}
+
+	if !s.d.Config().SecurityAccountEnumerationMitigate(ctx) {
+		// Account enumeration is disabled, so we show all providers that are linked to the identity.
+		// User is found and enumeration mitigation is disabled. Filter the list!
+		f.GetUI().UnsetNode("provider")
+
+		for _, l := range linked {
+			lc := l.Config()
+			AddProvider(f.UI, lc.ID, text.NewInfoLoginWith(stringsx.Coalesce(lc.Label, lc.ID), lc.ID))
+		}
+	}
+
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstIdentification(r *http.Request, f *login.Flow) error {
+	return s.populateMethod(r, f, text.NewInfoLoginWith)
+}
diff --git a/selfservice/strategy/oidc/strategy_login_test.go b/selfservice/strategy/oidc/strategy_login_test.go
new file mode 100644
index 000000000000..2191d5cf59a7
--- /dev/null
+++ b/selfservice/strategy/oidc/strategy_login_test.go
@@ -0,0 +1,166 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+
+	configtesthelpers "github.com/ory/kratos/driver/config/testhelpers"
+
+	"github.com/gofrs/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/driver"
+	"github.com/ory/kratos/driver/config"
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/internal"
+	"github.com/ory/kratos/internal/testhelpers"
+	"github.com/ory/kratos/selfservice/flow"
+	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/x"
+	"github.com/ory/x/snapshotx"
+)
+
+func createIdentity(t *testing.T, ctx context.Context, reg driver.Registry, id uuid.UUID, provider string) *identity.Identity {
+	creds, err := identity.NewCredentialsOIDC(new(identity.CredentialsOIDCEncryptedTokens), provider, id.String(), "")
+	require.NoError(t, err)
+
+	i := identity.NewIdentity("default")
+	i.SetCredentials(identity.CredentialsTypeOIDC, *creds)
+
+	require.NoError(t, reg.IdentityManager().Create(ctx, i))
+	return i
+}
+
+func TestFormHydration(t *testing.T) {
+	ctx := context.Background()
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	providerID := "test-provider"
+
+	ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeOIDC)+".enabled", true)
+	ctx = configtesthelpers.WithConfigValue(
+		ctx,
+		config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeOIDC)+".config",
+		map[string]interface{}{
+			"providers": []map[string]interface{}{
+				{
+					"provider":      "generic",
+					"id":            providerID,
+					"client_id":     "invalid",
+					"client_secret": "invalid",
+					"issuer_url":    "https://foobar/",
+					"mapper_url":    "file://./stub/oidc.facebook.jsonnet",
+				},
+			},
+		},
+	)
+	ctx = testhelpers.WithDefaultIdentitySchema(ctx, "file://stub/stub.schema.json")
+
+	s, err := reg.AllLoginStrategies().Strategy(identity.CredentialsTypeOIDC)
+	require.NoError(t, err)
+	fh, ok := s.(login.FormHydrator)
+	require.True(t, ok)
+
+	toSnapshot := func(t *testing.T, f *login.Flow) {
+		t.Helper()
+		// The CSRF token has a unique value that messes with the snapshot - ignore it.
+		f.UI.Nodes.ResetNodes("csrf_token")
+		snapshotx.SnapshotT(t, f.UI.Nodes)
+	}
+	newFlow := func(ctx context.Context, t *testing.T) (*http.Request, *login.Flow) {
+		r := httptest.NewRequest("GET", "/self-service/login/browser", nil)
+		r = r.WithContext(ctx)
+		t.Helper()
+		f, err := login.NewFlow(conf, time.Minute, "csrf_token", r, flow.TypeBrowser)
+		require.NoError(t, err)
+		return r, f
+	}
+
+	t.Run("method=PopulateLoginMethodSecondFactor", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+		require.NoError(t, fh.PopulateLoginMethodSecondFactor(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodFirstFactor", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodFirstFactor(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodFirstFactorRefresh", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+
+		id := createIdentity(t, ctx, reg, x.NewUUID(), providerID)
+		r.Header = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id).Transport.(*testhelpers.TransportWithHeader).GetHeader()
+		f.Refresh = true
+
+		require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodSecondFactorRefresh", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstCredentials", func(t *testing.T) {
+		t.Run("case=no options", func(t *testing.T) {
+			r, f := newFlow(ctx, t)
+			require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=WithIdentifier", func(t *testing.T) {
+			r, f := newFlow(ctx, t)
+			require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=WithIdentityHint", func(t *testing.T) {
+			t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+
+				id := identity.NewIdentity(providerID)
+				r, f := newFlow(ctx, t)
+				require.NoError(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)))
+				toSnapshot(t, f)
+			})
+
+			t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, false)
+
+				t.Run("case=identity has oidc", func(t *testing.T) {
+					identifier := x.NewUUID()
+					id := createIdentity(t, ctx, reg, identifier, providerID)
+
+					r, f := newFlow(ctx, t)
+					require.NoError(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)))
+					toSnapshot(t, f)
+				})
+
+				t.Run("case=identity does not have a oidc", func(t *testing.T) {
+					id := identity.NewIdentity("default")
+					r, f := newFlow(ctx, t)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+			})
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstIdentification", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodIdentifierFirstIdentification(r, f))
+		toSnapshot(t, f)
+	})
+}
diff --git a/selfservice/strategy/oidc/strategy_registration.go b/selfservice/strategy/oidc/strategy_registration.go
index 124e8539f6ea..5ed061119e7b 100644
--- a/selfservice/strategy/oidc/strategy_registration.go
+++ b/selfservice/strategy/oidc/strategy_registration.go
@@ -5,14 +5,16 @@ package oidc
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"net/http"
 	"strings"
 	"time"
 
+	"go.opentelemetry.io/otel/attribute"
+
 	"github.com/dgraph-io/ristretto"
 	"github.com/gofrs/uuid"
-	"github.com/julienschmidt/httprouter"
 	"github.com/pkg/errors"
 	"github.com/tidwall/gjson"
 	"github.com/tidwall/sjson"
@@ -33,7 +35,7 @@ import (
 
 var _ registration.Strategy = new(Strategy)
 
-var jsonnetCache, _ = ristretto.NewCache(&ristretto.Config{
+var jsonnetCache, _ = ristretto.NewCache(&ristretto.Config[[]byte, []byte]{
 	MaxCost:     100 << 20, // 100MB,
 	NumCounters: 1_000_000, // 1kB per snippet -> 100k snippets -> 1M counters
 	BufferItems: 64,
@@ -103,6 +105,7 @@ type UpdateRegistrationFlowWithOidcMethod struct {
 	//
 	// Supported providers are
 	// - Apple
+	// - Google
 	// required: false
 	IDToken string `json:"id_token,omitempty"`
 
@@ -118,8 +121,8 @@ type UpdateRegistrationFlowWithOidcMethod struct {
 	TransientPayload json.RawMessage `json:"transient_payload,omitempty" form:"transient_payload"`
 }
 
-func (s *Strategy) newLinkDecoder(p interface{}, r *http.Request) error {
-	ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(r.Context())
+func (s *Strategy) newLinkDecoder(ctx context.Context, p interface{}, r *http.Request) error {
+	ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(ctx)
 	if err != nil {
 		return err
 	}
@@ -147,17 +150,18 @@ func (s *Strategy) newLinkDecoder(p interface{}, r *http.Request) error {
 	return nil
 }
 
-func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registration.Flow, i *identity.Identity) (err error) {
-	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.oidc.strategy.Register")
+func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registration.Flow, _ *identity.Identity) (err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.oidc.Strategy.Register")
 	defer otelx.End(span, &err)
 
 	var p UpdateRegistrationFlowWithOidcMethod
-	if err := s.newLinkDecoder(&p, r); err != nil {
-		return s.handleError(w, r, f, "", nil, err)
+	if err := s.newLinkDecoder(ctx, &p, r); err != nil {
+		return s.handleError(ctx, w, r, f, "", nil, err)
 	}
 
 	pid := p.Provider // this can come from both url query and post body
 	if pid == "" {
+		span.SetAttributes(attribute.String("not_responsible_reason", "provider ID missing"))
 		return errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 
@@ -172,58 +176,59 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registrat
 			WithField("provider", p.Provider).
 			WithField("method", p.Method).
 			Warn("The payload includes a `provider` field but is using a method other than `oidc`. Therefore, social sign in will not be executed.")
+		span.SetAttributes(attribute.String("not_responsible_reason", "method is not oidc"))
 		return errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 
 	if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.SettingsStrategyID(), s.SettingsStrategyID(), s.d); err != nil {
-		return s.handleError(w, r, f, pid, nil, err)
+		return s.handleError(ctx, w, r, f, pid, nil, s.handleMethodNotAllowedError(err))
 	}
 
-	provider, err := s.provider(ctx, r, pid)
+	provider, err := s.provider(ctx, pid)
 	if err != nil {
-		return s.handleError(w, r, f, pid, nil, err)
+		return s.handleError(ctx, w, r, f, pid, nil, err)
 	}
 
 	req, err := s.validateFlow(ctx, r, f.ID)
 	if err != nil {
-		return s.handleError(w, r, f, pid, nil, err)
+		return s.handleError(ctx, w, r, f, pid, nil, err)
 	}
 
-	if authenticated, err := s.alreadyAuthenticated(w, r, req); err != nil {
-		return s.handleError(w, r, f, pid, nil, err)
+	if authenticated, err := s.alreadyAuthenticated(ctx, w, r, req); err != nil {
+		return s.handleError(ctx, w, r, f, pid, nil, err)
 	} else if authenticated {
 		return errors.WithStack(registration.ErrAlreadyLoggedIn)
 	}
 
 	if p.IDToken != "" {
-		claims, err := s.processIDToken(w, r, provider, p.IDToken, p.IDTokenNonce)
+		claims, err := s.processIDToken(r, provider, p.IDToken, p.IDTokenNonce)
 		if err != nil {
-			return s.handleError(w, r, f, pid, nil, err)
+			return s.handleError(ctx, w, r, f, pid, nil, err)
 		}
-		_, err = s.processRegistration(w, r, f, nil, claims, provider, &AuthCodeContainer{
+		_, err = s.processRegistration(ctx, w, r, f, nil, claims, provider, &AuthCodeContainer{
 			FlowID:           f.ID.String(),
 			Traits:           p.Traits,
 			TransientPayload: f.TransientPayload,
-		}, p.IDToken)
+		})
 		if err != nil {
-			return s.handleError(w, r, f, pid, nil, err)
+			return s.handleError(ctx, w, r, f, pid, nil, err)
 		}
 		return errors.WithStack(flow.ErrCompletedByStrategy)
 	}
 
-	state := generateState(f.ID.String())
-	if code, hasCode, _ := s.d.SessionTokenExchangePersister().CodeForFlow(ctx, f.ID); hasCode {
-		state.setCode(code.InitCode)
+	state, pkce, err := s.GenerateState(ctx, provider, f.ID)
+	if err != nil {
+		return s.handleError(ctx, w, r, f, pid, nil, err)
 	}
 	if err := s.d.ContinuityManager().Pause(ctx, w, r, sessionName,
 		continuity.WithPayload(&AuthCodeContainer{
-			State:            state.String(),
+			State:            state,
 			FlowID:           f.ID.String(),
 			Traits:           p.Traits,
 			TransientPayload: f.TransientPayload,
 		}),
 		continuity.WithLifespan(time.Minute*30)); err != nil {
-		return s.handleError(w, r, f, pid, nil, err)
+		return s.handleError(ctx, w, r, f, pid, nil, err)
 	}
 
 	var up map[string]string
@@ -231,9 +236,9 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registrat
 		return err
 	}
 
-	codeURL, err := getAuthRedirectURL(ctx, provider, f, state, up)
+	codeURL, err := getAuthRedirectURL(ctx, provider, f, state, up, pkce)
 	if err != nil {
-		return s.handleError(w, r, f, pid, nil, err)
+		return s.handleError(ctx, w, r, f, pid, nil, err)
 	}
 	if x.IsJSONRequest(r) {
 		s.d.Writer().WriteError(w, r, flow.NewBrowserLocationChangeRequiredError(codeURL))
@@ -244,7 +249,7 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registrat
 	return errors.WithStack(flow.ErrCompletedByStrategy)
 }
 
-func (s *Strategy) registrationToLogin(w http.ResponseWriter, r *http.Request, rf *registration.Flow, providerID string) (*login.Flow, error) {
+func (s *Strategy) registrationToLogin(ctx context.Context, w http.ResponseWriter, r *http.Request, rf *registration.Flow) (*login.Flow, error) {
 	// If return_to was set before, we need to preserve it.
 	var opts []login.FlowOption
 	if len(rf.ReturnTo) > 0 {
@@ -255,14 +260,14 @@ func (s *Strategy) registrationToLogin(w http.ResponseWriter, r *http.Request, r
 		opts = append(opts, login.WithFormErrorMessage(rf.UI.Messages))
 	}
 
-	opts = append(opts, login.WithInternalContext(rf.InternalContext))
+	opts = append(opts, login.WithInternalContext(rf.InternalContext), login.WithIsAccountLinking())
 
 	lf, _, err := s.d.LoginHandler().NewLoginFlow(w, r, rf.Type, opts...)
 	if err != nil {
 		return nil, err
 	}
 
-	err = s.d.SessionTokenExchangePersister().MoveToNewFlow(r.Context(), rf.ID, lf.ID)
+	err = s.d.SessionTokenExchangePersister().MoveToNewFlow(ctx, rf.ID, lf.ID)
 	if err != nil {
 		return nil, err
 	}
@@ -272,12 +277,17 @@ func (s *Strategy) registrationToLogin(w http.ResponseWriter, r *http.Request, r
 		return nil, err
 	}
 	lf.TransientPayload = rf.TransientPayload
+	lf.Active = s.ID()
+	lf.OrganizationID = rf.OrganizationID
 
 	return lf, nil
 }
 
-func (s *Strategy) processRegistration(w http.ResponseWriter, r *http.Request, rf *registration.Flow, token *identity.CredentialsOIDCEncryptedTokens, claims *Claims, provider Provider, container *AuthCodeContainer, idToken string) (*login.Flow, error) {
-	if _, _, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(r.Context(), identity.CredentialsTypeOIDC, identity.OIDCUniqueID(provider.Config().ID, claims.Subject)); err == nil {
+func (s *Strategy) processRegistration(ctx context.Context, w http.ResponseWriter, r *http.Request, rf *registration.Flow, token *identity.CredentialsOIDCEncryptedTokens, claims *Claims, provider Provider, container *AuthCodeContainer) (_ *login.Flow, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.oidc.Strategy.processRegistration")
+	defer otelx.End(span, &err)
+
+	if _, _, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(ctx, identity.CredentialsTypeOIDC, identity.OIDCUniqueID(provider.Config().ID, claims.Subject)); err == nil {
 		// If the identity already exists, we should perform the login flow instead.
 
 		// That will execute the "pre registration" hook which allows to e.g. disallow this flow. The registration
@@ -291,32 +301,32 @@ func (s *Strategy) processRegistration(w http.ResponseWriter, r *http.Request, r
 			WithField("subject", claims.Subject).
 			Debug("Received successful OpenID Connect callback but user is already registered. Re-initializing login flow now.")
 
-		lf, err := s.registrationToLogin(w, r, rf, provider.Config().ID)
+		lf, err := s.registrationToLogin(ctx, w, r, rf)
 		if err != nil {
-			return nil, s.handleError(w, r, rf, provider.Config().ID, nil, err)
+			return nil, s.handleError(ctx, w, r, rf, provider.Config().ID, nil, err)
 		}
 
-		if _, err := s.processLogin(w, r, lf, token, claims, provider, container); err != nil {
-			return lf, s.handleError(w, r, rf, provider.Config().ID, nil, err)
+		if _, err := s.processLogin(ctx, w, r, lf, token, claims, provider, container); err != nil {
+			return lf, s.handleError(ctx, w, r, rf, provider.Config().ID, nil, err)
 		}
 
 		return nil, nil
 	}
 
-	fetch := fetcher.NewFetcher(fetcher.WithClient(s.d.HTTPClient(r.Context())), fetcher.WithCache(jsonnetCache, 60*time.Minute))
-	jsonnetMapperSnippet, err := fetch.FetchContext(r.Context(), provider.Config().Mapper)
+	fetch := fetcher.NewFetcher(fetcher.WithClient(s.d.HTTPClient(ctx)), fetcher.WithCache(jsonnetCache, 60*time.Minute))
+	jsonnetMapperSnippet, err := fetch.FetchContext(ctx, provider.Config().Mapper)
 	if err != nil {
-		return nil, s.handleError(w, r, rf, provider.Config().ID, nil, err)
+		return nil, s.handleError(ctx, w, r, rf, provider.Config().ID, nil, err)
 	}
 
-	i, va, err := s.createIdentity(w, r, rf, claims, provider, container, jsonnetMapperSnippet.Bytes())
+	i, va, err := s.createIdentity(ctx, w, r, rf, claims, provider, container, jsonnetMapperSnippet.Bytes())
 	if err != nil {
-		return nil, s.handleError(w, r, rf, provider.Config().ID, nil, err)
+		return nil, s.handleError(ctx, w, r, rf, provider.Config().ID, nil, err)
 	}
 
 	// Validate the identity itself
-	if err := s.d.IdentityValidator().Validate(r.Context(), i); err != nil {
-		return nil, s.handleError(w, r, rf, provider.Config().ID, i.Traits, err)
+	if err := s.d.IdentityValidator().Validate(ctx, i); err != nil {
+		return nil, s.handleError(ctx, w, r, rf, provider.Config().ID, i.Traits, err)
 	}
 
 	for n := range i.VerifiableAddresses {
@@ -333,54 +343,54 @@ func (s *Strategy) processRegistration(w http.ResponseWriter, r *http.Request, r
 
 	creds, err := identity.NewCredentialsOIDC(token, provider.Config().ID, claims.Subject, provider.Config().OrganizationID)
 	if err != nil {
-		return nil, s.handleError(w, r, rf, provider.Config().ID, i.Traits, err)
+		return nil, s.handleError(ctx, w, r, rf, provider.Config().ID, i.Traits, err)
 	}
 
 	i.SetCredentials(s.ID(), *creds)
-	if err := s.d.RegistrationExecutor().PostRegistrationHook(w, r, identity.CredentialsTypeOIDC, provider.Config().ID, rf, i); err != nil {
-		return nil, s.handleError(w, r, rf, provider.Config().ID, i.Traits, err)
+	if err := s.d.RegistrationExecutor().PostRegistrationHook(w, r, s.ID(), provider.Config().ID, provider.Config().OrganizationID, rf, i); err != nil {
+		return nil, s.handleError(ctx, w, r, rf, provider.Config().ID, i.Traits, err)
 	}
 
 	return nil, nil
 }
 
-func (s *Strategy) createIdentity(w http.ResponseWriter, r *http.Request, a *registration.Flow, claims *Claims, provider Provider, container *AuthCodeContainer, jsonnetSnippet []byte) (*identity.Identity, []VerifiedAddress, error) {
+func (s *Strategy) createIdentity(ctx context.Context, w http.ResponseWriter, r *http.Request, a *registration.Flow, claims *Claims, provider Provider, container *AuthCodeContainer, jsonnetSnippet []byte) (*identity.Identity, []VerifiedAddress, error) {
 	var jsonClaims bytes.Buffer
 	if err := json.NewEncoder(&jsonClaims).Encode(claims); err != nil {
-		return nil, nil, s.handleError(w, r, a, provider.Config().ID, nil, err)
+		return nil, nil, s.handleError(ctx, w, r, a, provider.Config().ID, nil, err)
 	}
 
-	vm, err := s.d.JsonnetVM(r.Context())
+	vm, err := s.d.JsonnetVM(ctx)
 	if err != nil {
-		return nil, nil, s.handleError(w, r, a, provider.Config().ID, nil, err)
+		return nil, nil, s.handleError(ctx, w, r, a, provider.Config().ID, nil, err)
 	}
 
 	vm.ExtCode("claims", jsonClaims.String())
 	evaluated, err := vm.EvaluateAnonymousSnippet(provider.Config().Mapper, string(jsonnetSnippet))
 	if err != nil {
-		return nil, nil, s.handleError(w, r, a, provider.Config().ID, nil, err)
+		return nil, nil, s.handleError(ctx, w, r, a, provider.Config().ID, nil, err)
 	}
 
-	i := identity.NewIdentity(s.d.Config().DefaultIdentityTraitsSchemaID(r.Context()))
-	if err := s.setTraits(w, r, a, claims, provider, container, evaluated, i); err != nil {
-		return nil, nil, s.handleError(w, r, a, provider.Config().ID, i.Traits, err)
+	i := identity.NewIdentity(s.d.Config().DefaultIdentityTraitsSchemaID(ctx))
+	if err := s.setTraits(ctx, w, r, a, provider, container, evaluated, i); err != nil {
+		return nil, nil, s.handleError(ctx, w, r, a, provider.Config().ID, i.Traits, err)
 	}
 
 	if err := s.setMetadata(evaluated, i, PublicMetadata); err != nil {
-		return nil, nil, s.handleError(w, r, a, provider.Config().ID, i.Traits, err)
+		return nil, nil, s.handleError(ctx, w, r, a, provider.Config().ID, i.Traits, err)
 	}
 
 	if err := s.setMetadata(evaluated, i, AdminMetadata); err != nil {
-		return nil, nil, s.handleError(w, r, a, provider.Config().ID, i.Traits, err)
+		return nil, nil, s.handleError(ctx, w, r, a, provider.Config().ID, i.Traits, err)
 	}
 
 	va, err := s.extractVerifiedAddresses(evaluated)
 	if err != nil {
-		return nil, nil, s.handleError(w, r, a, provider.Config().ID, i.Traits, err)
+		return nil, nil, s.handleError(ctx, w, r, a, provider.Config().ID, i.Traits, err)
 	}
 
-	if orgID := httprouter.ParamsFromContext(r.Context()).ByName("organization"); orgID != "" {
-		i.OrganizationID = uuid.NullUUID{UUID: x.ParseUUID(orgID), Valid: true}
+	if orgID, err := uuid.FromString(provider.Config().OrganizationID); err == nil {
+		i.OrganizationID = uuid.NullUUID{UUID: orgID, Valid: true}
 	}
 
 	s.d.Logger().
@@ -393,7 +403,7 @@ func (s *Strategy) createIdentity(w http.ResponseWriter, r *http.Request, a *reg
 	return i, va, nil
 }
 
-func (s *Strategy) setTraits(w http.ResponseWriter, r *http.Request, a *registration.Flow, claims *Claims, provider Provider, container *AuthCodeContainer, evaluated string, i *identity.Identity) error {
+func (s *Strategy) setTraits(ctx context.Context, w http.ResponseWriter, r *http.Request, a *registration.Flow, provider Provider, container *AuthCodeContainer, evaluated string, i *identity.Identity) error {
 	jsonTraits := gjson.Get(evaluated, "identity.traits")
 	if !jsonTraits.IsObject() {
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("OpenID Connect Jsonnet mapper did not return an object for key identity.traits. Please check your Jsonnet code!"))
@@ -402,12 +412,12 @@ func (s *Strategy) setTraits(w http.ResponseWriter, r *http.Request, a *registra
 	if container != nil {
 		traits, err := merge(container.Traits, json.RawMessage(jsonTraits.Raw))
 		if err != nil {
-			return s.handleError(w, r, a, provider.Config().ID, nil, err)
+			return s.handleError(ctx, w, r, a, provider.Config().ID, nil, err)
 		}
 
 		i.Traits = traits
 	} else {
-		i.Traits = identity.Traits(json.RawMessage(jsonTraits.Raw))
+		i.Traits = identity.Traits(jsonTraits.Raw)
 	}
 	s.d.Logger().
 		WithRequest(r).
diff --git a/selfservice/strategy/oidc/strategy_settings.go b/selfservice/strategy/oidc/strategy_settings.go
index 4fde3a457548..dcc49f405be2 100644
--- a/selfservice/strategy/oidc/strategy_settings.go
+++ b/selfservice/strategy/oidc/strategy_settings.go
@@ -8,28 +8,28 @@ import (
 	"context"
 	_ "embed"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"time"
 
-	"github.com/ory/x/sqlxx"
-
-	"github.com/tidwall/sjson"
-
-	"github.com/ory/kratos/continuity"
-	"github.com/ory/kratos/selfservice/strategy"
-	"github.com/ory/x/decoderx"
-
-	"github.com/ory/kratos/session"
-
 	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
+	"github.com/tidwall/sjson"
+	"go.opentelemetry.io/otel/attribute"
 
 	"github.com/ory/herodot"
 	"github.com/ory/jsonschema/v3"
+	"github.com/ory/x/decoderx"
+	"github.com/ory/x/otelx"
+	"github.com/ory/x/sqlxx"
+	"github.com/ory/x/stringsx"
+
+	"github.com/ory/kratos/continuity"
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/settings"
-
+	"github.com/ory/kratos/selfservice/strategy"
+	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/x"
 )
 
@@ -51,14 +51,14 @@ var UnlinkAllFirstFactorConnectionsError = &jsonschema.ValidationError{
 	Message: "can not unlink OpenID Connect connection because it is the last remaining first factor credential", InstancePtr: "#/",
 }
 
-func (s *Strategy) RegisterSettingsRoutes(router *x.RouterPublic) {}
+func (s *Strategy) RegisterSettingsRoutes(*x.RouterPublic) {}
 
 func (s *Strategy) SettingsStrategyID() string {
 	return s.ID().String()
 }
 
-func (s *Strategy) decoderSettings(p *updateSettingsFlowWithOidcMethod, r *http.Request) error {
-	ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(r.Context())
+func (s *Strategy) decoderSettings(ctx context.Context, p *updateSettingsFlowWithOidcMethod, r *http.Request) error {
+	ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(ctx)
 	if err != nil {
 		return err
 	}
@@ -85,7 +85,7 @@ func (s *Strategy) decoderSettings(p *updateSettingsFlowWithOidcMethod, r *http.
 	return nil
 }
 
-func (s *Strategy) linkedProviders(ctx context.Context, r *http.Request, conf *ConfigurationCollection, confidential *identity.Identity) ([]Provider, error) {
+func (s *Strategy) linkedProviders(conf *ConfigurationCollection, confidential *identity.Identity) ([]Provider, error) {
 	creds, ok := confidential.GetCredentials(s.ID())
 	if !ok {
 		return nil, nil
@@ -110,7 +110,7 @@ func (s *Strategy) linkedProviders(ctx context.Context, r *http.Request, conf *C
 	return result, nil
 }
 
-func (s *Strategy) linkableProviders(ctx context.Context, r *http.Request, conf *ConfigurationCollection, confidential *identity.Identity) ([]Provider, error) {
+func (s *Strategy) linkableProviders(conf *ConfigurationCollection, confidential *identity.Identity) ([]Provider, error) {
 	var available identity.CredentialsOIDC
 	creds, ok := confidential.GetCredentials(s.ID())
 	if ok {
@@ -141,27 +141,25 @@ func (s *Strategy) linkableProviders(ctx context.Context, r *http.Request, conf
 	return result, nil
 }
 
-func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity, sr *settings.Flow) error {
+func (s *Strategy) PopulateSettingsMethod(ctx context.Context, r *http.Request, id *identity.Identity, sr *settings.Flow) (err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.oidc.Strategy.PopulateSettingsMethod")
+	defer otelx.End(span, &err)
+
 	if sr.Type != flow.TypeBrowser {
 		return nil
 	}
 
-	conf, err := s.Config(r.Context())
+	conf, err := s.Config(ctx)
 	if err != nil {
 		return err
 	}
 
-	confidential, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), id.ID)
+	linkable, err := s.linkableProviders(conf, id)
 	if err != nil {
 		return err
 	}
 
-	linkable, err := s.linkableProviders(r.Context(), r, conf, confidential)
-	if err != nil {
-		return err
-	}
-
-	linked, err := s.linkedProviders(r.Context(), r, conf, confidential)
+	linked, err := s.linkedProviders(conf, id)
 	if err != nil {
 		return err
 	}
@@ -173,10 +171,10 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 		if l.Config().OrganizationID != "" {
 			continue
 		}
-		sr.UI.GetNodes().Append(NewLinkNode(l.Config().ID))
+		sr.UI.GetNodes().Append(NewLinkNode(l.Config().ID, stringsx.Coalesce(l.Config().Label, l.Config().ID)))
 	}
 
-	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(r.Context(), confidential)
+	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(ctx, id)
 	if err != nil {
 		return err
 	}
@@ -185,7 +183,7 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 		// This means that we're able to remove a connection because it is the last configured credential. If it is
 		// removed, the identity is no longer able to sign in.
 		for _, l := range linked {
-			sr.UI.GetNodes().Append(NewUnlinkNode(l.Config().ID))
+			sr.UI.GetNodes().Append(NewUnlinkNode(l.Config().ID, stringsx.Coalesce(l.Config().Label, l.Config().ID)))
 		}
 	}
 
@@ -257,82 +255,83 @@ func (p *updateSettingsFlowWithOidcMethod) SetFlowID(rid uuid.UUID) {
 	p.FlowID = rid.String()
 }
 
-func (s *Strategy) Settings(w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (*settings.UpdateContext, error) {
+func (s *Strategy) Settings(ctx context.Context, w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (_ *settings.UpdateContext, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.oidc.Strategy.Settings")
+	defer otelx.End(span, &err)
+
 	var p updateSettingsFlowWithOidcMethod
-	if err := s.decoderSettings(&p, r); err != nil {
+	if err := s.decoderSettings(ctx, &p, r); err != nil {
 		return nil, err
 	}
 	f.TransientPayload = p.TransientPayload
 
 	ctxUpdate, err := settings.PrepareUpdate(s.d, w, r, f, ss, settings.ContinuityKey(s.SettingsStrategyID()), &p)
 	if errors.Is(err, settings.ErrContinuePreviousAction) {
-		if !s.d.Config().SelfServiceStrategy(r.Context(), s.SettingsStrategyID()).Enabled {
+		if !s.d.Config().SelfServiceStrategy(ctx, s.SettingsStrategyID()).Enabled {
 			return nil, errors.WithStack(herodot.ErrNotFound.WithReason(strategy.EndpointDisabledMessage))
 		}
 
-		if l := len(p.Link); l > 0 {
-			if err := s.initLinkProvider(w, r, ctxUpdate, &p); err != nil {
+		if len(p.Link) > 0 {
+			if err := s.initLinkProvider(ctx, w, r, ctxUpdate, &p); err != nil {
 				return nil, err
 			}
 
 			return ctxUpdate, nil
-		} else if u := len(p.Unlink); u > 0 {
-			if err := s.unlinkProvider(w, r, ctxUpdate, &p); err != nil {
+		} else if len(p.Unlink) > 0 {
+			if err := s.unlinkProvider(ctx, w, r, ctxUpdate, &p); err != nil {
 				return nil, err
 			}
 
 			return ctxUpdate, nil
 		}
 
-		return nil, s.handleSettingsError(w, r, ctxUpdate, &p, errors.WithStack(herodot.ErrInternalServerError.WithReason("Expected either link or unlink to be set when continuing flow but both are unset.")))
+		return nil, s.handleSettingsError(ctx, w, r, ctxUpdate, &p, errors.WithStack(herodot.ErrInternalServerError.WithReason("Expected either link or unlink to be set when continuing flow but both are unset.")))
 	} else if err != nil {
-		return nil, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return nil, s.handleSettingsError(ctx, w, r, ctxUpdate, &p, err)
 	}
 
-	if len(p.Link+p.Unlink) == 0 {
+	if len(p.Link)+len(p.Unlink) == 0 {
+		span.SetAttributes(attribute.String("not_responsible_reason", "neither link nor unlink set"))
 		return nil, errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 
-	if !s.d.Config().SelfServiceStrategy(r.Context(), s.SettingsStrategyID()).Enabled {
+	if !s.d.Config().SelfServiceStrategy(ctx, s.SettingsStrategyID()).Enabled {
 		return nil, errors.WithStack(herodot.ErrNotFound.WithReason(strategy.EndpointDisabledMessage))
 	}
 
-	if l, u := len(p.Link), len(p.Unlink); l > 0 && u > 0 {
-		return nil, s.handleSettingsError(w, r, ctxUpdate, &p, errors.WithStack(&jsonschema.ValidationError{
+	switch l, u := len(p.Link), len(p.Unlink); {
+	case l > 0 && u > 0:
+		return nil, s.handleSettingsError(ctx, w, r, ctxUpdate, &p, errors.WithStack(&jsonschema.ValidationError{
 			Message:     "it is not possible to link and unlink providers in the same request",
 			InstancePtr: "#/",
 		}))
-	} else if l > 0 {
-		if err := s.initLinkProvider(w, r, ctxUpdate, &p); err != nil {
+	case l > 0:
+		if err := s.initLinkProvider(ctx, w, r, ctxUpdate, &p); err != nil {
 			return nil, err
 		}
 		return ctxUpdate, nil
-	} else if u > 0 {
-		if err := s.unlinkProvider(w, r, ctxUpdate, &p); err != nil {
+	case u > 0:
+		if err := s.unlinkProvider(ctx, w, r, ctxUpdate, &p); err != nil {
 			return nil, err
 		}
-
 		return ctxUpdate, nil
 	}
-
-	return nil, s.handleSettingsError(w, r, ctxUpdate, &p, errors.WithStack(errors.WithStack(&jsonschema.ValidationError{
-		Message: "missing properties: link, unlink", InstancePtr: "#/",
-		Context: &jsonschema.ValidationErrorContextRequired{Missing: []string{"link", "unlink"}},
-	})))
+	// this case should never be reached as we previously checked whether link and unlink are both empty
+	return nil, errors.WithStack(flow.ErrStrategyNotResponsible)
 }
 
-func (s *Strategy) isLinkable(r *http.Request, ctxUpdate *settings.UpdateContext, toLink string) (*identity.Identity, error) {
-	providers, err := s.Config(r.Context())
+func (s *Strategy) isLinkable(ctx context.Context, ctxUpdate *settings.UpdateContext, toLink string) (*identity.Identity, error) {
+	providers, err := s.Config(ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.Identity.ID)
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.Identity.ID)
 	if err != nil {
 		return nil, err
 	}
 
-	linkable, err := s.linkableProviders(r.Context(), r, providers, i)
+	linkable, err := s.linkableProviders(providers, i)
 	if err != nil {
 		return nil, err
 	}
@@ -351,34 +350,37 @@ func (s *Strategy) isLinkable(r *http.Request, ctxUpdate *settings.UpdateContext
 	return i, nil
 }
 
-func (s *Strategy) initLinkProvider(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithOidcMethod) error {
-	if _, err := s.isLinkable(r, ctxUpdate, p.Link); err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+func (s *Strategy) initLinkProvider(ctx context.Context, w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithOidcMethod) error {
+	if _, err := s.isLinkable(ctx, ctxUpdate, p.Link); err != nil {
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
-	if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(r.Context())).Before(time.Now()) {
-		return s.handleSettingsError(w, r, ctxUpdate, p, errors.WithStack(settings.NewFlowNeedsReAuth()))
+	if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(ctx)).Before(time.Now()) {
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, errors.WithStack(settings.NewFlowNeedsReAuth()))
 	}
 
-	provider, err := s.provider(r.Context(), r, p.Link)
+	provider, err := s.provider(ctx, p.Link)
 	if err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
-	req, err := s.validateFlow(r.Context(), r, ctxUpdate.Flow.ID)
+	req, err := s.validateFlow(ctx, r, ctxUpdate.Flow.ID)
 	if err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
-	state := generateState(ctxUpdate.Flow.ID.String())
-	if err := s.d.ContinuityManager().Pause(r.Context(), w, r, sessionName,
+	state, pkce, err := s.GenerateState(ctx, provider, ctxUpdate.Flow.ID)
+	if err != nil {
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
+	}
+	if err := s.d.ContinuityManager().Pause(ctx, w, r, sessionName,
 		continuity.WithPayload(&AuthCodeContainer{
-			State:  state.String(),
+			State:  state,
 			FlowID: ctxUpdate.Flow.ID.String(),
 			Traits: p.Traits,
 		}),
 		continuity.WithLifespan(time.Minute*30)); err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	var up map[string]string
@@ -386,9 +388,9 @@ func (s *Strategy) initLinkProvider(w http.ResponseWriter, r *http.Request, ctxU
 		return err
 	}
 
-	codeURL, err := getAuthRedirectURL(r.Context(), provider, req, state, up)
+	codeURL, err := getAuthRedirectURL(ctx, provider, req, state, up, pkce)
 	if err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	if x.IsJSONRequest(r) {
@@ -400,65 +402,67 @@ func (s *Strategy) initLinkProvider(w http.ResponseWriter, r *http.Request, ctxU
 	return errors.WithStack(flow.ErrCompletedByStrategy)
 }
 
-func (s *Strategy) linkProvider(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, token *identity.CredentialsOIDCEncryptedTokens, claims *Claims, provider Provider) error {
+func (s *Strategy) linkProvider(ctx context.Context, w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, token *identity.CredentialsOIDCEncryptedTokens, claims *Claims, provider Provider) error {
 	p := &updateSettingsFlowWithOidcMethod{
 		Link: provider.Config().ID, FlowID: ctxUpdate.Flow.ID.String(),
 	}
-	if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(r.Context())).Before(time.Now()) {
-		return s.handleSettingsError(w, r, ctxUpdate, p, errors.WithStack(settings.NewFlowNeedsReAuth()))
+
+	if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(ctx)).Before(time.Now()) {
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, errors.WithStack(settings.NewFlowNeedsReAuth()))
 	}
 
-	i, err := s.isLinkable(r, ctxUpdate, p.Link)
+	i, err := s.isLinkable(ctx, ctxUpdate, p.Link)
 	if err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
-	if err := s.linkCredentials(r.Context(), i, token, provider.Config().ID, claims.Subject, provider.Config().OrganizationID); err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+	if err := s.linkCredentials(ctx, i, token, provider.Config().ID, claims.Subject, provider.Config().OrganizationID); err != nil {
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
-	if err := s.d.SettingsHookExecutor().PostSettingsHook(w, r, s.SettingsStrategyID(), ctxUpdate, i, settings.WithCallback(func(ctxUpdate *settings.UpdateContext) error {
-		return s.PopulateSettingsMethod(r, ctxUpdate.Session.Identity, ctxUpdate.Flow)
+	if err := s.d.SettingsHookExecutor().PostSettingsHook(ctx, w, r, s.SettingsStrategyID(), ctxUpdate, i, settings.WithCallback(func(ctxUpdate *settings.UpdateContext) error {
+		// Credential population is done by PostSettingsHook on ctxUpdate.Session.Identity
+		return s.PopulateSettingsMethod(ctx, r, ctxUpdate.Session.Identity, ctxUpdate.Flow)
 	})); err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	return nil
 }
 
-func (s *Strategy) unlinkProvider(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithOidcMethod) error {
-	if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(r.Context())).Before(time.Now()) {
-		return s.handleSettingsError(w, r, ctxUpdate, p, errors.WithStack(settings.NewFlowNeedsReAuth()))
+func (s *Strategy) unlinkProvider(ctx context.Context, w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithOidcMethod) error {
+	if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(ctx)).Before(time.Now()) {
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, errors.WithStack(settings.NewFlowNeedsReAuth()))
 	}
 
-	providers, err := s.Config(r.Context())
+	providers, err := s.Config(ctx)
 	if err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.Identity.ID)
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.Identity.ID)
 	if err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
-	availableProviders, err := s.linkedProviders(r.Context(), r, providers, i)
+	availableProviders, err := s.linkedProviders(providers, i)
 	if err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	var cc identity.CredentialsOIDC
 	creds, err := i.ParseCredentials(s.ID(), &cc)
 	if err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
-	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(r.Context(), i)
+	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(ctx, i)
 	if err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	if count < 2 {
-		return s.handleSettingsError(w, r, ctxUpdate, p, errors.WithStack(UnlinkAllFirstFactorConnectionsError))
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, errors.WithStack(UnlinkAllFirstFactorConnectionsError))
 	}
 
 	var found bool
@@ -478,28 +482,29 @@ func (s *Strategy) unlinkProvider(w http.ResponseWriter, r *http.Request, ctxUpd
 	}
 
 	if !found {
-		return s.handleSettingsError(w, r, ctxUpdate, p, errors.WithStack(UnknownConnectionValidationError))
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, errors.WithStack(UnknownConnectionValidationError))
 	}
 
 	creds.Identifiers = updatedIdentifiers
 	creds.Config, err = json.Marshal(&identity.CredentialsOIDC{Providers: updatedProviders})
 	if err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, errors.WithStack(err))
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, errors.WithStack(err))
 	}
 
 	i.Credentials[s.ID()] = *creds
-	if err := s.d.SettingsHookExecutor().PostSettingsHook(w, r, s.SettingsStrategyID(), ctxUpdate, i, settings.WithCallback(func(ctxUpdate *settings.UpdateContext) error {
-		return s.PopulateSettingsMethod(r, ctxUpdate.Session.Identity, ctxUpdate.Flow)
+	if err := s.d.SettingsHookExecutor().PostSettingsHook(ctx, w, r, s.SettingsStrategyID(), ctxUpdate, i, settings.WithCallback(func(ctxUpdate *settings.UpdateContext) error {
+		// Credential population is done by PostSettingsHook on ctxUpdate.Session.Identity
+		return s.PopulateSettingsMethod(ctx, r, ctxUpdate.Session.Identity, ctxUpdate.Flow)
 	})); err != nil {
-		return s.handleSettingsError(w, r, ctxUpdate, p, err)
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	return errors.WithStack(flow.ErrCompletedByStrategy)
 }
 
-func (s *Strategy) handleSettingsError(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithOidcMethod, err error) error {
+func (s *Strategy) handleSettingsError(ctx context.Context, w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithOidcMethod, err error) error {
 	if e := new(settings.FlowNeedsReAuth); errors.As(err, &e) {
-		if err := s.d.ContinuityManager().Pause(r.Context(), w, r,
+		if err := s.d.ContinuityManager().Pause(ctx, w, r,
 			settings.ContinuityKey(s.SettingsStrategyID()), settings.ContinuityOptions(p, ctxUpdate.Session.Identity)...); err != nil {
 			return err
 		}
@@ -519,7 +524,7 @@ func (s *Strategy) Link(ctx context.Context, i *identity.Identity, credentialsCo
 		return err
 	}
 	if len(credentialsOIDCConfig.Providers) != 1 {
-		return errors.New("No oidc provider was set")
+		return errors.New("no oidc provider was set")
 	}
 	credentialsOIDCProvider := credentialsOIDCConfig.Providers[0]
 
@@ -542,3 +547,47 @@ func (s *Strategy) Link(ctx context.Context, i *identity.Identity, credentialsCo
 
 	return nil
 }
+
+func (s *Strategy) CompletedLogin(sess *session.Session, data *flow.DuplicateCredentialsData) error {
+	var credentialsOIDCConfig identity.CredentialsOIDC
+	if err := json.Unmarshal(data.CredentialsConfig, &credentialsOIDCConfig); err != nil {
+		return err
+	}
+	if len(credentialsOIDCConfig.Providers) != 1 {
+		return errors.New("no oidc provider was set")
+	}
+	credentialsOIDCProvider := credentialsOIDCConfig.Providers[0]
+
+	sess.CompletedLoginForWithProvider(
+		s.ID(),
+		identity.AuthenticatorAssuranceLevel1,
+		credentialsOIDCProvider.Provider,
+		credentialsOIDCProvider.Organization,
+	)
+
+	return nil
+}
+
+func (s *Strategy) SetDuplicateCredentials(f flow.InternalContexter, duplicateIdentifier string, credentials identity.Credentials, provider string) error {
+	var credentialsOIDCConfig identity.CredentialsOIDC
+	if err := json.Unmarshal(credentials.Config, &credentialsOIDCConfig); err != nil {
+		return err
+	}
+
+	// We want to only set the provider in the credentials config that was used to authenticate the user.
+	for _, p := range credentialsOIDCConfig.Providers {
+		if p.Provider == provider {
+			credentialsOIDCConfig.Providers = []identity.CredentialsOIDCProvider{p}
+			config, err := json.Marshal(credentialsOIDCConfig)
+			if err != nil {
+				return err
+			}
+			return flow.SetDuplicateCredentials(f, flow.DuplicateCredentialsData{
+				CredentialsType:     s.ID(),
+				CredentialsConfig:   config,
+				DuplicateIdentifier: duplicateIdentifier,
+			})
+		}
+	}
+	return fmt.Errorf("provider %q not found in credentials", provider)
+}
diff --git a/selfservice/strategy/oidc/strategy_settings_test.go b/selfservice/strategy/oidc/strategy_settings_test.go
index 753bae5321b8..887c2414b9eb 100644
--- a/selfservice/strategy/oidc/strategy_settings_test.go
+++ b/selfservice/strategy/oidc/strategy_settings_test.go
@@ -7,6 +7,7 @@ import (
 	"context"
 	_ "embed"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -15,6 +16,7 @@ import (
 
 	"github.com/ory/x/snapshotx"
 
+	"github.com/ory/kratos/driver"
 	kratos "github.com/ory/kratos/internal/httpclient"
 	"github.com/ory/kratos/ui/container"
 	"github.com/ory/kratos/ui/node"
@@ -28,7 +30,6 @@ import (
 
 	"github.com/ory/x/sqlxx"
 
-	"github.com/ory/kratos/driver"
 	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/internal"
@@ -36,6 +37,7 @@ import (
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/settings"
 
+	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
 	"github.com/ory/kratos/selfservice/strategy/oidc"
 	"github.com/ory/kratos/x"
 )
@@ -67,7 +69,9 @@ func TestSettingsStrategy(t *testing.T) {
 	viperSetProviderConfig(
 		t,
 		conf,
-		newOIDCProvider(t, publicTS, remotePublic, remoteAdmin, "ory"),
+		newOIDCProvider(t, publicTS, remotePublic, remoteAdmin, "ory", func(c *oidc.Configuration) {
+			c.Label = "Ory"
+		}),
 		newOIDCProvider(t, publicTS, remotePublic, remoteAdmin, "google"),
 		newOIDCProvider(t, publicTS, remotePublic, remoteAdmin, "github"),
 		orgSSO,
@@ -183,7 +187,7 @@ func TestSettingsStrategy(t *testing.T) {
 	t.Run("case=should not be able to fetch another user's data", func(t *testing.T) {
 		req := newProfileFlow(t, agents["password"], "", time.Hour)
 
-		_, _, err := testhelpers.NewSDKCustomClient(publicTS, agents["oryer"]).FrontendApi.GetSettingsFlow(context.Background()).Id(req.ID.String()).Execute()
+		_, _, err := testhelpers.NewSDKCustomClient(publicTS, agents["oryer"]).FrontendAPI.GetSettingsFlow(context.Background()).Id(req.ID.String()).Execute()
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "403")
 	})
@@ -191,7 +195,7 @@ func TestSettingsStrategy(t *testing.T) {
 	t.Run("case=should fetch the settings request and expect data to be set appropriately", func(t *testing.T) {
 		req := newProfileFlow(t, agents["password"], "", time.Hour)
 
-		rs, _, err := testhelpers.NewSDKCustomClient(publicTS, agents["password"]).FrontendApi.GetSettingsFlow(context.Background()).Id(req.ID.String()).Execute()
+		rs, _, err := testhelpers.NewSDKCustomClient(publicTS, agents["password"]).FrontendAPI.GetSettingsFlow(context.Background()).Id(req.ID.String()).Execute()
 		require.NoError(t, err)
 
 		// Check our sanity. Does the SDK relay the same info that we expect and got from the store?
@@ -330,7 +334,7 @@ func TestSettingsStrategy(t *testing.T) {
 				_, res, req := unlink(t, agent, provider)
 				assert.Contains(t, res.Request.URL.String(), uiTS.URL+"/login")
 
-				fa := testhelpers.NewSDKCustomClient(publicTS, agents[agent]).FrontendApi
+				fa := testhelpers.NewSDKCustomClient(publicTS, agents[agent]).FrontendAPI
 				lf, _, err := fa.GetLoginFlow(context.Background()).Id(res.Request.URL.Query()["flow"][0]).Execute()
 				require.NoError(t, err)
 
@@ -456,7 +460,7 @@ func TestSettingsStrategy(t *testing.T) {
 			updatedFlow, res, originalFlow := link(t, agent, provider)
 			assert.Contains(t, res.Request.URL.String(), uiTS.URL)
 
-			updatedFlowSDK, _, err := testhelpers.NewSDKCustomClient(publicTS, agents[agent]).FrontendApi.GetSettingsFlow(context.Background()).Id(originalFlow.Id).Execute()
+			updatedFlowSDK, _, err := testhelpers.NewSDKCustomClient(publicTS, agents[agent]).FrontendAPI.GetSettingsFlow(context.Background()).Id(originalFlow.Id).Execute()
 			require.NoError(t, err)
 			require.EqualValues(t, flow.StateSuccess, updatedFlowSDK.State)
 
@@ -483,7 +487,7 @@ func TestSettingsStrategy(t *testing.T) {
 			_, res, req := link(t, agent, provider)
 			assert.Contains(t, res.Request.URL.String(), uiTS.URL)
 
-			rs, _, err := testhelpers.NewSDKCustomClient(publicTS, agents[agent]).FrontendApi.GetSettingsFlow(context.Background()).Id(req.Id).Execute()
+			rs, _, err := testhelpers.NewSDKCustomClient(publicTS, agents[agent]).FrontendAPI.GetSettingsFlow(context.Background()).Id(req.Id).Execute()
 			require.NoError(t, err)
 			require.EqualValues(t, flow.StateSuccess, rs.State)
 
@@ -567,7 +571,7 @@ func TestSettingsStrategy(t *testing.T) {
 				_, res, req := link(t, agent, provider)
 				assert.Contains(t, res.Request.URL.String(), uiTS.URL+"/login")
 
-				fa := testhelpers.NewSDKCustomClient(publicTS, agents[agent]).FrontendApi
+				fa := testhelpers.NewSDKCustomClient(publicTS, agents[agent]).FrontendAPI
 				lf, _, err := fa.GetLoginFlow(context.Background()).Id(res.Request.URL.Query()["flow"][0]).Execute()
 				require.NoError(t, err)
 
@@ -609,21 +613,27 @@ func TestSettingsStrategy(t *testing.T) {
 }
 
 func TestPopulateSettingsMethod(t *testing.T) {
-	ctx := context.Background()
-	nreg := func(t *testing.T, conf *oidc.ConfigurationCollection) *driver.RegistryDefault {
-		c, reg := internal.NewFastRegistryWithMocks(t)
-
-		testhelpers.SetDefaultIdentitySchema(c, "file://stub/registration.schema.json")
-		c.MustSet(ctx, config.ViperKeyPublicBaseURL, "https://www.ory.sh/")
+	t.Parallel()
+	nCtx := func(t *testing.T, conf *oidc.ConfigurationCollection) (*driver.RegistryDefault, context.Context) {
+		_, reg := internal.NewFastRegistryWithMocks(t)
+		ctx := context.Background()
+		ctx = testhelpers.WithDefaultIdentitySchema(ctx, "file://stub/registration.schema.json")
+		ctx = confighelpers.WithConfigValue(ctx, config.ViperKeyPublicBaseURL, "https://www.ory.sh/")
+		baseKey := fmt.Sprintf("%s.%s", config.ViperKeySelfServiceStrategyConfig, identity.CredentialsTypeOIDC)
+
+		ctx = confighelpers.WithConfigValues(ctx, map[string]interface{}{
+			baseKey + ".enabled": true,
+			baseKey + ".config":  conf,
+		})
 
 		// Enabled per default:
 		// 		conf.Set(ctx, configuration.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypePassword), map[string]interface{}{"enabled": true})
-		viperSetProviderConfig(t, c, conf.Providers...)
-		return reg
+		// viperSetProviderConfig(t, c, conf.Providers...)
+		return reg, ctx
 	}
 
-	ns := func(t *testing.T, reg *driver.RegistryDefault) *oidc.Strategy {
-		ss, err := reg.SettingsStrategies(context.Background()).Strategy(identity.CredentialsTypeOIDC.String())
+	ns := func(t *testing.T, reg *driver.RegistryDefault, ctx context.Context) *oidc.Strategy {
+		ss, err := reg.SettingsStrategies(ctx).Strategy(identity.CredentialsTypeOIDC.String())
 		require.NoError(t, err)
 		return ss.(*oidc.Strategy)
 	}
@@ -632,13 +642,14 @@ func TestPopulateSettingsMethod(t *testing.T) {
 		return &settings.Flow{Type: flow.TypeBrowser, ID: x.NewUUID(), UI: container.New("")}
 	}
 
-	populate := func(t *testing.T, reg *driver.RegistryDefault, i *identity.Identity, req *settings.Flow) *container.Container {
-		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), i))
-		require.NoError(t, ns(t, reg).PopulateSettingsMethod(new(http.Request), i, req))
-		require.NotNil(t, req.UI)
-		require.NotNil(t, req.UI.Nodes)
-		assert.Equal(t, "POST", req.UI.Method)
-		return req.UI
+	populate := func(t *testing.T, reg *driver.RegistryDefault, ctx context.Context, i *identity.Identity, f *settings.Flow) *container.Container {
+		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(ctx, i))
+		req := new(http.Request)
+		require.NoError(t, ns(t, reg, ctx).PopulateSettingsMethod(ctx, req, i, f))
+		require.NotNil(t, f.UI)
+		require.NotNil(t, f.UI.Nodes)
+		assert.Equal(t, "POST", f.UI.Method)
+		return f.UI
 	}
 
 	defaultConfig := []oidc.Configuration{
@@ -648,12 +659,14 @@ func TestPopulateSettingsMethod(t *testing.T) {
 	}
 
 	t.Run("case=should not populate non-browser flow", func(t *testing.T) {
-		reg := nreg(t, &oidc.ConfigurationCollection{Providers: []oidc.Configuration{{Provider: "generic", ID: "github"}}})
+		t.Parallel()
+		reg, ctx := nCtx(t, &oidc.ConfigurationCollection{Providers: []oidc.Configuration{{Provider: "generic", ID: "github"}}})
 		i := &identity.Identity{Traits: []byte(`{"subject":"foo@bar.com"}`)}
-		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), i))
-		req := &settings.Flow{Type: flow.TypeAPI, ID: x.NewUUID(), UI: container.New("")}
-		require.NoError(t, ns(t, reg).PopulateSettingsMethod(new(http.Request), i, req))
-		require.Empty(t, req.UI.Nodes)
+		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(ctx, i))
+		f := &settings.Flow{Type: flow.TypeAPI, ID: x.NewUUID(), UI: container.New("")}
+		req := new(http.Request)
+		require.NoError(t, ns(t, reg, ctx).PopulateSettingsMethod(ctx, req, i, f))
+		require.Empty(t, f.UI.Nodes)
 	})
 
 	for k, tc := range []struct {
@@ -674,25 +687,25 @@ func TestPopulateSettingsMethod(t *testing.T) {
 			},
 			e: node.Nodes{
 				node.NewCSRFNode(x.FakeCSRFToken),
-				oidc.NewLinkNode("github"),
+				oidc.NewLinkNode("github", "github"),
 			},
 		},
 		{
 			c: defaultConfig,
 			e: node.Nodes{
 				node.NewCSRFNode(x.FakeCSRFToken),
-				oidc.NewLinkNode("facebook"),
-				oidc.NewLinkNode("google"),
-				oidc.NewLinkNode("github"),
+				oidc.NewLinkNode("facebook", "facebook"),
+				oidc.NewLinkNode("google", "google"),
+				oidc.NewLinkNode("github", "github"),
 			},
 		},
 		{
 			c: defaultConfig,
 			e: node.Nodes{
 				node.NewCSRFNode(x.FakeCSRFToken),
-				oidc.NewLinkNode("facebook"),
-				oidc.NewLinkNode("google"),
-				oidc.NewLinkNode("github"),
+				oidc.NewLinkNode("facebook", "facebook"),
+				oidc.NewLinkNode("google", "google"),
+				oidc.NewLinkNode("github", "github"),
 			},
 			i: &identity.Credentials{Type: identity.CredentialsTypeOIDC, Identifiers: []string{}, Config: []byte(`{}`)},
 		},
@@ -700,8 +713,8 @@ func TestPopulateSettingsMethod(t *testing.T) {
 			c: defaultConfig,
 			e: node.Nodes{
 				node.NewCSRFNode(x.FakeCSRFToken),
-				oidc.NewLinkNode("facebook"),
-				oidc.NewLinkNode("github"),
+				oidc.NewLinkNode("facebook", "facebook"),
+				oidc.NewLinkNode("github", "github"),
 			},
 			i: &identity.Credentials{Type: identity.CredentialsTypeOIDC, Identifiers: []string{
 				"google:1234",
@@ -711,9 +724,9 @@ func TestPopulateSettingsMethod(t *testing.T) {
 			c: defaultConfig,
 			e: node.Nodes{
 				node.NewCSRFNode(x.FakeCSRFToken),
-				oidc.NewLinkNode("facebook"),
-				oidc.NewLinkNode("github"),
-				oidc.NewUnlinkNode("google"),
+				oidc.NewLinkNode("facebook", "facebook"),
+				oidc.NewLinkNode("github", "github"),
+				oidc.NewUnlinkNode("google", "google"),
 			},
 			withpw: true,
 			i: &identity.Credentials{
@@ -727,9 +740,9 @@ func TestPopulateSettingsMethod(t *testing.T) {
 			c: defaultConfig,
 			e: node.Nodes{
 				node.NewCSRFNode(x.FakeCSRFToken),
-				oidc.NewLinkNode("github"),
-				oidc.NewUnlinkNode("google"),
-				oidc.NewUnlinkNode("facebook"),
+				oidc.NewLinkNode("github", "github"),
+				oidc.NewUnlinkNode("google", "google"),
+				oidc.NewUnlinkNode("facebook", "facebook"),
 			},
 			i: &identity.Credentials{
 				Type: identity.CredentialsTypeOIDC, Identifiers: []string{
@@ -739,9 +752,37 @@ func TestPopulateSettingsMethod(t *testing.T) {
 				Config: []byte(`{"providers":[{"provider":"google","subject":"1234"},{"provider":"facebook","subject":"1234"}]}`),
 			},
 		},
+		{
+			c: []oidc.Configuration{
+				{Provider: "generic", ID: "labeled", Label: "Labeled"},
+			},
+			e: node.Nodes{
+				node.NewCSRFNode(x.FakeCSRFToken),
+				oidc.NewLinkNode("labeled", "Labeled"),
+			},
+		},
+		{
+			c: []oidc.Configuration{
+				{Provider: "generic", ID: "labeled", Label: "Labeled"},
+				{Provider: "generic", ID: "facebook"},
+			},
+			e: node.Nodes{
+				node.NewCSRFNode(x.FakeCSRFToken),
+				oidc.NewUnlinkNode("labeled", "Labeled"),
+				oidc.NewUnlinkNode("facebook", "facebook"),
+			},
+			i: &identity.Credentials{
+				Type: identity.CredentialsTypeOIDC, Identifiers: []string{
+					"labeled:1234",
+					"facebook:1234",
+				},
+				Config: []byte(`{"providers":[{"provider":"labeled","subject":"1234"},{"provider":"facebook","subject":"1234"}]}`),
+			},
+		},
 	} {
 		t.Run("iteration="+strconv.Itoa(k), func(t *testing.T) {
-			reg := nreg(t, &oidc.ConfigurationCollection{Providers: tc.c})
+			t.Parallel()
+			reg, ctx := nCtx(t, &oidc.ConfigurationCollection{Providers: tc.c})
 			i := &identity.Identity{
 				Traits:      []byte(`{"subject":"foo@bar.com"}`),
 				Credentials: make(map[identity.CredentialsType]identity.Credentials, 2),
@@ -756,7 +797,7 @@ func TestPopulateSettingsMethod(t *testing.T) {
 					Config:      []byte(`{"hashed_password":"$argon2id$..."}`),
 				}
 			}
-			actual := populate(t, reg, i, nr())
+			actual := populate(t, reg, ctx, i, nr())
 			assert.EqualValues(t, tc.e, actual.Nodes)
 		})
 	}
diff --git a/selfservice/strategy/oidc/strategy_state_test.go b/selfservice/strategy/oidc/strategy_state_test.go
deleted file mode 100644
index 28302400861d..000000000000
--- a/selfservice/strategy/oidc/strategy_state_test.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright © 2023 Ory Corp
-// SPDX-License-Identifier: Apache-2.0
-
-package oidc
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/ory/kratos/x"
-)
-
-func TestGenerateState(t *testing.T) {
-	flowID := x.NewUUID().String()
-	state := generateState(flowID).String()
-	assert.NotEmpty(t, state)
-
-	s, err := parseState(state)
-	require.NoError(t, err)
-	assert.Equal(t, flowID, s.FlowID)
-	assert.NotEmpty(t, s.Data)
-}
diff --git a/selfservice/strategy/oidc/strategy_test.go b/selfservice/strategy/oidc/strategy_test.go
index 65c8f09b2e06..dde3e1bda607 100644
--- a/selfservice/strategy/oidc/strategy_test.go
+++ b/selfservice/strategy/oidc/strategy_test.go
@@ -13,16 +13,20 @@ import (
 	"net/http/cookiejar"
 	"net/http/httptest"
 	"net/url"
+	"slices"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/davecgh/go-spew/spew"
+	"github.com/pkg/errors"
 	"github.com/samber/lo"
+	"golang.org/x/oauth2"
 
 	"github.com/ory/kratos/selfservice/hook/hooktest"
 	"github.com/ory/x/sqlxx"
+	"github.com/ory/x/uuidx"
 
 	"github.com/ory/kratos/hydra"
 	"github.com/ory/kratos/selfservice/sessiontokenexchange"
@@ -78,14 +82,26 @@ func TestStrategy(t *testing.T) {
 	routerA := x.NewRouterAdmin()
 	ts, _ := testhelpers.NewKratosServerWithRouters(t, reg, routerP, routerA)
 	invalid := newOIDCProvider(t, ts, remotePublic, remoteAdmin, "invalid-issuer")
+
+	orgID := uuidx.NewV4()
 	viperSetProviderConfig(
 		t,
 		conf,
 		newOIDCProvider(t, ts, remotePublic, remoteAdmin, "valid"),
+		newOIDCProvider(t, ts, remotePublic, remoteAdmin, "valid2"),
 		newOIDCProvider(t, ts, remotePublic, remoteAdmin, "secondProvider"),
 		newOIDCProvider(t, ts, remotePublic, remoteAdmin, "claimsViaUserInfo", func(c *oidc.Configuration) {
 			c.ClaimsSource = oidc.ClaimsSourceUserInfo
 		}),
+		newOIDCProvider(t, ts, remotePublic, remoteAdmin, "neverPKCE", func(c *oidc.Configuration) {
+			c.PKCE = "never"
+		}),
+		newOIDCProvider(t, ts, remotePublic, remoteAdmin, "autoPKCE", func(c *oidc.Configuration) {
+			c.PKCE = "auto"
+		}),
+		newOIDCProvider(t, ts, remotePublic, remoteAdmin, "forcePKCE", func(c *oidc.Configuration) {
+			c.PKCE = "force"
+		}),
 		oidc.Configuration{
 			Provider:     "generic",
 			ID:           "invalid-issuer",
@@ -130,14 +146,13 @@ func TestStrategy(t *testing.T) {
 
 		assert.Equal(t, "POST", config.Method)
 
-		var found bool
-		for _, field := range config.Nodes {
-			if strings.Contains(field.ID(), "provider") && field.GetValue() == provider {
-				found = true
-				break
+		var providers []interface{}
+		for _, nodes := range config.Nodes {
+			if strings.Contains(nodes.ID(), "provider") {
+				providers = append(providers, nodes.GetValue())
 			}
 		}
-		require.True(t, found, "%+v", assertx.PrettifyJSONPayload(t, config))
+		require.Contains(t, providers, provider, "%+v", assertx.PrettifyJSONPayload(t, config))
 
 		return config.Action
 	}
@@ -150,9 +165,9 @@ func TestStrategy(t *testing.T) {
 		return ts.URL + login.RouteSubmitFlow + "?flow=" + flowID.String()
 	}
 
-	makeRequestWithCookieJar := func(t *testing.T, provider string, action string, fv url.Values, jar *cookiejar.Jar) (*http.Response, []byte) {
+	makeRequestWithCookieJar := func(t *testing.T, provider string, action string, fv url.Values, jar *cookiejar.Jar, checkRedirect testhelpers.CheckRedirectFunc) (*http.Response, []byte) {
 		fv.Set("provider", provider)
-		res, err := testhelpers.NewClientWithCookieJar(t, jar, false).PostForm(action, fv)
+		res, err := testhelpers.NewClientWithCookieJar(t, jar, checkRedirect).PostForm(action, fv)
 		require.NoError(t, err, action)
 
 		body, err := io.ReadAll(res.Body)
@@ -165,12 +180,12 @@ func TestStrategy(t *testing.T) {
 	}
 
 	makeRequest := func(t *testing.T, provider string, action string, fv url.Values) (*http.Response, []byte) {
-		return makeRequestWithCookieJar(t, provider, action, fv, nil)
+		return makeRequestWithCookieJar(t, provider, action, fv, nil, nil)
 	}
 
 	makeJSONRequest := func(t *testing.T, provider string, action string, fv url.Values) (*http.Response, []byte) {
 		fv.Set("provider", provider)
-		client := testhelpers.NewClientWithCookieJar(t, nil, false)
+		client := testhelpers.NewClientWithCookieJar(t, nil, nil)
 		req, err := http.NewRequest("POST", action, strings.NewReader(fv.Encode()))
 		require.NoError(t, err)
 		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
@@ -197,7 +212,7 @@ func TestStrategy(t *testing.T) {
 		var changeLocation flow.BrowserLocationChangeRequiredError
 		require.NoError(t, json.NewDecoder(res.Body).Decode(&changeLocation))
 
-		res, err = testhelpers.NewClientWithCookieJar(t, nil, true).Get(changeLocation.RedirectBrowserTo)
+		res, err = testhelpers.NewClientWithCookieJar(t, nil, nil).Get(changeLocation.RedirectBrowserTo)
 		require.NoError(t, err)
 
 		returnToURL = res.Request.URL
@@ -239,7 +254,7 @@ func TestStrategy(t *testing.T) {
 
 	// assert ui error (redirect to login/registration ui endpoint)
 	assertUIError := func(t *testing.T, res *http.Response, body []byte, reason string) {
-		require.Contains(t, res.Request.URL.String(), uiTS.URL, "status: %d, body: %s", res.StatusCode, body)
+		require.Contains(t, res.Request.URL.String(), uiTS.URL, "Redirect does not point to UI server. Status: %d, body: %s", res.StatusCode, body)
 		assert.Contains(t, gjson.GetBytes(body, "ui.messages.0.text").String(), reason, "%s", prettyJSON(t, body))
 	}
 
@@ -424,21 +439,34 @@ func TestStrategy(t *testing.T) {
 		}
 
 		t.Run("case=should pass registration", func(t *testing.T) {
+			postRegistrationWebhook := hooktest.NewServer()
+			t.Cleanup(postRegistrationWebhook.Close)
+			postRegistrationWebhook.SetConfig(t, conf.GetProvider(ctx), config.HookStrategyKey(config.ViperKeySelfServiceRegistrationAfter, identity.CredentialsTypeOIDC.String()))
+			transientPayload := `{"data": "registration-one"}`
+
 			r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
 			action := assertFormValues(t, r.ID, "valid")
-			res, body := makeRequest(t, "valid", action, url.Values{})
+			res, body := makeRequest(t, "valid", action, url.Values{"transient_payload": {transientPayload}})
 			assertIdentity(t, res, body)
 			expectTokens(t, "valid", body)
+			postRegistrationWebhook.AssertTransientPayload(t, transientPayload)
 		})
 
 		t.Run("case=try another registration", func(t *testing.T) {
+			transientPayload := `{"data": "registration-two"}`
+			postLoginWebhook := hooktest.NewServer()
+			t.Cleanup(postLoginWebhook.Close)
+			postLoginWebhook.SetConfig(t, conf.GetProvider(ctx), config.HookStrategyKey(config.ViperKeySelfServiceLoginAfter, identity.CredentialsTypeOIDC.String()))
+
 			returnTo := fmt.Sprintf("%s/home?query=true", returnTS.URL)
 			r := newBrowserRegistrationFlow(t, fmt.Sprintf("%s?return_to=%s", returnTS.URL, url.QueryEscape(returnTo)), time.Minute)
 			action := assertFormValues(t, r.ID, "valid")
-			res, body := makeRequest(t, "valid", action, url.Values{})
+			res, body := makeRequest(t, "valid", action, url.Values{"transient_payload": {transientPayload}})
 			assert.Equal(t, returnTo, res.Request.URL.String())
 			assertIdentity(t, res, body)
 			expectTokens(t, "valid", body)
+
+			postLoginWebhook.AssertTransientPayload(t, transientPayload)
 		})
 	})
 
@@ -457,6 +485,168 @@ func TestStrategy(t *testing.T) {
 		return id
 	}
 
+	t.Run("case=force PKCE", func(t *testing.T) {
+		r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+		action := assertFormValues(t, r.ID, "forcePKCE")
+		subject = "force-pkce@ory.sh"
+		scope = []string{"openid", "offline"}
+		var redirects []*http.Request
+		res, body := makeRequestWithCookieJar(t, "forcePKCE", action, url.Values{}, nil, func(_ *http.Request, via []*http.Request) error {
+			redirects = via
+			return nil
+		})
+		require.GreaterOrEqual(t, len(redirects), 3)
+		assert.Contains(t, redirects[1].URL.String(), "/oauth2/auth")
+		assert.Contains(t, redirects[1].URL.String(), "code_challenge_method=S256")
+		assert.Contains(t, redirects[1].URL.String(), "code_challenge=")
+		assert.Equal(t, redirects[len(redirects)-1].URL.Path, "/self-service/methods/oidc/callback")
+
+		assertIdentity(t, res, body)
+		expectTokens(t, "forcePKCE", body)
+		assert.Equal(t, "forcePKCE", gjson.GetBytes(body, "authentication_methods.0.provider").String(), "%s", body)
+	})
+	t.Run("case=force PKCE, invalid verifier", func(t *testing.T) {
+		r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+		action := assertFormValues(t, r.ID, "forcePKCE")
+		subject = "force-pkce@ory.sh"
+		scope = []string{"openid", "offline"}
+		verifierFalsified := false
+		res, body := makeRequestWithCookieJar(t, "forcePKCE", action, url.Values{}, nil, func(req *http.Request, via []*http.Request) error {
+			if req.URL.Path == "/oauth2/auth" && !verifierFalsified {
+				q := req.URL.Query()
+				require.NotEmpty(t, q.Get("code_challenge"))
+				require.Equal(t, "S256", q.Get("code_challenge_method"))
+				q.Set("code_challenge", oauth2.S256ChallengeFromVerifier(oauth2.GenerateVerifier()))
+				req.URL.RawQuery = q.Encode()
+				verifierFalsified = true
+			}
+			return nil
+		})
+		require.True(t, verifierFalsified)
+		assertSystemErrorWithMessage(t, res, body, http.StatusInternalServerError, "The PKCE code challenge did not match the code verifier.")
+		assert.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowErrorURL(ctx).String())
+	})
+	t.Run("case=force PKCE, code challenge params removed from initial redirect", func(t *testing.T) {
+		r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+		action := assertFormValues(t, r.ID, "forcePKCE")
+		subject = "force-pkce@ory.sh"
+		scope = []string{"openid", "offline"}
+		challengeParamsRemoved := false
+		res, body := makeRequestWithCookieJar(t, "forcePKCE", action, url.Values{}, nil, func(req *http.Request, via []*http.Request) error {
+			if req.URL.Path == "/oauth2/auth" && !challengeParamsRemoved {
+				q := req.URL.Query()
+				require.NotEmpty(t, q.Get("code_challenge"))
+				require.Equal(t, "S256", q.Get("code_challenge_method"))
+				q.Del("code_challenge")
+				q.Del("code_challenge_method")
+				req.URL.RawQuery = q.Encode()
+				challengeParamsRemoved = true
+			}
+			return nil
+		})
+		require.True(t, challengeParamsRemoved)
+		assertSystemErrorWithMessage(t, res, body, http.StatusInternalServerError, "The PKCE code challenge did not match the code verifier.")
+		assert.Contains(t, res.Request.URL.String(), conf.SelfServiceFlowErrorURL(ctx).String())
+	})
+	t.Run("case=PKCE prevents authorization code injection attacks", func(t *testing.T) {
+		r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+		action := assertFormValues(t, r.ID, "forcePKCE")
+		subject = "attacker@ory.sh"
+		scope = []string{"openid", "offline"}
+		var code string
+		_, err := testhelpers.NewClientWithCookieJar(t, nil, func(req *http.Request, via []*http.Request) error {
+			if req.URL.Query().Has("code") {
+				code = req.URL.Query().Get("code")
+				return errors.New("code intercepted")
+			}
+			return nil
+		}).PostForm(action, url.Values{"provider": {"forcePKCE"}})
+		require.ErrorContains(t, err, "code intercepted")
+		require.NotEmpty(t, code) // code now contains a valid authorization code
+
+		r2 := newBrowserLoginFlow(t, returnTS.URL, time.Minute)
+		action = assertFormValues(t, r2.ID, "forcePKCE")
+		jar, err := cookiejar.New(nil) // must capture the continuity cookie
+		require.NoError(t, err)
+		var redirectURI, state string
+		_, err = testhelpers.NewClientWithCookieJar(t, jar, func(req *http.Request, via []*http.Request) error {
+			if req.URL.Path == "/oauth2/auth" {
+				redirectURI = req.URL.Query().Get("redirect_uri")
+				state = req.URL.Query().Get("state")
+				return errors.New("stop before redirect to Authorization URL")
+			}
+			return nil
+		}).PostForm(action, url.Values{"provider": {"forcePKCE"}})
+		require.ErrorContains(t, err, "stop")
+		require.NotEmpty(t, redirectURI)
+		require.NotEmpty(t, state)
+		res, err := testhelpers.NewClientWithCookieJar(t, jar, nil).Get(redirectURI + "?code=" + code + "&state=" + state)
+		require.NoError(t, err)
+		body := x.MustReadAll(res.Body)
+		require.NoError(t, res.Body.Close())
+		assertSystemErrorWithMessage(t, res, body, http.StatusInternalServerError, "The PKCE code challenge did not match the code verifier.")
+	})
+	t.Run("case=confused providers are detected", func(t *testing.T) {
+		r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+		action := assertFormValues(t, r.ID, "valid")
+		subject = "attacker@ory.sh"
+		scope = []string{"openid", "offline"}
+		redirectConfused := false
+		res, err := testhelpers.NewClientWithCookieJar(t, nil, func(req *http.Request, via []*http.Request) error {
+			if req.URL.Query().Has("code") {
+				req.URL.Path = strings.Replace(req.URL.Path, "valid", "valid2", 1)
+				redirectConfused = true
+			}
+			return nil
+		}).PostForm(action, url.Values{"provider": {"valid"}})
+		require.True(t, redirectConfused)
+		require.NoError(t, err)
+		body := x.MustReadAll(res.Body)
+		require.NoError(t, res.Body.Close())
+
+		assertSystemErrorWithReason(t, res, body, http.StatusBadRequest, "provider mismatch between internal state and URL")
+	})
+	t.Run("case=automatic PKCE", func(t *testing.T) {
+		r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+		action := assertFormValues(t, r.ID, "autoPKCE")
+		subject = "auto-pkce@ory.sh"
+		scope = []string{"openid", "offline"}
+		var redirects []*http.Request
+		res, body := makeRequestWithCookieJar(t, "autoPKCE", action, url.Values{}, nil, func(_ *http.Request, via []*http.Request) error {
+			redirects = via
+			return nil
+		})
+		require.GreaterOrEqual(t, len(redirects), 3)
+		assert.Contains(t, redirects[1].URL.String(), "/oauth2/auth")
+		assert.Contains(t, redirects[1].URL.String(), "code_challenge_method=S256")
+		assert.Contains(t, redirects[1].URL.String(), "code_challenge=")
+		assert.Equal(t, redirects[len(redirects)-1].URL.Path, "/self-service/methods/oidc/callback/autoPKCE")
+
+		assertIdentity(t, res, body)
+		expectTokens(t, "autoPKCE", body)
+		assert.Equal(t, "autoPKCE", gjson.GetBytes(body, "authentication_methods.0.provider").String(), "%s", body)
+	})
+	t.Run("case=disabled PKCE", func(t *testing.T) {
+		r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+		action := assertFormValues(t, r.ID, "neverPKCE")
+		subject = "never-pkce@ory.sh"
+		scope = []string{"openid", "offline"}
+		var redirects []*http.Request
+		res, body := makeRequestWithCookieJar(t, "neverPKCE", action, url.Values{}, nil, func(_ *http.Request, via []*http.Request) error {
+			redirects = via
+			return nil
+		})
+		require.GreaterOrEqual(t, len(redirects), 3)
+		assert.Contains(t, redirects[1].URL.String(), "/oauth2/auth")
+		assert.NotContains(t, redirects[1].URL.String(), "code_challenge_method=")
+		assert.NotContains(t, redirects[1].URL.String(), "code_challenge=")
+		assert.Equal(t, redirects[len(redirects)-1].URL.Path, "/self-service/methods/oidc/callback/neverPKCE")
+
+		assertIdentity(t, res, body)
+		expectTokens(t, "neverPKCE", body)
+		assert.Equal(t, "neverPKCE", gjson.GetBytes(body, "authentication_methods.0.provider").String(), "%s", body)
+	})
+
 	t.Run("case=register and then login", func(t *testing.T) {
 		postRegistrationWebhook := hooktest.NewServer()
 		t.Cleanup(postRegistrationWebhook.Close)
@@ -556,7 +746,7 @@ func TestStrategy(t *testing.T) {
 			// We essentially run into this bit:
 			//
 			// 	if authenticated, err := s.alreadyAuthenticated(w, r, req); err != nil {
-			//		s.forwardError(w, r, req, s.handleError(w, r, req, pid, nil, err))
+			//		s.forwardError(w, r, req, s.handleError(w, , r, req, pid, nil, err))
 			//	} else if authenticated {
 			//		return <-- we end up here on the second call
 			//	}
@@ -592,10 +782,7 @@ func TestStrategy(t *testing.T) {
 			require.NoError(t, err)
 			require.NoError(t, res.Body.Close())
 
-			// The reason for `invalid_client` here is that the code was already used and the session was already authenticated. The invalid_client
-			// happens because of the way Golang's OAuth2 library is trying out different auth methods when a token request fails, which obfuscates
-			// the underlying error.
-			assert.Contains(t, string(body), "invalid_client", "%s", body)
+			assert.Contains(t, string(body), "The authorization code has already been used", "%s", body)
 		})
 	})
 
@@ -724,7 +911,7 @@ func TestStrategy(t *testing.T) {
 			require.NotEmpty(t, returnedFlow, "flow query param was empty in the return_to URL")
 			loginFlow, err := reg.LoginFlowPersister().GetLoginFlow(ctx, uuid.FromStringOrNil(returnedFlow))
 			require.NoError(t, err)
-			assert.Equal(t, text.ErrorValidationDuplicateCredentials, loginFlow.UI.Messages[0].ID)
+			assert.Equal(t, text.InfoSelfServiceLoginLink, loginFlow.UI.Messages[0].ID)
 		})
 	})
 
@@ -742,7 +929,7 @@ func TestStrategy(t *testing.T) {
 				Mapper:       "file://./stub/oidc.facebook.jsonnet",
 			},
 		)
-		t.Cleanup(oidc.RegisterTestProvider("test-provider"))
+		oidc.RegisterTestProvider(t, "test-provider")
 
 		cl := http.Client{}
 
@@ -969,7 +1156,7 @@ func TestStrategy(t *testing.T) {
 			action := assertFormValues(t, r.ID, "valid")
 			fv := url.Values{}
 			fv.Set("provider", "valid")
-			res, err := testhelpers.NewClientWithCookieJar(t, nil, false).PostForm(action, fv)
+			res, err := testhelpers.NewClientWithCookieJar(t, nil, nil).PostForm(action, fv)
 			require.NoError(t, err)
 			// Expect to be returned to the hydra instance, that instantiated the request
 			assert.Equal(t, hydra.FakePostLoginURL, res.Request.URL.String())
@@ -981,34 +1168,54 @@ func TestStrategy(t *testing.T) {
 		scope = []string{"openid"}
 
 		t.Run("case=should pass registration", func(t *testing.T) {
+			postRegistrationWebhook := hooktest.NewServer()
+			t.Cleanup(postRegistrationWebhook.Close)
+			postRegistrationWebhook.SetConfig(t, conf.GetProvider(ctx), config.HookStrategyKey(config.ViperKeySelfServiceRegistrationAfter, identity.CredentialsTypeOIDC.String()))
+
 			r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
 			action := assertFormValues(t, r.ID, "valid")
-			res, body := makeRequest(t, "valid", action, url.Values{})
+			transientPayload := `{"data": "registration-one"}`
+			res, body := makeRequest(t, "valid", action, url.Values{"transient_payload": {transientPayload}})
 			assertIdentity(t, res, body)
+			postRegistrationWebhook.AssertTransientPayload(t, transientPayload)
 		})
 
 		t.Run("case=should pass second time registration", func(t *testing.T) {
+			postLoginWebhook := hooktest.NewServer()
+			t.Cleanup(postLoginWebhook.Close)
+			postLoginWebhook.SetConfig(t, conf.GetProvider(ctx), config.HookStrategyKey(config.ViperKeySelfServiceLoginAfter, identity.CredentialsTypeOIDC.String()))
+
 			r := newBrowserLoginFlow(t, returnTS.URL, time.Minute)
 			action := assertFormValues(t, r.ID, "valid")
-			res, body := makeRequest(t, "valid", action, url.Values{})
+			transientPayload := `{"data": "registration-two"}`
+			res, body := makeRequest(t, "valid", action, url.Values{"transient_payload": {transientPayload}})
 			assertIdentity(t, res, body)
+			postLoginWebhook.AssertTransientPayload(t, transientPayload)
 		})
 
 		t.Run("case=should pass third time registration with return to", func(t *testing.T) {
+			postLoginWebhook := hooktest.NewServer()
+			t.Cleanup(postLoginWebhook.Close)
+			postLoginWebhook.SetConfig(t, conf.GetProvider(ctx), config.HookStrategyKey(config.ViperKeySelfServiceLoginAfter, identity.CredentialsTypeOIDC.String()))
+
 			returnTo := "/foo"
 			r := newBrowserLoginFlow(t, fmt.Sprintf("%s?return_to=%s", returnTS.URL, returnTo), time.Minute)
 			action := assertFormValues(t, r.ID, "valid")
-			res, body := makeRequest(t, "valid", action, url.Values{})
+			transientPayload := `{"data": "registration-three"}`
+			res, body := makeRequest(t, "valid", action, url.Values{"transient_payload": {transientPayload}})
 			assert.True(t, strings.HasSuffix(res.Request.URL.String(), returnTo))
 			assertIdentity(t, res, body)
+			postLoginWebhook.AssertTransientPayload(t, transientPayload)
 		})
 	})
 
 	t.Run("case=register, merge, and complete data", func(t *testing.T) {
-
 		for _, tc := range []struct{ name, provider string }{
 			{name: "idtoken", provider: "valid"},
 			{name: "userinfo", provider: "claimsViaUserInfo"},
+			{name: "disable-pkce", provider: "neverPKCE"},
+			{name: "auto-pkce", provider: "autoPKCE"},
+			{name: "force-pkce", provider: "forcePKCE"},
 		} {
 			subject = fmt.Sprintf("incomplete-data@%s.ory.sh", tc.name)
 			scope = []string{"openid"}
@@ -1042,38 +1249,85 @@ func TestStrategy(t *testing.T) {
 				})
 			})
 		}
-
 	})
 
-	t.Run("case=should fail to register and return fresh login flow if email is already being used by password credentials", func(t *testing.T) {
-		subject = "email-exist-with-password-strategy@ory.sh"
-		scope = []string{"openid"}
+	for _, loginHintsEnabled := range []bool{true, false} {
+		t.Run("login-hints-enabled="+strconv.FormatBool(loginHintsEnabled), func(t *testing.T) {
+			t.Run("case=should fail to register and return fresh login flow if email is already being used by password credentials", func(t *testing.T) {
+				subject = "email-exist-with-password-strategy-lh-" + strconv.FormatBool(loginHintsEnabled) + "@ory.sh"
+				scope = []string{"openid"}
+				conf.MustSet(ctx, config.ViperKeySelfServiceRegistrationLoginHints, strconv.FormatBool(loginHintsEnabled))
+
+				t.Run("case=create password identity", func(t *testing.T) {
+					i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
+					i.SetCredentials(identity.CredentialsTypePassword, identity.Credentials{
+						Identifiers: []string{subject},
+						Config:      sqlxx.JSONRawMessage(`{"hashed_password": "foo"}`),
+					})
+					i.Traits = identity.Traits(`{"subject":"` + subject + `"}`)
+
+					require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), i))
+				})
 
-		t.Run("case=create password identity", func(t *testing.T) {
-			i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID)
-			i.SetCredentials(identity.CredentialsTypePassword, identity.Credentials{
-				Identifiers: []string{subject},
+				t.Run("case=should fail registration", func(t *testing.T) {
+					r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+					action := assertFormValues(t, r.ID, "valid")
+					_, body := makeRequest(t, "valid", action, url.Values{})
+					snapshotx.SnapshotTJSON(t, body, snapshotx.ExceptPaths("expires_at", "updated_at", "issued_at", "id", "created_at", "ui.action", findCsrfTokenPath(t, body), "request_url"), snapshotx.ExceptNestedKeys("newLoginUrl", "new_login_url"))
+				})
+
+				t.Run("case=should fail registration id_first strategy enabled", func(t *testing.T) {
+					conf.Set(ctx, config.ViperKeySelfServiceLoginFlowStyle, "identifier_first")
+					r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+					action := assertFormValues(t, r.ID, "valid")
+					_, body := makeRequest(t, "valid", action, url.Values{})
+					snapshotx.SnapshotTJSON(t, body, snapshotx.ExceptPaths("expires_at", "updated_at", "issued_at", "id", "created_at", "ui.action", findCsrfTokenPath(t, body), "request_url"), snapshotx.ExceptNestedKeys("newLoginUrl", "new_login_url"))
+				})
+
+				t.Run("case=should fail login", func(t *testing.T) {
+					r := newBrowserLoginFlow(t, returnTS.URL, time.Minute)
+					action := assertFormValues(t, r.ID, "valid")
+					_, body := makeRequest(t, "valid", action, url.Values{})
+					snapshotx.SnapshotTJSON(t, body, snapshotx.ExceptPaths("expires_at", "updated_at", "issued_at", "id", "created_at", "ui.action", findCsrfTokenPath(t, body), "request_url"), snapshotx.ExceptNestedKeys("newLoginUrl", "new_login_url"))
+				})
 			})
-			i.Traits = identity.Traits(`{"subject":"` + subject + `"}`)
 
-			require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), i))
-		})
+			t.Run("case=should fail to register and return fresh login flow if email is already being used by oidc credentials", func(t *testing.T) {
+				subject = "email-exist-with-oidc-strategy-lh-" + strconv.FormatBool(loginHintsEnabled) + "@ory.sh"
+				scope = []string{"openid"}
+				conf.MustSet(ctx, config.ViperKeySelfServiceRegistrationLoginHints, strconv.FormatBool(loginHintsEnabled))
 
-		t.Run("case=should fail registration", func(t *testing.T) {
-			r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
-			action := assertFormValues(t, r.ID, "valid")
-			res, body := makeRequest(t, "valid", action, url.Values{})
-			assertUIError(t, res, body, "An account with the same identifier (email, phone, username, ...) exists already.")
-			require.Contains(t, gjson.GetBytes(body, "ui.action").String(), "/self-service/login")
-		})
+				t.Run("case=create oidc identity", func(t *testing.T) {
+					r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+					action := assertFormValues(t, r.ID, "secondProvider")
+					res, _ := makeRequest(t, "secondProvider", action, url.Values{})
+					require.Equal(t, http.StatusOK, res.StatusCode)
+				})
 
-		t.Run("case=should fail login", func(t *testing.T) {
-			r := newBrowserLoginFlow(t, returnTS.URL, time.Minute)
-			action := assertFormValues(t, r.ID, "valid")
-			res, body := makeRequest(t, "valid", action, url.Values{})
-			assertUIError(t, res, body, "An account with the same identifier (email, phone, username, ...) exists already.")
+				t.Run("case=should fail registration", func(t *testing.T) {
+					r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+					action := assertFormValues(t, r.ID, "valid")
+					_, body := makeRequest(t, "valid", action, url.Values{})
+					snapshotx.SnapshotTJSON(t, body, snapshotx.ExceptPaths("expires_at", "updated_at", "issued_at", "id", "created_at", "ui.action", findCsrfTokenPath(t, body), "request_url"), snapshotx.ExceptNestedKeys("newLoginUrl", "new_login_url"))
+				})
+
+				t.Run("case=should fail registration id_first strategy enabled", func(t *testing.T) {
+					conf.Set(ctx, config.ViperKeySelfServiceLoginFlowStyle, "identifier_first")
+					r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute)
+					action := assertFormValues(t, r.ID, "valid")
+					_, body := makeRequest(t, "valid", action, url.Values{})
+					snapshotx.SnapshotTJSON(t, body, snapshotx.ExceptPaths("expires_at", "updated_at", "issued_at", "id", "created_at", "ui.action", findCsrfTokenPath(t, body), "request_url"), snapshotx.ExceptNestedKeys("newLoginUrl", "new_login_url"))
+				})
+
+				t.Run("case=should fail login", func(t *testing.T) {
+					r := newBrowserLoginFlow(t, returnTS.URL, time.Minute)
+					action := assertFormValues(t, r.ID, "valid")
+					_, body := makeRequest(t, "valid", action, url.Values{})
+					snapshotx.SnapshotTJSON(t, body, snapshotx.ExceptPaths("expires_at", "updated_at", "issued_at", "id", "created_at", "ui.action", findCsrfTokenPath(t, body), "request_url"), snapshotx.ExceptNestedKeys("newLoginUrl", "new_login_url"))
+				})
+			})
 		})
-	})
+	}
 
 	t.Run("case=should redirect to default return ts when sending authenticated login flow without forced flag", func(t *testing.T) {
 		subject = "no-reauth-login@ory.sh"
@@ -1082,10 +1336,10 @@ func TestStrategy(t *testing.T) {
 		fv := url.Values{"traits.name": {"valid-name"}}
 		jar, _ := cookiejar.New(nil)
 		r1 := newBrowserLoginFlow(t, returnTS.URL, time.Minute)
-		res1, body1 := makeRequestWithCookieJar(t, "valid", assertFormValues(t, r1.ID, "valid"), fv, jar)
+		res1, body1 := makeRequestWithCookieJar(t, "valid", assertFormValues(t, r1.ID, "valid"), fv, jar, nil)
 		assertIdentity(t, res1, body1)
 		r2 := newBrowserLoginFlow(t, returnTS.URL, time.Minute)
-		res2, body2 := makeRequestWithCookieJar(t, "valid", assertFormValues(t, r2.ID, "valid"), fv, jar)
+		res2, body2 := makeRequestWithCookieJar(t, "valid", assertFormValues(t, r2.ID, "valid"), fv, jar, nil)
 		assertIdentity(t, res2, body2)
 		assert.Equal(t, body1, body2)
 	})
@@ -1097,11 +1351,11 @@ func TestStrategy(t *testing.T) {
 		fv := url.Values{"traits.name": {"valid-name"}}
 		jar, _ := cookiejar.New(nil)
 		r1 := newBrowserLoginFlow(t, returnTS.URL, time.Minute)
-		res1, body1 := makeRequestWithCookieJar(t, "valid", assertFormValues(t, r1.ID, "valid"), fv, jar)
+		res1, body1 := makeRequestWithCookieJar(t, "valid", assertFormValues(t, r1.ID, "valid"), fv, jar, nil)
 		assertIdentity(t, res1, body1)
 		r2 := newBrowserLoginFlow(t, returnTS.URL, time.Minute)
 		require.NoError(t, reg.LoginFlowPersister().ForceLoginFlow(context.Background(), r2.ID))
-		res2, body2 := makeRequestWithCookieJar(t, "valid", assertFormValues(t, r2.ID, "valid"), fv, jar)
+		res2, body2 := makeRequestWithCookieJar(t, "valid", assertFormValues(t, r2.ID, "valid"), fv, jar, nil)
 		assertIdentity(t, res2, body2)
 		assert.NotEqual(t, gjson.GetBytes(body1, "id"), gjson.GetBytes(body2, "id"))
 		authAt1, err := time.Parse(time.RFC3339, gjson.GetBytes(body1, "authenticated_at").String())
@@ -1302,8 +1556,10 @@ func TestStrategy(t *testing.T) {
 				require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), i2))
 			})
 
-			client := testhelpers.NewClientWithCookieJar(t, nil, false)
+			client := testhelpers.NewClientWithCookieJar(t, nil, nil)
 			loginFlow := newLoginFlow(t, returnTS.URL, time.Minute, flow.TypeBrowser)
+			loginFlow.OrganizationID = uuid.NullUUID{UUID: orgID, Valid: true}
+			require.NoError(t, reg.LoginFlowPersister().UpdateLoginFlow(context.Background(), loginFlow))
 
 			var linkingLoginFlow struct {
 				ID        string
@@ -1317,9 +1573,11 @@ func TestStrategy(t *testing.T) {
 			t.Run("step=should fail login and start a new flow", func(t *testing.T) {
 				res, body := loginWithOIDC(t, client, loginFlow.ID, "valid")
 				assert.True(t, res.Request.URL.Query().Has("no_org_ui"))
-				assertUIError(t, res, body, "You tried signing in with new-login-if-email-exist-with-password-strategy@ory.sh which is already in use by another account. You can sign in using your password.")
-				assert.Equal(t, "password", gjson.GetBytes(body, "ui.messages.#(id==4000028).context.available_credential_types.0").String())
-				assert.Equal(t, "new-login-if-email-exist-with-password-strategy@ory.sh", gjson.GetBytes(body, "ui.messages.#(id==4000028).context.credential_identifier_hint").String())
+				assertUIError(t, res, body, "You tried to sign in with \"new-login-if-email-exist-with-password-strategy@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"new-login-if-email-exist-with-password-strategy@ory.sh\" at \"generic\" as another way to sign in.")
+				assert.True(t, gjson.GetBytes(body, "ui.nodes.#(attributes.name==identifier)").Exists(), "%s", body)
+				assert.True(t, gjson.GetBytes(body, "ui.nodes.#(attributes.name==password)").Exists(), "%s", body)
+				assert.Equal(t, "new-login-if-email-exist-with-password-strategy@ory.sh", gjson.GetBytes(body, "ui.messages.#(id==1010016).context.duplicateIdentifier").String())
+				assert.Equal(t, gjson.GetBytes(body, "organization_id").String(), orgID.String())
 				linkingLoginFlow.ID = gjson.GetBytes(body, "id").String()
 				linkingLoginFlow.UIAction = gjson.GetBytes(body, "ui.action").String()
 				linkingLoginFlow.CSRFToken = gjson.GetBytes(body, `ui.nodes.#(attributes.name=="csrf_token").attributes.value`).String()
@@ -1337,9 +1595,9 @@ func TestStrategy(t *testing.T) {
 				body, err := io.ReadAll(res.Body)
 				require.NoError(t, res.Body.Close())
 				require.NoError(t, err)
-				assert.Equal(t,
-					strconv.Itoa(int(text.ErrorValidationLoginLinkedCredentialsDoNotMatch)),
-					gjson.GetBytes(body, "ui.messages.0.id").String(),
+				assert.EqualValues(t,
+					text.ErrorValidationLoginLinkedCredentialsDoNotMatch,
+					gjson.GetBytes(body, "ui.messages.0.id").Int(),
 					prettyJSON(t, body),
 				)
 			})
@@ -1382,18 +1640,21 @@ func TestStrategy(t *testing.T) {
 			})
 
 			subject = email1
-			client := testhelpers.NewClientWithCookieJar(t, nil, false)
+			client := testhelpers.NewClientWithCookieJar(t, nil, nil)
 			loginFlow := newLoginFlow(t, returnTS.URL, time.Minute, flow.TypeBrowser)
 			var linkingLoginFlow struct{ ID string }
 			t.Run("step=should fail login and start a new login", func(t *testing.T) {
-				res, body := loginWithOIDC(t, client, loginFlow.ID, "valid")
-				assertUIError(t, res, body, "You tried signing in with existing-oidc-identity-1@ory.sh which is already in use by another account. You can sign in using social sign in. You can sign in using one of the following social sign in providers: Secondprovider.")
+				// To test the identifier mismatch
+				conf.MustSet(ctx, config.ViperKeySelfServiceRegistrationLoginHints, false)
+				res, body := loginWithOIDC(t, client, loginFlow.ID, "valid2")
+				assertUIError(t, res, body, "You tried to sign in with \"existing-oidc-identity-1@ory.sh\", but that email is already used by another account. Sign in to your account with one of the options below to add your account \"existing-oidc-identity-1@ory.sh\" at \"generic\" as another way to sign in.")
 				linkingLoginFlow.ID = gjson.GetBytes(body, "id").String()
 				assert.NotEqual(t, loginFlow.ID.String(), linkingLoginFlow.ID, "should have started a new flow")
 			})
 
 			subject = email2
 			t.Run("step=should fail login if existing identity identifier doesn't match", func(t *testing.T) {
+				require.NotNil(t, linkingLoginFlow.ID)
 				res, body := loginWithOIDC(t, client, uuid.Must(uuid.FromString(linkingLoginFlow.ID)), "valid")
 				assertUIError(t, res, body, "Linked credentials do not match.")
 			})
@@ -1415,16 +1676,6 @@ func TestStrategy(t *testing.T) {
 
 		snapshotx.SnapshotTExcept(t, sr.UI, []string{"action", "nodes.0.attributes.value"})
 	})
-
-	t.Run("method=TestPopulateLoginMethod", func(t *testing.T) {
-		conf.MustSet(ctx, config.ViperKeyPublicBaseURL, "https://foo/")
-
-		sr, err := login.NewFlow(conf, time.Minute, "nosurf", &http.Request{URL: urlx.ParseOrPanic("/")}, flow.TypeBrowser)
-		require.NoError(t, err)
-		require.NoError(t, reg.LoginStrategies(context.Background()).MustStrategy(identity.CredentialsTypeOIDC).(*oidc.Strategy).PopulateLoginMethod(&http.Request{}, identity.AuthenticatorAssuranceLevel1, sr))
-
-		snapshotx.SnapshotTExcept(t, sr.UI, []string{"action", "nodes.0.attributes.value"})
-	})
 }
 
 func prettyJSON(t *testing.T, body []byte) string {
@@ -1523,7 +1774,7 @@ func TestCountActiveFirstFactorCredentials(t *testing.T) {
 			for _, v := range tc.in {
 				in[v.Type] = v
 			}
-			actual, err := strategy.CountActiveFirstFactorCredentials(in)
+			actual, err := strategy.CountActiveFirstFactorCredentials(context.Background(), in)
 			require.NoError(t, err)
 			assert.Equal(t, tc.expected, actual)
 		})
@@ -1533,7 +1784,7 @@ func TestCountActiveFirstFactorCredentials(t *testing.T) {
 func TestDisabledEndpoint(t *testing.T) {
 	conf, reg := internal.NewFastRegistryWithMocks(t)
 	testhelpers.StrategyEnable(t, conf, identity.CredentialsTypeOIDC.String(), false)
-
+	ctx := context.Background()
 	publicTS, _ := testhelpers.NewKratosServer(t, reg)
 
 	t.Run("case=should not callback when oidc method is disabled", func(t *testing.T) {
@@ -1551,7 +1802,7 @@ func TestDisabledEndpoint(t *testing.T) {
 
 		t.Run("flow=settings", func(t *testing.T) {
 			testhelpers.SetDefaultIdentitySchema(conf, "file://stub/stub.schema.json")
-			c := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg)
+			c := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, ctx, reg)
 			f := testhelpers.InitializeSettingsFlowViaAPI(t, c, publicTS)
 
 			res, err := c.PostForm(f.Ui.Action, url.Values{"link": {"oidc"}})
@@ -1623,3 +1874,12 @@ func TestPostEndpointRedirect(t *testing.T) {
 		testhelpers.AssertNoCSRFCookieInResponse(t, publicTS, c, res)
 	})
 }
+
+func findCsrfTokenPath(t *testing.T, body []byte) string {
+	nodes := gjson.GetBytes(body, "ui.nodes").Array()
+	index := slices.IndexFunc(nodes, func(n gjson.Result) bool {
+		return n.Get("attributes.name").String() == "csrf_token"
+	})
+	require.GreaterOrEqual(t, index, 0)
+	return fmt.Sprintf("ui.nodes.%v.attributes.value", index)
+}
diff --git a/selfservice/strategy/oidc/types.go b/selfservice/strategy/oidc/types.go
index 4460c35ce67b..768e20d23531 100644
--- a/selfservice/strategy/oidc/types.go
+++ b/selfservice/strategy/oidc/types.go
@@ -18,10 +18,9 @@ type FlowMethod struct {
 	*container.Container
 }
 
-func AddProviders(c *container.Container, providers []Configuration, message func(provider string) *text.Message) {
+func AddProviders(c *container.Container, providers []Configuration, message func(provider string, providerId string) *text.Message) {
 	for _, p := range providers {
-		AddProvider(c, p.ID, message(
-			stringsx.Coalesce(p.Label, p.ID)))
+		AddProvider(c, p.ID, message(stringsx.Coalesce(p.Label, p.ID), p.ID))
 	}
 }
 
diff --git a/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=passwordless-case=passkey_button_exists.json b/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=passwordless-case=passkey_button_exists.json
index d2dd6567d240..ce6f722551f9 100644
--- a/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=passwordless-case=passkey_button_exists.json
+++ b/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=passwordless-case=passkey_button_exists.json
@@ -38,7 +38,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
@@ -53,8 +53,8 @@
       "disabled": false,
       "name": "passkey_login_trigger",
       "node_type": "input",
-      "onclick": "window.__oryPasskeyLogin()",
-      "onload": "window.__oryPasskeyLoginAutocompleteInit()",
+      "onclick": "window.oryPasskeyLogin()",
+      "onclickTrigger": "oryPasskeyLogin",
       "type": "button",
       "value": ""
     },
@@ -74,6 +74,8 @@
       "disabled": false,
       "name": "passkey_login",
       "node_type": "input",
+      "onload": "window.oryPasskeyLoginAutocompleteInit()",
+      "onloadTrigger": "oryPasskeyLoginAutocompleteInit",
       "type": "hidden"
     },
     "group": "passkey",
diff --git a/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=refresh-case=refresh_passwordless_credentials-browser.json b/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=refresh-case=refresh_passwordless_credentials-browser.json
index c331d4f4280f..46a7896863a1 100644
--- a/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=refresh-case=refresh_passwordless_credentials-browser.json
+++ b/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=refresh-case=refresh_passwordless_credentials-browser.json
@@ -30,7 +30,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
@@ -45,7 +45,8 @@
       "disabled": false,
       "name": "passkey_login_trigger",
       "node_type": "input",
-      "onclick": "window.__oryPasskeyLogin()",
+      "onclick": "window.oryPasskeyLogin()",
+      "onclickTrigger": "oryPasskeyLogin",
       "type": "button",
       "value": ""
     },
diff --git a/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=refresh-case=refresh_passwordless_credentials-spa.json b/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=refresh-case=refresh_passwordless_credentials-spa.json
index c331d4f4280f..46a7896863a1 100644
--- a/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=refresh-case=refresh_passwordless_credentials-spa.json
+++ b/selfservice/strategy/passkey/.snapshots/TestCompleteLogin-flow=refresh-case=refresh_passwordless_credentials-spa.json
@@ -30,7 +30,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
@@ -45,7 +45,8 @@
       "disabled": false,
       "name": "passkey_login_trigger",
       "node_type": "input",
-      "onclick": "window.__oryPasskeyLogin()",
+      "onclick": "window.oryPasskeyLogin()",
+      "onclickTrigger": "oryPasskeyLogin",
       "type": "button",
       "value": ""
     },
diff --git a/selfservice/strategy/passkey/.snapshots/TestCompleteSettings-case=a_device_is_shown_which_can_be_unlinked.json b/selfservice/strategy/passkey/.snapshots/TestCompleteSettings-case=a_device_is_shown_which_can_be_unlinked.json
index f9032e39049d..65ade1871cfe 100644
--- a/selfservice/strategy/passkey/.snapshots/TestCompleteSettings-case=a_device_is_shown_which_can_be_unlinked.json
+++ b/selfservice/strategy/passkey/.snapshots/TestCompleteSettings-case=a_device_is_shown_which_can_be_unlinked.json
@@ -4,7 +4,8 @@
       "disabled": false,
       "name": "passkey_register_trigger",
       "node_type": "input",
-      "onclick": "window.__oryPasskeySettingsRegistration()",
+      "onclick": "window.oryPasskeySettingsRegistration()",
+      "onclickTrigger": "oryPasskeySettingsRegistration",
       "type": "button",
       "value": ""
     },
@@ -109,7 +110,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
diff --git a/selfservice/strategy/passkey/.snapshots/TestCompleteSettings-case=one_activation_element_is_shown.json b/selfservice/strategy/passkey/.snapshots/TestCompleteSettings-case=one_activation_element_is_shown.json
index 7e5c5b3d082b..293a8752d52b 100644
--- a/selfservice/strategy/passkey/.snapshots/TestCompleteSettings-case=one_activation_element_is_shown.json
+++ b/selfservice/strategy/passkey/.snapshots/TestCompleteSettings-case=one_activation_element_is_shown.json
@@ -4,7 +4,8 @@
       "disabled": false,
       "name": "passkey_register_trigger",
       "node_type": "input",
-      "onclick": "window.__oryPasskeySettingsRegistration()",
+      "onclick": "window.oryPasskeySettingsRegistration()",
+      "onclickTrigger": "oryPasskeySettingsRegistration",
       "type": "button",
       "value": ""
     },
@@ -61,7 +62,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json
new file mode 100644
index 000000000000..7465a9a5ae82
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json
@@ -0,0 +1,98 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "text",
+      "value": "",
+      "required": true,
+      "autocomplete": "username webauthn",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070004,
+        "text": "ID",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_challenge",
+      "type": "hidden",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "script",
+    "group": "webauthn",
+    "attributes": {
+      "async": true,
+      "referrerpolicy": "no-referrer",
+      "crossorigin": "anonymous",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
+      "type": "text/javascript",
+      "id": "webauthn_script",
+      "node_type": "script"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_login",
+      "type": "hidden",
+      "disabled": false,
+      "onload": "window.oryPasskeyLoginAutocompleteInit()",
+      "onloadTrigger": "oryPasskeyLoginAutocompleteInit",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_login_trigger",
+      "type": "button",
+      "value": "",
+      "disabled": false,
+      "onclick": "window.oryPasskeyLogin()",
+      "onclickTrigger": "oryPasskeyLogin",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010021,
+        "text": "Sign in with passkey",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json
new file mode 100644
index 000000000000..c586635ce49a
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json
@@ -0,0 +1,88 @@
+[
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_challenge",
+      "type": "hidden",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "script",
+    "group": "webauthn",
+    "attributes": {
+      "async": true,
+      "referrerpolicy": "no-referrer",
+      "crossorigin": "anonymous",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
+      "type": "text/javascript",
+      "id": "webauthn_script",
+      "node_type": "script"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_login",
+      "type": "hidden",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_login_trigger",
+      "type": "button",
+      "value": "",
+      "disabled": false,
+      "onclick": "window.oryPasskeyLogin()",
+      "onclickTrigger": "oryPasskeyLogin",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010021,
+        "text": "Sign in with passkey",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "hidden",
+      "value": "",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_disabled.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_disabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_disabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..94263a4da9d1
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1,23 @@
+[
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_login_trigger",
+      "type": "button",
+      "value": "",
+      "disabled": false,
+      "onclick": "window.oryPasskeyLogin()",
+      "onclickTrigger": "oryPasskeyLogin",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010021,
+        "text": "Sign in with passkey",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_passkey.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_passkey.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_passkey.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_passkey.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_passkey.json
new file mode 100644
index 000000000000..94263a4da9d1
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_passkey.json
@@ -0,0 +1,23 @@
+[
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_login_trigger",
+      "type": "button",
+      "value": "",
+      "disabled": false,
+      "onclick": "window.oryPasskeyLogin()",
+      "onclickTrigger": "oryPasskeyLogin",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010021,
+        "text": "Sign in with passkey",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..94263a4da9d1
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1,23 @@
+[
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_login_trigger",
+      "type": "button",
+      "value": "",
+      "disabled": false,
+      "onclick": "window.oryPasskeyLogin()",
+      "onclickTrigger": "oryPasskeyLogin",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010021,
+        "text": "Sign in with passkey",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_disabled.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_disabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_disabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..94263a4da9d1
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1,23 @@
+[
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_login_trigger",
+      "type": "button",
+      "value": "",
+      "disabled": false,
+      "onclick": "window.oryPasskeyLogin()",
+      "onclickTrigger": "oryPasskeyLogin",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010021,
+        "text": "Sign in with passkey",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json
new file mode 100644
index 000000000000..e65526e82d48
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json
@@ -0,0 +1,77 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "text",
+      "value": "",
+      "required": true,
+      "autocomplete": "username webauthn",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070004,
+        "text": "ID",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_challenge",
+      "type": "hidden",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "script",
+    "group": "webauthn",
+    "attributes": {
+      "async": true,
+      "referrerpolicy": "no-referrer",
+      "crossorigin": "anonymous",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
+      "type": "text/javascript",
+      "id": "webauthn_script",
+      "node_type": "script"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "passkey",
+    "attributes": {
+      "name": "passkey_login",
+      "type": "hidden",
+      "disabled": false,
+      "onload": "window.oryPasskeyLoginAutocompleteInit()",
+      "onloadTrigger": "oryPasskeyLoginAutocompleteInit",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh.json b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/passkey/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/passkey/.snapshots/TestRegistration-case=passkey_button_exists-browser.json b/selfservice/strategy/passkey/.snapshots/TestRegistration-case=passkey_button_exists-browser.json
index 18e0cda77811..2068eb38ef1c 100644
--- a/selfservice/strategy/passkey/.snapshots/TestRegistration-case=passkey_button_exists-browser.json
+++ b/selfservice/strategy/passkey/.snapshots/TestRegistration-case=passkey_button_exists-browser.json
@@ -43,7 +43,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
@@ -70,7 +70,8 @@
       "disabled": false,
       "name": "passkey_register_trigger",
       "node_type": "input",
-      "onclick": "window.__oryPasskeyRegistration()",
+      "onclick": "window.oryPasskeyRegistration()",
+      "onclickTrigger": "oryPasskeyRegistration",
       "type": "button"
     },
     "group": "passkey",
diff --git a/selfservice/strategy/passkey/.snapshots/TestRegistration-case=passkey_button_exists-spa.json b/selfservice/strategy/passkey/.snapshots/TestRegistration-case=passkey_button_exists-spa.json
index 18e0cda77811..2068eb38ef1c 100644
--- a/selfservice/strategy/passkey/.snapshots/TestRegistration-case=passkey_button_exists-spa.json
+++ b/selfservice/strategy/passkey/.snapshots/TestRegistration-case=passkey_button_exists-spa.json
@@ -43,7 +43,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
@@ -70,7 +70,8 @@
       "disabled": false,
       "name": "passkey_register_trigger",
       "node_type": "input",
-      "onclick": "window.__oryPasskeyRegistration()",
+      "onclick": "window.oryPasskeyRegistration()",
+      "onclickTrigger": "oryPasskeyRegistration",
       "type": "button"
     },
     "group": "passkey",
diff --git a/selfservice/strategy/passkey/fixtures/registration/success/android/internal_context.json b/selfservice/strategy/passkey/fixtures/registration/success/android/internal_context.json
new file mode 100644
index 000000000000..cd9949ce0093
--- /dev/null
+++ b/selfservice/strategy/passkey/fixtures/registration/success/android/internal_context.json
@@ -0,0 +1,7 @@
+{
+  "passkey_session_data": {
+    "challenge": "mFtAwmtDDdwcO6200I2H6oWjzOiF21lZhQVlrC4tdaU",
+    "user_id": "d29OeDNJVjdYR2NRa09RVHhNVG1ZbHE1ejBDYzM1dGV3UWxFT25yaUJKcTUyb0VOR0pUMk5PeXExRXp3Z2M2dg",
+    "userVerification": ""
+  }
+}
diff --git a/selfservice/strategy/passkey/fixtures/registration/success/android/response.json b/selfservice/strategy/passkey/fixtures/registration/success/android/response.json
new file mode 100644
index 000000000000..8b480b356790
--- /dev/null
+++ b/selfservice/strategy/passkey/fixtures/registration/success/android/response.json
@@ -0,0 +1,9 @@
+{
+  "id": "mK2RV0b2NUGDsj8QqH0XtQ",
+  "rawId": "mK2RV0b2NUGDsj8QqH0XtQ",
+  "response": {
+    "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUJYVxRmHaAcJuz7n2X5FJILFPwxIhVpoURyBRglMxnFpdAAAAAOqbjWZNAR0hPOS2tIy1ddQAEJitkVdG9jVBg7I_EKh9F7WlAQIDJiABIVggjEkfDDjIm8yAYfth4u0EV7ApX4kclQONhpK5BLc7W6wiWCCHiHhRNqf8Qhc7bjoIFTqw4lafiC7yrXvojU_WMNcutA",
+    "clientDataJson": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoibUZ0QXdtdEREZHdjTzYyMDBJMkg2b1dqek9pRjIxbFpoUVZsckM0dGRhVSIsIm9yaWdpbiI6ImFuZHJvaWQ6YXBrLWtleS1oYXNoOlMyUmZOWWdKbVFpS2dkNi1zZGJqVzdwaGNMX09UUDR2R0U4TDUxUTJHQjAiLCJhbmRyb2lkUGFja2FnZU5hbWUiOiJjb20udHJwLmFuZC5wZXJzb25hbC5xbCJ9"
+  },
+  "type": "public-key"
+}
diff --git a/selfservice/strategy/passkey/fixtures/registration/success/identity.json b/selfservice/strategy/passkey/fixtures/registration/success/browser/identity.json
similarity index 100%
rename from selfservice/strategy/passkey/fixtures/registration/success/identity.json
rename to selfservice/strategy/passkey/fixtures/registration/success/browser/identity.json
diff --git a/selfservice/strategy/passkey/fixtures/registration/success/internal_context.json b/selfservice/strategy/passkey/fixtures/registration/success/browser/internal_context.json
similarity index 100%
rename from selfservice/strategy/passkey/fixtures/registration/success/internal_context.json
rename to selfservice/strategy/passkey/fixtures/registration/success/browser/internal_context.json
diff --git a/selfservice/strategy/passkey/fixtures/registration/success/response.json b/selfservice/strategy/passkey/fixtures/registration/success/browser/response.json
similarity index 100%
rename from selfservice/strategy/passkey/fixtures/registration/success/response.json
rename to selfservice/strategy/passkey/fixtures/registration/success/browser/response.json
diff --git a/selfservice/strategy/passkey/passkey_login.go b/selfservice/strategy/passkey/passkey_login.go
index 63d5ec66f2f0..9a062af1d697 100644
--- a/selfservice/strategy/passkey/passkey_login.go
+++ b/selfservice/strategy/passkey/passkey_login.go
@@ -4,11 +4,21 @@
 package passkey
 
 import (
+	"context"
 	_ "embed"
 	"encoding/json"
 	"net/http"
 	"strings"
 
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/ory/x/otelx"
+
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+
+	"github.com/ory/kratos/x/webauthnx/js"
+
 	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/pkg/errors"
@@ -29,23 +39,13 @@ import (
 	"github.com/ory/x/decoderx"
 )
 
+var _ login.FormHydrator = new(Strategy)
+
 func (s *Strategy) RegisterLoginRoutes(r *x.RouterPublic) {
 	webauthnx.RegisterWebauthnRoute(r)
 }
 
-func (s *Strategy) PopulateLoginMethod(r *http.Request, aal identity.AuthenticatorAssuranceLevel, sr *login.Flow) error {
-	if sr.Type != flow.TypeBrowser || aal != identity.AuthenticatorAssuranceLevel1 {
-		return nil
-	}
-
-	return s.populateLoginMethodForPasskeys(r, sr)
-}
-
 func (s *Strategy) populateLoginMethodForPasskeys(r *http.Request, loginFlow *login.Flow) error {
-	if loginFlow.IsForced() {
-		return s.populateLoginMethodForRefresh(r, loginFlow)
-	}
-
 	ctx := r.Context()
 
 	loginFlow.UI.SetCSRF(s.d.GenerateCSRFToken(r))
@@ -100,7 +100,8 @@ func (s *Strategy) populateLoginMethodForPasskeys(r *http.Request, loginFlow *lo
 			Name:       node.PasskeyChallenge,
 			Type:       node.InputAttributeTypeHidden,
 			FieldValue: string(injectWebAuthnOptions),
-		}})
+		},
+	})
 
 	loginFlow.UI.Nodes.Upsert(webauthnx.NewWebAuthnScript(s.d.Config().SelfPublicURL(ctx)))
 
@@ -109,122 +110,12 @@ func (s *Strategy) populateLoginMethodForPasskeys(r *http.Request, loginFlow *lo
 		Group: node.PasskeyGroup,
 		Meta:  &node.Meta{},
 		Attributes: &node.InputAttributes{
-			Name: node.PasskeyLogin,
-			Type: node.InputAttributeTypeHidden,
-		}})
-
-	loginFlow.UI.Nodes.Append(node.NewInputField(
-		node.PasskeyLoginTrigger,
-		"",
-		node.PasskeyGroup,
-		node.InputAttributeTypeButton,
-		node.WithInputAttributes(func(attr *node.InputAttributes) {
-			attr.OnClick = "window.__oryPasskeyLogin()"                // this function is defined in webauthn.js
-			attr.OnLoad = "window.__oryPasskeyLoginAutocompleteInit()" // same here
-		}),
-	).WithMetaLabel(text.NewInfoSelfServiceLoginPasskey()))
-
-	return nil
-}
-
-func (s *Strategy) populateLoginMethodForRefresh(r *http.Request, loginFlow *login.Flow) error {
-	ctx := r.Context()
-
-	identifier, id, _ := flowhelpers.GuessForcedLoginIdentifier(r, s.d, loginFlow, s.ID())
-	if identifier == "" {
-		return nil
-	}
-
-	id, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), id.ID)
-	if err != nil {
-		return err
-	}
-
-	cred, ok := id.GetCredentials(s.ID())
-	if !ok {
-		// Identity has no passkey
-		return nil
-	}
-
-	var conf identity.CredentialsWebAuthnConfig
-	if err := json.Unmarshal(cred.Config, &conf); err != nil {
-		return errors.WithStack(err)
-	}
-
-	webAuthCreds := conf.Credentials.ToWebAuthn()
-	if len(webAuthCreds) == 0 {
-		// Identity has no webauthn
-		return nil
-	}
-
-	passkeyIdentifier := s.PasskeyDisplayNameFromIdentity(ctx, id)
-
-	webAuthn, err := webauthn.New(s.d.Config().PasskeyConfig(ctx))
-	if err != nil {
-		return errors.WithStack(err)
-	}
-	option, sessionData, err := webAuthn.BeginLogin(&webauthnx.User{
-		Name:        passkeyIdentifier,
-		ID:          conf.UserHandle,
-		Credentials: webAuthCreds,
-		Config:      webAuthn.Config,
+			Name:          node.PasskeyLogin,
+			Type:          node.InputAttributeTypeHidden,
+			OnLoad:        js.WebAuthnTriggersPasskeyLoginAutocompleteInit.String() + "()",
+			OnLoadTrigger: js.WebAuthnTriggersPasskeyLoginAutocompleteInit,
+		},
 	})
-	if err != nil {
-		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to initiate passkey login.").WithDebug(err.Error()))
-	}
-
-	loginFlow.InternalContext, err = sjson.SetBytes(
-		loginFlow.InternalContext,
-		flow.PrefixInternalContextKey(s.ID(), InternalContextKeySessionData),
-		sessionData,
-	)
-	if err != nil {
-		return errors.WithStack(err)
-	}
-
-	injectWebAuthnOptions, err := json.Marshal(option)
-	if err != nil {
-		return errors.WithStack(err)
-	}
-
-	loginFlow.UI.Nodes.Upsert(&node.Node{
-		Type:  node.Input,
-		Group: node.PasskeyGroup,
-		Meta:  &node.Meta{},
-		Attributes: &node.InputAttributes{
-			Name:       node.PasskeyChallenge,
-			Type:       node.InputAttributeTypeHidden,
-			FieldValue: string(injectWebAuthnOptions),
-		}})
-
-	loginFlow.UI.Nodes.Append(webauthnx.NewWebAuthnScript(s.d.Config().SelfPublicURL(ctx)))
-
-	loginFlow.UI.Nodes.Upsert(&node.Node{
-		Type:  node.Input,
-		Group: node.PasskeyGroup,
-		Meta:  &node.Meta{},
-		Attributes: &node.InputAttributes{
-			Name: node.PasskeyLogin,
-			Type: node.InputAttributeTypeHidden,
-		}})
-
-	loginFlow.UI.Nodes.Append(node.NewInputField(
-		node.PasskeyLoginTrigger,
-		"",
-		node.PasskeyGroup,
-		node.InputAttributeTypeButton,
-		node.WithInputAttributes(func(attr *node.InputAttributes) {
-			attr.OnClick = "window.__oryPasskeyLogin()" // this function is defined in webauthn.js
-		}),
-	).WithMetaLabel(text.NewInfoSelfServiceLoginPasskey()))
-
-	loginFlow.UI.SetCSRF(s.d.GenerateCSRFToken(r))
-	loginFlow.UI.SetNode(node.NewInputField(
-		"identifier",
-		passkeyIdentifier,
-		node.DefaultGroup,
-		node.InputAttributeTypeHidden,
-	))
 
 	return nil
 }
@@ -259,12 +150,17 @@ type updateLoginFlowWithPasskeyMethod struct {
 }
 
 func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, _ *session.Session) (i *identity.Identity, err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.passkey.Strategy.Login")
+	defer otelx.End(span, &err)
+
 	if f.Type != flow.TypeBrowser {
+		span.SetAttributes(attribute.String("not_responsible_reason", "flow type is not browser"))
 		return nil, flow.ErrStrategyNotResponsible
 	}
 
 	var p updateLoginFlowWithPasskeyMethod
 	if err := s.hd.Decode(r, &p,
+		decoderx.HTTPKeepRequestBody(true),
 		decoderx.HTTPDecoderSetValidatePayloads(true),
 		decoderx.MustHTTPRawJSONSchemaCompiler(loginSchema),
 		decoderx.HTTPDecoderJSONFollowsFormFormat()); err != nil {
@@ -275,26 +171,28 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 		// This method has only two submit buttons
 		p.Method = s.SettingsStrategyID()
 	} else {
+		span.SetAttributes(attribute.String("not_responsible_reason", "no login value and mismatched method"))
 		return nil, flow.ErrStrategyNotResponsible
 	}
 
-	if err := flow.MethodEnabledAndAllowed(r.Context(), f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
+	if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
 		return nil, s.handleLoginError(r, f, err)
 	}
 
-	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 		return nil, s.handleLoginError(r, f, err)
 	}
 
-	return s.loginPasswordless(w, r, f, &p)
+	return s.loginPasswordless(ctx, w, r, f, &p)
 }
 
-func (s *Strategy) loginPasswordless(w http.ResponseWriter, r *http.Request, f *login.Flow, p *updateLoginFlowWithPasskeyMethod) (i *identity.Identity, err error) {
-	if err = login.CheckAAL(f, identity.AuthenticatorAssuranceLevel1); err != nil {
+func (s *Strategy) loginPasswordless(ctx context.Context, w http.ResponseWriter, r *http.Request, f *login.Flow, p *updateLoginFlowWithPasskeyMethod) (i *identity.Identity, err error) {
+	if err := login.CheckAAL(f, identity.AuthenticatorAssuranceLevel1); err != nil {
+		trace.SpanFromContext(ctx).SetAttributes(attribute.String("not_responsible_reason", "requested AAL is not AAL1"))
 		return nil, s.handleLoginError(r, f, err)
 	}
 
-	if err = flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 		return nil, s.handleLoginError(r, f, err)
 	}
 
@@ -302,11 +200,11 @@ func (s *Strategy) loginPasswordless(w http.ResponseWriter, r *http.Request, f *
 		// Reset all nodes to not confuse users.
 		f.UI.Nodes = node.Nodes{}
 
-		if err = s.populateLoginMethodForPasskeys(r, f); err != nil {
+		if err := s.populateLoginMethodForPasskeys(r, f); err != nil {
 			return nil, s.handleLoginError(r, f, err)
 		}
 
-		redirectTo := f.AppendTo(s.d.Config().SelfServiceFlowLoginUI(r.Context())).String()
+		redirectTo := f.AppendTo(s.d.Config().SelfServiceFlowLoginUI(ctx)).String()
 		if x.IsJSONRequest(r) {
 			s.d.Writer().WriteError(w, r, flow.NewBrowserLocationChangeRequiredError(redirectTo))
 		} else {
@@ -316,12 +214,10 @@ func (s *Strategy) loginPasswordless(w http.ResponseWriter, r *http.Request, f *
 		return nil, errors.WithStack(flow.ErrCompletedByStrategy)
 	}
 
-	return s.loginAuthenticate(w, r, f, p, identity.AuthenticatorAssuranceLevel1)
+	return s.loginAuthenticate(ctx, r, f, p, identity.AuthenticatorAssuranceLevel1)
 }
 
-func (s *Strategy) loginAuthenticate(_ http.ResponseWriter, r *http.Request, f *login.Flow, p *updateLoginFlowWithPasskeyMethod, _ identity.AuthenticatorAssuranceLevel) (*identity.Identity, error) {
-	ctx := r.Context()
-
+func (s *Strategy) loginAuthenticate(ctx context.Context, r *http.Request, f *login.Flow, p *updateLoginFlowWithPasskeyMethod, _ identity.AuthenticatorAssuranceLevel) (*identity.Identity, error) {
 	web, err := webauthn.New(s.d.Config().PasskeyConfig(ctx))
 	if err != nil {
 		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to get webAuthn config.").WithDebug(err.Error())))
@@ -370,8 +266,7 @@ func (s *Strategy) loginAuthenticate(_ http.ResponseWriter, r *http.Request, f *
 			WithWrap(err)))
 	}
 
-	webAuthCreds := o.Credentials.PasswordlessOnly()
-
+	webAuthCreds := o.Credentials.PasswordlessOnly(&webAuthnResponse.Response.AuthenticatorData.Flags)
 	_, err = web.ValidateDiscoverableLogin(
 		func(rawID, userHandle []byte) (user webauthn.User, err error) {
 			return webauthnx.NewUser(userHandle, webAuthCreds, web.Config), nil
@@ -393,3 +288,197 @@ func (s *Strategy) loginAuthenticate(_ http.ResponseWriter, r *http.Request, f *
 
 	return i, nil
 }
+
+func (s *Strategy) PopulateLoginMethodFirstFactorRefresh(r *http.Request, f *login.Flow) error {
+	if f.Type != flow.TypeBrowser {
+		return nil
+	}
+
+	ctx := r.Context()
+
+	identifier, id, _ := flowhelpers.GuessForcedLoginIdentifier(r, s.d, f, s.ID())
+	if identifier == "" {
+		return nil
+	}
+
+	id, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, id.ID)
+	if err != nil {
+		return err
+	}
+
+	cred, ok := id.GetCredentials(s.ID())
+	if !ok {
+		// Identity has no passkey
+		return nil
+	}
+
+	var conf identity.CredentialsWebAuthnConfig
+	if err := json.Unmarshal(cred.Config, &conf); err != nil {
+		return errors.WithStack(err)
+	}
+
+	webAuthCreds := conf.Credentials.ToWebAuthn()
+	if len(webAuthCreds) == 0 {
+		// Identity has no webauthn
+		return nil
+	}
+
+	passkeyIdentifier := s.PasskeyDisplayNameFromIdentity(ctx, id)
+
+	webAuthn, err := webauthn.New(s.d.Config().PasskeyConfig(ctx))
+	if err != nil {
+		return errors.WithStack(err)
+	}
+	option, sessionData, err := webAuthn.BeginLogin(&webauthnx.User{
+		Name:        passkeyIdentifier,
+		ID:          conf.UserHandle,
+		Credentials: webAuthCreds,
+		Config:      webAuthn.Config,
+	})
+	if err != nil {
+		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to initiate passkey login.").WithDebug(err.Error()))
+	}
+
+	f.InternalContext, err = sjson.SetBytes(
+		f.InternalContext,
+		flow.PrefixInternalContextKey(s.ID(), InternalContextKeySessionData),
+		sessionData,
+	)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	injectWebAuthnOptions, err := json.Marshal(option)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	f.UI.Nodes.Upsert(&node.Node{
+		Type:  node.Input,
+		Group: node.PasskeyGroup,
+		Meta:  &node.Meta{},
+		Attributes: &node.InputAttributes{
+			Name:       node.PasskeyChallenge,
+			Type:       node.InputAttributeTypeHidden,
+			FieldValue: string(injectWebAuthnOptions),
+		},
+	})
+
+	f.UI.Nodes.Append(webauthnx.NewWebAuthnScript(s.d.Config().SelfPublicURL(ctx)))
+
+	f.UI.Nodes.Upsert(&node.Node{
+		Type:  node.Input,
+		Group: node.PasskeyGroup,
+		Meta:  &node.Meta{},
+		Attributes: &node.InputAttributes{
+			Name: node.PasskeyLogin,
+			Type: node.InputAttributeTypeHidden,
+		},
+	})
+
+	f.UI.Nodes.Append(node.NewInputField(
+		node.PasskeyLoginTrigger,
+		"",
+		node.PasskeyGroup,
+		node.InputAttributeTypeButton,
+		node.WithInputAttributes(func(attr *node.InputAttributes) {
+			//nolint:staticcheck
+			attr.OnClick = js.WebAuthnTriggersPasskeyLogin.String() + "()" // this function is defined in webauthn.js
+			attr.OnClickTrigger = js.WebAuthnTriggersPasskeyLogin
+		}),
+	).WithMetaLabel(text.NewInfoSelfServiceLoginPasskey()))
+
+	f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
+	f.UI.SetNode(node.NewInputField(
+		"identifier",
+		passkeyIdentifier,
+		node.DefaultGroup,
+		node.InputAttributeTypeHidden,
+	))
+
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodFirstFactor(r *http.Request, f *login.Flow) error {
+	if f.Type != flow.TypeBrowser {
+		return nil
+	}
+
+	if err := s.populateLoginMethodForPasskeys(r, f); err != nil {
+		return err
+	}
+
+	f.UI.Nodes.Append(node.NewInputField(
+		node.PasskeyLoginTrigger,
+		"",
+		node.PasskeyGroup,
+		node.InputAttributeTypeButton,
+		node.WithInputAttributes(func(attr *node.InputAttributes) {
+			//nolint:staticcheck
+			attr.OnClick = js.WebAuthnTriggersPasskeyLogin.String() + "()" // this function is defined in webauthn.js
+			attr.OnClickTrigger = js.WebAuthnTriggersPasskeyLogin
+		}),
+	).WithMetaLabel(text.NewInfoSelfServiceLoginPasskey()))
+
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactor(r *http.Request, sr *login.Flow) error {
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactorRefresh(r *http.Request, sr *login.Flow) error {
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstCredentials(r *http.Request, sr *login.Flow, opts ...login.FormHydratorModifier) error {
+	if sr.Type != flow.TypeBrowser {
+		return errors.WithStack(idfirst.ErrNoCredentialsFound)
+	}
+
+	ctx := r.Context()
+	o := login.NewFormHydratorOptions(opts)
+
+	var count int
+	if o.IdentityHint != nil {
+		var err error
+		// If we have an identity hint we can perform identity credentials discovery and
+		// hide this credential if it should not be included.
+		count, err = s.CountActiveFirstFactorCredentials(ctx, o.IdentityHint.Credentials)
+		if err != nil {
+			return err
+		}
+	}
+
+	if count > 0 || s.d.Config().SecurityAccountEnumerationMitigate(ctx) {
+		sr.UI.Nodes.Append(node.NewInputField(
+			node.PasskeyLoginTrigger,
+			"",
+			node.PasskeyGroup,
+			node.InputAttributeTypeButton,
+			node.WithInputAttributes(func(attr *node.InputAttributes) {
+				//nolint:staticcheck
+				attr.OnClick = js.WebAuthnTriggersPasskeyLogin.String() + "()" // this function is defined in webauthn.js
+				attr.OnClickTrigger = js.WebAuthnTriggersPasskeyLogin
+			}),
+		).WithMetaLabel(text.NewInfoSelfServiceLoginPasskey()))
+	}
+
+	if count == 0 {
+		return errors.WithStack(idfirst.ErrNoCredentialsFound)
+	}
+
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstIdentification(r *http.Request, sr *login.Flow) error {
+	if sr.Type != flow.TypeBrowser {
+		return nil
+	}
+
+	if err := s.populateLoginMethodForPasskeys(r, sr); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/selfservice/strategy/passkey/passkey_login_test.go b/selfservice/strategy/passkey/passkey_login_test.go
index cae6aa0ee4dd..028d7281c5e6 100644
--- a/selfservice/strategy/passkey/passkey_login_test.go
+++ b/selfservice/strategy/passkey/passkey_login_test.go
@@ -8,22 +8,31 @@ import (
 	_ "embed"
 	"encoding/json"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"testing"
+	"time"
+
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+
+	configtesthelpers "github.com/ory/kratos/driver/config/testhelpers"
 
 	"github.com/gofrs/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/tidwall/gjson"
 
+	"github.com/ory/kratos/driver"
 	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/internal"
 	"github.com/ory/kratos/internal/testhelpers"
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/login"
 	"github.com/ory/kratos/selfservice/strategy/passkey"
 	"github.com/ory/kratos/text"
 	"github.com/ory/kratos/ui/node"
+	"github.com/ory/kratos/x"
 	"github.com/ory/x/snapshotx"
 )
 
@@ -45,12 +54,12 @@ func TestPopulateLoginMethod(t *testing.T) {
 
 	t.Run("case=should not handle AAL2", func(t *testing.T) {
 		loginFlow := &login.Flow{Type: flow.TypeBrowser}
-		assert.Nil(t, s.PopulateLoginMethod(nil, identity.AuthenticatorAssuranceLevel2, loginFlow))
+		assert.Nil(t, s.PopulateLoginMethodSecondFactor(nil, loginFlow))
 	})
 
 	t.Run("case=should not handle API flows", func(t *testing.T) {
 		loginFlow := &login.Flow{Type: flow.TypeAPI}
-		assert.Nil(t, s.PopulateLoginMethod(nil, identity.AuthenticatorAssuranceLevel1, loginFlow))
+		assert.Nil(t, s.PopulateLoginMethodFirstFactor(nil, loginFlow))
 	})
 }
 
@@ -209,7 +218,14 @@ func TestCompleteLogin(t *testing.T) {
 
 				actualFlow, err := fix.reg.LoginFlowPersister().GetLoginFlow(context.Background(), uuid.FromStringOrNil(f.Id))
 				require.NoError(t, err)
+
 				assert.Empty(t, gjson.GetBytes(actualFlow.InternalContext, flow.PrefixInternalContextKey(identity.CredentialsTypePasskey, passkey.InternalContextKeySessionData)))
+				if spa {
+					assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(body, "continue_with.0.action").String(), "%s", body)
+					assert.Contains(t, gjson.Get(body, "continue_with.0.redirect_browser_to").String(), fix.conf.SelfServiceBrowserDefaultReturnTo(ctx).String(), "%s", body)
+				} else {
+					assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
+				}
 			}
 
 			// We test here that login works even if the identity schema contains
@@ -233,8 +249,8 @@ func TestCompleteLogin(t *testing.T) {
 		fix.conf.MustSet(ctx, config.ViperKeySessionWhoAmIAAL, "aal1")
 		loginFixtureSuccessEmail := gjson.GetBytes(loginSuccessIdentity, "traits.email").String()
 
-		run := func(t *testing.T, id *identity.Identity, context, response []byte, isSPA bool, expectedAAL identity.AuthenticatorAssuranceLevel) {
-			body, res, f := fix.submitWebAuthnLogin(t, isSPA, id, context, func(values url.Values) {
+		run := func(t *testing.T, ctx context.Context, id *identity.Identity, context, response []byte, isSPA bool, expectedAAL identity.AuthenticatorAssuranceLevel) {
+			body, res, f := fix.submitWebAuthnLogin(t, ctx, isSPA, id, context, func(values url.Values) {
 				values.Set("identifier", loginFixtureSuccessEmail)
 				values.Set(node.PasskeyLogin, string(response))
 			}, testhelpers.InitFlowWithRefresh())
@@ -290,10 +306,166 @@ func TestCompleteLogin(t *testing.T) {
 					"spa",
 				} {
 					t.Run(f, func(t *testing.T) {
-						run(t, id, tc.context, tc.response, f == "spa", expectedAAL)
+						run(t, ctx, id, tc.context, tc.response, f == "spa", expectedAAL)
 					})
 				}
 			})
 		}
 	})
 }
+
+func createIdentity(t *testing.T, ctx context.Context, reg driver.Registry, id uuid.UUID) *identity.Identity {
+	i := identity.NewIdentity("default")
+	i.SetCredentials(identity.CredentialsTypePasskey, identity.Credentials{
+		Identifiers: []string{id.String()},
+		Config:      loginPasswordlessCredentials,
+		Type:        identity.CredentialsTypePasskey,
+		Version:     1,
+	})
+
+	require.NoError(t, reg.IdentityManager().Create(ctx, i))
+	return i
+}
+
+func TestFormHydration(t *testing.T) {
+	ctx := context.Background()
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+
+	ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypePasskey)+".enabled", true)
+	ctx = configtesthelpers.WithConfigValue(
+		ctx,
+		config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypePasskey)+".config",
+		map[string]interface{}{
+			"rp": map[string]interface{}{
+				"display_name": "foo",
+				"id":           "localhost",
+				"origins":      []string{"http://localhost"},
+			},
+		},
+	)
+	ctx = testhelpers.WithDefaultIdentitySchema(ctx, "file://stub/login.schema.json")
+
+	s, err := reg.AllLoginStrategies().Strategy(identity.CredentialsTypePasskey)
+	require.NoError(t, err)
+	fh, ok := s.(login.FormHydrator)
+	require.True(t, ok)
+
+	toSnapshot := func(t *testing.T, f *login.Flow) {
+		t.Helper()
+		// The CSRF token has a unique value that messes with the snapshot - ignore it.
+		f.UI.Nodes.ResetNodes("csrf_token")
+		f.UI.Nodes.ResetNodes("passkey_challenge")
+		snapshotx.SnapshotT(t, f.UI.Nodes, snapshotx.ExceptNestedKeys("nonce", "src"))
+	}
+
+	newFlow := func(ctx context.Context, t *testing.T) (*http.Request, *login.Flow) {
+		r := httptest.NewRequest("GET", "/self-service/login/browser", nil)
+		r = r.WithContext(ctx)
+		t.Helper()
+		f, err := login.NewFlow(conf, time.Minute, "csrf_token", r, flow.TypeBrowser)
+		f.UI.Nodes = make(node.Nodes, 0)
+		require.NoError(t, err)
+		return r, f
+	}
+
+	t.Run("method=PopulateLoginMethodSecondFactor", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+		require.NoError(t, fh.PopulateLoginMethodSecondFactor(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodFirstFactor", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodFirstFactor(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodFirstFactorRefresh", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+
+		id := createIdentity(t, ctx, reg, x.NewUUID())
+		r.Header = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id).Transport.(*testhelpers.TransportWithHeader).GetHeader()
+		f.Refresh = true
+
+		require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodSecondFactorRefresh", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodSecondFactorRefresh(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstCredentials", func(t *testing.T) {
+		t.Run("case=no options", func(t *testing.T) {
+			t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, false)
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+
+			t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+		})
+
+		t.Run("case=WithIdentifier", func(t *testing.T) {
+			t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, false)
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+
+			t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+		})
+
+		t.Run("case=WithIdentityHint", func(t *testing.T) {
+			t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+
+				id := identity.NewIdentity("test-provider")
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+
+			t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, false)
+
+				t.Run("case=identity has passkey", func(t *testing.T) {
+					identifier := x.NewUUID()
+					id := createIdentity(t, ctx, reg, identifier)
+
+					r, f := newFlow(ctx, t)
+					require.NoError(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)))
+					toSnapshot(t, f)
+				})
+
+				t.Run("case=identity does not have a passkey", func(t *testing.T) {
+					id := identity.NewIdentity("default")
+					r, f := newFlow(ctx, t)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+			})
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstIdentification", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodIdentifierFirstIdentification(r, f))
+		toSnapshot(t, f)
+	})
+}
diff --git a/selfservice/strategy/passkey/passkey_registration.go b/selfservice/strategy/passkey/passkey_registration.go
index 88efd420d725..1b3a2edbc21c 100644
--- a/selfservice/strategy/passkey/passkey_registration.go
+++ b/selfservice/strategy/passkey/passkey_registration.go
@@ -11,6 +11,12 @@ import (
 	"net/url"
 	"strings"
 
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/ory/x/otelx"
+
+	"github.com/ory/kratos/x/webauthnx/js"
+
 	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/pkg/errors"
@@ -95,9 +101,11 @@ func (s *Strategy) decode(r *http.Request) (*updateRegistrationFlowWithPasskeyMe
 }
 
 func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, regFlow *registration.Flow, ident *identity.Identity) (err error) {
-	ctx := r.Context()
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.passkey.Strategy.Register")
+	defer otelx.End(span, &err)
 
 	if regFlow.Type != flow.TypeBrowser {
+		span.SetAttributes(attribute.String("not_responsible_reason", "flow type is not browser"))
 		return flow.ErrStrategyNotResponsible
 	}
 
@@ -110,6 +118,7 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, regFlow *reg
 
 	if params.Register == "" ||
 		params.Register == "true" { // The React SDK sends "true" on empty values, so we ignore these.
+		span.SetAttributes(attribute.String("not_responsible_reason", "register is empty"))
 		return flow.ErrStrategyNotResponsible
 	}
 
@@ -138,7 +147,7 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, regFlow *reg
 			herodot.ErrInternalServerError.WithReasonf("Expected WebAuthN in internal context to be an object but got: %s", err)))
 	}
 
-	if webAuthnSess.UserID == nil || len(webAuthnSess.UserID) == 0 {
+	if len(webAuthnSess.UserID) == 0 {
 		return s.handleRegistrationError(w, r, regFlow, params, errors.WithStack(
 			herodot.ErrInternalServerError.WithReasonf("Expected WebAuthN session data to contain a user ID")))
 	}
@@ -264,7 +273,8 @@ func (s *Strategy) PopulateRegistrationMethod(r *http.Request, regFlow *registra
 			Name:       node.PasskeyCreateData,
 			Type:       node.InputAttributeTypeHidden,
 			FieldValue: string(injectWebAuthnOptions),
-		}})
+		},
+	})
 
 	regFlow.UI.Nodes.Upsert(&node.Node{
 		Type:  node.Input,
@@ -273,17 +283,20 @@ func (s *Strategy) PopulateRegistrationMethod(r *http.Request, regFlow *registra
 		Attributes: &node.InputAttributes{
 			Name: node.PasskeyRegister,
 			Type: node.InputAttributeTypeHidden,
-		}})
+		},
+	})
 
 	regFlow.UI.Nodes.Append(&node.Node{
 		Type:  node.Input,
 		Group: node.PasskeyGroup,
 		Meta:  &node.Meta{Label: text.NewInfoSelfServiceRegistrationRegisterPasskey()},
 		Attributes: &node.InputAttributes{
-			Name:    node.PasskeyRegisterTrigger,
-			Type:    node.InputAttributeTypeButton,
-			OnClick: "window.__oryPasskeyRegistration()", // defined in webauthn.js
-		}})
+			Name:           node.PasskeyRegisterTrigger,
+			Type:           node.InputAttributeTypeButton,
+			OnClick:        js.WebAuthnTriggersPasskeyRegistration.String() + "()", // defined in webauthn.js
+			OnClickTrigger: js.WebAuthnTriggersPasskeyRegistration,
+		},
+	})
 
 	// Passkey nodes end
 
diff --git a/selfservice/strategy/passkey/passkey_registration_test.go b/selfservice/strategy/passkey/passkey_registration_test.go
index d495e8c4dfe4..3e0338dcc357 100644
--- a/selfservice/strategy/passkey/passkey_registration_test.go
+++ b/selfservice/strategy/passkey/passkey_registration_test.go
@@ -8,6 +8,10 @@ import (
 	"net/url"
 	"testing"
 
+	"github.com/ory/x/assertx"
+
+	"github.com/ory/kratos/selfservice/flow"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/tidwall/gjson"
@@ -26,12 +30,21 @@ import (
 var (
 	flows = []string{"spa", "browser"}
 
-	//go:embed fixtures/registration/success/response.json
+	//go:embed fixtures/registration/success/browser/response.json
 	registrationFixtureSuccessResponse []byte
-	//go:embed fixtures/registration/success/internal_context.json
-	registrationFixtureSuccessInternalContext []byte
+
+	//go:embed fixtures/registration/success/browser/internal_context.json
+	registrationFixtureSuccessBrowserInternalContext []byte
+
+	//go:embed fixtures/registration/success/android/response.json
+	registrationFixtureSuccessAndroidResponse []byte
+
+	//go:embed fixtures/registration/success/android/internal_context.json
+	registrationFixtureSuccessAndroidInternalContext []byte
+
 	//go:embed fixtures/registration/failure/internal_context_missing_user_id.json
 	registrationFixtureFailureInternalContextMissingUserID []byte
+
 	//go:embed fixtures/registration/failure/internal_context_wrong_user_id.json
 	registrationFixtureFailureInternalContextWrongUserID []byte
 )
@@ -178,7 +191,7 @@ func TestRegistration(t *testing.T) {
 
 		for _, f := range flows {
 			t.Run("type="+f, func(t *testing.T) {
-				actual, _, _ := fix.submitPasskeyRegistration(t, f, testhelpers.NewClientWithCookies(t), values)
+				actual, _, _ := fix.submitPasskeyBrowserRegistration(t, f, testhelpers.NewClientWithCookies(t), values)
 				assert.NotEmpty(t, gjson.Get(actual, "id").String(), "%s", actual)
 				assert.Contains(t, gjson.Get(actual, "ui.action").String(), fix.publicTS.URL+registration.RouteSubmitFlow, "%s", actual)
 				registrationhelpers.CheckFormContent(t, []byte(actual), node.PasskeyRegister, "csrf_token", "traits.username", "traits.foobar")
@@ -218,7 +231,7 @@ func TestRegistration(t *testing.T) {
 
 				for _, f := range flows {
 					t.Run("type="+f, func(t *testing.T) {
-						actual, _, _ := fix.submitPasskeyRegistration(t, f, testhelpers.NewClientWithCookies(t), values,
+						actual, _, _ := fix.submitPasskeyBrowserRegistration(t, f, testhelpers.NewClientWithCookies(t), values,
 							withInternalContext(sqlxx.JSONRawMessage(tc.internalContext)))
 						if flowIsSPA(f) {
 							assert.Equal(t, "Internal Server Error", gjson.Get(actual, "error.status").String(), "%s", actual)
@@ -297,7 +310,7 @@ func TestRegistration(t *testing.T) {
 
 					i, _, err := fix.reg.PrivilegedIdentityPool().FindByCredentialsIdentifier(fix.ctx, identity.CredentialsTypePasskey, userID)
 					require.NoError(t, err)
-					assert.Equal(t, "aal1", i.AvailableAAL.String)
+					assert.Equal(t, "aal1", i.InternalAvailableAAL.String)
 					assert.Equal(t, email, gjson.GetBytes(i.Traits, "username").String(), "%s", actual)
 				})
 			}
@@ -327,6 +340,13 @@ func TestRegistration(t *testing.T) {
 					i, _, err := fix.reg.PrivilegedIdentityPool().FindByCredentialsIdentifier(fix.ctx, identity.CredentialsTypePasskey, userID)
 					require.NoError(t, err)
 					assert.Equal(t, email, gjson.GetBytes(i.Traits, "username").String(), "%s", actual)
+
+					if f == "spa" {
+						assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(actual, "continue_with.0.action").String(), "%s", actual)
+						assert.Contains(t, gjson.Get(actual, "continue_with.0.redirect_browser_to").String(), fix.redirNoSessionTS.URL+"/registration-return-ts", "%s", actual)
+					} else {
+						assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
+					}
 				})
 			}
 		})
@@ -406,5 +426,49 @@ func TestRegistration(t *testing.T) {
 				})
 			}
 		})
+
+		t.Run("case=should create the identity when using android", func(t *testing.T) {
+			fix.useRedirNoSessionTS()
+			t.Cleanup(fix.useRedirTS)
+			fix.disableSessionAfterRegistration()
+
+			prevRPID := fix.conf.GetProvider(fix.ctx).String(config.ViperKeyPasskeyRPID)
+			prevOrigins := fix.conf.GetProvider(fix.ctx).String(config.ViperKeyPasskeyRPOrigins)
+
+			fix.conf.MustSet(fix.ctx, config.ViperKeyPasskeyRPID, "www.troweprice.com")
+			fix.conf.MustSet(fix.ctx, config.ViperKeyPasskeyRPOrigins, []string{"android:apk-key-hash:S2RfNYgJmQiKgd6-sdbjW7phcL_OTP4vGE8L51Q2GB0"})
+			t.Cleanup(func() {
+				fix.conf.MustSet(fix.ctx, config.ViperKeyPasskeyRPID, prevRPID)
+				fix.conf.MustSet(fix.ctx, config.ViperKeyPasskeyRPOrigins, prevOrigins)
+			})
+
+			for _, f := range flows {
+				t.Run("type="+f, func(t *testing.T) {
+					email := f + "-" + testhelpers.RandomEmail()
+					userID := f + "-user-" + randx.MustString(8, randx.AlphaNum)
+
+					expectReturnTo := fix.redirNoSessionTS.URL + "/registration-return-ts"
+					actual, res, _ := fix.submitPasskeyAndroidRegistration(t, f, testhelpers.NewClientWithCookies(t), func(v url.Values) {
+						values(email)(v)
+						v.Set(node.PasskeyRegister, string(registrationFixtureSuccessAndroidResponse))
+					}, withUserID(userID))
+
+					if f == "spa" {
+						expectReturnTo = fix.publicTS.URL
+						assert.Equal(t, email, gjson.Get(actual, "identity.traits.username").String(), "%s", actual)
+						assert.False(t, gjson.Get(actual, "session").Exists(), "because the registration yielded no session, the user is not expected to be signed in: %s", actual)
+					} else {
+						assert.Equal(t, "null\n", actual, "because the registration yielded no session, the user is not expected to be signed in: %s", actual)
+					}
+
+					assert.Contains(t, res.Request.URL.String(), expectReturnTo, "%+v\n\t%s", res.Request, assertx.PrettifyJSONPayload(t, actual))
+
+					i, _, err := fix.reg.PrivilegedIdentityPool().FindByCredentialsIdentifier(fix.ctx, identity.CredentialsTypePasskey, userID)
+					require.NoError(t, err)
+					assert.Equal(t, "aal1", i.InternalAvailableAAL.String)
+					assert.Equal(t, email, gjson.GetBytes(i.Traits, "username").String(), "%s", actual)
+				})
+			}
+		})
 	})
 }
diff --git a/selfservice/strategy/passkey/passkey_settings.go b/selfservice/strategy/passkey/passkey_settings.go
index 548a261e442b..0af4a4c2a214 100644
--- a/selfservice/strategy/passkey/passkey_settings.go
+++ b/selfservice/strategy/passkey/passkey_settings.go
@@ -4,6 +4,7 @@
 package passkey
 
 import (
+	"context"
 	_ "embed"
 	"encoding/json"
 	"fmt"
@@ -11,6 +12,12 @@ import (
 	"strings"
 	"time"
 
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/ory/x/otelx"
+
+	"github.com/ory/kratos/x/webauthnx/js"
+
 	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/gofrs/uuid"
@@ -41,24 +48,21 @@ const (
 	InternalContextKeySessionData = "session_data"
 )
 
-func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity, f *settings.Flow) error {
+func (s *Strategy) PopulateSettingsMethod(ctx context.Context, r *http.Request, id *identity.Identity, f *settings.Flow) (err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.passkey.Strategy.PopulateSettingsMethod")
+	defer otelx.End(span, &err)
+
 	if f.Type != flow.TypeBrowser {
 		return nil
 	}
 
 	f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
-
-	confidentialIdentity, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), id.ID)
+	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(ctx, id)
 	if err != nil {
 		return err
 	}
 
-	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(r.Context(), confidentialIdentity)
-	if err != nil {
-		return err
-	}
-
-	if webAuthns, err := s.identityListWebAuthn(confidentialIdentity); errors.Is(err, sqlcon.ErrNoRows) {
+	if webAuthns, err := s.identityListWebAuthn(id); errors.Is(err, sqlcon.ErrNoRows) {
 		// Do nothing
 	} else if err != nil {
 		return err
@@ -75,12 +79,12 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 		}
 	}
 
-	web, err := webauthn.New(s.d.Config().PasskeyConfig(r.Context()))
+	web, err := webauthn.New(s.d.Config().PasskeyConfig(ctx))
 	if err != nil {
 		return errors.WithStack(err)
 	}
 
-	identifier := s.PasskeyDisplayNameFromIdentity(r.Context(), id)
+	identifier := s.PasskeyDisplayNameFromIdentity(ctx, id)
 	if identifier == "" {
 		f.UI.Messages.Add(text.NewErrorValidationIdentifierMissing())
 		return nil
@@ -89,7 +93,7 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 	user := &webauthnx.User{
 		Name:   identifier,
 		ID:     []byte(randx.MustString(64, randx.AlphaNum)),
-		Config: s.d.Config().PasskeyConfig(r.Context()),
+		Config: s.d.Config().PasskeyConfig(ctx),
 	}
 	option, sessionData, err := web.BeginRegistration(user)
 	if err != nil {
@@ -106,7 +110,7 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 		return errors.WithStack(err)
 	}
 
-	f.UI.Nodes.Upsert(webauthnx.NewWebAuthnScript(s.d.Config().SelfPublicURL(r.Context())))
+	f.UI.Nodes.Upsert(webauthnx.NewWebAuthnScript(s.d.Config().SelfPublicURL(ctx)))
 
 	f.UI.Nodes.Upsert(node.NewInputField(
 		node.PasskeyRegisterTrigger,
@@ -114,7 +118,9 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 		node.PasskeyGroup,
 		node.InputAttributeTypeButton,
 		node.WithInputAttributes(func(a *node.InputAttributes) {
-			a.OnClick = "window.__oryPasskeySettingsRegistration()"
+			//nolint:staticcheck
+			a.OnClick = js.WebAuthnTriggersPasskeySettingsRegistration.String() + "()"
+			a.OnClickTrigger = js.WebAuthnTriggersPasskeySettingsRegistration
 		}),
 	).WithMetaLabel(text.NewInfoSelfServiceSettingsRegisterPasskey()))
 
@@ -156,36 +162,41 @@ func (s *Strategy) identityListWebAuthn(id *identity.Identity) (*identity.Creden
 	return &cc, nil
 }
 
-func (s *Strategy) Settings(w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (*settings.UpdateContext, error) {
+func (s *Strategy) Settings(ctx context.Context, w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (_ *settings.UpdateContext, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.passkey.Strategy.Settings")
+	defer otelx.End(span, &err)
+
 	if f.Type != flow.TypeBrowser {
+		span.SetAttributes(attribute.String("not_responsible_reason", "not a browser flow"))
 		return nil, errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 	var p updateSettingsFlowWithPasskeyMethod
 	ctxUpdate, err := settings.PrepareUpdate(s.d, w, r, f, ss, settings.ContinuityKey(s.SettingsStrategyID()), &p)
 	if errors.Is(err, settings.ErrContinuePreviousAction) {
-		return ctxUpdate, s.continueSettingsFlow(w, r, ctxUpdate, &p)
+		return ctxUpdate, s.continueSettingsFlow(ctx, w, r, ctxUpdate, p)
 	} else if err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	if err := s.decodeSettingsFlow(r, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
-	if len(p.Register+p.Remove) > 0 {
+	if len(p.Register)+len(p.Remove) > 0 {
 		// This method has only two submit buttons
 		p.Method = s.SettingsStrategyID()
-		if err := flow.MethodEnabledAndAllowed(r.Context(), f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
-			return nil, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
+			return nil, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 		}
 	} else {
+		span.SetAttributes(attribute.String("not_responsible_reason", "neither register nor remove provided"))
 		return nil, errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 
 	// This does not come from the payload!
 	p.Flow = ctxUpdate.Flow.ID.String()
-	if err := s.continueSettingsFlow(w, r, ctxUpdate, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+	if err := s.continueSettingsFlow(ctx, w, r, ctxUpdate, p); err != nil {
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	return ctxUpdate, nil
@@ -231,19 +242,20 @@ func (p *updateSettingsFlowWithPasskeyMethod) SetFlowID(rid uuid.UUID) {
 }
 
 func (s *Strategy) continueSettingsFlow(
+	ctx context.Context,
 	w http.ResponseWriter, r *http.Request,
-	ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithPasskeyMethod,
+	ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithPasskeyMethod,
 ) error {
 	if len(p.Register+p.Remove) > 0 {
-		if err := flow.MethodEnabledAndAllowed(r.Context(), flow.SettingsFlow, s.SettingsStrategyID(), s.SettingsStrategyID(), s.d); err != nil {
+		if err := flow.MethodEnabledAndAllowed(ctx, flow.SettingsFlow, s.SettingsStrategyID(), s.SettingsStrategyID(), s.d); err != nil {
 			return err
 		}
 
-		if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+		if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 			return err
 		}
 
-		if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(r.Context())).Before(time.Now()) {
+		if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(ctx)).Before(time.Now()) {
 			return errors.WithStack(settings.NewFlowNeedsReAuth())
 		}
 	} else {
@@ -252,16 +264,16 @@ func (s *Strategy) continueSettingsFlow(
 
 	switch {
 	case len(p.Remove) > 0:
-		return s.continueSettingsFlowRemove(w, r, ctxUpdate, p)
+		return s.continueSettingsFlowRemove(ctx, w, r, ctxUpdate, p)
 	case len(p.Register) > 0:
-		return s.continueSettingsFlowAdd(r, ctxUpdate, p)
+		return s.continueSettingsFlowAdd(ctx, ctxUpdate, p)
 	default:
 		return errors.New("ended up in unexpected state")
 	}
 }
 
-func (s *Strategy) continueSettingsFlowRemove(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithPasskeyMethod) error {
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.IdentityID)
+func (s *Strategy) continueSettingsFlowRemove(ctx context.Context, w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithPasskeyMethod) error {
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.IdentityID)
 	if err != nil {
 		return err
 	}
@@ -287,13 +299,13 @@ func (s *Strategy) continueSettingsFlowRemove(w http.ResponseWriter, r *http.Req
 		return errors.WithStack(herodot.ErrBadRequest.WithReasonf("You tried to remove a passkey which does not exist."))
 	}
 
-	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(r.Context(), i)
+	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(ctx, i)
 	if err != nil {
 		return err
 	}
 
 	if count < 2 {
-		return s.handleSettingsError(w, r, ctxUpdate, p, errors.WithStack(webauthnx.ErrNotEnoughCredentials))
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, errors.WithStack(webauthnx.ErrNotEnoughCredentials))
 	}
 
 	if len(updated) == 0 {
@@ -313,7 +325,7 @@ func (s *Strategy) continueSettingsFlowRemove(w http.ResponseWriter, r *http.Req
 	return nil
 }
 
-func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithPasskeyMethod) error {
+func (s *Strategy) continueSettingsFlowAdd(ctx context.Context, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithPasskeyMethod) error {
 	webAuthnSession := gjson.GetBytes(ctxUpdate.Flow.InternalContext, flow.PrefixInternalContextKey(s.ID(), InternalContextKeySessionData))
 	if !webAuthnSession.IsObject() {
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Expected WebAuthN in internal context to be an object."))
@@ -329,7 +341,7 @@ func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.
 		return errors.WithStack(herodot.ErrBadRequest.WithReasonf("Unable to parse WebAuthn response: %s", err))
 	}
 
-	web, err := webauthn.New(s.d.Config().PasskeyConfig(r.Context()))
+	web, err := webauthn.New(s.d.Config().PasskeyConfig(ctx))
 	if err != nil {
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to get webAuthn config.").WithDebug(err.Error()))
 	}
@@ -342,7 +354,7 @@ func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to create WebAuthn credential: %s", err))
 	}
 
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.IdentityID)
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.IdentityID)
 	if err != nil {
 		return err
 	}
@@ -363,7 +375,7 @@ func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.
 	}
 
 	i.UpsertCredentialsConfig(s.ID(), credentialsConfig, 1, identity.WithAdditionalIdentifier(string(webAuthnSess.UserID)))
-	if err := s.validateCredentials(r.Context(), i); err != nil {
+	if err := s.validateCredentials(ctx, i); err != nil {
 		return err
 	}
 
@@ -373,14 +385,14 @@ func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.
 		return err
 	}
 
-	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(r.Context(), ctxUpdate.Flow); err != nil {
+	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(ctx, ctxUpdate.Flow); err != nil {
 		return err
 	}
 
 	aal := identity.AuthenticatorAssuranceLevel1
 
 	// Since we added the method, it also means that we have authenticated it
-	if err := s.d.SessionManager().SessionAddAuthenticationMethods(r.Context(), ctxUpdate.Session.ID, session.AuthenticationMethod{
+	if err := s.d.SessionManager().SessionAddAuthenticationMethods(ctx, ctxUpdate.Session.ID, session.AuthenticationMethod{
 		Method: s.ID(),
 		AAL:    aal,
 	}); err != nil {
@@ -398,16 +410,17 @@ func (s *Strategy) decodeSettingsFlow(r *http.Request, dest interface{}) error {
 	}
 
 	return decoderx.NewHTTP().Decode(r, dest, compiler,
+		decoderx.HTTPKeepRequestBody(true),
 		decoderx.HTTPDecoderAllowedMethods("POST", "GET"),
 		decoderx.HTTPDecoderSetValidatePayloads(true),
 		decoderx.HTTPDecoderJSONFollowsFormFormat(),
 	)
 }
 
-func (s *Strategy) handleSettingsError(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithPasskeyMethod, err error) error {
+func (s *Strategy) handleSettingsError(ctx context.Context, w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithPasskeyMethod, err error) error {
 	// Do not pause flow if the flow type is an API flow as we can't save cookies in those flows.
 	if e := new(settings.FlowNeedsReAuth); errors.As(err, &e) && ctxUpdate.Flow != nil && ctxUpdate.Flow.Type == flow.TypeBrowser {
-		if err := s.d.ContinuityManager().Pause(r.Context(), w, r, settings.ContinuityKey(s.SettingsStrategyID()), settings.ContinuityOptions(p, ctxUpdate.GetSessionIdentity())...); err != nil {
+		if err := s.d.ContinuityManager().Pause(ctx, w, r, settings.ContinuityKey(s.SettingsStrategyID()), settings.ContinuityOptions(p, ctxUpdate.GetSessionIdentity())...); err != nil {
 			return err
 		}
 	}
diff --git a/selfservice/strategy/passkey/passkey_settings_test.go b/selfservice/strategy/passkey/passkey_settings_test.go
index ced111071711..781af829be3e 100644
--- a/selfservice/strategy/passkey/passkey_settings_test.go
+++ b/selfservice/strategy/passkey/passkey_settings_test.go
@@ -54,7 +54,7 @@ func TestCompleteSettings(t *testing.T) {
 		fix := newSettingsFixture(t)
 		fix.conf.MustSet(ctx, config.ViperKeyPasskeyRPID, "")
 		id := fix.createIdentity(t)
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, fix.reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, fix.reg, id)
 
 		req, err := http.NewRequest("GET", fix.publicTS.URL+settings.RouteInitBrowserFlow, nil)
 		require.NoError(t, err)
@@ -67,7 +67,7 @@ func TestCompleteSettings(t *testing.T) {
 	t.Run("case=a device is shown which can be unlinked", func(t *testing.T) {
 		id := fix.createIdentity(t)
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, fix.reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, fix.reg, id)
 		f := testhelpers.InitializeSettingsFlowViaBrowser(t, apiClient, true, fix.publicTS)
 
 		testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{
@@ -78,24 +78,11 @@ func TestCompleteSettings(t *testing.T) {
 		})
 	})
 
-	t.Run("case=invalid credentials", func(t *testing.T) {
-		id, _ := fix.createIdentityAndReturnIdentifier(t, []byte(`{invalid}`))
-
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, fix.reg, id)
-
-		req, err := http.NewRequest("GET", fix.publicTS.URL+settings.RouteInitBrowserFlow, nil)
-		require.NoError(t, err)
-		req.Header.Set("Accept", "application/json")
-		res, err := apiClient.Do(req)
-		require.NoError(t, err)
-		assert.Equal(t, http.StatusInternalServerError, res.StatusCode)
-	})
-
 	t.Run("case=one activation element is shown", func(t *testing.T) {
 		id := fix.createIdentityWithoutPasskey(t)
 		require.NoError(t, fix.reg.PrivilegedIdentityPool().UpdateIdentity(fix.ctx, id))
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, fix.reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, fix.reg, id)
 		f := testhelpers.InitializeSettingsFlowViaBrowser(t, apiClient, true, fix.publicTS)
 
 		testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{
@@ -110,7 +97,7 @@ func TestCompleteSettings(t *testing.T) {
 		id := fix.createIdentityWithoutPasskey(t)
 		require.NoError(t, fix.reg.PrivilegedIdentityPool().UpdateIdentity(fix.ctx, id))
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, fix.reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, fix.reg, id)
 		f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, fix.publicTS)
 		for _, n := range f.Ui.Nodes {
 			assert.NotEqual(t, n.Group, "passkey", "unexpected group: %s", n.Group)
@@ -118,7 +105,7 @@ func TestCompleteSettings(t *testing.T) {
 	})
 
 	doAPIFlow := func(t *testing.T, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, fix.reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, fix.reg, id)
 		f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, fix.publicTS)
 		values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 		v(values)
@@ -127,7 +114,7 @@ func TestCompleteSettings(t *testing.T) {
 	}
 
 	doBrowserFlow := func(t *testing.T, spa bool, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, fix.reg, id)
+		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, fix.reg, id)
 		f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, spa, fix.publicTS)
 		values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 		v(values)
@@ -233,8 +220,9 @@ func TestCompleteSettings(t *testing.T) {
 			// We load our identity which we will use to replay the webauth session
 			var id identity.Identity
 			require.NoError(t, json.Unmarshal(settingsFixtureSuccessIdentity, &id))
+			id.NID = x.NewUUID()
 			_ = fix.reg.PrivilegedIdentityPool().DeleteIdentity(fix.ctx, id.ID)
-			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, fix.reg, &id)
+			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, fix.reg, &id)
 			f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, spa, fix.publicTS)
 
 			// We inject the session to replay
@@ -249,6 +237,7 @@ func TestCompleteSettings(t *testing.T) {
 			values.Set("method", "passkey")
 			values.Set(node.PasskeySettingsRegister, string(settingsFixtureSuccessResponse))
 			body, res := testhelpers.SettingsMakeRequest(t, false, spa, f, browserClient, testhelpers.EncodeFormAsJSON(t, spa, values))
+			require.Equal(t, http.StatusOK, res.StatusCode, "%s", body)
 
 			if spa {
 				assert.Contains(t, res.Request.URL.String(), fix.publicTS.URL+settings.RouteSubmitFlow)
@@ -260,7 +249,7 @@ func TestCompleteSettings(t *testing.T) {
 			actual, err := fix.reg.Persister().GetIdentityConfidential(fix.ctx, id.ID)
 			require.NoError(t, err)
 			cred, ok := actual.GetCredentials(identity.CredentialsTypePasskey)
-			assert.True(t, ok)
+			require.True(t, ok)
 			assert.Len(t, gjson.GetBytes(cred.Config, "credentials").Array(), 1)
 
 			actualFlow, err := fix.reg.SettingsFlowPersister().GetSettingsFlow(fix.ctx, uuid.FromStringOrNil(f.Id))
@@ -271,6 +260,13 @@ func TestCompleteSettings(t *testing.T) {
 					flow.PrefixInternalContextKey(identity.CredentialsTypePasskey, passkey.InternalContextKeySessionData)))
 
 			testhelpers.EnsureAAL(t, browserClient, fix.publicTS, "aal1", string(identity.CredentialsTypePasskey))
+
+			if spa {
+				assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(body, "continue_with.0.action").String(), "%s", body)
+				assert.Contains(t, gjson.Get(body, "continue_with.0.redirect_browser_to").String(), fix.uiTS.URL, "%s", body)
+			} else {
+				assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
+			}
 		}
 
 		t.Run("type=browser", func(t *testing.T) {
@@ -431,7 +427,8 @@ func TestCompleteSettings(t *testing.T) {
 				var id identity.Identity
 				require.NoError(t, json.Unmarshal(settingsFixtureSuccessIdentity, &id))
 				_ = fix.reg.PrivilegedIdentityPool().DeleteIdentity(fix.ctx, id.ID)
-				browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, fix.reg, &id)
+				id.NID = x.NewUUID()
+				browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, fix.reg, &id)
 
 				req, err := http.NewRequest("GET", fix.publicTS.URL+settings.RouteInitBrowserFlow, nil)
 				require.NoError(t, err)
diff --git a/selfservice/strategy/passkey/passkey_strategy.go b/selfservice/strategy/passkey/passkey_strategy.go
index b590a7e93b6d..53102ae48982 100644
--- a/selfservice/strategy/passkey/passkey_strategy.go
+++ b/selfservice/strategy/passkey/passkey_strategy.go
@@ -6,6 +6,7 @@ package passkey
 import (
 	"context"
 	"encoding/json"
+	"strings"
 
 	"github.com/pkg/errors"
 
@@ -28,6 +29,7 @@ type strategyDependencies interface {
 	x.WriterProvider
 	x.CSRFTokenGeneratorProvider
 	x.CSRFProvider
+	x.TracingProvider
 
 	config.Provider
 
@@ -88,24 +90,24 @@ func (*Strategy) NodeGroup() node.UiNodeGroup {
 	return node.PasskeyGroup
 }
 
-func (s *Strategy) CompletedAuthenticationMethod(context.Context, session.AuthenticationMethods) session.AuthenticationMethod {
+func (s *Strategy) CompletedAuthenticationMethod(context.Context) session.AuthenticationMethod {
 	return session.AuthenticationMethod{
 		Method: identity.CredentialsTypePasskey,
 		AAL:    identity.AuthenticatorAssuranceLevel1,
 	}
 }
 
-func (s *Strategy) CountActiveMultiFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveMultiFactorCredentials(_ context.Context, _ map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	return 0, nil
 }
 
-func (s *Strategy) CountActiveFirstFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveFirstFactorCredentials(_ context.Context, cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	return s.countCredentials(cc)
 }
 
 func (s *Strategy) countCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	for _, c := range cc {
-		if c.Type == s.ID() && len(c.Config) > 0 && len(c.Identifiers) > 0 {
+		if c.Type == s.ID() && len(c.Config) > 0 && len(strings.Join(c.Identifiers, "")) > 0 {
 			var conf identity.CredentialsWebAuthnConfig
 			if err = json.Unmarshal(c.Config, &conf); err != nil {
 				return 0, errors.WithStack(err)
diff --git a/selfservice/strategy/passkey/testfixture_test.go b/selfservice/strategy/passkey/testfixture_test.go
index d7abf8459fb6..3f0fadfd2387 100644
--- a/selfservice/strategy/passkey/testfixture_test.go
+++ b/selfservice/strategy/passkey/testfixture_test.go
@@ -207,8 +207,8 @@ func (fix *fixture) submitWebAuthnLoginWithClient(t *testing.T, isSPA bool, cont
 	return fix.submitWebAuthnLoginFlowWithClient(t, isSPA, f, contextFixture, client, cb)
 }
 
-func (fix *fixture) submitWebAuthnLogin(t *testing.T, isSPA bool, id *identity.Identity, contextFixture []byte, cb func(values url.Values), opts ...testhelpers.InitFlowWithOption) (string, *http.Response, *kratos.LoginFlow) {
-	browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, fix.reg, id)
+func (fix *fixture) submitWebAuthnLogin(t *testing.T, ctx context.Context, isSPA bool, id *identity.Identity, contextFixture []byte, cb func(values url.Values), opts ...testhelpers.InitFlowWithOption) (string, *http.Response, *kratos.LoginFlow) {
+	browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, fix.reg, id)
 	return fix.submitWebAuthnLoginWithClient(t, isSPA, contextFixture, browserClient, cb, opts...)
 }
 
@@ -241,12 +241,6 @@ type submitPasskeyOpt struct {
 	internalContext sqlxx.JSONRawMessage
 }
 
-func newSubmitPasskeyOpt() *submitPasskeyOpt {
-	return &submitPasskeyOpt{
-		internalContext: registrationFixtureSuccessInternalContext,
-	}
-}
-
 type submitPasskeyOption func(o *submitPasskeyOpt)
 
 func withUserID(id string) submitPasskeyOption {
@@ -261,6 +255,29 @@ func withInternalContext(ic sqlxx.JSONRawMessage) submitPasskeyOption {
 	}
 }
 
+func (fix *fixture) submitPasskeyBrowserRegistration(
+	t *testing.T,
+	flowType string,
+	client *http.Client,
+	cb func(values url.Values),
+	opts ...submitPasskeyOption,
+) (string, *http.Response, *kratos.RegistrationFlow) {
+	return fix.submitPasskeyRegistration(t, flowType, client, cb, append([]submitPasskeyOption{withInternalContext(registrationFixtureSuccessBrowserInternalContext)}, opts...)...)
+}
+
+func (fix *fixture) submitPasskeyAndroidRegistration(
+	t *testing.T,
+	flowType string,
+	client *http.Client,
+	cb func(values url.Values),
+	opts ...submitPasskeyOption,
+) (string, *http.Response, *kratos.RegistrationFlow) {
+	return fix.submitPasskeyRegistration(t, flowType, client, cb,
+		append([]submitPasskeyOption{withInternalContext(
+			registrationFixtureSuccessAndroidInternalContext,
+		)}, opts...)...)
+}
+
 func (fix *fixture) submitPasskeyRegistration(
 	t *testing.T,
 	flowType string,
@@ -268,7 +285,7 @@ func (fix *fixture) submitPasskeyRegistration(
 	cb func(values url.Values),
 	opts ...submitPasskeyOption,
 ) (string, *http.Response, *kratos.RegistrationFlow) {
-	o := newSubmitPasskeyOpt()
+	o := &submitPasskeyOpt{}
 	for _, fn := range opts {
 		fn(o)
 	}
@@ -302,7 +319,7 @@ func (fix *fixture) submitPasskeyRegistration(
 }
 
 func (fix *fixture) makeRegistration(t *testing.T, flowType string, values func(v url.Values), opts ...submitPasskeyOption) (actual string, res *http.Response, fetchedFlow *registration.Flow) {
-	actual, res, actualFlow := fix.submitPasskeyRegistration(t, flowType, testhelpers.NewClientWithCookies(t), values, opts...)
+	actual, res, actualFlow := fix.submitPasskeyBrowserRegistration(t, flowType, testhelpers.NewClientWithCookies(t), values, opts...)
 	fetchedFlow, err := fix.reg.RegistrationFlowPersister().GetRegistrationFlow(fix.ctx, uuid.FromStringOrNil(actualFlow.Id))
 	require.NoError(t, err)
 
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json
new file mode 100644
index 000000000000..4b13f4012f6f
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor.json
@@ -0,0 +1,74 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "text",
+      "value": "",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070004,
+        "text": "ID",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "password",
+      "type": "password",
+      "required": true,
+      "autocomplete": "current-password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070001,
+        "text": "Password",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010022,
+        "text": "Sign in with password",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json
new file mode 100644
index 000000000000..eb9d0e213786
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactorRefresh.json
@@ -0,0 +1,67 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "hidden",
+      "value": "some@user.com",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "password",
+      "type": "password",
+      "required": true,
+      "autocomplete": "current-password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070001,
+        "text": "Password",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010001,
+        "text": "Sign in",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_disabled.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_disabled.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_disabled.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..831d9f07ba25
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1,54 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "password",
+      "type": "password",
+      "required": true,
+      "autocomplete": "current-password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070001,
+        "text": "Password",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010022,
+        "text": "Sign in with password",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_password.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_password.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_password.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_password.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_password.json
new file mode 100644
index 000000000000..831d9f07ba25
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_password.json
@@ -0,0 +1,54 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "password",
+      "type": "password",
+      "required": true,
+      "autocomplete": "current-password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070001,
+        "text": "Password",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010022,
+        "text": "Sign in with password",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled_and_identity_has_no_password.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled_and_identity_has_no_password.json
new file mode 100644
index 000000000000..831d9f07ba25
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled_and_identity_has_no_password.json
@@ -0,0 +1,54 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "password",
+      "type": "password",
+      "required": true,
+      "autocomplete": "current-password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070001,
+        "text": "Password",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010022,
+        "text": "Sign in with password",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_disabled.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_disabled.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_disabled.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..831d9f07ba25
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1,54 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "password",
+      "type": "password",
+      "required": true,
+      "autocomplete": "current-password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070001,
+        "text": "Password",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "password",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "password",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010022,
+        "text": "Sign in with password",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh.json b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh.json
new file mode 100644
index 000000000000..19765bd501b6
--- /dev/null
+++ b/selfservice/strategy/password/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactorRefresh.json
@@ -0,0 +1 @@
+null
diff --git a/selfservice/strategy/password/login.go b/selfservice/strategy/password/login.go
index 8c91d7e6c4f9..92eda3390076 100644
--- a/selfservice/strategy/password/login.go
+++ b/selfservice/strategy/password/login.go
@@ -10,32 +10,36 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/ory/kratos/selfservice/flowhelpers"
-	"github.com/ory/kratos/session"
+	"go.opentelemetry.io/otel/attribute"
 
-	"github.com/ory/x/stringsx"
+	"github.com/ory/x/otelx"
 
 	"github.com/gofrs/uuid"
-
 	"github.com/pkg/errors"
 
 	"github.com/ory/herodot"
-	"github.com/ory/x/decoderx"
-
 	"github.com/ory/kratos/hash"
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/schema"
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/selfservice/flowhelpers"
+	"github.com/ory/kratos/selfservice/hook"
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/text"
 	"github.com/ory/kratos/ui/node"
 	"github.com/ory/kratos/x"
+	"github.com/ory/x/decoderx"
+	"github.com/ory/x/stringsx"
 )
 
+var _ login.FormHydrator = new(Strategy)
+
 func (s *Strategy) RegisterLoginRoutes(r *x.RouterPublic) {
 }
 
-func (s *Strategy) handleLoginError(w http.ResponseWriter, r *http.Request, f *login.Flow, payload *updateLoginFlowWithPasswordMethod, err error) error {
+func (s *Strategy) handleLoginError(r *http.Request, f *login.Flow, payload updateLoginFlowWithPasswordMethod, err error) error {
 	if f != nil {
 		f.UI.Nodes.ResetNodes("password")
 		f.UI.Nodes.SetValueAttribute("identifier", stringsx.Coalesce(payload.Identifier, payload.LegacyIdentifier))
@@ -48,7 +52,11 @@ func (s *Strategy) handleLoginError(w http.ResponseWriter, r *http.Request, f *l
 }
 
 func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, _ *session.Session) (i *identity.Identity, err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.password.Strategy.Login")
+	defer otelx.End(span, &err)
+
 	if err := login.CheckAAL(f, identity.AuthenticatorAssuranceLevel1); err != nil {
+		span.SetAttributes(attribute.String("not_responsible_reason", "requested AAL is not AAL1"))
 		return nil, err
 	}
 
@@ -61,18 +69,19 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 		decoderx.HTTPDecoderSetValidatePayloads(true),
 		decoderx.MustHTTPRawJSONSchemaCompiler(loginSchema),
 		decoderx.HTTPDecoderJSONFollowsFormFormat()); err != nil {
-		return nil, s.handleLoginError(w, r, f, &p, err)
+		return nil, s.handleLoginError(r, f, p, err)
 	}
 	f.TransientPayload = p.TransientPayload
 
-	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
-		return nil, s.handleLoginError(w, r, f, &p, err)
+	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+		return nil, s.handleLoginError(r, f, p, err)
 	}
 
-	i, c, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(r.Context(), s.ID(), stringsx.Coalesce(p.Identifier, p.LegacyIdentifier))
+	identifier := stringsx.Coalesce(p.Identifier, p.LegacyIdentifier)
+	i, c, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(ctx, s.ID(), identifier)
 	if err != nil {
-		time.Sleep(x.RandomDelay(s.d.Config().HasherArgon2(r.Context()).ExpectedDuration, s.d.Config().HasherArgon2(r.Context()).ExpectedDeviation))
-		return nil, s.handleLoginError(w, r, f, &p, errors.WithStack(schema.NewInvalidCredentialsError()))
+		time.Sleep(x.RandomDelay(s.d.Config().HasherArgon2(ctx).ExpectedDuration, s.d.Config().HasherArgon2(ctx).ExpectedDeviation))
+		return nil, s.handleLoginError(r, f, p, errors.WithStack(schema.NewInvalidCredentialsError()))
 	}
 
 	var o identity.CredentialsPassword
@@ -81,26 +90,45 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 		return nil, herodot.ErrInternalServerError.WithReason("The password credentials could not be decoded properly").WithDebug(err.Error()).WithWrap(err)
 	}
 
-	if err := hash.Compare(r.Context(), []byte(p.Password), []byte(o.HashedPassword)); err != nil {
-		return nil, s.handleLoginError(w, r, f, &p, errors.WithStack(schema.NewInvalidCredentialsError()))
-	}
+	if o.ShouldUsePasswordMigrationHook() {
+		pwHook := s.d.Config().PasswordMigrationHook(ctx)
+		if !pwHook.Enabled {
+			return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Password migration hook is not enabled but password migration is requested."))
+		}
+
+		migrationHook := hook.NewPasswordMigrationHook(s.d, pwHook.Config)
+		err = migrationHook.Execute(ctx, &hook.PasswordMigrationRequest{Identifier: identifier, Password: p.Password})
+		if err != nil {
+			return nil, s.handleLoginError(r, f, p, err)
+		}
 
-	if !s.d.Hasher(r.Context()).Understands([]byte(o.HashedPassword)) {
-		if err := s.migratePasswordHash(r.Context(), i.ID, []byte(p.Password)); err != nil {
-			return nil, s.handleLoginError(w, r, f, &p, err)
+		if err := s.migratePasswordHash(ctx, i.ID, []byte(p.Password)); err != nil {
+			return nil, s.handleLoginError(r, f, p, err)
+		}
+	} else {
+		if err := hash.Compare(ctx, []byte(p.Password), []byte(o.HashedPassword)); err != nil {
+			return nil, s.handleLoginError(r, f, p, errors.WithStack(schema.NewInvalidCredentialsError()))
+		}
+
+		if !s.d.Hasher(ctx).Understands([]byte(o.HashedPassword)) {
+			if err := s.migratePasswordHash(ctx, i.ID, []byte(p.Password)); err != nil {
+				s.d.Logger().Warnf("Unable to migrate password hash for identity %s: %s Keeping existing password hash and continuing.", i.ID, err)
+			}
 		}
 	}
 
-	f.Active = identity.CredentialsTypePassword
 	f.Active = s.ID()
-	if err = s.d.LoginFlowPersister().UpdateLoginFlow(r.Context(), f); err != nil {
-		return nil, s.handleLoginError(w, r, f, &p, errors.WithStack(herodot.ErrInternalServerError.WithReason("Could not update flow").WithDebug(err.Error())))
+	if err = s.d.LoginFlowPersister().UpdateLoginFlow(ctx, f); err != nil {
+		return nil, s.handleLoginError(r, f, p, errors.WithStack(herodot.ErrInternalServerError.WithReason("Could not update flow").WithDebug(err.Error())))
 	}
 
 	return i, nil
 }
 
-func (s *Strategy) migratePasswordHash(ctx context.Context, identifier uuid.UUID, password []byte) error {
+func (s *Strategy) migratePasswordHash(ctx context.Context, identifier uuid.UUID, password []byte) (err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.password.Strategy.migratePasswordHash")
+	defer otelx.End(span, &err)
+
 	hpw, err := s.d.Hasher(ctx).Generate(ctx, password)
 	if err != nil {
 		return err
@@ -123,46 +151,97 @@ func (s *Strategy) migratePasswordHash(ctx context.Context, identifier uuid.UUID
 	c.Config = co
 	i.SetCredentials(s.ID(), *c)
 
-	return s.d.PrivilegedIdentityPool().UpdateIdentity(ctx, i)
+	return s.d.IdentityManager().Update(ctx, i, identity.ManagerAllowWriteProtectedTraits)
 }
 
-func (s *Strategy) PopulateLoginMethod(r *http.Request, requestedAAL identity.AuthenticatorAssuranceLevel, sr *login.Flow) error {
-	// This strategy can only solve AAL1
-	if requestedAAL > identity.AuthenticatorAssuranceLevel1 {
+func (s *Strategy) PopulateLoginMethodFirstFactorRefresh(r *http.Request, sr *login.Flow) (err error) {
+	ctx := r.Context()
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.password.Strategy.PopulateLoginMethodFirstFactorRefresh")
+	defer otelx.End(span, &err)
+
+	identifier, id, _ := flowhelpers.GuessForcedLoginIdentifier(r, s.d, sr, s.ID())
+	if identifier == "" {
 		return nil
 	}
 
-	if sr.IsForced() {
-		// We only show this method on a refresh request if the user has indeed a password set.
-		identifier, id, _ := flowhelpers.GuessForcedLoginIdentifier(r, s.d, sr, s.ID())
-		if identifier == "" {
-			return nil
-		}
+	// If we don't have a password set, do not show the password field.
+	count, err := s.CountActiveFirstFactorCredentials(ctx, id.Credentials)
+	if err != nil {
+		return err
+	} else if count == 0 {
+		return nil
+	}
 
-		count, err := s.CountActiveFirstFactorCredentials(id.Credentials)
-		if err != nil {
+	sr.UI.SetCSRF(s.d.GenerateCSRFToken(r))
+	sr.UI.SetNode(node.NewInputField("identifier", identifier, node.DefaultGroup, node.InputAttributeTypeHidden))
+	sr.UI.SetNode(NewPasswordNode("password", node.InputAttributeAutocompleteCurrentPassword))
+	sr.UI.GetNodes().Append(node.NewInputField("method", "password", node.PasswordGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoLogin()))
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactor(r *http.Request, sr *login.Flow) error {
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactorRefresh(r *http.Request, sr *login.Flow) error {
+	return nil
+}
+
+func (s *Strategy) addIdentifierNode(r *http.Request, sr *login.Flow) error {
+	ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(r.Context())
+	if err != nil {
+		return err
+	}
+
+	identifierLabel, err := login.GetIdentifierLabelFromSchema(r.Context(), ds.String())
+	if err != nil {
+		return err
+	}
+
+	sr.UI.SetNode(node.NewInputField("identifier", "", node.DefaultGroup, node.InputAttributeTypeText, node.WithRequiredInputAttribute).WithMetaLabel(identifierLabel))
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodFirstFactor(r *http.Request, sr *login.Flow) error {
+	if err := s.addIdentifierNode(r, sr); err != nil {
+		return err
+	}
+
+	sr.UI.SetCSRF(s.d.GenerateCSRFToken(r))
+	sr.UI.SetNode(NewPasswordNode("password", node.InputAttributeAutocompleteCurrentPassword))
+	sr.UI.GetNodes().Append(node.NewInputField("method", "password", node.PasswordGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoLoginPassword()))
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstCredentials(r *http.Request, sr *login.Flow, opts ...login.FormHydratorModifier) (err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.password.Strategy.PopulateLoginMethodIdentifierFirstCredentials")
+	defer otelx.End(span, &err)
+
+	o := login.NewFormHydratorOptions(opts)
+
+	var count int
+	if o.IdentityHint != nil {
+		var err error
+		// If we have an identity hint we can perform identity credentials discovery and
+		// hide this credential if it should not be included.
+		if count, err = s.CountActiveFirstFactorCredentials(ctx, o.IdentityHint.Credentials); err != nil {
 			return err
-		} else if count == 0 {
-			return nil
 		}
+	}
 
+	if count > 0 || s.d.Config().SecurityAccountEnumerationMitigate(ctx) {
 		sr.UI.SetCSRF(s.d.GenerateCSRFToken(r))
-		sr.UI.SetNode(node.NewInputField("identifier", identifier, node.DefaultGroup, node.InputAttributeTypeHidden))
-	} else {
-		ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(r.Context())
-		if err != nil {
-			return err
-		}
-		identifierLabel, err := login.GetIdentifierLabelFromSchema(r.Context(), ds.String())
-		if err != nil {
-			return err
-		}
-		sr.UI.SetNode(node.NewInputField("identifier", "", node.DefaultGroup, node.InputAttributeTypeText, node.WithRequiredInputAttribute).WithMetaLabel(identifierLabel))
+		sr.UI.SetNode(NewPasswordNode("password", node.InputAttributeAutocompleteCurrentPassword))
+		sr.UI.GetNodes().Append(node.NewInputField("method", "password", node.PasswordGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoLoginPassword()))
 	}
 
-	sr.UI.SetCSRF(s.d.GenerateCSRFToken(r))
-	sr.UI.SetNode(NewPasswordNode("password", node.InputAttributeAutocompleteCurrentPassword))
-	sr.UI.GetNodes().Append(node.NewInputField("method", "password", node.PasswordGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoLogin()))
+	if count == 0 {
+		return errors.WithStack(idfirst.ErrNoCredentialsFound)
+	}
+
+	return nil
+}
 
+func (s *Strategy) PopulateLoginMethodIdentifierFirstIdentification(r *http.Request, sr *login.Flow) error {
 	return nil
 }
diff --git a/selfservice/strategy/password/login_test.go b/selfservice/strategy/password/login_test.go
index 8d8879cce91c..79f82b9c45b2 100644
--- a/selfservice/strategy/password/login_test.go
+++ b/selfservice/strategy/password/login_test.go
@@ -6,53 +6,61 @@ package password_test
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
 	_ "embed"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
+	"slices"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+
+	configtesthelpers "github.com/ory/kratos/driver/config/testhelpers"
+
+	"github.com/ory/x/randx"
+	"github.com/ory/x/snapshotx"
+
 	"github.com/ory/kratos/driver"
 	"github.com/ory/kratos/internal/registrationhelpers"
 
 	"github.com/ory/kratos/selfservice/flow"
 
 	"github.com/gofrs/uuid"
-
-	"github.com/ory/x/urlx"
-
-	"github.com/ory/kratos/hash"
-	kratos "github.com/ory/kratos/internal/httpclient"
-	"github.com/ory/x/assertx"
-	"github.com/ory/x/errorsx"
-	"github.com/ory/x/ioutilx"
-	"github.com/ory/x/sqlxx"
-
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/tidwall/gjson"
 
 	"github.com/ory/kratos/driver/config"
+	"github.com/ory/kratos/hash"
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/internal"
+	kratos "github.com/ory/kratos/internal/httpclient"
 	"github.com/ory/kratos/internal/testhelpers"
 	"github.com/ory/kratos/schema"
 	"github.com/ory/kratos/selfservice/flow/login"
 	"github.com/ory/kratos/text"
 	"github.com/ory/kratos/x"
+	"github.com/ory/x/assertx"
+	"github.com/ory/x/errorsx"
+	"github.com/ory/x/ioutilx"
+	"github.com/ory/x/sqlxx"
+	"github.com/ory/x/urlx"
 )
 
 //go:embed stub/login.schema.json
 var loginSchema []byte
 
-func createIdentity(ctx context.Context, reg *driver.RegistryDefault, t *testing.T, identifier, password string) {
+func createIdentity(ctx context.Context, reg *driver.RegistryDefault, t *testing.T, identifier, password string) *identity.Identity {
 	p, _ := reg.Hasher(ctx).Generate(context.Background(), []byte(password))
 	iId := x.NewUUID()
-	require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &identity.Identity{
+	id := &identity.Identity{
 		ID:     iId,
 		Traits: identity.Traits(fmt.Sprintf(`{"subject":"%s"}`, identifier)),
 		Credentials: map[identity.CredentialsType]identity.Credentials{
@@ -71,7 +79,9 @@ func createIdentity(ctx context.Context, reg *driver.RegistryDefault, t *testing
 				IdentityID: iId,
 			},
 		},
-	}))
+	}
+	require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(ctx, id))
+	return id
 }
 
 func TestCompleteLogin(t *testing.T) {
@@ -90,7 +100,11 @@ func TestCompleteLogin(t *testing.T) {
 	conf.MustSet(ctx, config.ViperKeySelfServiceErrorUI, errTS.URL+"/error-ts")
 	conf.MustSet(ctx, config.ViperKeySelfServiceLoginUI, uiTS.URL+"/login-ts")
 
-	testhelpers.SetDefaultIdentitySchemaFromRaw(conf, loginSchema)
+	testhelpers.SetIdentitySchemas(t, conf, map[string]string{
+		"migration": "file://./stub/migration.schema.json",
+		"default":   "file://./stub/login.schema.json",
+	})
+
 	conf.MustSet(ctx, config.ViperKeySecretsDefault, []string{"not-a-secure-session-key"})
 
 	ensureFieldsExist := func(t *testing.T, body []byte) {
@@ -513,8 +527,9 @@ func TestCompleteLogin(t *testing.T) {
 			})
 
 			t.Run("do not show password method if identity has no password set", func(t *testing.T) {
-				id := identity.NewIdentity("")
-				browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+				id := identity.NewIdentity("default")
+				id.NID = x.NewUUID()
+				browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 
 				res, err := browserClient.Get(publicTS.URL + login.RouteInitBrowserFlow + "?refresh=true")
 				require.NoError(t, err)
@@ -573,8 +588,9 @@ func TestCompleteLogin(t *testing.T) {
 			})
 
 			t.Run("do not show password method if identity has no password set", func(t *testing.T) {
-				id := identity.NewIdentity("")
-				hc := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+				id := identity.NewIdentity("default")
+				id.NID = x.NewUUID()
+				hc := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 
 				res, err := hc.Do(testhelpers.NewHTTPGetAJAXRequest(t, publicTS.URL+login.RouteInitBrowserFlow+"?refresh=true"))
 				require.NoError(t, err)
@@ -632,8 +648,9 @@ func TestCompleteLogin(t *testing.T) {
 			})
 
 			t.Run("do not show password method if identity has no password set", func(t *testing.T) {
-				id := identity.NewIdentity("")
-				hc := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+				id := identity.NewIdentity("default")
+				id.NID = x.NewUUID()
+				hc := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 
 				res, err := hc.Do(testhelpers.NewHTTPGetAJAXRequest(t, publicTS.URL+login.RouteInitAPIFlow+"?refresh=true"))
 				require.NoError(t, err)
@@ -649,8 +666,6 @@ func TestCompleteLogin(t *testing.T) {
 	})
 
 	t.Run("case=should return an error because not passing validation and reset previous errors and values", func(t *testing.T) {
-		testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/login.schema.json")
-
 		check := func(t *testing.T, actual string) {
 			assert.NotEmpty(t, gjson.Get(actual, "id").String(), "%s", actual)
 			assert.Contains(t, gjson.Get(actual, "ui.action").String(), publicTS.URL+login.RouteSubmitFlow, "%s", actual)
@@ -741,6 +756,32 @@ func TestCompleteLogin(t *testing.T) {
 		assert.Equal(t, identifier, gjson.Get(body, "identity.traits.subject").String(), "%s", body)
 	})
 
+	t.Run("should succeed and include redirect continue_with in SPA flow", func(t *testing.T) {
+		identifier, pwd := x.NewUUID().String(), "password"
+		createIdentity(ctx, reg, t, identifier, pwd)
+
+		browserClient := testhelpers.NewClientWithCookies(t)
+		f := testhelpers.InitializeLoginFlowViaBrowser(t, browserClient, publicTS, false, true, false, false)
+		values := url.Values{"method": {"password"}, "identifier": {strings.ToUpper(identifier)}, "password": {pwd}, "csrf_token": {x.FakeCSRFToken}}.Encode()
+		body, res := testhelpers.LoginMakeRequest(t, false, true, f, browserClient, values)
+
+		assert.EqualValues(t, http.StatusOK, res.StatusCode)
+		assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(body, "continue_with.0.action").String(), "%s", body)
+		assert.EqualValues(t, conf.SelfServiceBrowserDefaultReturnTo(ctx).String(), gjson.Get(body, "continue_with.0.redirect_browser_to").String(), "%s", body)
+	})
+
+	t.Run("should succeed and not have redirect continue_with in api flow", func(t *testing.T) {
+		identifier, pwd := x.NewUUID().String(), "password"
+		createIdentity(ctx, reg, t, identifier, pwd)
+		browserClient := testhelpers.NewClientWithCookies(t)
+		f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false)
+
+		body, res := testhelpers.LoginMakeRequest(t, true, true, f, browserClient, fmt.Sprintf(`{"method":"password","identifier":"%s","password":"%s"}`, strings.ToUpper(identifier), pwd))
+
+		assert.EqualValues(t, http.StatusOK, res.StatusCode, body)
+		assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
+	})
+
 	t.Run("should login even if old form field name is used", func(t *testing.T) {
 		identifier, pwd := x.NewUUID().String(), "password"
 		createIdentity(ctx, reg, t, identifier, pwd)
@@ -807,7 +848,7 @@ func TestCompleteLogin(t *testing.T) {
 	})
 
 	t.Run("should upgrade password not primary hashing algorithm", func(t *testing.T) {
-		identifier, pwd := x.NewUUID().String(), "password"
+		identifier, pwd := x.NewUUID().String()+"@google.com", "password"
 		h := &hash.Pbkdf2{
 			Algorithm:  "sha256",
 			Iterations: 100000,
@@ -818,8 +859,9 @@ func TestCompleteLogin(t *testing.T) {
 
 		iId := x.NewUUID()
 		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &identity.Identity{
-			ID:     iId,
-			Traits: identity.Traits(fmt.Sprintf(`{"subject":"%s"}`, identifier)),
+			ID:       iId,
+			SchemaID: "migration",
+			Traits:   identity.Traits(fmt.Sprintf(`{"email":"%s"}`, identifier)),
 			Credentials: map[identity.CredentialsType]identity.Credentials{
 				identity.CredentialsTypePassword: {
 					Type:        identity.CredentialsTypePassword,
@@ -849,7 +891,7 @@ func TestCompleteLogin(t *testing.T) {
 		body := testhelpers.SubmitLoginForm(t, false, browserClient, publicTS, values,
 			false, false, http.StatusOK, redirTS.URL)
 
-		assert.Equal(t, identifier, gjson.Get(body, "identity.traits.subject").String(), "%s", body)
+		assert.Equal(t, identifier, gjson.Get(body, "identity.traits.email").String(), "%s", body)
 
 		// check if password hash algorithm is upgraded
 		_, c, err := reg.PrivilegedIdentityPool().FindByCredentialsIdentifier(context.Background(), identity.CredentialsTypePassword, identifier)
@@ -862,6 +904,392 @@ func TestCompleteLogin(t *testing.T) {
 		// retry after upgraded
 		body = testhelpers.SubmitLoginForm(t, false, browserClient, publicTS, values,
 			false, true, http.StatusOK, redirTS.URL)
-		assert.Equal(t, identifier, gjson.Get(body, "identity.traits.subject").String(), "%s", body)
+		assert.Equal(t, identifier, gjson.Get(body, "identity.traits.email").String(), "%s", body)
+	})
+
+	t.Run("suite=password rehashing degrades gracefully during login", func(t *testing.T) {
+		identifier := x.NewUUID().String() + "@google.com"
+		// pwd := "Kd9hUV4Xkcq87VSca6A4fq1iBijrMScBFhkpIPEwBtvTDsBwfqJCqXPPr4TkhOhsd9wFGeB3MzS4bJuesLCAjJc5s1GKJ51zW7F"
+		pwd := randx.MustString(100, randx.AlphaNum) // longer than bcrypt max length
+		require.Greater(t, len(pwd), 72)             // bcrypt max length
+		salt := randx.MustString(32, randx.AlphaNum)
+		sha := sha256.Sum256([]byte(pwd + salt))
+		hashed := "{SSHA256}" + base64.StdEncoding.EncodeToString(slices.Concat(sha[:], []byte(salt)))
+		iId := x.NewUUID()
+		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &identity.Identity{
+			ID:       iId,
+			SchemaID: "migration",
+			Traits:   identity.Traits(fmt.Sprintf(`{"email":%q}`, identifier)),
+			Credentials: map[identity.CredentialsType]identity.Credentials{
+				identity.CredentialsTypePassword: {
+					Type:        identity.CredentialsTypePassword,
+					Identifiers: []string{identifier},
+					Config:      sqlxx.JSONRawMessage(`{"hashed_password":"` + hashed + `"}`),
+				},
+			},
+			VerifiableAddresses: []identity.VerifiableAddress{
+				{
+					ID:         x.NewUUID(),
+					Value:      identifier,
+					Verified:   true,
+					CreatedAt:  time.Now(),
+					IdentityID: iId,
+				},
+			},
+		}))
+
+		values := func(v url.Values) {
+			v.Set("identifier", identifier)
+			v.Set("method", identity.CredentialsTypePassword.String())
+			v.Set("password", pwd)
+		}
+
+		browserClient := testhelpers.NewClientWithCookies(t)
+
+		body := testhelpers.SubmitLoginForm(t, false, browserClient, publicTS, values,
+			false, false, http.StatusOK, redirTS.URL)
+
+		assert.Equal(t, identifier, gjson.Get(body, "identity.traits.email").String(), "%s", body)
+
+		// check that the password hash algorithm is unchanged
+		_, c, err := reg.PrivilegedIdentityPool().FindByCredentialsIdentifier(context.Background(), identity.CredentialsTypePassword, identifier)
+		require.NoError(t, err)
+		var o identity.CredentialsPassword
+		require.NoError(t, json.NewDecoder(bytes.NewBuffer(c.Config)).Decode(&o))
+		assert.Equal(t, hashed, o.HashedPassword)
+
+		// login still works
+		body = testhelpers.SubmitLoginForm(t, false, browserClient, publicTS, values,
+			false, true, http.StatusOK, redirTS.URL)
+		assert.Equal(t, identifier, gjson.Get(body, "identity.traits.email").String(), "%s", body)
+	})
+
+	t.Run("suite=password migration hook", func(t *testing.T) {
+		ctx := context.Background()
+
+		type (
+			hookPayload = struct {
+				Identifier string `json:"identifier"`
+				Password   string `json:"password"`
+			}
+			tsRequestHandler = func(hookPayload) (status int, body string)
+		)
+		returnStatus := func(status int) func(string, string) tsRequestHandler {
+			return func(string, string) tsRequestHandler {
+				return func(hookPayload) (int, string) { return status, "" }
+			}
+		}
+		returnStatic := func(status int, body string) func(string, string) tsRequestHandler {
+			return func(string, string) tsRequestHandler {
+				return func(hookPayload) (int, string) { return status, body }
+			}
+		}
+
+		// each test case sends (number of expected calls) handlers to the channel, at a max of 3
+		tsChan := make(chan tsRequestHandler, 3)
+
+		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			b, err := io.ReadAll(r.Body)
+			require.NoError(t, err)
+			_ = r.Body.Close()
+			var payload hookPayload
+			require.NoError(t, json.Unmarshal(b, &payload))
+
+			select {
+			case handlerFn := <-tsChan:
+				status, body := handlerFn(payload)
+				w.WriteHeader(status)
+				_, _ = io.WriteString(w, body)
+
+			default:
+				t.Fatal("unexpected call to the password migration hook")
+			}
+		}))
+		t.Cleanup(ts.Close)
+
+		require.NoError(t, reg.Config().Set(ctx, config.ViperKeyPasswordMigrationHook, map[string]any{
+			"config":  map[string]any{"url": ts.URL},
+			"enabled": true,
+		}))
+
+		for _, tc := range []struct {
+			name              string
+			hookHandler       func(identifier, password string) tsRequestHandler
+			expectHookCalls   int
+			setupFn           func() func()
+			credentialsConfig string
+			expectSuccess     bool
+		}{{
+			name:              "should call migration hook",
+			credentialsConfig: `{"use_password_migration_hook": true}`,
+			hookHandler: func(identifier, password string) tsRequestHandler {
+				return func(payload hookPayload) (status int, body string) {
+					if payload.Identifier == identifier && payload.Password == password {
+						return http.StatusOK, `{"status":"password_match"}`
+					} else {
+						return http.StatusOK, `{"status":"no_match"}`
+					}
+				}
+			},
+			expectHookCalls: 1,
+			expectSuccess:   true,
+		}, {
+			name:              "should not update identity when the password is wrong",
+			credentialsConfig: `{"use_password_migration_hook": true}`,
+			hookHandler:       returnStatus(http.StatusForbidden),
+			expectHookCalls:   1,
+			expectSuccess:     false,
+		}, {
+			name:              "should inspect response",
+			credentialsConfig: `{"use_password_migration_hook": true}`,
+			hookHandler:       returnStatic(http.StatusOK, `{"status":"password_no_match"}`),
+			expectHookCalls:   1,
+			expectSuccess:     false,
+		}, {
+			name:              "should not update identity when the migration hook returns 200 without JSON",
+			credentialsConfig: `{"use_password_migration_hook": true}`,
+			hookHandler:       returnStatus(http.StatusOK),
+			expectHookCalls:   1,
+			expectSuccess:     false,
+		}, {
+			name:              "should not update identity when the migration hook returns 500",
+			credentialsConfig: `{"use_password_migration_hook": true}`,
+			hookHandler:       returnStatus(http.StatusInternalServerError),
+			expectHookCalls:   3, // expect retries on 500
+			expectSuccess:     false,
+		}, {
+			name:              "should not update identity when the migration hook returns 201",
+			credentialsConfig: `{"use_password_migration_hook": true}`,
+			hookHandler:       returnStatic(http.StatusCreated, `{"status":"password_match"}`),
+			expectHookCalls:   1,
+			expectSuccess:     false,
+		}, {
+			name:              "should not update identity and not call hook when hash is set",
+			credentialsConfig: `{"use_password_migration_hook": true, "hashed_password":"hash"}`,
+			expectSuccess:     false,
+		}, {
+			name:              "should not update identity and not call hook when use_password_migration_hook is not set",
+			credentialsConfig: `{"hashed_password":"hash"}`,
+			expectSuccess:     false,
+		}, {
+			name:              "should not update identity and not call hook when credential is empty",
+			credentialsConfig: `{}`,
+			expectSuccess:     false,
+		}, {
+			name:              "should not call migration hook if disabled",
+			credentialsConfig: `{"use_password_migration_hook": true}`,
+			setupFn: func() func() {
+				require.NoError(t, reg.Config().Set(ctx, config.ViperKeyPasswordMigrationHook+".enabled", false))
+				return func() {
+					require.NoError(t, reg.Config().Set(ctx, config.ViperKeyPasswordMigrationHook+".enabled", true))
+				}
+			},
+			expectSuccess: false,
+		}} {
+			t.Run("case="+tc.name, func(t *testing.T) {
+				if tc.setupFn != nil {
+					cleanup := tc.setupFn()
+					t.Cleanup(cleanup)
+				}
+
+				identifier := x.NewUUID().String() + "@google.com"
+				password := x.NewUUID().String()
+				iId := x.NewUUID()
+				require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(ctx, &identity.Identity{
+					ID:       iId,
+					SchemaID: "migration",
+					Traits:   identity.Traits(fmt.Sprintf(`{"email":"%s"}`, identifier)),
+					Credentials: map[identity.CredentialsType]identity.Credentials{
+						identity.CredentialsTypePassword: {
+							Type:        identity.CredentialsTypePassword,
+							Identifiers: []string{identifier},
+							Config:      sqlxx.JSONRawMessage(tc.credentialsConfig),
+						},
+					},
+					VerifiableAddresses: []identity.VerifiableAddress{
+						{
+							ID:         x.NewUUID(),
+							Value:      identifier,
+							Verified:   true,
+							CreatedAt:  time.Now(),
+							IdentityID: iId,
+						},
+					},
+				}))
+
+				values := func(v url.Values) {
+					v.Set("identifier", identifier)
+					v.Set("method", identity.CredentialsTypePassword.String())
+					v.Set("password", password)
+				}
+
+				for range tc.expectHookCalls {
+					tsChan <- tc.hookHandler(identifier, password)
+				}
+
+				browserClient := testhelpers.NewClientWithCookies(t)
+
+				if tc.expectSuccess {
+					body := testhelpers.SubmitLoginForm(t, false, browserClient, publicTS, values,
+						false, false, http.StatusOK, redirTS.URL)
+					assert.Equal(t, identifier, gjson.Get(body, "identity.traits.email").String(), "%s", body)
+
+					// check if password hash algorithm is upgraded
+					_, c, err := reg.PrivilegedIdentityPool().FindByCredentialsIdentifier(ctx, identity.CredentialsTypePassword, identifier)
+					require.NoError(t, err)
+					var o identity.CredentialsPassword
+					require.NoError(t, json.NewDecoder(bytes.NewBuffer(c.Config)).Decode(&o))
+					assert.True(t, reg.Hasher(ctx).Understands([]byte(o.HashedPassword)), "%s", o.HashedPassword)
+					assert.True(t, hash.IsBcryptHash([]byte(o.HashedPassword)), "%s", o.HashedPassword)
+
+					// retry after upgraded
+					body = testhelpers.SubmitLoginForm(t, false, browserClient, publicTS, values,
+						false, true, http.StatusOK, redirTS.URL)
+					assert.Equal(t, identifier, gjson.Get(body, "identity.traits.email").String(), "%s", body)
+				} else {
+					body := testhelpers.SubmitLoginForm(t, false, browserClient, publicTS, values,
+						false, false, http.StatusOK, "")
+					assert.Empty(t, gjson.Get(body, "identity.traits.subject").String(), "%s", body)
+					// Check that the config did not change
+					_, c, err := reg.PrivilegedIdentityPool().FindByCredentialsIdentifier(context.Background(), identity.CredentialsTypePassword, identifier)
+					require.NoError(t, err)
+					assert.JSONEq(t, tc.credentialsConfig, string(c.Config))
+				}
+
+				// expect all hook calls to be done
+				select {
+				case <-tsChan:
+					t.Fatal("the test unexpectedly did too few calls to the password hook")
+				default:
+					// pass
+				}
+			})
+		}
+	})
+}
+
+func TestFormHydration(t *testing.T) {
+	ctx := context.Background()
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypePassword), map[string]interface{}{"enabled": true})
+	ctx = testhelpers.WithDefaultIdentitySchemaFromRaw(ctx, loginSchema)
+
+	s, err := reg.AllLoginStrategies().Strategy(identity.CredentialsTypePassword)
+	require.NoError(t, err)
+	fh, ok := s.(login.FormHydrator)
+	require.True(t, ok)
+
+	toSnapshot := func(t *testing.T, f *login.Flow) {
+		t.Helper()
+		// The CSRF token has a unique value that messes with the snapshot - ignore it.
+		f.UI.Nodes.ResetNodes("csrf_token")
+		snapshotx.SnapshotT(t, f.UI.Nodes)
+	}
+	newFlow := func(ctx context.Context, t *testing.T) (*http.Request, *login.Flow) {
+		r := httptest.NewRequest("GET", "/self-service/login/browser", nil)
+		r = r.WithContext(ctx)
+		t.Helper()
+		f, err := login.NewFlow(conf, time.Minute, "csrf_token", r, flow.TypeBrowser)
+		require.NoError(t, err)
+		return r, f
+	}
+
+	t.Run("method=PopulateLoginMethodSecondFactor", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+		require.NoError(t, fh.PopulateLoginMethodSecondFactor(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodFirstFactor", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodFirstFactor(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodFirstFactorRefresh", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		id := createIdentity(ctx, reg, t, "some@user.com", "password")
+		r.Header = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id).Transport.(*testhelpers.TransportWithHeader).GetHeader()
+		f.Refresh = true
+		require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodSecondFactorRefresh", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodSecondFactorRefresh(r, f))
+		toSnapshot(t, f)
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstCredentials", func(t *testing.T) {
+		t.Run("case=no options", func(t *testing.T) {
+			t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, false)
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+
+			t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+		})
+
+		t.Run("case=WithIdentifier", func(t *testing.T) {
+			t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, false)
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+
+			t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+		})
+
+		t.Run("case=WithIdentityHint", func(t *testing.T) {
+			t.Run("case=account enumeration mitigation enabled and identity has no password", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, true)
+
+				id := identity.NewIdentity("default")
+				r, f := newFlow(ctx, t)
+				require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+				toSnapshot(t, f)
+			})
+
+			t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+				ctx := configtesthelpers.WithConfigValue(ctx, config.ViperKeySecurityAccountEnumerationMitigate, false)
+
+				t.Run("case=identity has password", func(t *testing.T) {
+					identifier, pwd := x.NewUUID().String(), "password"
+					id := createIdentity(ctx, reg, t, identifier, pwd)
+
+					r, f := newFlow(ctx, t)
+					require.NoError(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)))
+					toSnapshot(t, f)
+				})
+
+				t.Run("case=identity does not have a password", func(t *testing.T) {
+					id := identity.NewIdentity("default")
+					r, f := newFlow(ctx, t)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+			})
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstIdentification", func(t *testing.T) {
+		r, f := newFlow(ctx, t)
+		require.NoError(t, fh.PopulateLoginMethodIdentifierFirstIdentification(r, f))
+		toSnapshot(t, f)
 	})
 }
diff --git a/selfservice/strategy/password/op_helpers_test.go b/selfservice/strategy/password/op_helpers_test.go
index ccbb186ae103..6a300807374c 100644
--- a/selfservice/strategy/password/op_helpers_test.go
+++ b/selfservice/strategy/password/op_helpers_test.go
@@ -70,21 +70,21 @@ type testConfig struct {
 	browserClient    *http.Client
 	kratosPublicTS   *httptest.Server
 	clientAppTS      *httptest.Server
-	hydraAdminClient *hydraclientgo.OAuth2ApiService
+	hydraAdminClient hydraclientgo.OAuth2API
 	consentRemember  bool
 	requestedScope   []string
 	callTrace        *[]callTrace
 }
 
-func createHydraOAuth2ApiClient(url string) *hydraclientgo.OAuth2ApiService {
+func createHydraOAuth2ApiClient(url string) hydraclientgo.OAuth2API {
 	configuration := hydraclientgo.NewConfiguration()
 	configuration.Host = urlx.ParseOrPanic(url).Host
 	configuration.Servers = hydraclientgo.ServerConfigurations{{URL: url}}
 
-	return hydraclientgo.NewAPIClient(configuration).OAuth2Api
+	return hydraclientgo.NewAPIClient(configuration).OAuth2API
 }
 
-func createOAuth2Client(t *testing.T, ctx context.Context, hydraAdmin *hydraclientgo.OAuth2ApiService, redirectURIs []string, scope string, skipConsent bool) string {
+func createOAuth2Client(t *testing.T, ctx context.Context, hydraAdmin hydraclientgo.OAuth2API, redirectURIs []string, scope string, skipConsent bool) string {
 	t.Helper()
 
 	clientName := "kratos-hydra-integration-test-client-1"
diff --git a/selfservice/strategy/password/op_login_test.go b/selfservice/strategy/password/op_login_test.go
index 6d8492a2ff3e..1fad1cce1c18 100644
--- a/selfservice/strategy/password/op_login_test.go
+++ b/selfservice/strategy/password/op_login_test.go
@@ -227,7 +227,7 @@ func TestOAuth2Provider(t *testing.T) {
 		t.Cleanup(func() {
 			conf.MustSet(ctx, config.ViperKeySessionPersistentCookie, true)
 		})
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 
 		identifier, pwd := x.NewUUID().String(), "password"
 		createIdentity(ctx, reg, t, identifier, pwd)
@@ -298,7 +298,7 @@ func TestOAuth2Provider(t *testing.T) {
 		// to SessionPersistentCookie=false, the user is not
 		// remembered from the previous OAuth2 flow.
 		// The user must then re-authenticate and re-consent.
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 
 		identifier, pwd := x.NewUUID().String(), "password"
 		createIdentity(ctx, reg, t, identifier, pwd)
@@ -398,7 +398,7 @@ func TestOAuth2Provider(t *testing.T) {
 		// The user must then only re-consent.
 		conf.MustSet(ctx, config.ViperKeySessionPersistentCookie, true)
 
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 
 		identifier, pwd := x.NewUUID().String(), "password"
 
@@ -488,7 +488,7 @@ func TestOAuth2Provider(t *testing.T) {
 	})
 
 	t.Run("should prompt login even with session with OAuth flow", func(t *testing.T) {
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 
 		identifier, pwd := x.NewUUID().String(), "password"
 		createIdentity(ctx, reg, t, identifier, pwd)
@@ -559,7 +559,7 @@ func TestOAuth2Provider(t *testing.T) {
 	})
 
 	t.Run("first party clients can skip consent", func(t *testing.T) {
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 
 		identifier, pwd := x.NewUUID().String(), "password"
 		createIdentity(ctx, reg, t, identifier, pwd)
@@ -628,7 +628,7 @@ func TestOAuth2Provider(t *testing.T) {
 	})
 
 	t.Run("oauth flow with consent remember, skips consent", func(t *testing.T) {
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 
 		identifier, pwd := x.NewUUID().String(), "password"
 		createIdentity(ctx, reg, t, identifier, pwd)
@@ -719,7 +719,7 @@ func TestOAuth2Provider(t *testing.T) {
 	})
 
 	t.Run("should fail when Hydra session subject doesn't match the subject authenticated by Kratos", func(t *testing.T) {
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 
 		identifier, pwd := x.NewUUID().String(), "password"
 		createIdentity(ctx, reg, t, identifier, pwd)
diff --git a/selfservice/strategy/password/op_registration_test.go b/selfservice/strategy/password/op_registration_test.go
index 40b3d0193511..dc2df971b9f9 100644
--- a/selfservice/strategy/password/op_registration_test.go
+++ b/selfservice/strategy/password/op_registration_test.go
@@ -40,7 +40,7 @@ func TestOAuth2ProviderRegistration(t *testing.T) {
 	errTS := testhelpers.NewErrorTestServer(t, reg)
 	redirTS := testhelpers.NewRedirSessionEchoTS(t, reg)
 
-	var hydraAdminClient *hydraclientgo.OAuth2ApiService
+	var hydraAdminClient hydraclientgo.OAuth2API
 
 	router := x.NewRouterPublic()
 
@@ -261,7 +261,7 @@ func TestOAuth2ProviderRegistration(t *testing.T) {
 		require.Equal(t, http.StatusOK, res.StatusCode)
 	}
 
-	registerNewAccount := func(t *testing.T, ctx context.Context, browserClient *http.Client, identifier, password string) {
+	registerNewAccount := func(t *testing.T, browserClient *http.Client, identifier, password string) {
 		// we need to create a new session directly with kratos
 		f := testhelpers.InitializeRegistrationFlowViaBrowser(t, browserClient, kratosPublicTS, false, false, false)
 		require.NotNil(t, f)
@@ -310,7 +310,7 @@ func TestOAuth2ProviderRegistration(t *testing.T) {
 			Scopes:      scopes,
 			RedirectURL: clientAppTS.URL,
 		}
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 
 		identifier := x.NewUUID().String()
 		password := x.NewUUID().String()
@@ -387,7 +387,7 @@ func TestOAuth2ProviderRegistration(t *testing.T) {
 			RedirectURL: clientAppTS.URL,
 		}
 
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 		identifier := x.NewUUID().String()
 		password := x.NewUUID().String()
 
@@ -418,7 +418,7 @@ func TestOAuth2ProviderRegistration(t *testing.T) {
 			state:       &clientAS,
 		})
 
-		registerNewAccount(t, ctx, browserClient, identifier, password)
+		registerNewAccount(t, browserClient, identifier, password)
 
 		require.ElementsMatch(t, []callTrace{
 			RegistrationUI,
@@ -472,7 +472,7 @@ func TestOAuth2ProviderRegistration(t *testing.T) {
 			RedirectURL: clientAppTS.URL,
 		}
 
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 		identifier := x.NewUUID().String()
 		password := x.NewUUID().String()
 
@@ -579,7 +579,7 @@ func TestOAuth2ProviderRegistration(t *testing.T) {
 			RedirectURL: clientAppTS.URL,
 		}
 
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 		identifier := x.NewUUID().String()
 		password := x.NewUUID().String()
 
@@ -659,7 +659,7 @@ func TestOAuth2ProviderRegistration(t *testing.T) {
 			RedirectURL: clientAppTS.URL,
 		}
 
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 		identifier := x.NewUUID().String()
 		password := x.NewUUID().String()
 
@@ -776,7 +776,7 @@ func TestOAuth2ProviderRegistration(t *testing.T) {
 			RedirectURL: clientAppTS.URL,
 		}
 
-		browserClient := testhelpers.NewClientWithCookieJar(t, nil, false)
+		browserClient := testhelpers.NewClientWithCookieJar(t, nil, nil)
 
 		ct := make([]callTrace, 0)
 
diff --git a/selfservice/strategy/password/registration.go b/selfservice/strategy/password/registration.go
index 55970fdf0b5e..b99d0543a980 100644
--- a/selfservice/strategy/password/registration.go
+++ b/selfservice/strategy/password/registration.go
@@ -8,6 +8,8 @@ import (
 	"encoding/json"
 	"net/http"
 
+	"github.com/ory/x/otelx"
+
 	"github.com/ory/kratos/text"
 
 	"github.com/pkg/errors"
@@ -56,13 +58,11 @@ type UpdateRegistrationFlowWithPasswordMethod struct {
 func (s *Strategy) RegisterRegistrationRoutes(*x.RouterPublic) {
 }
 
-func (s *Strategy) handleRegistrationError(_ http.ResponseWriter, r *http.Request, f *registration.Flow, p *UpdateRegistrationFlowWithPasswordMethod, err error) error {
+func (s *Strategy) handleRegistrationError(r *http.Request, f *registration.Flow, p UpdateRegistrationFlowWithPasswordMethod, err error) error {
 	if f != nil {
-		if p != nil {
-			for _, n := range container.NewFromJSON("", node.ProfileGroup, p.Traits, "traits").Nodes {
-				// we only set the value and not the whole field because we want to keep types from the initial form generation
-				f.UI.Nodes.SetValueAttribute(n.ID(), n.Attributes.GetValue())
-			}
+		for _, n := range container.NewFromJSON("", node.ProfileGroup, p.Traits, "traits").Nodes {
+			// we only set the value and not the whole field because we want to keep types from the initial form generation
+			f.UI.Nodes.SetValueAttribute(n.ID(), n.Attributes.GetValue())
 		}
 
 		if f.Type == flow.TypeBrowser {
@@ -73,28 +73,31 @@ func (s *Strategy) handleRegistrationError(_ http.ResponseWriter, r *http.Reques
 	return err
 }
 
-func (s *Strategy) decode(p *UpdateRegistrationFlowWithPasswordMethod, r *http.Request) error {
+func (s *Strategy) decode(p *UpdateRegistrationFlowWithPasswordMethod, r *http.Request) (err error) {
 	return registration.DecodeBody(p, r, s.hd, s.d.Config(), registrationSchema)
 }
 
-func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registration.Flow, i *identity.Identity) (err error) {
+func (s *Strategy) Register(_ http.ResponseWriter, r *http.Request, f *registration.Flow, i *identity.Identity) (err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.password.Strategy.Register")
+	defer otelx.End(span, &err)
+
 	if err := flow.MethodEnabledAndAllowedFromRequest(r, f.GetFlowName(), s.ID().String(), s.d); err != nil {
 		return err
 	}
 
 	var p UpdateRegistrationFlowWithPasswordMethod
 	if err := s.decode(&p, r); err != nil {
-		return s.handleRegistrationError(w, r, f, &p, err)
+		return s.handleRegistrationError(r, f, p, err)
 	}
 
 	f.TransientPayload = p.TransientPayload
 
-	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
-		return s.handleRegistrationError(w, r, f, &p, err)
+	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+		return s.handleRegistrationError(r, f, p, err)
 	}
 
 	if len(p.Password) == 0 {
-		return s.handleRegistrationError(w, r, f, &p, schema.NewRequiredError("#/password", "password"))
+		return s.handleRegistrationError(r, f, p, schema.NewRequiredError("#/password", "password"))
 	}
 
 	if len(p.Traits) == 0 {
@@ -107,7 +110,7 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registrat
 		defer close(hpw)
 		defer close(errC)
 
-		h, err := s.d.Hasher(r.Context()).Generate(r.Context(), []byte(p.Password))
+		h, err := s.d.Hasher(ctx).Generate(ctx, []byte(p.Password))
 		if err != nil {
 			errC <- err
 			return
@@ -116,27 +119,27 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registrat
 	}()
 
 	if err != nil {
-		return s.handleRegistrationError(w, r, f, &p, err)
+		return s.handleRegistrationError(r, f, p, err)
 	}
 
 	i.Traits = identity.Traits(p.Traits)
 	// We have to set the credential here, so the identity validator can populate the identifiers.
 	// The password hash is computed in parallel and set later.
 	if err := i.SetCredentialsWithConfig(s.ID(), identity.Credentials{Type: s.ID(), Identifiers: []string{}}, json.RawMessage("{}")); err != nil {
-		return s.handleRegistrationError(w, r, f, &p, err)
+		return s.handleRegistrationError(r, f, p, err)
 	}
 
-	if err := s.validateCredentials(r.Context(), i, p.Password); err != nil {
-		return s.handleRegistrationError(w, r, f, &p, err)
+	if err := s.validateCredentials(ctx, i, p.Password); err != nil {
+		return s.handleRegistrationError(r, f, p, err)
 	}
 
 	select {
 	case err := <-errC:
-		return s.handleRegistrationError(w, r, f, &p, err)
+		return s.handleRegistrationError(r, f, p, err)
 	case h := <-hpw:
 		co, err := json.Marshal(&identity.CredentialsPassword{HashedPassword: string(h)})
 		if err != nil {
-			return s.handleRegistrationError(w, r, f, &p, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to encode password options to JSON: %s", err)))
+			return s.handleRegistrationError(r, f, p, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to encode password options to JSON: %s", err)))
 		}
 		i.UpsertCredentialsConfig(s.ID(), co, 0)
 	}
@@ -144,7 +147,10 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, f *registrat
 	return nil
 }
 
-func (s *Strategy) validateCredentials(ctx context.Context, i *identity.Identity, pw string) error {
+func (s *Strategy) validateCredentials(ctx context.Context, i *identity.Identity, pw string) (err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.password.Strategy.validateCredentials")
+	defer otelx.End(span, &err)
+
 	if err := s.d.IdentityValidator().Validate(ctx, i); err != nil {
 		return err
 	}
diff --git a/selfservice/strategy/password/registration_test.go b/selfservice/strategy/password/registration_test.go
index 14bf2382b212..d52ca2d77707 100644
--- a/selfservice/strategy/password/registration_test.go
+++ b/selfservice/strategy/password/registration_test.go
@@ -14,6 +14,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/selfservice/flow"
+
 	"github.com/ory/kratos/driver"
 	"github.com/ory/kratos/internal/registrationhelpers"
 
@@ -106,7 +108,7 @@ func TestRegistration(t *testing.T) {
 			})
 		})
 
-		var expectLoginBody = func(t *testing.T, browserRedirTS *httptest.Server, isAPI, isSPA bool, hc *http.Client, values func(url.Values)) string {
+		var expectRegistrationBody = func(t *testing.T, browserRedirTS *httptest.Server, isAPI, isSPA bool, hc *http.Client, values func(url.Values)) string {
 			if isAPI {
 				return testhelpers.SubmitRegistrationForm(t, isAPI, hc, publicTS, values,
 					isSPA, http.StatusOK,
@@ -126,17 +128,17 @@ func TestRegistration(t *testing.T) {
 				isSPA, http.StatusOK, expectReturnTo)
 		}
 
-		var expectSuccessfulLogin = func(t *testing.T, isAPI, isSPA bool, hc *http.Client, values func(url.Values)) string {
+		var expectSuccessfulRegistration = func(t *testing.T, isAPI, isSPA bool, hc *http.Client, values func(url.Values)) string {
 			useReturnToFromTS(redirTS)
-			return expectLoginBody(t, redirTS, isAPI, isSPA, hc, values)
+			return expectRegistrationBody(t, redirTS, isAPI, isSPA, hc, values)
 		}
 
-		var expectNoLogin = func(t *testing.T, isAPI, isSPA bool, hc *http.Client, values func(url.Values)) string {
+		var expectNoRegistration = func(t *testing.T, isAPI, isSPA bool, hc *http.Client, values func(url.Values)) string {
 			useReturnToFromTS(redirNoSessionTS)
 			t.Cleanup(func() {
 				useReturnToFromTS(redirTS)
 			})
-			return expectLoginBody(t, redirNoSessionTS, isAPI, isSPA, hc, values)
+			return expectRegistrationBody(t, redirNoSessionTS, isAPI, isSPA, hc, values)
 		}
 
 		t.Run("case=should reject invalid transient payload", func(t *testing.T) {
@@ -178,7 +180,7 @@ func TestRegistration(t *testing.T) {
 
 			t.Run("type=api", func(t *testing.T) {
 				username := x.NewUUID().String()
-				body := expectSuccessfulLogin(t, true, false, nil, func(v url.Values) {
+				body := expectSuccessfulRegistration(t, true, false, nil, func(v url.Values) {
 					setValues(username, v)
 				})
 				assert.Equal(t, username, gjson.Get(body, "identity.traits.username").String(), "%s", body)
@@ -188,7 +190,7 @@ func TestRegistration(t *testing.T) {
 
 			t.Run("type=spa", func(t *testing.T) {
 				username := x.NewUUID().String()
-				body := expectSuccessfulLogin(t, false, true, nil, func(v url.Values) {
+				body := expectSuccessfulRegistration(t, false, true, nil, func(v url.Values) {
 					setValues(username, v)
 				})
 				assert.Equal(t, username, gjson.Get(body, "identity.traits.username").String(), "%s", body)
@@ -198,7 +200,7 @@ func TestRegistration(t *testing.T) {
 
 			t.Run("type=browser", func(t *testing.T) {
 				username := x.NewUUID().String()
-				body := expectSuccessfulLogin(t, false, false, nil, func(v url.Values) {
+				body := expectSuccessfulRegistration(t, false, false, nil, func(v url.Values) {
 					setValues(username, v)
 				})
 				assert.Equal(t, username, gjson.Get(body, "identity.traits.username").String(), "%s", body)
@@ -213,7 +215,7 @@ func TestRegistration(t *testing.T) {
 			})
 
 			t.Run("type=api", func(t *testing.T) {
-				body := expectSuccessfulLogin(t, true, false, nil, func(v url.Values) {
+				body := expectSuccessfulRegistration(t, true, false, nil, func(v url.Values) {
 					v.Set("traits.username", "registration-identifier-8-api")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.foobar", "bar")
@@ -221,10 +223,11 @@ func TestRegistration(t *testing.T) {
 				assert.Equal(t, `registration-identifier-8-api`, gjson.Get(body, "identity.traits.username").String(), "%s", body)
 				assert.NotEmpty(t, gjson.Get(body, "session_token").String(), "%s", body)
 				assert.NotEmpty(t, gjson.Get(body, "session.id").String(), "%s", body)
+				assert.NotContains(t, gjson.Get(body, "continue_with").Raw, string(flow.ContinueWithActionRedirectBrowserToString), "%s", body)
 			})
 
 			t.Run("type=spa", func(t *testing.T) {
-				body := expectSuccessfulLogin(t, false, true, nil, func(v url.Values) {
+				body := expectSuccessfulRegistration(t, false, true, nil, func(v url.Values) {
 					v.Set("traits.username", "registration-identifier-8-spa")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.foobar", "bar")
@@ -232,15 +235,17 @@ func TestRegistration(t *testing.T) {
 				assert.Equal(t, `registration-identifier-8-spa`, gjson.Get(body, "identity.traits.username").String(), "%s", body)
 				assert.Empty(t, gjson.Get(body, "session_token").String(), "%s", body)
 				assert.NotEmpty(t, gjson.Get(body, "session.id").String(), "%s", body)
+				assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(body, "continue_with.0.action").String(), "%s", body)
 			})
 
 			t.Run("type=browser", func(t *testing.T) {
-				body := expectSuccessfulLogin(t, false, false, nil, func(v url.Values) {
+				body := expectSuccessfulRegistration(t, false, false, nil, func(v url.Values) {
 					v.Set("traits.username", "registration-identifier-8-browser")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.foobar", "bar")
 				})
 				assert.Equal(t, `registration-identifier-8-browser`, gjson.Get(body, "identity.traits.username").String(), "%s", body)
+				assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
 			})
 		})
 
@@ -249,7 +254,7 @@ func TestRegistration(t *testing.T) {
 			conf.MustSet(ctx, config.HookStrategyKey(config.ViperKeySelfServiceRegistrationAfter, identity.CredentialsTypePassword.String()), nil)
 
 			t.Run("type=api", func(t *testing.T) {
-				body := expectNoLogin(t, true, false, nil, func(v url.Values) {
+				body := expectNoRegistration(t, true, false, nil, func(v url.Values) {
 					v.Set("traits.username", "registration-identifier-8-api-nosession")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.foobar", "bar")
@@ -260,7 +265,7 @@ func TestRegistration(t *testing.T) {
 			})
 
 			t.Run("type=spa", func(t *testing.T) {
-				expectNoLogin(t, false, true, nil, func(v url.Values) {
+				expectNoRegistration(t, false, true, nil, func(v url.Values) {
 					v.Set("traits.username", "registration-identifier-8-spa-nosession")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.foobar", "bar")
@@ -268,7 +273,7 @@ func TestRegistration(t *testing.T) {
 			})
 
 			t.Run("type=browser", func(t *testing.T) {
-				expectNoLogin(t, false, false, nil, func(v url.Values) {
+				expectNoRegistration(t, false, false, nil, func(v url.Values) {
 					v.Set("traits.username", "registration-identifier-8-browser-nosession")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.foobar", "bar")
@@ -300,7 +305,7 @@ func TestRegistration(t *testing.T) {
 						v.Set("traits.foobar", "bar")
 					}
 
-					_ = expectSuccessfulLogin(t, true, false, apiClient, values)
+					_ = expectSuccessfulRegistration(t, true, false, apiClient, values)
 					body := testhelpers.SubmitRegistrationForm(t, true, apiClient, publicTS,
 						applyTransform(values, transform), false, http.StatusBadRequest,
 						publicTS.URL+registration.RouteSubmitFlow)
@@ -314,7 +319,7 @@ func TestRegistration(t *testing.T) {
 						v.Set("traits.foobar", "bar")
 					}
 
-					_ = expectSuccessfulLogin(t, false, true, nil, values)
+					_ = expectSuccessfulRegistration(t, false, true, nil, values)
 					body := registrationhelpers.ExpectValidationError(t, publicTS, conf, "spa", applyTransform(values, transform))
 					assert.Contains(t, gjson.Get(body, "ui.messages.0.text").String(), "You tried signing in with registration-identifier-8-spa-duplicate-"+suffix+" which is already in use by another account. You can sign in using your password.", "%s", body)
 				})
@@ -326,7 +331,7 @@ func TestRegistration(t *testing.T) {
 						v.Set("traits.foobar", "bar")
 					}
 
-					_ = expectSuccessfulLogin(t, false, false, nil, values)
+					_ = expectSuccessfulRegistration(t, false, false, nil, values)
 					body := registrationhelpers.ExpectValidationError(t, publicTS, conf, "browser", applyTransform(values, transform))
 					assert.Contains(t, gjson.Get(body, "ui.messages.0.text").String(), "You tried signing in with registration-identifier-8-browser-duplicate-"+suffix+" which is already in use by another account. You can sign in using your password.", "%s", body)
 				})
@@ -541,7 +546,7 @@ func TestRegistration(t *testing.T) {
 			})
 
 			t.Run("type=api", func(t *testing.T) {
-				actual := expectSuccessfulLogin(t, true, false, nil, func(v url.Values) {
+				actual := expectSuccessfulRegistration(t, true, false, nil, func(v url.Values) {
 					v.Set("traits.username", "registration-identifier-10-api")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.foobar", "bar")
@@ -550,7 +555,7 @@ func TestRegistration(t *testing.T) {
 			})
 
 			t.Run("type=spa", func(t *testing.T) {
-				actual := expectSuccessfulLogin(t, false, false, nil, func(v url.Values) {
+				actual := expectSuccessfulRegistration(t, false, false, nil, func(v url.Values) {
 					v.Set("traits.username", "registration-identifier-10-spa")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.foobar", "bar")
@@ -559,7 +564,7 @@ func TestRegistration(t *testing.T) {
 			})
 
 			t.Run("type=browser", func(t *testing.T) {
-				actual := expectSuccessfulLogin(t, false, false, nil, func(v url.Values) {
+				actual := expectSuccessfulRegistration(t, false, false, nil, func(v url.Values) {
 					v.Set("traits.username", "registration-identifier-10-browser")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.foobar", "bar")
@@ -620,7 +625,7 @@ func TestRegistration(t *testing.T) {
 
 			username := "registration-custom-schema"
 			t.Run("type=api", func(t *testing.T) {
-				body := expectNoLogin(t, true, false, nil, func(v url.Values) {
+				body := expectNoRegistration(t, true, false, nil, func(v url.Values) {
 					v.Set("traits.username", username+"-api")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.baz", "bar")
@@ -631,7 +636,7 @@ func TestRegistration(t *testing.T) {
 			})
 
 			t.Run("type=spa", func(t *testing.T) {
-				expectNoLogin(t, false, true, nil, func(v url.Values) {
+				expectNoRegistration(t, false, true, nil, func(v url.Values) {
 					v.Set("traits.username", username+"-spa")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.baz", "bar")
@@ -639,7 +644,7 @@ func TestRegistration(t *testing.T) {
 			})
 
 			t.Run("type=browser", func(t *testing.T) {
-				expectNoLogin(t, false, false, nil, func(v url.Values) {
+				expectNoRegistration(t, false, false, nil, func(v url.Values) {
 					v.Set("traits.username", username+"-browser")
 					v.Set("password", x.NewUUID().String())
 					v.Set("traits.baz", "bar")
diff --git a/selfservice/strategy/password/settings.go b/selfservice/strategy/password/settings.go
index f763163d3180..183f06eb70b2 100644
--- a/selfservice/strategy/password/settings.go
+++ b/selfservice/strategy/password/settings.go
@@ -8,6 +8,10 @@ import (
 	"net/http"
 	"time"
 
+	"golang.org/x/net/context"
+
+	"github.com/ory/x/otelx"
+
 	"github.com/ory/kratos/text"
 
 	"github.com/ory/kratos/ui/node"
@@ -71,27 +75,30 @@ func (p *updateSettingsFlowWithPasswordMethod) SetFlowID(rid uuid.UUID) {
 	p.Flow = rid.String()
 }
 
-func (s *Strategy) Settings(w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (*settings.UpdateContext, error) {
+func (s *Strategy) Settings(ctx context.Context, w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (_ *settings.UpdateContext, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.password.Strategy.Settings")
+	defer otelx.End(span, &err)
+
 	var p updateSettingsFlowWithPasswordMethod
 	ctxUpdate, err := settings.PrepareUpdate(s.d, w, r, f, ss, settings.ContinuityKey(s.SettingsStrategyID()), &p)
 	if errors.Is(err, settings.ErrContinuePreviousAction) {
-		return ctxUpdate, s.continueSettingsFlow(w, r, ctxUpdate, &p)
+		return ctxUpdate, s.continueSettingsFlow(ctx, r, ctxUpdate, p)
 	} else if err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	if err := flow.MethodEnabledAndAllowedFromRequest(r, f.GetFlowName(), s.SettingsStrategyID(), s.d); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	if err := s.decodeSettingsFlow(r, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	// This does not come from the payload!
 	p.Flow = ctxUpdate.Flow.ID.String()
-	if err := s.continueSettingsFlow(w, r, ctxUpdate, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+	if err := s.continueSettingsFlow(ctx, r, ctxUpdate, p); err != nil {
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	return ctxUpdate, nil
@@ -104,25 +111,23 @@ func (s *Strategy) decodeSettingsFlow(r *http.Request, dest interface{}) error {
 	}
 
 	return decoderx.NewHTTP().Decode(r, dest, compiler,
+		decoderx.HTTPKeepRequestBody(true),
 		decoderx.HTTPDecoderAllowedMethods("POST", "GET"),
 		decoderx.HTTPDecoderSetValidatePayloads(true),
 		decoderx.HTTPDecoderJSONFollowsFormFormat(),
 	)
 }
 
-func (s *Strategy) continueSettingsFlow(
-	w http.ResponseWriter, r *http.Request,
-	ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithPasswordMethod,
-) error {
-	if err := flow.MethodEnabledAndAllowed(r.Context(), flow.SettingsFlow, s.SettingsStrategyID(), p.Method, s.d); err != nil {
+func (s *Strategy) continueSettingsFlow(ctx context.Context, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithPasswordMethod) error {
+	if err := flow.MethodEnabledAndAllowed(ctx, flow.SettingsFlow, s.SettingsStrategyID(), p.Method, s.d); err != nil {
 		return err
 	}
 
-	if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+	if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 		return err
 	}
 
-	if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(r.Context())).Before(time.Now()) {
+	if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(ctx)).Before(time.Now()) {
 		return errors.WithStack(settings.NewFlowNeedsReAuth())
 	}
 
@@ -134,7 +139,7 @@ func (s *Strategy) continueSettingsFlow(
 	go func() {
 		defer close(hpw)
 		defer close(errC)
-		h, err := s.d.Hasher(r.Context()).Generate(r.Context(), []byte(p.Password))
+		h, err := s.d.Hasher(ctx).Generate(ctx, []byte(p.Password))
 		if err != nil {
 			errC <- err
 			return
@@ -142,13 +147,13 @@ func (s *Strategy) continueSettingsFlow(
 		hpw <- h
 	}()
 
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.Identity.ID)
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.Identity.ID)
 	if err != nil {
 		return err
 	}
 
 	i.UpsertCredentialsConfig(s.ID(), []byte("{}"), 0)
-	if err := s.validateCredentials(r.Context(), i, p.Password); err != nil {
+	if err := s.validateCredentials(ctx, i, p.Password); err != nil {
 		return err
 	}
 
@@ -167,7 +172,10 @@ func (s *Strategy) continueSettingsFlow(
 	return nil
 }
 
-func (s *Strategy) PopulateSettingsMethod(r *http.Request, _ *identity.Identity, f *settings.Flow) error {
+func (s *Strategy) PopulateSettingsMethod(ctx context.Context, r *http.Request, _ *identity.Identity, f *settings.Flow) (err error) {
+	_, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.password.Strategy.PopulateSettingsMethod")
+	defer otelx.End(span, &err)
+
 	f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
 	f.UI.Nodes.Upsert(NewPasswordNode("password", node.InputAttributeAutocompleteNewPassword).WithMetaLabel(text.NewInfoNodeInputPassword()))
 	f.UI.Nodes.Append(node.NewInputField("method", "password", node.PasswordGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoNodeLabelSave()))
@@ -175,10 +183,10 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, _ *identity.Identity,
 	return nil
 }
 
-func (s *Strategy) handleSettingsError(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithPasswordMethod, err error) error {
+func (s *Strategy) handleSettingsError(ctx context.Context, w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithPasswordMethod, err error) error {
 	// Do not pause flow if the flow type is an API flow as we can't save cookies in those flows.
 	if e := new(settings.FlowNeedsReAuth); errors.As(err, &e) && ctxUpdate.Flow != nil && ctxUpdate.Flow.Type == flow.TypeBrowser {
-		if err := s.d.ContinuityManager().Pause(r.Context(), w, r, settings.ContinuityKey(s.SettingsStrategyID()), settings.ContinuityOptions(p, ctxUpdate.GetSessionIdentity())...); err != nil {
+		if err := s.d.ContinuityManager().Pause(ctx, w, r, settings.ContinuityKey(s.SettingsStrategyID()), settings.ContinuityOptions(p, ctxUpdate.GetSessionIdentity())...); err != nil {
 			return err
 		}
 	}
diff --git a/selfservice/strategy/password/settings_test.go b/selfservice/strategy/password/settings_test.go
index a4ee7e6c7fa0..c670395d5f24 100644
--- a/selfservice/strategy/password/settings_test.go
+++ b/selfservice/strategy/password/settings_test.go
@@ -13,6 +13,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/ory/kratos/selfservice/flow"
+
 	"github.com/ory/kratos/internal/settingshelpers"
 	"github.com/ory/kratos/text"
 
@@ -42,7 +44,8 @@ func init() {
 
 func newIdentityWithPassword(email string) *identity.Identity {
 	return &identity.Identity{
-		ID: x.NewUUID(),
+		ID:  x.NewUUID(),
+		NID: x.NewUUID(),
 		Credentials: map[identity.CredentialsType]identity.Credentials{
 			"password": {
 				Type:        "password",
@@ -59,6 +62,7 @@ func newIdentityWithPassword(email string) *identity.Identity {
 func newEmptyIdentity() *identity.Identity {
 	return &identity.Identity{
 		ID:       x.NewUUID(),
+		NID:      x.NewUUID(),
 		State:    identity.StateActive,
 		Traits:   identity.Traits(`{}`),
 		SchemaID: config.DefaultIdentityTraitsSchemaID,
@@ -68,6 +72,7 @@ func newEmptyIdentity() *identity.Identity {
 func newIdentityWithoutCredentials(email string) *identity.Identity {
 	return &identity.Identity{
 		ID:       x.NewUUID(),
+		NID:      x.NewUUID(),
 		State:    identity.StateActive,
 		Traits:   identity.Traits(`{"email":"` + email + `"}`),
 		SchemaID: config.DefaultIdentityTraitsSchemaID,
@@ -82,7 +87,7 @@ func TestSettings(t *testing.T) {
 	testhelpers.StrategyEnable(t, conf, identity.CredentialsTypePassword.String(), true)
 	testhelpers.StrategyEnable(t, conf, settings.StrategyProfile, true)
 
-	_ = testhelpers.NewSettingsUIFlowEchoServer(t, reg)
+	settingsUI := testhelpers.NewSettingsUIFlowEchoServer(t, reg)
 	_ = testhelpers.NewErrorTestServer(t, reg)
 	_ = testhelpers.NewLoginUIWith401Response(t, conf)
 	conf.MustSet(ctx, config.ViperKeySelfServiceSettingsPrivilegedAuthenticationAfter, "1m")
@@ -94,10 +99,10 @@ func TestSettings(t *testing.T) {
 
 	publicTS, _ := testhelpers.NewKratosServer(t, reg)
 
-	browserUser1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, browserIdentity1)
-	browserUser2 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, browserIdentity2)
-	apiUser1 := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, apiIdentity1)
-	apiUser2 := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, apiIdentity2)
+	browserUser1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, browserIdentity1)
+	browserUser2 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, browserIdentity2)
+	apiUser1 := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, apiIdentity1)
+	apiUser2 := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, apiIdentity2)
 
 	t.Run("description=not authorized to call endpoints without a session", func(t *testing.T) {
 		c := testhelpers.NewDebugClient(t)
@@ -242,15 +247,20 @@ func TestSettings(t *testing.T) {
 		t.Run("type=api", func(t *testing.T) {
 			actual := testhelpers.SubmitSettingsForm(t, true, false, apiUser1, publicTS, payload, http.StatusOK, publicTS.URL+settings.RouteSubmitFlow)
 			check(t, actual)
+			assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
 		})
 
 		t.Run("type=spa", func(t *testing.T) {
 			actual := testhelpers.SubmitSettingsForm(t, false, true, browserUser1, publicTS, payload, http.StatusOK, publicTS.URL+settings.RouteSubmitFlow)
 			check(t, actual)
+			assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(actual, "continue_with.0.action").String(), "%s", actual)
+			assert.Contains(t, gjson.Get(actual, "continue_with.0.redirect_browser_to").String(), settingsUI.URL, "%s", actual)
 		})
 
 		t.Run("type=browser", func(t *testing.T) {
-			check(t, testhelpers.SubmitSettingsForm(t, false, false, browserUser1, publicTS, payload, http.StatusOK, conf.SelfServiceFlowSettingsUI(ctx).String()))
+			actual := testhelpers.SubmitSettingsForm(t, false, false, browserUser1, publicTS, payload, http.StatusOK, conf.SelfServiceFlowSettingsUI(ctx).String())
+			check(t, actual)
+			assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
 		})
 	})
 
@@ -340,9 +350,9 @@ func TestSettings(t *testing.T) {
 		bi := newIdentityWithoutCredentials(x.NewUUID().String() + "@ory.sh")
 		si := newIdentityWithoutCredentials(x.NewUUID().String() + "@ory.sh")
 		ai := newIdentityWithoutCredentials(x.NewUUID().String() + "@ory.sh")
-		browserUser := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, bi)
-		spaUser := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, si)
-		apiUser := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, ai)
+		browserUser := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, bi)
+		spaUser := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, si)
+		apiUser := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, ai)
 
 		var check = func(t *testing.T, actual string, id *identity.Identity) {
 			assert.Equal(t, "success", gjson.Get(actual, "state").String(), "%s", actual)
@@ -433,12 +443,12 @@ func TestSettings(t *testing.T) {
 
 		var initClients = func(isAPI, isSPA bool, id *identity.Identity) (client1, client2 *http.Client) {
 			if isAPI {
-				client1 = testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
-				client2 = testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+				client1 = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
+				client2 = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 				return client1, client2
 			}
-			client1 = testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
-			client2 = testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+			client1 = testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
+			client2 = testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 
 			return client1, client2
 		}
@@ -485,8 +495,8 @@ func TestSettings(t *testing.T) {
 		testhelpers.SetDefaultIdentitySchema(conf, "file://stub/missing-identifier.schema.json")
 
 		id := newIdentityWithoutCredentials(testhelpers.RandomEmail())
-		browser := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
-		api := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		browser := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
+		api := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 
 		for _, f := range []string{"spa", "api", "browser"} {
 			t.Run("type="+f, func(t *testing.T) {
diff --git a/selfservice/strategy/password/strategy.go b/selfservice/strategy/password/strategy.go
index 911ad619cd15..9aa36ebeb8a1 100644
--- a/selfservice/strategy/password/strategy.go
+++ b/selfservice/strategy/password/strategy.go
@@ -6,12 +6,14 @@ package password
 import (
 	"context"
 	"encoding/json"
-
-	"github.com/ory/kratos/ui/node"
+	"strings"
 
 	"github.com/go-playground/validator/v10"
 	"github.com/pkg/errors"
 
+	"github.com/ory/kratos/ui/node"
+	"github.com/ory/x/jsonnetsecure"
+
 	"github.com/ory/x/decoderx"
 
 	"github.com/ory/kratos/continuity"
@@ -37,9 +39,10 @@ type registrationStrategyDependencies interface {
 	x.WriterProvider
 	x.CSRFTokenGeneratorProvider
 	x.CSRFProvider
-
+	x.HTTPClientProvider
+	x.TracingProvider
+	jsonnetsecure.VMProvider
 	config.Provider
-
 	continuity.ManagementProvider
 
 	errorx.ManagementProvider
@@ -65,6 +68,7 @@ type registrationStrategyDependencies interface {
 
 	identity.PrivilegedPoolProvider
 	identity.ValidationProvider
+	identity.ManagementProvider
 
 	session.HandlerProvider
 	session.ManagementProvider
@@ -84,7 +88,7 @@ func NewStrategy(d any) *Strategy {
 	}
 }
 
-func (s *Strategy) CountActiveFirstFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveFirstFactorCredentials(ctx context.Context, cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	for _, c := range cc {
 		if c.Type == s.ID() && len(c.Config) > 0 {
 			var conf identity.CredentialsPassword
@@ -92,8 +96,9 @@ func (s *Strategy) CountActiveFirstFactorCredentials(cc map[identity.Credentials
 				return 0, errors.WithStack(err)
 			}
 
-			if len(c.Identifiers) > 0 && len(c.Identifiers[0]) > 0 &&
-				(hash.IsBcryptHash([]byte(conf.HashedPassword)) || hash.IsArgon2idHash([]byte(conf.HashedPassword))) {
+			if len(strings.Join(c.Identifiers, "")) > 0 &&
+				((s.d.Config().PasswordMigrationHook(ctx).Enabled && conf.UsePasswordMigrationHook) ||
+					len(conf.HashedPassword) > 0) {
 				count++
 			}
 		}
@@ -101,7 +106,7 @@ func (s *Strategy) CountActiveFirstFactorCredentials(cc map[identity.Credentials
 	return
 }
 
-func (s *Strategy) CountActiveMultiFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveMultiFactorCredentials(_ context.Context, _ map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	return 0, nil
 }
 
@@ -109,7 +114,7 @@ func (s *Strategy) ID() identity.CredentialsType {
 	return identity.CredentialsTypePassword
 }
 
-func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context, _ session.AuthenticationMethods) session.AuthenticationMethod {
+func (s *Strategy) CompletedAuthenticationMethod(_ context.Context) session.AuthenticationMethod {
 	return session.AuthenticationMethod{
 		Method: s.ID(),
 		AAL:    identity.AuthenticatorAssuranceLevel1,
diff --git a/selfservice/strategy/password/strategy_disabled_test.go b/selfservice/strategy/password/strategy_disabled_test.go
index 6cf92147c3a4..e95e98c5913e 100644
--- a/selfservice/strategy/password/strategy_disabled_test.go
+++ b/selfservice/strategy/password/strategy_disabled_test.go
@@ -4,6 +4,7 @@
 package password_test
 
 import (
+	"context"
 	"io"
 	"net/http"
 	"net/url"
@@ -54,7 +55,7 @@ func TestDisabledEndpoint(t *testing.T) {
 
 	t.Run("case=should not settings when password method is disabled", func(t *testing.T) {
 		testhelpers.SetDefaultIdentitySchema(conf, "file://stub/login.schema.json")
-		c := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, reg)
+		c := testhelpers.NewHTTPClientWithArbitrarySessionCookie(t, context.Background(), reg)
 
 		t.Run("method=GET", func(t *testing.T) {
 			t.Skip("GET is currently not supported for this endpoint.")
diff --git a/selfservice/strategy/password/strategy_test.go b/selfservice/strategy/password/strategy_test.go
index e27a0950ca28..dc86e5f1a85e 100644
--- a/selfservice/strategy/password/strategy_test.go
+++ b/selfservice/strategy/password/strategy_test.go
@@ -4,20 +4,36 @@
 package password_test
 
 import (
+	"cmp"
 	"context"
+	"encoding/json"
 	"fmt"
 	"testing"
 
+	"github.com/ory/kratos/driver/config"
+	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
+
 	hash2 "github.com/ory/kratos/hash"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/go-faker/faker/v4"
+
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/internal"
 	"github.com/ory/kratos/selfservice/strategy/password"
 )
 
+func generateRandomConfig(t *testing.T) (identity.CredentialsPassword, []byte) {
+	t.Helper()
+	var cred identity.CredentialsPassword
+	require.NoError(t, faker.FakeData(&cred))
+	c, err := json.Marshal(cred)
+	require.NoError(t, err)
+	return cred, c
+}
+
 func TestCountActiveFirstFactorCredentials(t *testing.T) {
 	ctx := context.Background()
 	_, reg := internal.NewFastRegistryWithMocks(t)
@@ -28,75 +44,127 @@ func TestCountActiveFirstFactorCredentials(t *testing.T) {
 	h2, err := reg.Hasher(ctx).Generate(context.Background(), []byte("a password"))
 	require.NoError(t, err)
 
-	for k, tc := range []struct {
-		in       map[identity.CredentialsType]identity.Credentials
-		expected int
-	}{
-		{
-			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
-				Type:   strategy.ID(),
-				Config: []byte{},
-			}},
-			expected: 0,
-		},
-		{
-			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
-				Type:   strategy.ID(),
-				Config: []byte(`{"hashed_password": "` + string(h1) + `"}`),
-			}},
-			expected: 0,
-		},
-		{
-			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
-				Type:        strategy.ID(),
-				Identifiers: []string{""},
-				Config:      []byte(`{"hashed_password": "` + string(h1) + `"}`),
-			}},
-			expected: 0,
-		},
-		{
-			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
-				Type:        strategy.ID(),
-				Identifiers: []string{"foo"},
-				Config:      []byte(`{"hashed_password": "` + string(h1) + `"}`),
-			}},
-			expected: 1,
-		},
-		{
-			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
-				Type:        strategy.ID(),
-				Identifiers: []string{"foo"},
-				Config:      []byte(`{"hashed_password": "` + string(h2) + `"}`),
-			}},
-			expected: 1,
-		},
-		{
-			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
-				Type:   strategy.ID(),
-				Config: []byte(`{"hashed_password": "asdf"}`),
-			}},
-			expected: 0,
-		},
-		{
-			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
-				Type:   strategy.ID(),
-				Config: []byte(`{}`),
-			}},
-			expected: 0,
-		},
-		{
-			in:       nil,
-			expected: 0,
-		},
-	} {
-		t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
-			actual, err := strategy.CountActiveFirstFactorCredentials(tc.in)
-			assert.NoError(t, err)
-			assert.Equal(t, tc.expected, actual)
+	t.Run("test regressions fixtures", func(t *testing.T) {
+		// This test ensures we do not add regressions to this method by, for example, adding a new field.
+		for k := 0; k < 100; k++ {
+			t.Run(fmt.Sprintf("run=%d", k), func(t *testing.T) {
+				cred, c := generateRandomConfig(t)
+				actual, err := strategy.CountActiveFirstFactorCredentials(ctx, map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:        strategy.ID(),
+					Identifiers: []string{"foo"},
+					Config:      c,
+				}})
+				assert.NoError(t, err)
+
+				if len(cred.HashedPassword) == 0 && cred.UsePasswordMigrationHook {
+					// This case is OK
+					assert.Equal(t, 0, actual)
+					return
+				}
+
+				assert.Equal(t, 1, actual)
+			})
+		}
+	})
+
+	t.Run("with fixtures", func(t *testing.T) {
+		for k, tc := range []struct {
+			in       map[identity.CredentialsType]identity.Credentials
+			expected int
+			ctx      context.Context
+		}{
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:   strategy.ID(),
+					Config: []byte{},
+				}},
+				expected: 0,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:   strategy.ID(),
+					Config: []byte(`{"hashed_password": "` + string(h1) + `"}`),
+				}},
+				expected: 0,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:        strategy.ID(),
+					Identifiers: []string{""},
+					Config:      []byte(`{"hashed_password": "` + string(h1) + `"}`),
+				}},
+				expected: 0,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:        strategy.ID(),
+					Identifiers: []string{"foo"},
+					Config:      []byte(`{"hashed_password": "` + string(h1) + `"}`),
+				}},
+				expected: 1,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:        strategy.ID(),
+					Identifiers: []string{"foo"},
+					Config:      []byte(`{"hashed_password": "` + string(h2) + `"}`),
+				}},
+				expected: 1,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:        strategy.ID(),
+					Identifiers: []string{"foo"},
+					Config:      []byte(`{"use_password_migration_hook":true}`),
+				}},
+				expected: 1,
+				ctx:      confighelpers.WithConfigValue(ctx, config.ViperKeyPasswordMigrationHook+".enabled", true),
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:        strategy.ID(),
+					Identifiers: []string{"foo"},
+					Config:      []byte(`{"use_password_migration_hook":true}`),
+				}},
+				expected: 0,
+				ctx:      confighelpers.WithConfigValue(ctx, config.ViperKeyPasswordMigrationHook+".enabled", false),
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:        strategy.ID(),
+					Identifiers: []string{"foo"},
+					Config:      []byte(`{"use_password_migration_hook":false}`),
+				}},
+				expected: 0,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:   strategy.ID(),
+					Config: []byte(`{"hashed_password": "asdf"}`),
+				}},
+				expected: 0,
+			},
+			{
+				in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+					Type:   strategy.ID(),
+					Config: []byte(`{}`),
+				}},
+				expected: 0,
+			},
+			{
+				in:       nil,
+				expected: 0,
+			},
+		} {
+			t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
+				actual, err := strategy.CountActiveFirstFactorCredentials(cmp.Or(tc.ctx, ctx), tc.in)
+				assert.NoError(t, err)
+				assert.Equal(t, tc.expected, actual)
 
-			actual, err = strategy.CountActiveMultiFactorCredentials(tc.in)
-			assert.NoError(t, err)
-			assert.Equal(t, 0, actual)
-		})
-	}
+				actual, err = strategy.CountActiveMultiFactorCredentials(cmp.Or(tc.ctx, ctx), tc.in)
+				assert.NoError(t, err)
+				assert.Equal(t, 0, actual)
+			})
+		}
+	})
 }
diff --git a/selfservice/strategy/password/stub/migration.schema.json b/selfservice/strategy/password/stub/migration.schema.json
new file mode 100644
index 000000000000..5ac7314cd7d9
--- /dev/null
+++ b/selfservice/strategy/password/stub/migration.schema.json
@@ -0,0 +1,36 @@
+{
+  "$id": "https://example.com/person.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Person",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string",
+          "ory.sh/kratos": {
+            "credentials": {
+              "password": {
+                "identifier": true
+              },
+              "webauthn": {
+                "identifier": true
+              }
+            },
+            "verification": {
+              "via": "email"
+            },
+            "recovery": {
+              "via": "email"
+            }
+          }
+        }
+      },
+      "required": [
+        "email"
+      ]
+    }
+  },
+  "additionalProperties": false
+}
diff --git a/selfservice/strategy/password/validator.go b/selfservice/strategy/password/validator.go
index be1aac3c3497..00d15e3c80b6 100644
--- a/selfservice/strategy/password/validator.go
+++ b/selfservice/strategy/password/validator.go
@@ -62,7 +62,7 @@ var (
 type DefaultPasswordValidator struct {
 	reg    validatorDependencies
 	Client *retryablehttp.Client
-	hashes *ristretto.Cache
+	hashes *ristretto.Cache[string, int64]
 
 	minIdentifierPasswordDist            int
 	maxIdentifierPasswordSubstrThreshold float32
@@ -73,7 +73,7 @@ type validatorDependencies interface {
 }
 
 func NewDefaultPasswordValidatorStrategy(reg validatorDependencies) (*DefaultPasswordValidator, error) {
-	cache, err := ristretto.NewCache(&ristretto.Config{
+	cache, err := ristretto.NewCache(&ristretto.Config[string, int64]{
 		NumCounters:        10 * 10000,
 		MaxCost:            60 * 10000, // BCrypt hash size is 60 bytes
 		BufferItems:        64,
@@ -180,7 +180,9 @@ func (s *DefaultPasswordValidator) Validate(ctx context.Context, identifier, pas
 func (s *DefaultPasswordValidator) validate(ctx context.Context, identifier, password string) error {
 	passwordPolicyConfig := s.reg.Config().PasswordPolicyConfig(ctx)
 
+	//nolint:gosec // disable G115
 	if len(password) < int(passwordPolicyConfig.MinPasswordLength) {
+		//nolint:gosec // disable G115
 		return text.NewErrorValidationPasswordMinLength(int(passwordPolicyConfig.MinPasswordLength), len(password))
 	}
 
@@ -215,9 +217,9 @@ func (s *DefaultPasswordValidator) validate(ctx context.Context, identifier, pas
 		}
 	}
 
-	v, ok := c.(int64)
-	if ok && v > int64(s.reg.Config().PasswordPolicyConfig(ctx).MaxBreaches) {
-		return text.NewErrorValidationPasswordTooManyBreaches(v)
+	//nolint:gosec // disable G115
+	if c > int64(s.reg.Config().PasswordPolicyConfig(ctx).MaxBreaches) {
+		return text.NewErrorValidationPasswordTooManyBreaches(c)
 	}
 
 	return nil
diff --git a/selfservice/strategy/profile/.schema/registration.schema.json b/selfservice/strategy/profile/.schema/registration.schema.json
index 4a4d5dba16c4..727b8f86c7d5 100644
--- a/selfservice/strategy/profile/.schema/registration.schema.json
+++ b/selfservice/strategy/profile/.schema/registration.schema.json
@@ -12,7 +12,8 @@
     "screen": {
       "type": "string",
       "enum": [
-        "credential-selection"
+        "credential-selection",
+        "previous"
       ]
     },
     "method": {
diff --git a/selfservice/strategy/profile/.schema/settings.schema.json b/selfservice/strategy/profile/.schema/settings.schema.json
index 5ae4ad70d94a..90246cbde523 100644
--- a/selfservice/strategy/profile/.schema/settings.schema.json
+++ b/selfservice/strategy/profile/.schema/settings.schema.json
@@ -13,6 +13,9 @@
     "csrf_token": {
       "type": "string"
     },
+    "action": {
+      "type": "string"
+    },
     "transient_payload": {
       "type": "object",
       "additionalProperties": true
diff --git a/selfservice/strategy/profile/.snapshots/TestStrategyTraits-description=hydrate_the_proper_fields-type=api#01.json b/selfservice/strategy/profile/.snapshots/TestStrategyTraits-description=hydrate_the_proper_fields-type=spa.json
similarity index 100%
rename from selfservice/strategy/profile/.snapshots/TestStrategyTraits-description=hydrate_the_proper_fields-type=api#01.json
rename to selfservice/strategy/profile/.snapshots/TestStrategyTraits-description=hydrate_the_proper_fields-type=spa.json
diff --git a/selfservice/strategy/profile/strategy.go b/selfservice/strategy/profile/strategy.go
index b83e6ad527b2..0347d3160cb8 100644
--- a/selfservice/strategy/profile/strategy.go
+++ b/selfservice/strategy/profile/strategy.go
@@ -9,6 +9,8 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/ory/x/otelx"
+
 	"github.com/ory/jsonschema/v3"
 	"github.com/ory/kratos/selfservice/flow/registration"
 	"github.com/ory/kratos/text"
@@ -40,6 +42,7 @@ type (
 		x.CSRFTokenGeneratorProvider
 		x.WriterProvider
 		x.LoggingProvider
+		x.TracingProvider
 
 		config.Provider
 
@@ -78,10 +81,13 @@ func (s *Strategy) SettingsStrategyID() string {
 	return settings.StrategyProfile
 }
 
-func (s *Strategy) RegisterSettingsRoutes(public *x.RouterPublic) {}
+func (s *Strategy) RegisterSettingsRoutes(_ *x.RouterPublic) {}
+
+func (s *Strategy) PopulateSettingsMethod(ctx context.Context, r *http.Request, id *identity.Identity, f *settings.Flow) (err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.profile.Strategy.PopulateSettingsMethod")
+	defer otelx.End(span, &err)
 
-func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity, f *settings.Flow) error {
-	schemas, err := s.d.IdentityTraitsSchemas(r.Context())
+	schemas, err := s.d.IdentityTraitsSchemas(ctx)
 	if err != nil {
 		return err
 	}
@@ -93,7 +99,7 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 
 	// use a schema compiler that disables identifiers
 	schemaCompiler := jsonschema.NewCompiler()
-	nodes, err := container.NodesFromJSONSchema(r.Context(), node.ProfileGroup, traitsSchema.URL.String(), "", schemaCompiler)
+	nodes, err := container.NodesFromJSONSchema(ctx, node.ProfileGroup, traitsSchema.URL.String(), "", schemaCompiler)
 	if err != nil {
 		return err
 	}
@@ -109,22 +115,25 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 	return nil
 }
 
-func (s *Strategy) Settings(w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (*settings.UpdateContext, error) {
+func (s *Strategy) Settings(ctx context.Context, w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (_ *settings.UpdateContext, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.profile.Strategy.Settings")
+	defer otelx.End(span, &err)
+
 	var p updateSettingsFlowWithProfileMethod
 	ctxUpdate, err := settings.PrepareUpdate(s.d, w, r, f, ss, settings.ContinuityKey(s.SettingsStrategyID()), &p)
 	if errors.Is(err, settings.ErrContinuePreviousAction) {
-		return ctxUpdate, s.continueFlow(w, r, ctxUpdate, &p)
+		return ctxUpdate, s.continueFlow(ctx, r, ctxUpdate, p)
 	} else if err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, nil, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, nil, p, err)
 	}
 
 	if err := flow.MethodEnabledAndAllowedFromRequest(r, f.GetFlowName(), s.SettingsStrategyID(), s.d); err != nil {
 		return ctxUpdate, err
 	}
 
-	option, err := s.newSettingsProfileDecoder(r.Context(), ctxUpdate.GetSessionIdentity())
+	option, err := s.newSettingsProfileDecoder(ctx, ctxUpdate.GetSessionIdentity())
 	if err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, nil, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, nil, p, err)
 	}
 
 	if err := s.dc.Decode(r, &p, option,
@@ -132,25 +141,25 @@ func (s *Strategy) Settings(w http.ResponseWriter, r *http.Request, f *settings.
 		decoderx.HTTPDecoderSetValidatePayloads(true),
 		decoderx.HTTPDecoderJSONFollowsFormFormat(),
 	); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, nil, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, nil, p, err)
 	}
 
 	// Reset after decoding form
 	p.SetFlowID(ctxUpdate.Flow.ID)
 
-	if err := s.continueFlow(w, r, ctxUpdate, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, nil, &p, err)
+	if err := s.continueFlow(ctx, r, ctxUpdate, p); err != nil {
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, nil, p, err)
 	}
 
 	return ctxUpdate, nil
 }
 
-func (s *Strategy) continueFlow(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithProfileMethod) error {
-	if err := flow.MethodEnabledAndAllowed(r.Context(), flow.SettingsFlow, s.SettingsStrategyID(), p.Method, s.d); err != nil {
+func (s *Strategy) continueFlow(ctx context.Context, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithProfileMethod) error {
+	if err := flow.MethodEnabledAndAllowed(ctx, flow.SettingsFlow, s.SettingsStrategyID(), p.Method, s.d); err != nil {
 		return err
 	}
 
-	if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+	if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 		return err
 	}
 
@@ -158,17 +167,17 @@ func (s *Strategy) continueFlow(w http.ResponseWriter, r *http.Request, ctxUpdat
 		return errors.WithStack(herodot.ErrBadRequest.WithReasonf("Did not receive any value changes."))
 	}
 
-	if err := s.hydrateForm(r, ctxUpdate.Flow, ctxUpdate.Session, p.Traits); err != nil {
+	if err := s.hydrateForm(r, ctxUpdate.Flow, p.Traits); err != nil {
 		return err
 	}
 
 	options := []identity.ManagerOption{identity.ManagerExposeValidationErrorsForInternalTypeAssertion}
-	ttl := s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(r.Context())
+	ttl := s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(ctx)
 	if ctxUpdate.Session.AuthenticatedAt.Add(ttl).After(time.Now()) {
 		options = append(options, identity.ManagerAllowWriteProtectedTraits)
 	}
 
-	update, err := s.d.IdentityManager().SetTraits(r.Context(), ctxUpdate.GetSessionIdentity().ID, identity.Traits(p.Traits), options...)
+	update, err := s.d.IdentityManager().SetTraits(ctx, ctxUpdate.GetSessionIdentity().ID, identity.Traits(p.Traits), options...)
 	if err != nil {
 		if errors.Is(err, identity.ErrProtectedFieldModified) {
 			return settings.NewFlowNeedsReAuth()
@@ -225,7 +234,7 @@ func (p *updateSettingsFlowWithProfileMethod) SetFlowID(rid uuid.UUID) {
 	p.FlowID = rid.String()
 }
 
-func (s *Strategy) hydrateForm(r *http.Request, ar *settings.Flow, ss *session.Session, traits json.RawMessage) error {
+func (s *Strategy) hydrateForm(r *http.Request, ar *settings.Flow, traits json.RawMessage) error {
 	if traits != nil {
 		ar.UI.Nodes.ResetNodesWithPrefix("traits.")
 		ar.UI.UpdateNodeValuesFromJSON(traits, "traits", node.ProfileGroup)
@@ -237,9 +246,9 @@ func (s *Strategy) hydrateForm(r *http.Request, ar *settings.Flow, ss *session.S
 
 // handleSettingsError is a convenience function for handling all types of errors that may occur (e.g. validation error)
 // during a settings request.
-func (s *Strategy) handleSettingsError(w http.ResponseWriter, r *http.Request, puc *settings.UpdateContext, traits json.RawMessage, p *updateSettingsFlowWithProfileMethod, err error) error {
+func (s *Strategy) handleSettingsError(ctx context.Context, w http.ResponseWriter, r *http.Request, puc *settings.UpdateContext, traits json.RawMessage, p updateSettingsFlowWithProfileMethod, err error) error {
 	if e := new(settings.FlowNeedsReAuth); errors.As(err, &e) {
-		if err := s.d.ContinuityManager().Pause(r.Context(), w, r,
+		if err := s.d.ContinuityManager().Pause(ctx, w, r,
 			settings.ContinuityKey(s.SettingsStrategyID()),
 			settings.ContinuityOptions(p, puc.GetSessionIdentity())...); err != nil {
 			return err
@@ -255,7 +264,7 @@ func (s *Strategy) handleSettingsError(w http.ResponseWriter, r *http.Request, p
 			}
 		}
 
-		if err := s.hydrateForm(r, puc.Flow, puc.Session, traits); err != nil {
+		if err := s.hydrateForm(r, puc.Flow, traits); err != nil {
 			return err
 		}
 	}
diff --git a/selfservice/strategy/profile/strategy_test.go b/selfservice/strategy/profile/strategy_test.go
index 7d0c831711c3..be9b448a0215 100644
--- a/selfservice/strategy/profile/strategy_test.go
+++ b/selfservice/strategy/profile/strategy_test.go
@@ -89,13 +89,19 @@ func TestStrategyTraits(t *testing.T) {
 
 	browserIdentity1 := newIdentityWithPassword("john-browser@doe.com")
 	apiIdentity1 := newIdentityWithPassword("john-api@doe.com")
-	browserIdentity2 := &identity.Identity{ID: x.NewUUID(), Traits: identity.Traits(`{}`), State: identity.StateActive}
-	apiIdentity2 := &identity.Identity{ID: x.NewUUID(), Traits: identity.Traits(`{}`), State: identity.StateActive}
-
-	browserUser1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, browserIdentity1)
-	browserUser2 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, browserIdentity2)
-	apiUser1 := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, apiIdentity1)
-	apiUser2 := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, apiIdentity2)
+	browserID2 := x.NewUUID()
+	browserIdentity2 := &identity.Identity{ID: browserID2, Traits: identity.Traits(`{}`), State: identity.StateActive, Credentials: map[identity.CredentialsType]identity.Credentials{
+		identity.CredentialsTypePassword: {Type: "password", Identifiers: []string{browserID2.String()}, Config: []byte(`{"hashed_password":"$2a$04$zvZz1zV"}`)},
+	}}
+	apiID2 := x.NewUUID()
+	apiIdentity2 := &identity.Identity{ID: apiID2, Traits: identity.Traits(`{}`), State: identity.StateActive, Credentials: map[identity.CredentialsType]identity.Credentials{
+		identity.CredentialsTypePassword: {Type: "password", Identifiers: []string{apiID2.String()}, Config: []byte(`{"hashed_password":"$2a$04$zvZz1zV"}`)},
+	}}
+
+	browserUser1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, browserIdentity1)
+	browserUser2 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, browserIdentity2)
+	apiUser1 := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, apiIdentity1)
+	apiUser2 := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, apiIdentity2)
 
 	t.Run("description=not authorized to call endpoints without a session", func(t *testing.T) {
 		setUnprivileged(t)
@@ -205,13 +211,13 @@ func TestStrategyTraits(t *testing.T) {
 		}
 
 		t.Run("type=api", func(t *testing.T) {
-			pr, _, err := testhelpers.NewSDKCustomClient(publicTS, apiUser1).FrontendApi.CreateNativeSettingsFlow(context.Background()).Execute()
+			pr, _, err := testhelpers.NewSDKCustomClient(publicTS, apiUser1).FrontendAPI.CreateNativeSettingsFlow(context.Background()).Execute()
 			require.NoError(t, err)
 			run(t, apiIdentity1, pr, settings.RouteInitAPIFlow)
 		})
 
-		t.Run("type=api", func(t *testing.T) {
-			pr, _, err := testhelpers.NewSDKCustomClient(publicTS, browserUser1).FrontendApi.CreateBrowserSettingsFlow(context.Background()).Execute()
+		t.Run("type=spa", func(t *testing.T) {
+			pr, _, err := testhelpers.NewSDKCustomClient(publicTS, browserUser1).FrontendAPI.CreateBrowserSettingsFlow(context.Background()).Execute()
 			require.NoError(t, err)
 			run(t, browserIdentity1, pr, settings.RouteInitBrowserFlow)
 		})
@@ -224,7 +230,7 @@ func TestStrategyTraits(t *testing.T) {
 			rid := res.Request.URL.Query().Get("flow")
 			require.NotEmpty(t, rid)
 
-			pr, _, err := testhelpers.NewSDKCustomClient(publicTS, browserUser1).FrontendApi.GetSettingsFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
+			pr, _, err := testhelpers.NewSDKCustomClient(publicTS, browserUser1).FrontendAPI.GetSettingsFlow(context.Background()).Id(res.Request.URL.Query().Get("flow")).Execute()
 			require.NoError(t, err, "%s", rid)
 
 			run(t, browserIdentity1, pr, settings.RouteInitBrowserFlow)
@@ -449,15 +455,20 @@ func TestStrategyTraits(t *testing.T) {
 		t.Run("type=api", func(t *testing.T) {
 			actual := expectSuccess(t, true, false, apiUser1, payload("not-john-doe-api@mail.com"))
 			check(t, actual)
+			assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
 		})
 
 		t.Run("type=sqa", func(t *testing.T) {
 			actual := expectSuccess(t, false, true, browserUser1, payload("not-john-doe-browser@mail.com"))
 			check(t, actual)
+			assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(actual, "continue_with.0.action").String(), "%s", actual)
+			assert.Contains(t, gjson.Get(actual, "continue_with.0.redirect_browser_to").String(), ui.URL, "%s", actual)
 		})
 
 		t.Run("type=browser", func(t *testing.T) {
-			check(t, expectSuccess(t, false, false, browserUser1, payload("not-john-doe-browser@mail.com")))
+			actual := expectSuccess(t, false, false, browserUser1, payload("not-john-doe-browser@mail.com"))
+			check(t, actual)
+			assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
 		})
 	})
 
@@ -533,7 +544,7 @@ func TestStrategyTraits(t *testing.T) {
 
 			m, err := reg.CourierPersister().LatestQueuedMessage(context.Background())
 			require.NoError(t, err)
-			assert.Contains(t, m.Subject, "verify your email address")
+			assert.Contains(t, m.Subject, "Use code")
 		}
 
 		payload := func(newEmail string) func(v url.Values) {
@@ -612,7 +623,7 @@ func TestDisabledEndpoint(t *testing.T) {
 
 	publicTS, _ := testhelpers.NewKratosServer(t, reg)
 	browserIdentity1 := newIdentityWithPassword("john-browser@doe.com")
-	browserUser1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, browserIdentity1)
+	browserUser1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, context.Background(), reg, browserIdentity1)
 
 	t.Run("case=should not submit when profile method is disabled", func(t *testing.T) {
 		t.Run("method=GET", func(t *testing.T) {
diff --git a/selfservice/strategy/profile/two_step_registration.go b/selfservice/strategy/profile/two_step_registration.go
index 98f4fe806913..d6f037a54a92 100644
--- a/selfservice/strategy/profile/two_step_registration.go
+++ b/selfservice/strategy/profile/two_step_registration.go
@@ -4,10 +4,17 @@
 package profile
 
 import (
+	"context"
 	_ "embed"
 	"encoding/json"
 	"net/http"
 
+	"github.com/ory/x/otelx/semconv"
+
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/ory/x/otelx"
+
 	"github.com/tidwall/gjson"
 
 	"github.com/ory/kratos/identity"
@@ -60,6 +67,16 @@ func (s *Strategy) PopulateRegistrationMethod(r *http.Request, f *registration.F
 	return nil
 }
 
+// The RegistrationScreen
+// swagger:enum RegistrationScreen
+type RegistrationScreen string
+
+const (
+	//nolint:gosec // not a credential
+	RegistrationScreenCredentialSelection RegistrationScreen = "credential-selection"
+	RegistrationScreenPrevious            RegistrationScreen = "previous"
+)
+
 // Update Registration Flow with Profile Method
 //
 // swagger:model updateRegistrationFlowWithProfileMethod
@@ -87,7 +104,7 @@ type updateRegistrationFlowWithProfileMethod struct {
 	// selection screen.
 	//
 	// required: false
-	Screen string `json:"screen" form:"screen"`
+	Screen RegistrationScreen `json:"screen" form:"screen"`
 
 	// FlowIDRequestID is the flow ID.
 	//
@@ -110,41 +127,45 @@ func (s *Strategy) decode(p *updateRegistrationFlowWithProfileMethod, r *http.Re
 }
 
 func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, regFlow *registration.Flow, i *identity.Identity) (err error) {
-	if !s.d.Config().SelfServiceFlowRegistrationTwoSteps(r.Context()) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.profile.Strategy.Register")
+	defer otelx.End(span, &err)
+
+	if !s.d.Config().SelfServiceFlowRegistrationTwoSteps(ctx) {
+		span.SetAttributes(attribute.String("not_responsible_reason", "two-step registration is not enabled"))
 		return flow.ErrStrategyNotResponsible
 	}
 
 	var params updateRegistrationFlowWithProfileMethod
 
 	if err = s.decode(&params, r); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &params, err)
+		return s.handleRegistrationError(r, regFlow, params, err)
 	}
 
-	if params.Screen == "credential-selection" {
-		params.Method = "profile"
+	if params.Method == "profile" || params.Screen == RegistrationScreenCredentialSelection {
+		return s.displayStepTwoNodes(ctx, w, r, regFlow, i, params)
+	} else if params.Method == "profile:back" {
+		// "profile:back" is kept for backwards compatibility.
+		span.AddEvent(semconv.NewDeprecatedFeatureUsedEvent(ctx, "profile:back"))
+		return s.displayStepOneNodes(ctx, w, r, regFlow, params)
+	} else if params.Screen == RegistrationScreenPrevious {
+		return s.displayStepOneNodes(ctx, w, r, regFlow, params)
 	}
 
-	switch params.Method {
-	case "profile":
-		return s.displayStepTwoNodes(w, r, regFlow, i, params)
-	case "profile:back":
-		return s.displayStepOneNodes(w, r, regFlow, i, params)
-	}
 	// Default case
+	span.SetAttributes(attribute.String("not_responsible_reason", "method mismatch"))
 	return flow.ErrStrategyNotResponsible
 }
 
-func (s *Strategy) displayStepOneNodes(w http.ResponseWriter, r *http.Request, regFlow *registration.Flow, _ *identity.Identity, params updateRegistrationFlowWithProfileMethod) error {
-	ctx := r.Context()
+func (s *Strategy) displayStepOneNodes(ctx context.Context, w http.ResponseWriter, r *http.Request, regFlow *registration.Flow, params updateRegistrationFlowWithProfileMethod) error {
 	regFlow.UI.ResetMessages()
 	err := json.Unmarshal([]byte(gjson.GetBytes(regFlow.InternalContext, "stepOneNodes").Raw), &regFlow.UI.Nodes)
 	if err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &params, err)
+		return s.handleRegistrationError(r, regFlow, params, err)
 	}
 	regFlow.UI.UpdateNodeValuesFromJSON(params.Traits, "traits", node.DefaultGroup)
 
 	if err := s.d.RegistrationFlowPersister().UpdateRegistrationFlow(ctx, regFlow); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &params, err)
+		return s.handleRegistrationError(r, regFlow, params, err)
 	}
 
 	redirectTo := regFlow.AppendTo(s.d.Config().SelfServiceFlowRegistrationUI(ctx)).String()
@@ -157,9 +178,7 @@ func (s *Strategy) displayStepOneNodes(w http.ResponseWriter, r *http.Request, r
 	return flow.ErrCompletedByStrategy
 }
 
-func (s *Strategy) displayStepTwoNodes(w http.ResponseWriter, r *http.Request, regFlow *registration.Flow, i *identity.Identity, params updateRegistrationFlowWithProfileMethod) error {
-	ctx := r.Context()
-
+func (s *Strategy) displayStepTwoNodes(ctx context.Context, w http.ResponseWriter, r *http.Request, regFlow *registration.Flow, i *identity.Identity, params updateRegistrationFlowWithProfileMethod) error {
 	// Reset state-esque flow fields
 	regFlow.Active = ""
 	regFlow.State = "choose_method"
@@ -167,8 +186,8 @@ func (s *Strategy) displayStepTwoNodes(w http.ResponseWriter, r *http.Request, r
 	regFlow.UI.ResetMessages()
 	regFlow.TransientPayload = params.TransientPayload
 
-	if err := flow.EnsureCSRF(s.d, r, regFlow.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, params.CSRFToken); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &params, err)
+	if err := flow.EnsureCSRF(s.d, r, regFlow.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, params.CSRFToken); err != nil {
+		return s.handleRegistrationError(r, regFlow, params, err)
 	}
 
 	if len(params.Traits) == 0 {
@@ -176,19 +195,19 @@ func (s *Strategy) displayStepTwoNodes(w http.ResponseWriter, r *http.Request, r
 	}
 	i.Traits = identity.Traits(params.Traits)
 	if err := s.d.IdentityValidator().Validate(ctx, i); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &params, err)
+		return s.handleRegistrationError(r, regFlow, params, err)
 	}
 
 	err := json.Unmarshal([]byte(gjson.GetBytes(regFlow.InternalContext, "stepTwoNodes").Raw), &regFlow.UI.Nodes)
 	if err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &params, err)
+		return s.handleRegistrationError(r, regFlow, params, err)
 	}
 
 	regFlow.UI.Messages.Add(text.NewInfoSelfServiceChooseCredentials())
 
 	regFlow.UI.Nodes.Append(node.NewInputField(
-		"method",
-		"profile:back",
+		"screen",
+		"previous",
 		node.ProfileGroup,
 		node.InputAttributeTypeSubmit,
 	).WithMetaLabel(text.NewInfoRegistrationBack()))
@@ -208,7 +227,7 @@ func (s *Strategy) displayStepTwoNodes(w http.ResponseWriter, r *http.Request, r
 	}
 
 	if err = s.d.RegistrationFlowPersister().UpdateRegistrationFlow(ctx, regFlow); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &params, err)
+		return s.handleRegistrationError(r, regFlow, params, err)
 	}
 
 	redirectTo := regFlow.AppendTo(s.d.Config().SelfServiceFlowRegistrationUI(ctx)).String()
@@ -221,13 +240,11 @@ func (s *Strategy) displayStepTwoNodes(w http.ResponseWriter, r *http.Request, r
 	return flow.ErrCompletedByStrategy
 }
 
-func (s *Strategy) handleRegistrationError(_ http.ResponseWriter, r *http.Request, regFlow *registration.Flow, params *updateRegistrationFlowWithProfileMethod, err error) error {
+func (s *Strategy) handleRegistrationError(r *http.Request, regFlow *registration.Flow, params updateRegistrationFlowWithProfileMethod, err error) error {
 	if regFlow != nil {
-		if params != nil {
-			for _, n := range container.NewFromJSON("", node.ProfileGroup, params.Traits, "traits").Nodes {
-				// we only set the value and not the whole field because we want to keep types from the initial form generation
-				regFlow.UI.Nodes.SetValueAttribute(n.ID(), n.Attributes.GetValue())
-			}
+		for _, n := range container.NewFromJSON("", node.ProfileGroup, params.Traits, "traits").Nodes {
+			// we only set the value and not the whole field because we want to keep types from the initial form generation
+			regFlow.UI.Nodes.SetValueAttribute(n.ID(), n.Attributes.GetValue())
 		}
 
 		if regFlow.Type == flow.TypeBrowser {
diff --git a/selfservice/strategy/totp/generator.go b/selfservice/strategy/totp/generator.go
index fe79d8991d0d..9846506f1671 100644
--- a/selfservice/strategy/totp/generator.go
+++ b/selfservice/strategy/totp/generator.go
@@ -25,6 +25,7 @@ import (
 // So we need 160/8 = 20 key length. stdtotp.Generate uses the key
 // length for reading from crypto.Rand.
 const secretSize = 160 / 8
+const digits = otp.DigitsSix
 
 func NewKey(ctx context.Context, accountName string, d interface {
 	config.Provider
@@ -33,7 +34,7 @@ func NewKey(ctx context.Context, accountName string, d interface {
 		Issuer:      d.Config().TOTPIssuer(ctx),
 		AccountName: accountName,
 		SecretSize:  secretSize,
-		Digits:      otp.DigitsSix,
+		Digits:      digits,
 		Period:      30,
 	})
 	if err != nil {
diff --git a/selfservice/strategy/totp/login.go b/selfservice/strategy/totp/login.go
index 2aaface8dc5c..a05443206cf6 100644
--- a/selfservice/strategy/totp/login.go
+++ b/selfservice/strategy/totp/login.go
@@ -7,6 +7,10 @@ import (
 	"encoding/json"
 	"net/http"
 
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/ory/x/otelx"
+
 	"github.com/pkg/errors"
 	"github.com/pquerna/otp"
 	"github.com/pquerna/otp/totp"
@@ -90,8 +94,12 @@ type updateLoginFlowWithTotpMethod struct {
 	TransientPayload json.RawMessage `json:"transient_payload,omitempty" form:"transient_payload"`
 }
 
-func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, sess *session.Session) (i *identity.Identity, err error) {
+func (s *Strategy) Login(_ http.ResponseWriter, r *http.Request, f *login.Flow, sess *session.Session) (i *identity.Identity, err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.totp.Strategy.Login")
+	defer otelx.End(span, &err)
+
 	if err := login.CheckAAL(f, identity.AuthenticatorAssuranceLevel2); err != nil {
+		span.SetAttributes(attribute.String("not_responsible_reason", "requested AAL is not AAL2"))
 		return nil, err
 	}
 
@@ -108,11 +116,11 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 	}
 	f.TransientPayload = p.TransientPayload
 
-	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 		return nil, s.handleLoginError(r, f, err)
 	}
 
-	i, c, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(r.Context(), s.ID(), sess.IdentityID.String())
+	i, c, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(ctx, s.ID(), sess.IdentityID.String())
 	if err != nil {
 		return nil, s.handleLoginError(r, f, errors.WithStack(schema.NewNoTOTPDeviceRegistered()))
 	}
@@ -132,7 +140,7 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 	}
 
 	f.Active = s.ID()
-	if err = s.d.LoginFlowPersister().UpdateLoginFlow(r.Context(), f); err != nil {
+	if err = s.d.LoginFlowPersister().UpdateLoginFlow(ctx, f); err != nil {
 		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrInternalServerError.WithReason("Could not update flow").WithDebug(err.Error())))
 	}
 
diff --git a/selfservice/strategy/totp/login_test.go b/selfservice/strategy/totp/login_test.go
index 6456ea7cc599..7a48424ab412 100644
--- a/selfservice/strategy/totp/login_test.go
+++ b/selfservice/strategy/totp/login_test.go
@@ -13,6 +13,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/selfservice/flow"
+
 	"github.com/ory/x/assertx"
 
 	"github.com/gofrs/uuid"
@@ -107,7 +109,7 @@ func TestCompleteLogin(t *testing.T) {
 	t.Run("case=totp payload is set when identity has totp", func(t *testing.T) {
 		id, _, _ := createIdentity(t, reg)
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 		testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{
 			"0.attributes.value",
@@ -117,7 +119,7 @@ func TestCompleteLogin(t *testing.T) {
 	t.Run("case=totp payload is not set when identity has no totp", func(t *testing.T) {
 		id := createIdentityWithoutTOTP(t, reg)
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 		assertx.EqualAsJSON(t, nil, f.Ui.Nodes)
 	})
@@ -126,7 +128,7 @@ func TestCompleteLogin(t *testing.T) {
 		id, _, _ := createIdentity(t, reg)
 
 		t.Run("type=api", func(t *testing.T) {
-			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 			f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 
 			body, res := testhelpers.LoginMakeRequest(t, true, false, f, apiClient, "14=)=!(%)$/ZP()GHIÖ")
@@ -136,7 +138,7 @@ func TestCompleteLogin(t *testing.T) {
 		})
 
 		t.Run("type=browser", func(t *testing.T) {
-			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 			f := testhelpers.InitializeLoginFlowViaBrowser(t, browserClient, publicTS, false, false, false, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 
 			body, res := testhelpers.LoginMakeRequest(t, false, false, f, browserClient, "14=)=!(%)$/ZP()GHIÖ")
@@ -146,7 +148,7 @@ func TestCompleteLogin(t *testing.T) {
 		})
 
 		t.Run("type=spa", func(t *testing.T) {
-			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 			f := testhelpers.InitializeLoginFlowViaBrowser(t, browserClient, publicTS, false, true, false, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 
 			body, res := testhelpers.LoginMakeRequest(t, false, true, f, browserClient, "14=)=!(%)$/ZP()GHIÖ")
@@ -157,7 +159,7 @@ func TestCompleteLogin(t *testing.T) {
 	})
 
 	doAPIFlow := func(t *testing.T, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 		values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 		values.Set("method", "totp")
@@ -167,7 +169,7 @@ func TestCompleteLogin(t *testing.T) {
 	}
 
 	doBrowserFlow := func(t *testing.T, spa bool, v func(url.Values), id *identity.Identity, returnTo string) (string, *http.Response) {
-		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 
 		opts := []testhelpers.InitFlowWithOption{testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2)}
 		if len(returnTo) > 0 {
@@ -333,23 +335,36 @@ func TestCompleteLogin(t *testing.T) {
 		t.Run("type=api", func(t *testing.T) {
 			body, res := doAPIFlow(t, payload, id)
 			check(t, false, body, res)
+			assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
 		})
 
 		t.Run("type=browser", func(t *testing.T) {
 			body, res := doBrowserFlow(t, false, payload, id, "")
 			check(t, true, body, res)
+			assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
 		})
 
 		t.Run("type=browser set return_to", func(t *testing.T) {
 			returnTo := "https://www.ory.sh"
-			_, res := doBrowserFlow(t, false, payload, id, returnTo)
+			body, res := doBrowserFlow(t, false, payload, id, returnTo)
 			t.Log(res.Request.URL.String())
 			assert.Contains(t, res.Request.URL.String(), returnTo)
+			assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
 		})
 
 		t.Run("type=spa", func(t *testing.T) {
 			body, res := doBrowserFlow(t, true, payload, id, "")
 			check(t, false, body, res)
+			assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(body, "continue_with.0.action").String(), "%s", body)
+			assert.EqualValues(t, conf.SelfServiceBrowserDefaultReturnTo(ctx).String(), gjson.Get(body, "continue_with.0.redirect_browser_to").String(), "%s", body)
+		})
+
+		t.Run("type=spa set return_to", func(t *testing.T) {
+			returnTo := "https://www.ory.sh"
+			body, res := doBrowserFlow(t, true, payload, id, returnTo)
+			check(t, false, body, res)
+			assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(body, "continue_with.0.action").String(), "%s", body)
+			assert.EqualValues(t, returnTo, gjson.Get(body, "continue_with.0.redirect_browser_to").String(), "%s", body)
 		})
 	})
 
diff --git a/selfservice/strategy/totp/settings.go b/selfservice/strategy/totp/settings.go
index bbb3f5496dc5..993e1adf8033 100644
--- a/selfservice/strategy/totp/settings.go
+++ b/selfservice/strategy/totp/settings.go
@@ -9,6 +9,8 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/ory/x/otelx"
+
 	"github.com/pquerna/otp"
 	"github.com/pquerna/otp/totp"
 	"github.com/tidwall/gjson"
@@ -83,33 +85,36 @@ func (p *updateSettingsFlowWithTotpMethod) SetFlowID(rid uuid.UUID) {
 	p.Flow = rid.String()
 }
 
-func (s *Strategy) Settings(w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (*settings.UpdateContext, error) {
+func (s *Strategy) Settings(ctx context.Context, w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (_ *settings.UpdateContext, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.totp.Strategy.Settings")
+	defer otelx.End(span, &err)
+
 	var p updateSettingsFlowWithTotpMethod
 	ctxUpdate, err := settings.PrepareUpdate(s.d, w, r, f, ss, settings.ContinuityKey(s.SettingsStrategyID()), &p)
 	if errors.Is(err, settings.ErrContinuePreviousAction) {
-		return ctxUpdate, s.continueSettingsFlow(w, r, ctxUpdate, &p)
+		return ctxUpdate, s.continueSettingsFlow(ctx, r, ctxUpdate, p)
 	} else if err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	if err := s.decodeSettingsFlow(r, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	if p.UnlinkTOTP {
 		// This is a submit so we need to manually set the type to TOTP
 		p.Method = s.SettingsStrategyID()
-		if err := flow.MethodEnabledAndAllowed(r.Context(), f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
-			return nil, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
+			return nil, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 		}
 	} else if err := flow.MethodEnabledAndAllowedFromRequest(r, f.GetFlowName(), s.SettingsStrategyID(), s.d); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	// This does not come from the payload!
 	p.Flow = ctxUpdate.Flow.ID.String()
-	if err := s.continueSettingsFlow(w, r, ctxUpdate, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+	if err := s.continueSettingsFlow(ctx, r, ctxUpdate, p); err != nil {
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	return ctxUpdate, nil
@@ -122,29 +127,27 @@ func (s *Strategy) decodeSettingsFlow(r *http.Request, dest interface{}) error {
 	}
 
 	return decoderx.NewHTTP().Decode(r, dest, compiler,
+		decoderx.HTTPKeepRequestBody(true),
 		decoderx.HTTPDecoderAllowedMethods("POST", "GET"),
 		decoderx.HTTPDecoderSetValidatePayloads(true),
 		decoderx.HTTPDecoderJSONFollowsFormFormat(),
 	)
 }
 
-func (s *Strategy) continueSettingsFlow(
-	w http.ResponseWriter, r *http.Request,
-	ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithTotpMethod,
-) error {
-	if err := flow.MethodEnabledAndAllowed(r.Context(), flow.SettingsFlow, s.SettingsStrategyID(), p.Method, s.d); err != nil {
+func (s *Strategy) continueSettingsFlow(ctx context.Context, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithTotpMethod) error {
+	if err := flow.MethodEnabledAndAllowed(ctx, flow.SettingsFlow, s.SettingsStrategyID(), p.Method, s.d); err != nil {
 		return err
 	}
 
-	if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+	if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 		return err
 	}
 
-	if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(r.Context())).Before(time.Now()) {
+	if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(ctx)).Before(time.Now()) {
 		return errors.WithStack(settings.NewFlowNeedsReAuth())
 	}
 
-	hasTOTP, err := s.identityHasTOTP(r.Context(), ctxUpdate.Session.IdentityID)
+	hasTOTP, err := s.identityHasTOTP(ctx, ctxUpdate.Session.Identity)
 	if err != nil {
 		return err
 	}
@@ -155,9 +158,9 @@ func (s *Strategy) continueSettingsFlow(
 	// 2. TOTP should be added -> we do not have it yet
 	var i *identity.Identity
 	if hasTOTP {
-		i, err = s.continueSettingsFlowRemoveTOTP(w, r, ctxUpdate, p)
+		i, err = s.continueSettingsFlowRemoveTOTP(ctx, ctxUpdate, p)
 	} else {
-		i, err = s.continueSettingsFlowAddTOTP(w, r, ctxUpdate, p)
+		i, err = s.continueSettingsFlowAddTOTP(ctx, ctxUpdate, p)
 	}
 
 	if err != nil {
@@ -168,7 +171,7 @@ func (s *Strategy) continueSettingsFlow(
 	return nil
 }
 
-func (s *Strategy) continueSettingsFlowAddTOTP(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithTotpMethod) (*identity.Identity, error) {
+func (s *Strategy) continueSettingsFlowAddTOTP(ctx context.Context, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithTotpMethod) (*identity.Identity, error) {
 	keyURL := gjson.GetBytes(ctxUpdate.Flow.InternalContext, flow.PrefixInternalContextKey(s.ID(), InternalContextKeyURL)).String()
 	if len(keyURL) == 0 {
 		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Could not find they TOTP key in the internal context. This is a code bug and should be reported to https://github.com/ory/kratos/."))
@@ -196,7 +199,7 @@ func (s *Strategy) continueSettingsFlowAddTOTP(w http.ResponseWriter, r *http.Re
 		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to encode totp options to JSON: %s", err))
 	}
 
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.Identity.ID)
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.Identity.ID)
 	if err != nil {
 		return nil, err
 	}
@@ -212,12 +215,12 @@ func (s *Strategy) continueSettingsFlowAddTOTP(w http.ResponseWriter, r *http.Re
 		return nil, err
 	}
 
-	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(r.Context(), ctxUpdate.Flow); err != nil {
+	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(ctx, ctxUpdate.Flow); err != nil {
 		return nil, err
 	}
 
 	// Since we added the method, it also means that we have authenticated it
-	if err := s.d.SessionManager().SessionAddAuthenticationMethods(r.Context(), ctxUpdate.Session.ID, session.AuthenticationMethod{
+	if err := s.d.SessionManager().SessionAddAuthenticationMethods(ctx, ctxUpdate.Session.ID, session.AuthenticationMethod{
 		Method: s.ID(),
 		AAL:    identity.AuthenticatorAssuranceLevel2,
 	}); err != nil {
@@ -227,12 +230,12 @@ func (s *Strategy) continueSettingsFlowAddTOTP(w http.ResponseWriter, r *http.Re
 	return i, nil
 }
 
-func (s *Strategy) continueSettingsFlowRemoveTOTP(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithTotpMethod) (*identity.Identity, error) {
+func (s *Strategy) continueSettingsFlowRemoveTOTP(ctx context.Context, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithTotpMethod) (*identity.Identity, error) {
 	if !p.UnlinkTOTP {
 		return ctxUpdate.Session.Identity, nil
 	}
 
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.Identity.ID)
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.Identity.ID)
 	if err != nil {
 		return nil, err
 	}
@@ -241,13 +244,14 @@ func (s *Strategy) continueSettingsFlowRemoveTOTP(w http.ResponseWriter, r *http
 	return i, nil
 }
 
-func (s *Strategy) identityHasTOTP(ctx context.Context, id uuid.UUID) (bool, error) {
-	confidential, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, id)
-	if err != nil {
-		return false, err
+func (s *Strategy) identityHasTOTP(ctx context.Context, id *identity.Identity) (bool, error) {
+	if len(id.Credentials) == 0 {
+		if err := s.d.PrivilegedIdentityPool().HydrateIdentityAssociations(ctx, id, identity.ExpandCredentials); err != nil {
+			return false, err
+		}
 	}
 
-	count, err := s.CountActiveMultiFactorCredentials(confidential.Credentials)
+	count, err := s.CountActiveMultiFactorCredentials(ctx, id.Credentials)
 	if err != nil {
 		return false, err
 	}
@@ -255,10 +259,13 @@ func (s *Strategy) identityHasTOTP(ctx context.Context, id uuid.UUID) (bool, err
 	return count > 0, nil
 }
 
-func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity, f *settings.Flow) error {
+func (s *Strategy) PopulateSettingsMethod(ctx context.Context, r *http.Request, id *identity.Identity, f *settings.Flow) (err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.totp.Strategy.PopulateSettingsMethod")
+	defer otelx.End(span, &err)
+
 	f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
 
-	hasTOTP, err := s.identityHasTOTP(r.Context(), id.ID)
+	hasTOTP, err := s.identityHasTOTP(ctx, id)
 	if err != nil {
 		return err
 	}
@@ -268,10 +275,10 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 		f.UI.Nodes.Upsert(NewUnlinkTOTPNode())
 	} else {
 		e := NewSchemaExtension(id.ID.String())
-		_ = s.d.IdentityValidator().ValidateWithRunner(r.Context(), id, e)
+		_ = s.d.IdentityValidator().ValidateWithRunner(ctx, id, e)
 
 		// No TOTP set up yet, add nodes allowing us to add it.
-		key, err := NewKey(r.Context(), e.AccountName, s.d)
+		key, err := NewKey(ctx, e.AccountName, s.d)
 		if err != nil {
 			return err
 		}
@@ -295,10 +302,10 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 	return nil
 }
 
-func (s *Strategy) handleSettingsError(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithTotpMethod, err error) error {
+func (s *Strategy) handleSettingsError(ctx context.Context, w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithTotpMethod, err error) error {
 	// Do not pause flow if the flow type is an API flow as we can't save cookies in those flows.
 	if e := new(settings.FlowNeedsReAuth); errors.As(err, &e) && ctxUpdate.Flow != nil && ctxUpdate.Flow.Type == flow.TypeBrowser {
-		if err := s.d.ContinuityManager().Pause(r.Context(), w, r, settings.ContinuityKey(s.SettingsStrategyID()), settings.ContinuityOptions(p, ctxUpdate.GetSessionIdentity())...); err != nil {
+		if err := s.d.ContinuityManager().Pause(ctx, w, r, settings.ContinuityKey(s.SettingsStrategyID()), settings.ContinuityOptions(p, ctxUpdate.GetSessionIdentity())...); err != nil {
 			return err
 		}
 	}
diff --git a/selfservice/strategy/totp/settings_test.go b/selfservice/strategy/totp/settings_test.go
index 0fd479f1b220..b44cc736a560 100644
--- a/selfservice/strategy/totp/settings_test.go
+++ b/selfservice/strategy/totp/settings_test.go
@@ -64,7 +64,7 @@ func TestCompleteSettings(t *testing.T) {
 	t.Run("case=device unlinking is available when identity has totp", func(t *testing.T) {
 		id, _, _ := createIdentity(t, reg)
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 		testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{
 			"0.attributes.value",
@@ -76,7 +76,7 @@ func TestCompleteSettings(t *testing.T) {
 		id.Credentials = nil
 		require.NoError(t, reg.PrivilegedIdentityPool().UpdateIdentity(context.Background(), id))
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 		testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{
 			"0.attributes.value",
@@ -87,7 +87,7 @@ func TestCompleteSettings(t *testing.T) {
 	})
 
 	doAPIFlow := func(t *testing.T, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 		values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 		values.Set("method", "totp")
@@ -97,7 +97,7 @@ func TestCompleteSettings(t *testing.T) {
 	}
 
 	doBrowserFlow := func(t *testing.T, spa bool, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, spa, publicTS)
 		values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 		values.Set("method", "totp")
@@ -241,6 +241,7 @@ func TestCompleteSettings(t *testing.T) {
 			assert.Contains(t, res.Request.URL.String(), publicTS.URL+settings.RouteSubmitFlow)
 			assert.EqualValues(t, flow.StateSuccess, gjson.Get(actual, "state").String(), actual)
 			checkIdentity(t, id)
+			assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
 		})
 
 		t.Run("type=spa", func(t *testing.T) {
@@ -250,6 +251,9 @@ func TestCompleteSettings(t *testing.T) {
 			assert.Contains(t, res.Request.URL.String(), publicTS.URL+settings.RouteSubmitFlow)
 			assert.EqualValues(t, flow.StateSuccess, gjson.Get(actual, "state").String(), actual)
 			checkIdentity(t, id)
+
+			assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(actual, "continue_with.0.action").String(), "%s", actual)
+			assert.Contains(t, gjson.Get(actual, "continue_with.0.redirect_browser_to").String(), uiTS.URL, "%s", actual)
 		})
 
 		t.Run("type=browser", func(t *testing.T) {
@@ -259,6 +263,7 @@ func TestCompleteSettings(t *testing.T) {
 			assert.Contains(t, res.Request.URL.String(), uiTS.URL)
 			assert.EqualValues(t, flow.StateSuccess, gjson.Get(actual, "state").String(), actual)
 			checkIdentity(t, id)
+			assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
 		})
 	})
 
@@ -344,12 +349,19 @@ func TestCompleteSettings(t *testing.T) {
 
 			checkIdentity(t, id, key)
 			testhelpers.EnsureAAL(t, hc, publicTS, "aal2", string(identity.CredentialsTypeTOTP))
+
+			if isSPA {
+				assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(actual, "continue_with.0.action").String(), "%s", actual)
+				assert.Contains(t, gjson.Get(actual, "continue_with.0.redirect_browser_to").String(), uiTS.URL, "%s", actual)
+			} else {
+				assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
+			}
 		}
 
 		t.Run("type=api", func(t *testing.T) {
 			id := createIdentityWithoutTOTP(t, reg)
 
-			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 			f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 
 			run(t, true, false, id, apiClient, f)
@@ -358,7 +370,7 @@ func TestCompleteSettings(t *testing.T) {
 		t.Run("type=spa", func(t *testing.T) {
 			id := createIdentityWithoutTOTP(t, reg)
 
-			user := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+			user := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 			f := testhelpers.InitializeSettingsFlowViaBrowser(t, user, true, publicTS)
 
 			run(t, false, true, id, user, f)
@@ -367,7 +379,7 @@ func TestCompleteSettings(t *testing.T) {
 		t.Run("type=browser", func(t *testing.T) {
 			id := createIdentityWithoutTOTP(t, reg)
 
-			user := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+			user := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 			f := testhelpers.InitializeSettingsFlowViaBrowser(t, user, false, publicTS)
 
 			run(t, false, false, id, user, f)
diff --git a/selfservice/strategy/totp/strategy.go b/selfservice/strategy/totp/strategy.go
index 6c3205abd9ac..d4f30ba09c67 100644
--- a/selfservice/strategy/totp/strategy.go
+++ b/selfservice/strategy/totp/strategy.go
@@ -35,6 +35,7 @@ type totpStrategyDependencies interface {
 	x.WriterProvider
 	x.CSRFTokenGeneratorProvider
 	x.CSRFProvider
+	x.TracingProvider
 
 	config.Provider
 
@@ -80,11 +81,11 @@ func NewStrategy(d any) *Strategy {
 	}
 }
 
-func (s *Strategy) CountActiveFirstFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveFirstFactorCredentials(_ context.Context, _ map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	return 0, nil
 }
 
-func (s *Strategy) CountActiveMultiFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveMultiFactorCredentials(_ context.Context, cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	for _, c := range cc {
 		if c.Type == s.ID() && len(c.Config) > 0 {
 			var conf identity.CredentialsTOTPConfig
@@ -93,7 +94,7 @@ func (s *Strategy) CountActiveMultiFactorCredentials(cc map[identity.Credentials
 			}
 
 			_, err := otp.NewKeyFromURL(conf.TOTPURL)
-			if len(c.Identifiers) > 0 && len(c.Identifiers[0]) > 0 && len(conf.TOTPURL) > 0 && err == nil {
+			if len(conf.TOTPURL) > 0 && err == nil {
 				count++
 			}
 		}
@@ -109,7 +110,7 @@ func (s *Strategy) NodeGroup() node.UiNodeGroup {
 	return node.TOTPGroup
 }
 
-func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context, _ session.AuthenticationMethods) session.AuthenticationMethod {
+func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context) session.AuthenticationMethod {
 	return session.AuthenticationMethod{
 		Method: s.ID(),
 		AAL:    identity.AuthenticatorAssuranceLevel2,
diff --git a/selfservice/strategy/totp/strategy_test.go b/selfservice/strategy/totp/strategy_test.go
index 17c507c9d144..7bce7fe16961 100644
--- a/selfservice/strategy/totp/strategy_test.go
+++ b/selfservice/strategy/totp/strategy_test.go
@@ -25,7 +25,7 @@ func TestCountActiveCredentials(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Run("first factor", func(t *testing.T) {
-		actual, err := strategy.CountActiveFirstFactorCredentials(nil)
+		actual, err := strategy.CountActiveFirstFactorCredentials(nil, nil)
 		require.NoError(t, err)
 		assert.Equal(t, 0, actual)
 	})
@@ -75,7 +75,7 @@ func TestCountActiveCredentials(t *testing.T) {
 					cc[c.Type] = c
 				}
 
-				actual, err := strategy.CountActiveMultiFactorCredentials(cc)
+				actual, err := strategy.CountActiveMultiFactorCredentials(nil, cc)
 				require.NoError(t, err)
 				assert.Equal(t, tc.expected, actual)
 			})
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=mfa-case=webauthn_payload_is_set_when_identity_has_webauthn.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=mfa-case=webauthn_payload_is_set_when_identity_has_webauthn.json
index ca960c98d683..7f1f252857ec 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=mfa-case=webauthn_payload_is_set_when_identity_has_webauthn.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=mfa-case=webauthn_payload_is_set_when_identity_has_webauthn.json
@@ -24,25 +24,6 @@
     "meta": {},
     "type": "input"
   },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
   {
     "attributes": {
       "disabled": false,
@@ -61,7 +42,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
@@ -70,5 +51,24 @@
     "messages": [],
     "meta": {},
     "type": "script"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "webauthn_login_trigger",
+      "node_type": "input",
+      "onclickTrigger": "oryWebAuthnLogin",
+      "type": "button"
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    },
+    "type": "input"
   }
 ]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=should_fail_if_webauthn_login_is_invalid-type=browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=should_fail_if_webauthn_login_is_invalid-type=browser.json
index f4be195cdecf..d3e3d320af14 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=should_fail_if_webauthn_login_is_invalid-type=browser.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=should_fail_if_webauthn_login_is_invalid-type=browser.json
@@ -37,7 +37,7 @@
           "async": true,
           "referrerpolicy": "no-referrer",
           "crossorigin": "anonymous",
-          "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+          "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
           "type": "text/javascript",
           "node_type": "script"
         },
@@ -51,6 +51,7 @@
           "name": "webauthn_login_trigger",
           "type": "button",
           "disabled": false,
+          "onclickTrigger": "oryWebAuthnLogin",
           "node_type": "input"
         },
         "messages": [],
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=should_fail_if_webauthn_login_is_invalid-type=spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=should_fail_if_webauthn_login_is_invalid-type=spa.json
index f4be195cdecf..d3e3d320af14 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=should_fail_if_webauthn_login_is_invalid-type=spa.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=should_fail_if_webauthn_login_is_invalid-type=spa.json
@@ -37,7 +37,7 @@
           "async": true,
           "referrerpolicy": "no-referrer",
           "crossorigin": "anonymous",
-          "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+          "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
           "type": "text/javascript",
           "node_type": "script"
         },
@@ -51,6 +51,7 @@
           "name": "webauthn_login_trigger",
           "type": "button",
           "disabled": false,
+          "onclickTrigger": "oryWebAuthnLogin",
           "node_type": "input"
         },
         "messages": [],
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=webauthn_button_exists.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=webauthn_button_exists.json
index 6668b171ed43..052fc466dc5b 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=webauthn_button_exists.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=passwordless-case=webauthn_button_exists.json
@@ -46,7 +46,7 @@
     "meta": {
       "label": {
         "id": 1010008,
-        "text": "Use security key",
+        "text": "Sign in with hardware key",
         "type": "info"
       }
     },
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false-browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false-browser.json
deleted file mode 100644
index 581bff275b17..000000000000
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false-browser.json
+++ /dev/null
@@ -1,75 +0,0 @@
-[
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "csrf_token",
-      "node_type": "input",
-      "required": true,
-      "type": "hidden"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "identifier",
-      "node_type": "input",
-      "type": "hidden",
-      "value": "foo@bar.com"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login",
-      "node_type": "input",
-      "type": "hidden",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "async": true,
-      "crossorigin": "anonymous",
-      "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
-      "node_type": "script",
-      "referrerpolicy": "no-referrer",
-      "type": "text/javascript"
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "script"
-  }
-]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false-spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false-spa.json
deleted file mode 100644
index 581bff275b17..000000000000
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false-spa.json
+++ /dev/null
@@ -1,75 +0,0 @@
-[
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "csrf_token",
-      "node_type": "input",
-      "required": true,
-      "type": "hidden"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "identifier",
-      "node_type": "input",
-      "type": "hidden",
-      "value": "foo@bar.com"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login",
-      "node_type": "input",
-      "type": "hidden",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "async": true,
-      "crossorigin": "anonymous",
-      "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
-      "node_type": "script",
-      "referrerpolicy": "no-referrer",
-      "type": "text/javascript"
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "script"
-  }
-]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#01-browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#01-browser.json
deleted file mode 100644
index 581bff275b17..000000000000
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#01-browser.json
+++ /dev/null
@@ -1,75 +0,0 @@
-[
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "csrf_token",
-      "node_type": "input",
-      "required": true,
-      "type": "hidden"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "identifier",
-      "node_type": "input",
-      "type": "hidden",
-      "value": "foo@bar.com"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login",
-      "node_type": "input",
-      "type": "hidden",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "async": true,
-      "crossorigin": "anonymous",
-      "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
-      "node_type": "script",
-      "referrerpolicy": "no-referrer",
-      "type": "text/javascript"
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "script"
-  }
-]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#01-spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#01-spa.json
deleted file mode 100644
index 581bff275b17..000000000000
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#01-spa.json
+++ /dev/null
@@ -1,75 +0,0 @@
-[
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "csrf_token",
-      "node_type": "input",
-      "required": true,
-      "type": "hidden"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "identifier",
-      "node_type": "input",
-      "type": "hidden",
-      "value": "foo@bar.com"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login",
-      "node_type": "input",
-      "type": "hidden",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "async": true,
-      "crossorigin": "anonymous",
-      "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
-      "node_type": "script",
-      "referrerpolicy": "no-referrer",
-      "type": "text/javascript"
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "script"
-  }
-]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#02-browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#02-browser.json
deleted file mode 100644
index 581bff275b17..000000000000
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#02-browser.json
+++ /dev/null
@@ -1,75 +0,0 @@
-[
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "csrf_token",
-      "node_type": "input",
-      "required": true,
-      "type": "hidden"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "identifier",
-      "node_type": "input",
-      "type": "hidden",
-      "value": "foo@bar.com"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login",
-      "node_type": "input",
-      "type": "hidden",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "async": true,
-      "crossorigin": "anonymous",
-      "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
-      "node_type": "script",
-      "referrerpolicy": "no-referrer",
-      "type": "text/javascript"
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "script"
-  }
-]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#02-spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#02-spa.json
deleted file mode 100644
index 581bff275b17..000000000000
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true#02-spa.json
+++ /dev/null
@@ -1,75 +0,0 @@
-[
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "csrf_token",
-      "node_type": "input",
-      "required": true,
-      "type": "hidden"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "identifier",
-      "node_type": "input",
-      "type": "hidden",
-      "value": "foo@bar.com"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login",
-      "node_type": "input",
-      "type": "hidden",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "async": true,
-      "crossorigin": "anonymous",
-      "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
-      "node_type": "script",
-      "referrerpolicy": "no-referrer",
-      "type": "text/javascript"
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "script"
-  }
-]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true-browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true-browser.json
deleted file mode 100644
index 581bff275b17..000000000000
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true-browser.json
+++ /dev/null
@@ -1,75 +0,0 @@
-[
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "csrf_token",
-      "node_type": "input",
-      "required": true,
-      "type": "hidden"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "identifier",
-      "node_type": "input",
-      "type": "hidden",
-      "value": "foo@bar.com"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login",
-      "node_type": "input",
-      "type": "hidden",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "async": true,
-      "crossorigin": "anonymous",
-      "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
-      "node_type": "script",
-      "referrerpolicy": "no-referrer",
-      "type": "text/javascript"
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "script"
-  }
-]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true-spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true-spa.json
deleted file mode 100644
index 581bff275b17..000000000000
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=true-spa.json
+++ /dev/null
@@ -1,75 +0,0 @@
-[
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "csrf_token",
-      "node_type": "input",
-      "required": true,
-      "type": "hidden"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "identifier",
-      "node_type": "input",
-      "type": "hidden",
-      "value": "foo@bar.com"
-    },
-    "group": "default",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login",
-      "node_type": "input",
-      "type": "hidden",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "input"
-  },
-  {
-    "attributes": {
-      "async": true,
-      "crossorigin": "anonymous",
-      "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
-      "node_type": "script",
-      "referrerpolicy": "no-referrer",
-      "type": "text/javascript"
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {},
-    "type": "script"
-  }
-]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#02-spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v0_credentials-browser.json
similarity index 85%
rename from selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#02-spa.json
rename to selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v0_credentials-browser.json
index 581bff275b17..2df3a118d304 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#02-spa.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v0_credentials-browser.json
@@ -25,25 +25,6 @@
     "meta": {},
     "type": "input"
   },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
   {
     "attributes": {
       "disabled": false,
@@ -62,7 +43,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
@@ -71,5 +52,24 @@
     "messages": [],
     "meta": {},
     "type": "script"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "webauthn_login_trigger",
+      "node_type": "input",
+      "onclickTrigger": "oryWebAuthnLogin",
+      "type": "button"
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    },
+    "type": "input"
   }
 ]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#02-browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v0_credentials-spa.json
similarity index 85%
rename from selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#02-browser.json
rename to selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v0_credentials-spa.json
index 581bff275b17..2df3a118d304 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#02-browser.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v0_credentials-spa.json
@@ -25,25 +25,6 @@
     "meta": {},
     "type": "input"
   },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
   {
     "attributes": {
       "disabled": false,
@@ -62,7 +43,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
@@ -71,5 +52,24 @@
     "messages": [],
     "meta": {},
     "type": "script"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "webauthn_login_trigger",
+      "node_type": "input",
+      "onclickTrigger": "oryWebAuthnLogin",
+      "type": "button"
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    },
+    "type": "input"
   }
 ]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#01-browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v1_credentials-browser.json
similarity index 85%
rename from selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#01-browser.json
rename to selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v1_credentials-browser.json
index 581bff275b17..2df3a118d304 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#01-browser.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v1_credentials-browser.json
@@ -25,25 +25,6 @@
     "meta": {},
     "type": "input"
   },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
   {
     "attributes": {
       "disabled": false,
@@ -62,7 +43,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
@@ -71,5 +52,24 @@
     "messages": [],
     "meta": {},
     "type": "script"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "webauthn_login_trigger",
+      "node_type": "input",
+      "onclickTrigger": "oryWebAuthnLogin",
+      "type": "button"
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    },
+    "type": "input"
   }
 ]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#01-spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v1_credentials-spa.json
similarity index 85%
rename from selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#01-spa.json
rename to selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v1_credentials-spa.json
index 581bff275b17..2df3a118d304 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-case=mfa_v0_credentials-passwordless_enabled=false#01-spa.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=mfa_v1_credentials-spa.json
@@ -25,25 +25,6 @@
     "meta": {},
     "type": "input"
   },
-  {
-    "attributes": {
-      "disabled": false,
-      "name": "webauthn_login_trigger",
-      "node_type": "input",
-      "type": "button",
-      "value": ""
-    },
-    "group": "webauthn",
-    "messages": [],
-    "meta": {
-      "label": {
-        "id": 1010008,
-        "text": "Use security key",
-        "type": "info"
-      }
-    },
-    "type": "input"
-  },
   {
     "attributes": {
       "disabled": false,
@@ -62,7 +43,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
@@ -71,5 +52,24 @@
     "messages": [],
     "meta": {},
     "type": "script"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "webauthn_login_trigger",
+      "node_type": "input",
+      "onclickTrigger": "oryWebAuthnLogin",
+      "type": "button"
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    },
+    "type": "input"
   }
 ]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=passwordless_credentials-browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=passwordless_credentials-browser.json
new file mode 100644
index 000000000000..d601ae14020f
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=passwordless_credentials-browser.json
@@ -0,0 +1,15 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "csrf_token",
+      "node_type": "input",
+      "required": true,
+      "type": "hidden"
+    },
+    "group": "default",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=passwordless_credentials-spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=passwordless_credentials-spa.json
new file mode 100644
index 000000000000..d601ae14020f
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=false-case=passwordless_credentials-spa.json
@@ -0,0 +1,15 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "csrf_token",
+      "node_type": "input",
+      "required": true,
+      "type": "hidden"
+    },
+    "group": "default",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v0_credentials-browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v0_credentials-browser.json
new file mode 100644
index 000000000000..d601ae14020f
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v0_credentials-browser.json
@@ -0,0 +1,15 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "csrf_token",
+      "node_type": "input",
+      "required": true,
+      "type": "hidden"
+    },
+    "group": "default",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v0_credentials-spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v0_credentials-spa.json
new file mode 100644
index 000000000000..d601ae14020f
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v0_credentials-spa.json
@@ -0,0 +1,15 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "csrf_token",
+      "node_type": "input",
+      "required": true,
+      "type": "hidden"
+    },
+    "group": "default",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v1_credentials-browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v1_credentials-browser.json
new file mode 100644
index 000000000000..d601ae14020f
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v1_credentials-browser.json
@@ -0,0 +1,15 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "csrf_token",
+      "node_type": "input",
+      "required": true,
+      "type": "hidden"
+    },
+    "group": "default",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v1_credentials-spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v1_credentials-spa.json
new file mode 100644
index 000000000000..d601ae14020f
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=mfa_v1_credentials-spa.json
@@ -0,0 +1,15 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "csrf_token",
+      "node_type": "input",
+      "required": true,
+      "type": "hidden"
+    },
+    "group": "default",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=passwordless_credentials-browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=passwordless_credentials-browser.json
new file mode 100644
index 000000000000..2df3a118d304
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=passwordless_credentials-browser.json
@@ -0,0 +1,75 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "csrf_token",
+      "node_type": "input",
+      "required": true,
+      "type": "hidden"
+    },
+    "group": "default",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "identifier",
+      "node_type": "input",
+      "type": "hidden",
+      "value": "foo@bar.com"
+    },
+    "group": "default",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "webauthn_login",
+      "node_type": "input",
+      "type": "hidden",
+      "value": ""
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "async": true,
+      "crossorigin": "anonymous",
+      "id": "webauthn_script",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
+      "node_type": "script",
+      "referrerpolicy": "no-referrer",
+      "type": "text/javascript"
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {},
+    "type": "script"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "webauthn_login_trigger",
+      "node_type": "input",
+      "onclickTrigger": "oryWebAuthnLogin",
+      "type": "button"
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=passwordless_credentials-spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=passwordless_credentials-spa.json
new file mode 100644
index 000000000000..2df3a118d304
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteLogin-flow=refresh-case=passwordless-passwordless_enabled=true-case=passwordless_credentials-spa.json
@@ -0,0 +1,75 @@
+[
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "csrf_token",
+      "node_type": "input",
+      "required": true,
+      "type": "hidden"
+    },
+    "group": "default",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "identifier",
+      "node_type": "input",
+      "type": "hidden",
+      "value": "foo@bar.com"
+    },
+    "group": "default",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "webauthn_login",
+      "node_type": "input",
+      "type": "hidden",
+      "value": ""
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {},
+    "type": "input"
+  },
+  {
+    "attributes": {
+      "async": true,
+      "crossorigin": "anonymous",
+      "id": "webauthn_script",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
+      "node_type": "script",
+      "referrerpolicy": "no-referrer",
+      "type": "text/javascript"
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {},
+    "type": "script"
+  },
+  {
+    "attributes": {
+      "disabled": false,
+      "name": "webauthn_login_trigger",
+      "node_type": "input",
+      "onclickTrigger": "oryWebAuthnLogin",
+      "type": "button"
+    },
+    "group": "webauthn",
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    },
+    "type": "input"
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=a_device_is_shown_which_can_be_unlinked.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=a_device_is_shown_which_can_be_unlinked.json
index 0b1702c09413..c335744d6532 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=a_device_is_shown_which_can_be_unlinked.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=a_device_is_shown_which_can_be_unlinked.json
@@ -82,33 +82,33 @@
   {
     "attributes": {
       "disabled": false,
-      "name": "webauthn_register_trigger",
+      "name": "webauthn_register",
       "node_type": "input",
-      "type": "button",
+      "type": "hidden",
       "value": ""
     },
     "group": "webauthn",
     "messages": [],
-    "meta": {
-      "label": {
-        "id": 1050012,
-        "text": "Add security key",
-        "type": "info"
-      }
-    },
+    "meta": {},
     "type": "input"
   },
   {
     "attributes": {
       "disabled": false,
-      "name": "webauthn_register",
+      "name": "webauthn_register_trigger",
       "node_type": "input",
-      "type": "hidden",
-      "value": ""
+      "onclickTrigger": "oryWebAuthnRegistration",
+      "type": "button"
     },
     "group": "webauthn",
     "messages": [],
-    "meta": {},
+    "meta": {
+      "label": {
+        "id": 1050012,
+        "text": "Add security key",
+        "type": "info"
+      }
+    },
     "type": "input"
   },
   {
@@ -116,7 +116,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=fails_to_remove_security_key_if_it_is_passwordless_and_the_last_credential_available-type=browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=fails_to_remove_security_key_if_it_is_passwordless_and_the_last_credential_available-type=browser.json
index 515658a3d64f..9bd36e752fd0 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=fails_to_remove_security_key_if_it_is_passwordless_and_the_last_credential_available-type=browser.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=fails_to_remove_security_key_if_it_is_passwordless_and_the_last_credential_available-type=browser.json
@@ -5,9 +5,6 @@
   "webauthn_register_displayname": [
     ""
   ],
-  "webauthn_register_trigger": [
-    ""
-  ],
   "webauthn_remove": [
     "666f6f666f6f"
   ]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=fails_to_remove_security_key_if_it_is_passwordless_and_the_last_credential_available-type=spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=fails_to_remove_security_key_if_it_is_passwordless_and_the_last_credential_available-type=spa.json
index 515658a3d64f..9bd36e752fd0 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=fails_to_remove_security_key_if_it_is_passwordless_and_the_last_credential_available-type=spa.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=fails_to_remove_security_key_if_it_is_passwordless_and_the_last_credential_available-type=spa.json
@@ -5,9 +5,6 @@
   "webauthn_register_displayname": [
     ""
   ],
-  "webauthn_register_trigger": [
-    ""
-  ],
   "webauthn_remove": [
     "666f6f666f6f"
   ]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=one_activation_element_is_shown.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=one_activation_element_is_shown.json
index b21fa4833028..ff26034abc11 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=one_activation_element_is_shown.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=one_activation_element_is_shown.json
@@ -34,33 +34,33 @@
   {
     "attributes": {
       "disabled": false,
-      "name": "webauthn_register_trigger",
+      "name": "webauthn_register",
       "node_type": "input",
-      "type": "button",
+      "type": "hidden",
       "value": ""
     },
     "group": "webauthn",
     "messages": [],
-    "meta": {
-      "label": {
-        "id": 1050012,
-        "text": "Add security key",
-        "type": "info"
-      }
-    },
+    "meta": {},
     "type": "input"
   },
   {
     "attributes": {
       "disabled": false,
-      "name": "webauthn_register",
+      "name": "webauthn_register_trigger",
       "node_type": "input",
-      "type": "hidden",
-      "value": ""
+      "onclickTrigger": "oryWebAuthnRegistration",
+      "type": "button"
     },
     "group": "webauthn",
     "messages": [],
-    "meta": {},
+    "meta": {
+      "label": {
+        "id": 1050012,
+        "text": "Add security key",
+        "type": "info"
+      }
+    },
     "type": "input"
   },
   {
@@ -68,7 +68,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=possible_to_remove_webauthn_credential_if_it_is_MFA_at_all_times-type=browser.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=possible_to_remove_webauthn_credential_if_it_is_MFA_at_all_times-type=browser.json
index 515658a3d64f..9bd36e752fd0 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=possible_to_remove_webauthn_credential_if_it_is_MFA_at_all_times-type=browser.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=possible_to_remove_webauthn_credential_if_it_is_MFA_at_all_times-type=browser.json
@@ -5,9 +5,6 @@
   "webauthn_register_displayname": [
     ""
   ],
-  "webauthn_register_trigger": [
-    ""
-  ],
   "webauthn_remove": [
     "666f6f666f6f"
   ]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=possible_to_remove_webauthn_credential_if_it_is_MFA_at_all_times-type=spa.json b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=possible_to_remove_webauthn_credential_if_it_is_MFA_at_all_times-type=spa.json
index 515658a3d64f..9bd36e752fd0 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=possible_to_remove_webauthn_credential_if_it_is_MFA_at_all_times-type=spa.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestCompleteSettings-case=possible_to_remove_webauthn_credential_if_it_is_MFA_at_all_times-type=spa.json
@@ -5,9 +5,6 @@
   "webauthn_register_displayname": [
     ""
   ],
-  "webauthn_register_trigger": [
-    ""
-  ],
   "webauthn_remove": [
     "666f6f666f6f"
   ]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=mfa_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=mfa_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=mfa_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=passwordless_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=passwordless_enabled.json
new file mode 100644
index 000000000000..ddd8316aa00f
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodFirstFactor-case=passwordless_enabled.json
@@ -0,0 +1,54 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "text",
+      "required": true,
+      "autocomplete": "username webauthn",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1070004,
+        "text": "ID",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "webauthn",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=mfa_enabled-case=account_enumeration_mitigation_disabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=mfa_enabled-case=account_enumeration_mitigation_disabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=mfa_enabled-case=account_enumeration_mitigation_disabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=mfa_enabled-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=mfa_enabled-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=mfa_enabled-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=mfa_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=mfa_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=mfa_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=passwordless_enabled-case=account_enumeration_mitigation_disabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=passwordless_enabled-case=account_enumeration_mitigation_disabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=passwordless_enabled-case=account_enumeration_mitigation_disabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=passwordless_enabled-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=passwordless_enabled-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..63ce82315a77
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentifier-case=passwordless_enabled-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1,34 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "webauthn",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_webauthn-case=mfa_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_webauthn-case=mfa_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_webauthn-case=mfa_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_webauthn-case=passwordless_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_webauthn-case=passwordless_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_does_not_have_a_webauthn-case=passwordless_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_webauthn-case=mfa_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_webauthn-case=mfa_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_webauthn-case=mfa_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_webauthn-case=passwordless_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_webauthn-case=passwordless_enabled.json
new file mode 100644
index 000000000000..63ce82315a77
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_disabled-case=identity_has_webauthn-case=passwordless_enabled.json
@@ -0,0 +1,34 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "webauthn",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=mfa_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=mfa_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=mfa_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=passwordless_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=passwordless_enabled.json
new file mode 100644
index 000000000000..63ce82315a77
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=WithIdentityHint-case=account_enumeration_mitigation_enabled-case=passwordless_enabled.json
@@ -0,0 +1,34 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "webauthn",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=mfa_enabled-case=account_enumeration_mitigation_disabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=mfa_enabled-case=account_enumeration_mitigation_disabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=mfa_enabled-case=account_enumeration_mitigation_disabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=mfa_enabled-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=mfa_enabled-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=mfa_enabled-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=mfa_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=mfa_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=mfa_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=passwordless_enabled-case=account_enumeration_mitigation_disabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=passwordless_enabled-case=account_enumeration_mitigation_disabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=passwordless_enabled-case=account_enumeration_mitigation_disabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=passwordless_enabled-case=account_enumeration_mitigation_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=passwordless_enabled-case=account_enumeration_mitigation_enabled.json
new file mode 100644
index 000000000000..63ce82315a77
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstCredentials-case=no_options-case=passwordless_enabled-case=account_enumeration_mitigation_enabled.json
@@ -0,0 +1,34 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "method",
+      "type": "submit",
+      "value": "webauthn",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    }
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification-case=mfa_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification-case=mfa_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification-case=mfa_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification-case=passwordless_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification-case=passwordless_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodIdentifierFirstIdentification-case=passwordless_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=mfa_enabled_and_user_has_mfa_credentials.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=mfa_enabled_and_user_has_mfa_credentials.json
new file mode 100644
index 000000000000..9f84956e3f6c
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=mfa_enabled_and_user_has_mfa_credentials.json
@@ -0,0 +1,74 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "hidden",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "script",
+    "group": "webauthn",
+    "attributes": {
+      "async": true,
+      "referrerpolicy": "no-referrer",
+      "crossorigin": "anonymous",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
+      "type": "text/javascript",
+      "id": "webauthn_script",
+      "node_type": "script"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "webauthn_login_trigger",
+      "type": "button",
+      "disabled": false,
+      "onclickTrigger": "oryWebAuthnLogin",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "webauthn_login",
+      "type": "hidden",
+      "value": "",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=mfa_enabled_but_user_has_passwordless_credentials.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=mfa_enabled_but_user_has_passwordless_credentials.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=mfa_enabled_but_user_has_passwordless_credentials.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=passwordless_enabled_and_user_has_passwordless_credentials.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=passwordless_enabled_and_user_has_passwordless_credentials.json
new file mode 100644
index 000000000000..9f84956e3f6c
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=passwordless_enabled_and_user_has_passwordless_credentials.json
@@ -0,0 +1,74 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "hidden",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "script",
+    "group": "webauthn",
+    "attributes": {
+      "async": true,
+      "referrerpolicy": "no-referrer",
+      "crossorigin": "anonymous",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
+      "type": "text/javascript",
+      "id": "webauthn_script",
+      "node_type": "script"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "webauthn_login_trigger",
+      "type": "button",
+      "disabled": false,
+      "onclickTrigger": "oryWebAuthnLogin",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "webauthn_login",
+      "type": "hidden",
+      "value": "",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=passwordless_enabled_but_user_has_no_passwordless_credentials.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=passwordless_enabled_but_user_has_no_passwordless_credentials.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodRefresh-case=passwordless_enabled_but_user_has_no_passwordless_credentials.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=mfa_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=mfa_enabled.json
new file mode 100644
index 000000000000..9f84956e3f6c
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=mfa_enabled.json
@@ -0,0 +1,74 @@
+[
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "identifier",
+      "type": "hidden",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "default",
+    "attributes": {
+      "name": "csrf_token",
+      "type": "hidden",
+      "required": true,
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "script",
+    "group": "webauthn",
+    "attributes": {
+      "async": true,
+      "referrerpolicy": "no-referrer",
+      "crossorigin": "anonymous",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
+      "type": "text/javascript",
+      "id": "webauthn_script",
+      "node_type": "script"
+    },
+    "messages": [],
+    "meta": {}
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "webauthn_login_trigger",
+      "type": "button",
+      "disabled": false,
+      "onclickTrigger": "oryWebAuthnLogin",
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {
+      "label": {
+        "id": 1010008,
+        "text": "Sign in with hardware key",
+        "type": "info"
+      }
+    }
+  },
+  {
+    "type": "input",
+    "group": "webauthn",
+    "attributes": {
+      "name": "webauthn_login",
+      "type": "hidden",
+      "value": "",
+      "disabled": false,
+      "node_type": "input"
+    },
+    "messages": [],
+    "meta": {}
+  }
+]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=passwordless_enabled.json b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=passwordless_enabled.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/selfservice/strategy/webauthn/.snapshots/TestFormHydration-method=PopulateLoginMethodSecondFactor-case=passwordless_enabled.json
@@ -0,0 +1 @@
+[]
diff --git a/selfservice/strategy/webauthn/.snapshots/TestRegistration-case=webauthn_button_exists-browser.json b/selfservice/strategy/webauthn/.snapshots/TestRegistration-case=webauthn_button_exists-browser.json
index 14a920d0a18d..733a28311ebd 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestRegistration-case=webauthn_button_exists-browser.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestRegistration-case=webauthn_button_exists-browser.json
@@ -75,8 +75,8 @@
       "disabled": false,
       "name": "webauthn_register_trigger",
       "node_type": "input",
-      "type": "button",
-      "value": ""
+      "onclickTrigger": "oryWebAuthnRegistration",
+      "type": "button"
     },
     "group": "webauthn",
     "messages": [],
@@ -94,7 +94,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
diff --git a/selfservice/strategy/webauthn/.snapshots/TestRegistration-case=webauthn_button_exists-spa.json b/selfservice/strategy/webauthn/.snapshots/TestRegistration-case=webauthn_button_exists-spa.json
index 14a920d0a18d..733a28311ebd 100644
--- a/selfservice/strategy/webauthn/.snapshots/TestRegistration-case=webauthn_button_exists-spa.json
+++ b/selfservice/strategy/webauthn/.snapshots/TestRegistration-case=webauthn_button_exists-spa.json
@@ -75,8 +75,8 @@
       "disabled": false,
       "name": "webauthn_register_trigger",
       "node_type": "input",
-      "type": "button",
-      "value": ""
+      "onclickTrigger": "oryWebAuthnRegistration",
+      "type": "button"
     },
     "group": "webauthn",
     "messages": [],
@@ -94,7 +94,7 @@
       "async": true,
       "crossorigin": "anonymous",
       "id": "webauthn_script",
-      "integrity": "sha512-SSVrbpK6KOwN4xsH+nSyinjp4BOw8dsCU5dgegdpYUk0k7idTnQTd2JGVd+EJZV/TkdRaSKFJHRetpt5vydIZA==",
+      "integrity": "sha512-GJndj+bkFBMHiun3qBMmFh5eeGodY/eSh8tg50xHcNEdOBCIKnlofYd2slaBTtVpyI4opfkMc/zw+nwBjGdAbw==",
       "node_type": "script",
       "referrerpolicy": "no-referrer",
       "type": "text/javascript"
diff --git a/selfservice/strategy/webauthn/login.go b/selfservice/strategy/webauthn/login.go
index 4c7dd23f09ea..c225368fa29e 100644
--- a/selfservice/strategy/webauthn/login.go
+++ b/selfservice/strategy/webauthn/login.go
@@ -4,11 +4,19 @@
 package webauthn
 
 import (
+	"context"
 	"encoding/json"
 	"net/http"
 	"strings"
 	"time"
 
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/ory/x/otelx"
+
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
+
 	"github.com/ory/kratos/selfservice/flowhelpers"
 	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/x/webauthnx"
@@ -34,84 +42,14 @@ import (
 	"github.com/ory/x/decoderx"
 )
 
+var _ login.FormHydrator = new(Strategy)
+
 func (s *Strategy) RegisterLoginRoutes(r *x.RouterPublic) {
 	webauthnx.RegisterWebauthnRoute(r)
 }
 
-func (s *Strategy) PopulateLoginMethod(r *http.Request, requestedAAL identity.AuthenticatorAssuranceLevel, sr *login.Flow) error {
-	if sr.Type != flow.TypeBrowser {
-		return nil
-	}
-
-	if s.d.Config().WebAuthnForPasswordless(r.Context()) && (requestedAAL == identity.AuthenticatorAssuranceLevel1) {
-		if err := s.populateLoginMethodForPasswordless(r, sr); errors.Is(err, webauthnx.ErrNoCredentials) {
-			return nil
-		} else if err != nil {
-			return err
-		}
-		return nil
-	} else if sr.IsForced() {
-		if err := s.populateLoginMethodForPasswordless(r, sr); errors.Is(err, webauthnx.ErrNoCredentials) {
-			return nil
-		} else if err != nil {
-			return err
-		}
-		return nil
-	} else if !s.d.Config().WebAuthnForPasswordless(r.Context()) && (requestedAAL == identity.AuthenticatorAssuranceLevel2) {
-		// We have done proper validation before so this should never error
-		sess, err := s.d.SessionManager().FetchFromRequest(r.Context(), r)
-		if err != nil {
-			return err
-		}
-
-		if err := s.populateLoginMethod(r, sr, sess.Identity, text.NewInfoSelfServiceLoginWebAuthn(), identity.AuthenticatorAssuranceLevel2); errors.Is(err, webauthnx.ErrNoCredentials) {
-			return nil
-		} else if err != nil {
-			return err
-		}
-
-		return nil
-	}
-
-	return nil
-}
-
 func (s *Strategy) populateLoginMethodForPasswordless(r *http.Request, sr *login.Flow) error {
-	if sr.IsForced() {
-		identifier, id, _ := flowhelpers.GuessForcedLoginIdentifier(r, s.d, sr, s.ID())
-		if identifier == "" {
-			return nil
-		}
-
-		if err := s.populateLoginMethod(r, sr, id, text.NewInfoSelfServiceLoginWebAuthn(), ""); errors.Is(err, webauthnx.ErrNoCredentials) {
-			return nil
-		} else if err != nil {
-			return err
-		}
-
-		sr.UI.SetCSRF(s.d.GenerateCSRFToken(r))
-		sr.UI.SetNode(node.NewInputField("identifier", identifier, node.DefaultGroup, node.InputAttributeTypeHidden))
-		return nil
-	}
-
-	ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(r.Context())
-	if err != nil {
-		return err
-	}
-	identifierLabel, err := login.GetIdentifierLabelFromSchema(r.Context(), ds.String())
-	if err != nil {
-		return err
-	}
-
 	sr.UI.SetCSRF(s.d.GenerateCSRFToken(r))
-	sr.UI.SetNode(node.NewInputField(
-		"identifier",
-		"",
-		node.DefaultGroup,
-		node.InputAttributeTypeText,
-		node.WithRequiredInputAttribute,
-		func(attributes *node.InputAttributes) { attributes.Autocomplete = "username webauthn" },
-	).WithMetaLabel(identifierLabel))
 	sr.UI.GetNodes().Append(node.NewInputField("method", "webauthn", node.WebAuthnGroup, node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoSelfServiceLoginWebAuthn()))
 	return nil
 }
@@ -133,11 +71,7 @@ func (s *Strategy) populateLoginMethod(r *http.Request, sr *login.Flow, i *ident
 		return errors.WithStack(err)
 	}
 
-	webAuthCreds := conf.Credentials.ToWebAuthn()
-	if !sr.IsForced() {
-		webAuthCreds = conf.Credentials.ToWebAuthnFiltered(aal)
-	}
-
+	webAuthCreds := conf.Credentials.ToWebAuthnFiltered(aal, nil)
 	if len(webAuthCreds) == 0 {
 		// Identity has no webauthn
 		return webauthnx.ErrNoCredentials
@@ -217,12 +151,17 @@ type updateLoginFlowWithWebAuthnMethod struct {
 }
 
 func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, sess *session.Session) (i *identity.Identity, err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.webauthn.Strategy.Login")
+	defer otelx.End(span, &err)
+
 	if f.Type != flow.TypeBrowser {
+		span.SetAttributes(attribute.String("not_responsible_reason", "flow type is not browser"))
 		return nil, flow.ErrStrategyNotResponsible
 	}
 
 	var p updateLoginFlowWithWebAuthnMethod
 	if err := s.hd.Decode(r, &p,
+		decoderx.HTTPKeepRequestBody(true),
 		decoderx.HTTPDecoderSetValidatePayloads(true),
 		decoderx.MustHTTPRawJSONSchemaCompiler(loginSchema),
 		decoderx.HTTPDecoderJSONFollowsFormFormat()); err != nil {
@@ -234,30 +173,35 @@ func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow,
 		// This method has only two submit buttons
 		p.Method = s.SettingsStrategyID()
 	} else {
+		span.SetAttributes(attribute.String("not_responsible_reason", "login is not provided and method is not webauthn"))
 		return nil, flow.ErrStrategyNotResponsible
 	}
 
-	if err := flow.MethodEnabledAndAllowed(r.Context(), f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
+	if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
 		return nil, s.handleLoginError(r, f, err)
 	}
 
-	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 		return nil, s.handleLoginError(r, f, err)
 	}
 
-	if s.d.Config().WebAuthnForPasswordless(r.Context()) || f.IsForced() && f.RequestedAAL == identity.AuthenticatorAssuranceLevel1 {
-		return s.loginPasswordless(w, r, f, &p)
+	if s.d.Config().WebAuthnForPasswordless(ctx) || f.IsRefresh() && f.RequestedAAL == identity.AuthenticatorAssuranceLevel1 {
+		return s.loginPasswordless(ctx, w, r, f, &p)
 	}
 
-	return s.loginMultiFactor(w, r, f, sess.IdentityID, &p)
+	return s.loginMultiFactor(ctx, r, f, sess.IdentityID, &p)
 }
 
-func (s *Strategy) loginPasswordless(w http.ResponseWriter, r *http.Request, f *login.Flow, p *updateLoginFlowWithWebAuthnMethod) (i *identity.Identity, err error) {
+func (s *Strategy) loginPasswordless(ctx context.Context, w http.ResponseWriter, r *http.Request, f *login.Flow, p *updateLoginFlowWithWebAuthnMethod) (i *identity.Identity, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.webauthn.Strategy.loginPasswordless")
+	defer otelx.End(span, &err)
+
 	if err := login.CheckAAL(f, identity.AuthenticatorAssuranceLevel1); err != nil {
+		span.SetAttributes(attribute.String("not_responsible_reason", "requested AAL is not AAL1"))
 		return nil, s.handleLoginError(r, f, err)
 	}
 
-	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+	if err := flow.EnsureCSRF(s.d, r, f.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 		return nil, s.handleLoginError(r, f, err)
 	}
 
@@ -265,9 +209,9 @@ func (s *Strategy) loginPasswordless(w http.ResponseWriter, r *http.Request, f *
 		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrBadRequest.WithReason("identifier is required")))
 	}
 
-	i, _, err = s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(r.Context(), s.ID(), p.Identifier)
+	i, _, err = s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(ctx, s.ID(), p.Identifier)
 	if err != nil {
-		time.Sleep(x.RandomDelay(s.d.Config().HasherArgon2(r.Context()).ExpectedDuration, s.d.Config().HasherArgon2(r.Context()).ExpectedDeviation))
+		time.Sleep(x.RandomDelay(s.d.Config().HasherArgon2(ctx).ExpectedDuration, s.d.Config().HasherArgon2(ctx).ExpectedDeviation))
 		return nil, s.handleLoginError(r, f, errors.WithStack(schema.NewNoWebAuthnCredentials()))
 	}
 
@@ -288,25 +232,28 @@ func (s *Strategy) loginPasswordless(w http.ResponseWriter, r *http.Request, f *
 		f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
 		f.UI.Messages.Add(text.NewInfoLoginWebAuthnPasswordless())
 		f.UI.SetNode(node.NewInputField("identifier", p.Identifier, node.DefaultGroup, node.InputAttributeTypeHidden, node.WithRequiredInputAttribute))
-		if err := s.d.LoginFlowPersister().UpdateLoginFlow(r.Context(), f); err != nil {
+		if err := s.d.LoginFlowPersister().UpdateLoginFlow(ctx, f); err != nil {
 			return nil, s.handleLoginError(r, f, err)
 		}
 
-		redirectTo := f.AppendTo(s.d.Config().SelfServiceFlowLoginUI(r.Context())).String()
+		redirectTo := f.AppendTo(s.d.Config().SelfServiceFlowLoginUI(ctx)).String()
 		if x.IsJSONRequest(r) {
 			s.d.Writer().WriteError(w, r, flow.NewBrowserLocationChangeRequiredError(redirectTo))
 		} else {
-			http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowLoginUI(r.Context())).String(), http.StatusSeeOther)
+			http.Redirect(w, r, f.AppendTo(s.d.Config().SelfServiceFlowLoginUI(ctx)).String(), http.StatusSeeOther)
 		}
 
 		return nil, errors.WithStack(flow.ErrCompletedByStrategy)
 	}
 
-	return s.loginAuthenticate(w, r, f, i.ID, p, identity.AuthenticatorAssuranceLevel1)
+	return s.loginAuthenticate(ctx, r, f, i.ID, p, identity.AuthenticatorAssuranceLevel1)
 }
 
-func (s *Strategy) loginAuthenticate(_ http.ResponseWriter, r *http.Request, f *login.Flow, identityID uuid.UUID, p *updateLoginFlowWithWebAuthnMethod, aal identity.AuthenticatorAssuranceLevel) (*identity.Identity, error) {
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), identityID)
+func (s *Strategy) loginAuthenticate(ctx context.Context, r *http.Request, f *login.Flow, identityID uuid.UUID, p *updateLoginFlowWithWebAuthnMethod, aal identity.AuthenticatorAssuranceLevel) (_ *identity.Identity, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.webauthn.Strategy.loginAuthenticate")
+	defer otelx.End(span, &err)
+
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, identityID)
 	if err != nil {
 		return nil, s.handleLoginError(r, f, errors.WithStack(schema.NewNoWebAuthnRegistered()))
 	}
@@ -321,7 +268,7 @@ func (s *Strategy) loginAuthenticate(_ http.ResponseWriter, r *http.Request, f *
 		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrInternalServerError.WithReason("The WebAuthn credentials could not be decoded properly").WithDebug(err.Error()).WithWrap(err)))
 	}
 
-	web, err := webauthn.New(s.d.Config().WebAuthnConfig(r.Context()))
+	web, err := webauthn.New(s.d.Config().WebAuthnConfig(ctx))
 	if err != nil {
 		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to get webAuthn config.").WithDebug(err.Error())))
 	}
@@ -336,8 +283,8 @@ func (s *Strategy) loginAuthenticate(_ http.ResponseWriter, r *http.Request, f *
 		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Expected WebAuthN in internal context to be an object but got: %s", err)))
 	}
 
-	webAuthCreds := o.Credentials.ToWebAuthnFiltered(aal)
-	if f.IsForced() {
+	webAuthCreds := o.Credentials.ToWebAuthnFiltered(aal, &webAuthnResponse.Response.AuthenticatorData.Flags)
+	if f.IsRefresh() {
 		webAuthCreds = o.Credentials.ToWebAuthn()
 	}
 
@@ -352,16 +299,138 @@ func (s *Strategy) loginAuthenticate(_ http.ResponseWriter, r *http.Request, f *
 	}
 
 	f.Active = s.ID()
-	if err = s.d.LoginFlowPersister().UpdateLoginFlow(r.Context(), f); err != nil {
+	if err = s.d.LoginFlowPersister().UpdateLoginFlow(ctx, f); err != nil {
 		return nil, s.handleLoginError(r, f, errors.WithStack(herodot.ErrInternalServerError.WithReason("Could not update flow").WithDebug(err.Error())))
 	}
 
 	return i, nil
 }
 
-func (s *Strategy) loginMultiFactor(w http.ResponseWriter, r *http.Request, f *login.Flow, identityID uuid.UUID, p *updateLoginFlowWithWebAuthnMethod) (*identity.Identity, error) {
+func (s *Strategy) loginMultiFactor(ctx context.Context, r *http.Request, f *login.Flow, identityID uuid.UUID, p *updateLoginFlowWithWebAuthnMethod) (*identity.Identity, error) {
 	if err := login.CheckAAL(f, identity.AuthenticatorAssuranceLevel2); err != nil {
+		trace.SpanFromContext(ctx).SetAttributes(attribute.String("not_responsible_reason", "requested AAL is not AAL2"))
 		return nil, err
 	}
-	return s.loginAuthenticate(w, r, f, identityID, p, identity.AuthenticatorAssuranceLevel2)
+	return s.loginAuthenticate(ctx, r, f, identityID, p, identity.AuthenticatorAssuranceLevel2)
+}
+
+func (s *Strategy) populateLoginMethodRefresh(r *http.Request, sr *login.Flow) error {
+	if sr.Type != flow.TypeBrowser {
+		return nil
+	}
+
+	identifier, id, _ := flowhelpers.GuessForcedLoginIdentifier(r, s.d, sr, s.ID())
+	if identifier == "" {
+		return nil
+	}
+
+	if err := s.populateLoginMethod(r, sr, id, text.NewInfoSelfServiceLoginWebAuthn(), sr.RequestedAAL); errors.Is(err, webauthnx.ErrNoCredentials) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+
+	sr.UI.SetCSRF(s.d.GenerateCSRFToken(r))
+	sr.UI.SetNode(node.NewInputField("identifier", identifier, node.DefaultGroup, node.InputAttributeTypeHidden))
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodFirstFactorRefresh(r *http.Request, sr *login.Flow) error {
+	return s.populateLoginMethodRefresh(r, sr)
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactorRefresh(r *http.Request, sr *login.Flow) error {
+	return s.populateLoginMethodRefresh(r, sr)
+}
+
+func (s *Strategy) PopulateLoginMethodFirstFactor(r *http.Request, sr *login.Flow) error {
+	if sr.Type != flow.TypeBrowser || !s.d.Config().WebAuthnForPasswordless(r.Context()) {
+		return nil
+	}
+
+	ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(r.Context())
+	if err != nil {
+		return err
+	}
+
+	identifierLabel, err := login.GetIdentifierLabelFromSchema(r.Context(), ds.String())
+	if err != nil {
+		return err
+	}
+
+	sr.UI.SetNode(node.NewInputField(
+		"identifier",
+		"",
+		node.DefaultGroup,
+		node.InputAttributeTypeText,
+		node.WithRequiredInputAttribute,
+		func(attributes *node.InputAttributes) { attributes.Autocomplete = "username webauthn" },
+	).WithMetaLabel(identifierLabel))
+
+	if err := s.populateLoginMethodForPasswordless(r, sr); errors.Is(err, webauthnx.ErrNoCredentials) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodSecondFactor(r *http.Request, sr *login.Flow) error {
+	if sr.Type != flow.TypeBrowser || s.d.Config().WebAuthnForPasswordless(r.Context()) {
+		return nil
+	}
+
+	// We have done proper validation before so this should never error
+	sess, err := s.d.SessionManager().FetchFromRequest(r.Context(), r)
+	if err != nil {
+		return err
+	}
+
+	if err := s.populateLoginMethod(r, sr, sess.Identity, text.NewInfoSelfServiceLoginWebAuthn(), identity.AuthenticatorAssuranceLevel2); errors.Is(err, webauthnx.ErrNoCredentials) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstCredentials(r *http.Request, sr *login.Flow, opts ...login.FormHydratorModifier) error {
+	if sr.Type != flow.TypeBrowser || !s.d.Config().WebAuthnForPasswordless(r.Context()) {
+		return errors.WithStack(idfirst.ErrNoCredentialsFound)
+	}
+
+	o := login.NewFormHydratorOptions(opts)
+
+	var count int
+	if o.IdentityHint != nil {
+		var err error
+		// If we have an identity hint we can perform identity credentials discovery and
+		// hide this credential if it should not be included.
+		if count, err = s.CountActiveFirstFactorCredentials(r.Context(), o.IdentityHint.Credentials); err != nil {
+			return err
+		}
+	}
+
+	if count > 0 || s.d.Config().SecurityAccountEnumerationMitigate(r.Context()) {
+		if err := s.populateLoginMethodForPasswordless(r, sr); errors.Is(err, webauthnx.ErrNoCredentials) {
+			if !s.d.Config().SecurityAccountEnumerationMitigate(r.Context()) {
+				return errors.WithStack(idfirst.ErrNoCredentialsFound)
+			}
+			return nil
+		} else if err != nil {
+			return err
+		}
+	}
+
+	if count == 0 {
+		return errors.WithStack(idfirst.ErrNoCredentialsFound)
+	}
+
+	return nil
+}
+
+func (s *Strategy) PopulateLoginMethodIdentifierFirstIdentification(r *http.Request, sr *login.Flow) error {
+	return nil
 }
diff --git a/selfservice/strategy/webauthn/login_test.go b/selfservice/strategy/webauthn/login_test.go
index f5d332182163..6a98f3b3d383 100644
--- a/selfservice/strategy/webauthn/login_test.go
+++ b/selfservice/strategy/webauthn/login_test.go
@@ -10,8 +10,12 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"testing"
+	"time"
+
+	"github.com/ory/kratos/selfservice/strategy/idfirst"
 
 	"github.com/ory/x/jsonx"
 
@@ -30,6 +34,7 @@ import (
 	"github.com/tidwall/gjson"
 
 	"github.com/ory/kratos/driver/config"
+	configtesthelpers "github.com/ory/kratos/driver/config/testhelpers"
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/internal"
 	"github.com/ory/kratos/internal/testhelpers"
@@ -153,7 +158,7 @@ func TestCompleteLogin(t *testing.T) {
 	}
 
 	submitWebAuthnLogin := func(t *testing.T, isSPA bool, id *identity.Identity, contextFixture []byte, cb func(values url.Values), opts ...testhelpers.InitFlowWithOption) (string, *http.Response, *kratos.LoginFlow) {
-		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 		return submitWebAuthnLoginWithClient(t, isSPA, id, contextFixture, browserClient, cb, opts...)
 	}
 
@@ -163,19 +168,30 @@ func TestCompleteLogin(t *testing.T) {
 			conf.MustSet(ctx, config.ViperKeySessionWhoAmIAAL, nil)
 		})
 
-		run := func(t *testing.T, id *identity.Identity, context, response []byte, isSPA bool, expectedAAL identity.AuthenticatorAssuranceLevel) {
+		run := func(t *testing.T, id *identity.Identity, context, response []byte, isSPA bool, expectedAAL identity.AuthenticatorAssuranceLevel, expectTriggers bool) {
 			body, res, f := submitWebAuthnLogin(t, isSPA, id, context, func(values url.Values) {
 				values.Set("identifier", loginFixtureSuccessEmail)
 				values.Set(node.WebAuthnLogin, string(response))
-			}, testhelpers.InitFlowWithRefresh())
+			},
+				testhelpers.InitFlowWithRefresh(),
+				testhelpers.InitFlowWithAAL(expectedAAL),
+			)
 			snapshotx.SnapshotTExcept(t, f.Ui.Nodes, []string{
 				"0.attributes.value",
-				"2.attributes.onclick",
-				"4.attributes.nonce",
-				"4.attributes.src",
+				"3.attributes.nonce",
+				"3.attributes.src",
+				"4.attributes.value",
+				"4.attributes.onclick",
 			})
+
 			nodes, err := json.Marshal(f.Ui.Nodes)
 			require.NoError(t, err)
+
+			if !expectTriggers {
+				assert.Falsef(t, gjson.GetBytes(nodes, "#(attributes.name==identifier)").Exists(), "%s", nodes)
+				return
+			}
+
 			assert.Equal(t, loginFixtureSuccessEmail, gjson.GetBytes(nodes, "#(attributes.name==identifier).attributes.value").String(), "%s", nodes)
 
 			prefix := ""
@@ -208,40 +224,44 @@ func TestCompleteLogin(t *testing.T) {
 				}
 
 				for _, tc := range []struct {
-					creds    identity.Credentials
-					response []byte
-					context  []byte
-					descript string
+					creds          identity.Credentials
+					response       []byte
+					context        []byte
+					descript       string
+					expectTriggers bool
 				}{
 					{
 						creds: identity.Credentials{
 							Config:  loginFixtureSuccessV0Credentials,
 							Version: 0,
 						},
-						context:  loginFixtureSuccessV0Context,
-						response: loginFixtureSuccessV0Response,
-						descript: "mfa v0 credentials",
+						context:        loginFixtureSuccessV0Context,
+						response:       loginFixtureSuccessV0Response,
+						descript:       "mfa v0 credentials",
+						expectTriggers: !e,
 					},
 					{
 						creds: identity.Credentials{
 							Config:  loginFixtureSuccessV1Credentials,
 							Version: 1,
 						},
-						context:  loginFixtureSuccessV1Context,
-						response: loginFixtureSuccessV1Response,
-						descript: "mfa v1 credentials",
+						context:        loginFixtureSuccessV1Context,
+						response:       loginFixtureSuccessV1Response,
+						descript:       "mfa v1 credentials",
+						expectTriggers: !e,
 					},
 					{
 						creds: identity.Credentials{
 							Config:  loginFixtureSuccessV1PasswordlessCredentials,
 							Version: 1,
 						},
-						context:  loginFixtureSuccessV1PasswordlessContext,
-						response: loginFixtureSuccessV1PasswordlessResponse,
-						descript: "passwordless credentials",
+						context:        loginFixtureSuccessV1PasswordlessContext,
+						response:       loginFixtureSuccessV1PasswordlessResponse,
+						descript:       "passwordless credentials",
+						expectTriggers: e,
 					},
 				} {
-					t.Run(fmt.Sprintf("case=mfa v0 credentials/passwordless enabled=%v", e), func(t *testing.T) {
+					t.Run(fmt.Sprintf("passwordless enabled=%v/case=%s", e, tc.descript), func(t *testing.T) {
 						id := createIdentityWithWebAuthn(t, tc.creds)
 
 						for _, f := range []string{
@@ -249,7 +269,7 @@ func TestCompleteLogin(t *testing.T) {
 							"spa",
 						} {
 							t.Run(f, func(t *testing.T) {
-								run(t, id, tc.context, tc.response, f == "spa", expectedAAL)
+								run(t, id, tc.context, tc.response, f == "spa", expectedAAL, tc.expectTriggers)
 							})
 						}
 					})
@@ -264,7 +284,8 @@ func TestCompleteLogin(t *testing.T) {
 					for _, f := range []string{"browser", "spa"} {
 						t.Run(f, func(t *testing.T) {
 							id := identity.NewIdentity("")
-							client := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+							id.NID = x.NewUUID()
+							client := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 
 							f := testhelpers.InitializeLoginFlowViaBrowser(t, client, publicTS, true, f == "spa", false, false)
 							snapshotx.SnapshotTExcept(t, f.Ui.Nodes, []string{
@@ -317,7 +338,7 @@ func TestCompleteLogin(t *testing.T) {
 		})
 
 		t.Run("case=webauthn shows error if user tries to sign in but user has no webauth credentials set up", func(t *testing.T) {
-			id, subject := createIdentityAndReturnIdentifier(t, reg, nil)
+			id, subject := createIdentityAndReturnIdentifier(t, ctx, reg, nil)
 			id.DeleteCredentialsType(identity.CredentialsTypeWebAuthn)
 			require.NoError(t, reg.IdentityManager().Update(ctx, id, identity.ManagerAllowWriteProtectedTraits))
 
@@ -344,7 +365,7 @@ func TestCompleteLogin(t *testing.T) {
 		})
 
 		t.Run("case=webauthn MFA credentials can not be used for passwordless login", func(t *testing.T) {
-			_, subject := createIdentityAndReturnIdentifier(t, reg, []byte(`{"credentials":[{"id":"Zm9vZm9v","is_passwordless":false}]}`))
+			_, subject := createIdentityAndReturnIdentifier(t, ctx, reg, []byte(`{"credentials":[{"id":"Zm9vZm9v","is_passwordless":false}]}`))
 
 			payload := func(v url.Values) {
 				v.Set("method", identity.CredentialsTypeWebAuthn.String())
@@ -369,7 +390,7 @@ func TestCompleteLogin(t *testing.T) {
 		})
 
 		t.Run("case=should fail if webauthn login is invalid", func(t *testing.T) {
-			_, subject := createIdentityAndReturnIdentifier(t, reg, []byte(`{"credentials":[{"id":"Zm9vZm9v","display_name":"foo","is_passwordless":true}]}`))
+			_, subject := createIdentityAndReturnIdentifier(t, ctx, reg, []byte(`{"credentials":[{"id":"Zm9vZm9v","display_name":"foo","is_passwordless":true}]}`))
 
 			doBrowserFlow := func(t *testing.T, spa bool, browserClient *http.Client, opts ...testhelpers.InitFlowWithOption) {
 				f := testhelpers.InitializeLoginFlowViaBrowser(t, browserClient, publicTS, false, spa, false, false, opts...)
@@ -446,6 +467,13 @@ func TestCompleteLogin(t *testing.T) {
 				actualFlow, err := reg.LoginFlowPersister().GetLoginFlow(context.Background(), uuid.FromStringOrNil(f.Id))
 				require.NoError(t, err)
 				assert.Empty(t, gjson.GetBytes(actualFlow.InternalContext, flow.PrefixInternalContextKey(identity.CredentialsTypeWebAuthn, webauthn.InternalContextKeySessionData)))
+
+				if spa {
+					assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(body, "continue_with.0.action").String(), "%s", body)
+					assert.Contains(t, gjson.Get(body, "continue_with.0.redirect_browser_to").String(), conf.SelfServiceBrowserDefaultReturnTo(ctx).String(), "%s", body)
+				} else {
+					assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
+				}
 			}
 
 			t.Run("type=browser", func(t *testing.T) {
@@ -460,25 +488,26 @@ func TestCompleteLogin(t *testing.T) {
 
 	t.Run("flow=mfa", func(t *testing.T) {
 		t.Run("case=webauthn payload is set when identity has webauthn", func(t *testing.T) {
-			id := createIdentity(t, reg)
+			id := createIdentity(t, ctx, reg)
 
-			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 			f := testhelpers.InitializeLoginFlowViaBrowser(t, apiClient, publicTS, false, true, false, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 			assert.Equal(t, gjson.GetBytes(id.Traits, "subject").String(), f.Ui.Nodes[1].Attributes.UiNodeInputAttributes.Value, jsonx.TestMarshalJSONString(t, f.Ui))
 			testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{
 				"0.attributes.value",
 				"1.attributes.value",
-				"2.attributes.onclick",
-				"2.attributes.onload",
-				"4.attributes.src",
-				"4.attributes.nonce",
+				"3.attributes.src",
+				"3.attributes.nonce",
+				"4.attributes.onclick",
+				"4.attributes.onload",
+				"4.attributes.value",
 			})
-			ensureReplacement(t, "2", f.Ui, "allowCredentials")
+			ensureReplacement(t, "4", f.Ui, "allowCredentials")
 		})
 
 		t.Run("case=webauthn payload is not set when identity has no webauthn", func(t *testing.T) {
 			id := createIdentityWithoutWebAuthn(t, reg)
-			apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+			apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 			f := testhelpers.InitializeLoginFlowViaBrowser(t, apiClient, publicTS, false, true, false, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 
 			testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{
@@ -487,23 +516,23 @@ func TestCompleteLogin(t *testing.T) {
 		})
 
 		t.Run("case=webauthn payload is not set for API clients", func(t *testing.T) {
-			id := createIdentity(t, reg)
+			id := createIdentity(t, ctx, reg)
 
-			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+			apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 			f := testhelpers.InitializeLoginFlowViaAPI(t, apiClient, publicTS, false, testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 			assertx.EqualAsJSON(t, nil, f.Ui.Nodes)
 		})
 
 		doAPIFlowSignedIn := func(t *testing.T, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-			return doAPIFlow(t, v, testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id), testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
+			return doAPIFlow(t, v, testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id), testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 		}
 
 		doBrowserFlowSignIn := func(t *testing.T, spa bool, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-			return doBrowserFlow(t, spa, v, testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id), testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
+			return doBrowserFlow(t, spa, v, testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id), testhelpers.InitFlowWithAAL(identity.AuthenticatorAssuranceLevel2))
 		}
 
 		t.Run("case=should refuse to execute api flow", func(t *testing.T) {
-			id := createIdentity(t, reg)
+			id := createIdentity(t, ctx, reg)
 			payload := func(v url.Values) {
 				v.Set(node.WebAuthnLogin, "{}")
 			}
@@ -515,7 +544,7 @@ func TestCompleteLogin(t *testing.T) {
 		})
 
 		t.Run("case=should fail if webauthn login is invalid", func(t *testing.T) {
-			id, sub := createIdentityAndReturnIdentifier(t, reg, nil)
+			id, sub := createIdentityAndReturnIdentifier(t, ctx, reg, nil)
 			payload := func(v url.Values) {
 				v.Set("identifier", sub)
 				v.Set(node.WebAuthnLogin, string(loginFixtureSuccessResponseInvalid))
@@ -615,3 +644,284 @@ func TestCompleteLogin(t *testing.T) {
 		})
 	})
 }
+
+func TestFormHydration(t *testing.T) {
+	ctx := context.Background()
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+
+	ctx = configtesthelpers.WithConfigValue(ctx, config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeWebAuthn)+".enabled", true)
+	ctx = configtesthelpers.WithConfigValue(
+		ctx,
+		config.ViperKeySelfServiceStrategyConfig+"."+string(identity.CredentialsTypeWebAuthn)+".config",
+		map[string]interface{}{
+			"rp": map[string]interface{}{
+				"display_name": "foo",
+				"id":           "localhost",
+				"origins":      []string{"http://localhost"},
+			},
+		},
+	)
+	ctx = testhelpers.WithDefaultIdentitySchema(ctx, "file://stub/login.schema.json")
+
+	s, err := reg.AllLoginStrategies().Strategy(identity.CredentialsTypeWebAuthn)
+	require.NoError(t, err)
+	fh, ok := s.(login.FormHydrator)
+	require.True(t, ok)
+
+	toSnapshot := func(t *testing.T, f *login.Flow) {
+		t.Helper()
+		// The CSRF token has a unique value that messes with the snapshot - ignore it.
+		f.UI.Nodes.ResetNodes("csrf_token")
+		f.UI.Nodes.ResetNodes("identifier")
+		f.UI.Nodes.ResetNodes("webauthn_login_trigger")
+		snapshotx.SnapshotT(t, f.UI.Nodes, snapshotx.ExceptNestedKeys("onclick", "nonce", "src"))
+	}
+
+	newFlow := func(ctx context.Context, t *testing.T) (*http.Request, *login.Flow) {
+		r := httptest.NewRequest("GET", "/self-service/login/browser", nil)
+		r = r.WithContext(ctx)
+		t.Helper()
+		f, err := login.NewFlow(conf, time.Minute, "csrf_token", r, flow.TypeBrowser)
+		f.UI.Nodes = make(node.Nodes, 0)
+		require.NoError(t, err)
+		return r, f
+	}
+
+	passwordlessEnabled := configtesthelpers.WithConfigValue(ctx, config.ViperKeyWebAuthnPasswordless, true)
+	mfaEnabled := configtesthelpers.WithConfigValue(ctx, config.ViperKeyWebAuthnPasswordless, false)
+
+	t.Run("method=PopulateLoginMethodSecondFactor", func(t *testing.T) {
+		id := createIdentity(t, ctx, reg)
+		headers := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id).Transport.(*testhelpers.TransportWithHeader).GetHeader()
+		t.Run("case=passwordless enabled", func(t *testing.T) {
+			r, f := newFlow(passwordlessEnabled, t)
+
+			r.Header = headers
+			f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+
+			require.NoError(t, fh.PopulateLoginMethodSecondFactor(r, f))
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=mfa enabled", func(t *testing.T) {
+			r, f := newFlow(mfaEnabled, t)
+
+			r.Header = headers
+			f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+
+			require.NoError(t, fh.PopulateLoginMethodSecondFactor(r, f))
+			toSnapshot(t, f)
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodFirstFactor", func(t *testing.T) {
+		t.Run("case=passwordless enabled", func(t *testing.T) {
+			r, f := newFlow(passwordlessEnabled, t)
+			require.NoError(t, fh.PopulateLoginMethodFirstFactor(r, f))
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=mfa enabled", func(t *testing.T) {
+			r, f := newFlow(mfaEnabled, t)
+			require.NoError(t, fh.PopulateLoginMethodFirstFactor(r, f))
+			toSnapshot(t, f)
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodRefresh", func(t *testing.T) {
+		t.Run("case=passwordless enabled but user has no passwordless credentials", func(t *testing.T) {
+			id := createIdentity(t, ctx, reg)
+			r, f := newFlow(passwordlessEnabled, t)
+			r.Header = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id).Transport.(*testhelpers.TransportWithHeader).GetHeader()
+			f.Refresh = true
+			require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=passwordless enabled and user has passwordless credentials", func(t *testing.T) {
+			id, _ := createIdentityAndReturnIdentifier(t, ctx, reg, []byte(`{"credentials":[{"id":"Zm9vZm9v","display_name":"foo","is_passwordless":true}]}`))
+			r, f := newFlow(passwordlessEnabled, t)
+			r.Header = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id).Transport.(*testhelpers.TransportWithHeader).GetHeader()
+			f.Refresh = true
+			require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=mfa enabled and user has mfa credentials", func(t *testing.T) {
+			id := createIdentity(t, ctx, reg)
+			r, f := newFlow(mfaEnabled, t)
+			r.Header = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id).Transport.(*testhelpers.TransportWithHeader).GetHeader()
+			f.Refresh = true
+			f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+			require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=mfa enabled but user has passwordless credentials", func(t *testing.T) {
+			id, _ := createIdentityAndReturnIdentifier(t, ctx, reg, []byte(`{"credentials":[{"id":"Zm9vZm9v","display_name":"foo","is_passwordless":true}]}`))
+			r, f := newFlow(mfaEnabled, t)
+			r.Header = testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id).Transport.(*testhelpers.TransportWithHeader).GetHeader()
+			f.Refresh = true
+			f.RequestedAAL = identity.AuthenticatorAssuranceLevel2
+			require.NoError(t, fh.PopulateLoginMethodFirstFactorRefresh(r, f))
+			toSnapshot(t, f)
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstCredentials", func(t *testing.T) {
+		t.Run("case=no options", func(t *testing.T) {
+			t.Run("case=passwordless enabled", func(t *testing.T) {
+				t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+					r, f := newFlow(
+						configtesthelpers.WithConfigValue(passwordlessEnabled, config.ViperKeySecurityAccountEnumerationMitigate, false),
+						t,
+					)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+
+				t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+					r, f := newFlow(
+						configtesthelpers.WithConfigValue(passwordlessEnabled, config.ViperKeySecurityAccountEnumerationMitigate, true),
+						t,
+					)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+			})
+
+			t.Run("case=mfa enabled", func(t *testing.T) {
+				t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+					r, f := newFlow(
+						configtesthelpers.WithConfigValue(mfaEnabled, config.ViperKeySecurityAccountEnumerationMitigate, false),
+						t,
+					)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+
+				t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+					r, f := newFlow(
+						configtesthelpers.WithConfigValue(mfaEnabled, config.ViperKeySecurityAccountEnumerationMitigate, true),
+						t,
+					)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+			})
+		})
+
+		t.Run("case=WithIdentifier", func(t *testing.T) {
+			t.Run("case=passwordless enabled", func(t *testing.T) {
+				t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+					r, f := newFlow(
+						configtesthelpers.WithConfigValue(passwordlessEnabled, config.ViperKeySecurityAccountEnumerationMitigate, false),
+						t,
+					)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+
+				t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+					r, f := newFlow(
+						configtesthelpers.WithConfigValue(passwordlessEnabled, config.ViperKeySecurityAccountEnumerationMitigate, true),
+						t,
+					)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+			})
+
+			t.Run("case=mfa enabled", func(t *testing.T) {
+				t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+					r, f := newFlow(
+						configtesthelpers.WithConfigValue(mfaEnabled, config.ViperKeySecurityAccountEnumerationMitigate, false),
+						t,
+					)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+
+				t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+					r, f := newFlow(
+						configtesthelpers.WithConfigValue(mfaEnabled, config.ViperKeySecurityAccountEnumerationMitigate, true),
+						t,
+					)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+			})
+		})
+
+		t.Run("case=WithIdentityHint", func(t *testing.T) {
+			t.Run("case=account enumeration mitigation enabled", func(t *testing.T) {
+				mfaEnabled := configtesthelpers.WithConfigValue(mfaEnabled, config.ViperKeySecurityAccountEnumerationMitigate, true)
+				passwordlessEnabled := configtesthelpers.WithConfigValue(passwordlessEnabled, config.ViperKeySecurityAccountEnumerationMitigate, true)
+
+				id := identity.NewIdentity("test-provider")
+				t.Run("case=passwordless enabled", func(t *testing.T) {
+					r, f := newFlow(passwordlessEnabled, t)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+
+				t.Run("case=mfa enabled", func(t *testing.T) {
+					r, f := newFlow(mfaEnabled, t)
+					require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+					toSnapshot(t, f)
+				})
+			})
+
+			t.Run("case=account enumeration mitigation disabled", func(t *testing.T) {
+				mfaEnabled := configtesthelpers.WithConfigValue(mfaEnabled, config.ViperKeySecurityAccountEnumerationMitigate, false)
+				passwordlessEnabled := configtesthelpers.WithConfigValue(passwordlessEnabled, config.ViperKeySecurityAccountEnumerationMitigate, false)
+
+				id, _ := createIdentityAndReturnIdentifier(t, ctx, reg, []byte(`{"credentials":[{"id":"Zm9vZm9v","display_name":"foo","is_passwordless":true}]}`))
+
+				t.Run("case=identity has webauthn", func(t *testing.T) {
+					t.Run("case=passwordless enabled", func(t *testing.T) {
+						r, f := newFlow(passwordlessEnabled, t)
+						require.NoError(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)))
+						toSnapshot(t, f)
+					})
+
+					t.Run("case=mfa enabled", func(t *testing.T) {
+						r, f := newFlow(mfaEnabled, t)
+						require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+						toSnapshot(t, f)
+					})
+				})
+
+				t.Run("case=identity does not have a webauthn", func(t *testing.T) {
+					t.Run("case=passwordless enabled", func(t *testing.T) {
+						id := identity.NewIdentity("default")
+						r, f := newFlow(passwordlessEnabled, t)
+						require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+						toSnapshot(t, f)
+					})
+
+					t.Run("case=mfa enabled", func(t *testing.T) {
+						id := identity.NewIdentity("default")
+						r, f := newFlow(mfaEnabled, t)
+						require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentityHint(id)), idfirst.ErrNoCredentialsFound)
+						toSnapshot(t, f)
+					})
+				})
+			})
+		})
+	})
+
+	t.Run("method=PopulateLoginMethodIdentifierFirstIdentification", func(t *testing.T) {
+		t.Run("case=passwordless enabled", func(t *testing.T) {
+			r, f := newFlow(passwordlessEnabled, t)
+			require.NoError(t, fh.PopulateLoginMethodIdentifierFirstIdentification(r, f))
+			toSnapshot(t, f)
+		})
+
+		t.Run("case=mfa enabled", func(t *testing.T) {
+			r, f := newFlow(mfaEnabled, t)
+			require.NoError(t, fh.PopulateLoginMethodIdentifierFirstIdentification(r, f))
+			toSnapshot(t, f)
+		})
+	})
+}
diff --git a/selfservice/strategy/webauthn/registration.go b/selfservice/strategy/webauthn/registration.go
index 85cb3628e59d..fcba84ddcd42 100644
--- a/selfservice/strategy/webauthn/registration.go
+++ b/selfservice/strategy/webauthn/registration.go
@@ -8,6 +8,10 @@ import (
 	"net/http"
 	"strings"
 
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/ory/x/otelx"
+
 	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/pkg/errors"
@@ -69,16 +73,15 @@ type updateRegistrationFlowWithWebAuthnMethod struct {
 func (s *Strategy) RegisterRegistrationRoutes(_ *x.RouterPublic) {
 }
 
-func (s *Strategy) handleRegistrationError(_ http.ResponseWriter, r *http.Request, f *registration.Flow, p *updateRegistrationFlowWithWebAuthnMethod, err error) error {
+func (s *Strategy) handleRegistrationError(r *http.Request, f *registration.Flow, p updateRegistrationFlowWithWebAuthnMethod, err error) error {
 	if f != nil {
-		if p != nil {
-			for _, n := range container.NewFromJSON("", node.DefaultGroup, p.Traits, "traits").Nodes {
-				// we only set the value and not the whole field because we want to keep types from the initial form generation
-				f.UI.Nodes.SetValueAttribute(n.ID(), n.Attributes.GetValue())
-			}
+		for _, n := range container.NewFromJSON("", node.DefaultGroup, p.Traits, "traits").Nodes {
+			// we only set the value and not the whole field because we want to keep types from the initial form generation
+			f.UI.Nodes.SetValueAttribute(n.ID(), n.Attributes.GetValue())
 		}
 
 		f.UI.Nodes.SetValueAttribute(node.WebAuthnRegisterDisplayName, p.RegisterDisplayName)
+
 		if f.Type == flow.TypeBrowser {
 			f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
 		}
@@ -91,31 +94,34 @@ func (s *Strategy) decode(p *updateRegistrationFlowWithWebAuthnMethod, r *http.R
 	return registration.DecodeBody(p, r, s.hd, s.d.Config(), registrationSchema)
 }
 
-func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, regFlow *registration.Flow, i *identity.Identity) (err error) {
-	ctx := r.Context()
+func (s *Strategy) Register(_ http.ResponseWriter, r *http.Request, regFlow *registration.Flow, i *identity.Identity) (err error) {
+	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.webauthn.Strategy.Register")
+	defer otelx.End(span, &err)
 
-	if regFlow.Type != flow.TypeBrowser || !s.d.Config().WebAuthnForPasswordless(r.Context()) {
+	if regFlow.Type != flow.TypeBrowser || !s.d.Config().WebAuthnForPasswordless(ctx) {
+		span.SetAttributes(attribute.String("not_responsible_reason", "registration flow is not a browser flow or WebAuthn is not enabled"))
 		return flow.ErrStrategyNotResponsible
 	}
 
 	var p updateRegistrationFlowWithWebAuthnMethod
 	if err := s.decode(&p, r); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &p, err)
+		return s.handleRegistrationError(r, regFlow, p, err)
 	}
 
 	regFlow.TransientPayload = p.TransientPayload
 
 	if err := flow.EnsureCSRF(s.d, r, regFlow.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &p, err)
+		return s.handleRegistrationError(r, regFlow, p, err)
 	}
 
 	if len(p.Register) == 0 {
+		span.SetAttributes(attribute.String("not_responsible_reason", "register field is empty"))
 		return flow.ErrStrategyNotResponsible
 	}
 
 	p.Method = s.SettingsStrategyID()
 	if err := flow.MethodEnabledAndAllowed(ctx, regFlow.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &p, err)
+		return s.handleRegistrationError(r, regFlow, p, err)
 	}
 
 	if len(p.Traits) == 0 {
@@ -125,25 +131,25 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, regFlow *reg
 
 	webAuthnSession := gjson.GetBytes(regFlow.InternalContext, flow.PrefixInternalContextKey(s.ID(), InternalContextKeySessionData))
 	if !webAuthnSession.IsObject() {
-		return s.handleRegistrationError(w, r, regFlow, &p, errors.WithStack(
+		return s.handleRegistrationError(r, regFlow, p, errors.WithStack(
 			herodot.ErrInternalServerError.WithReasonf("Expected WebAuthN in internal context to be an object.")))
 	}
 
 	var webAuthnSess webauthn.SessionData
 	if err := json.Unmarshal([]byte(webAuthnSession.Raw), &webAuthnSess); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &p, errors.WithStack(
+		return s.handleRegistrationError(r, regFlow, p, errors.WithStack(
 			herodot.ErrInternalServerError.WithReasonf("Expected WebAuthN in internal context to be an object but got: %s", err)))
 	}
 
 	webAuthnResponse, err := protocol.ParseCredentialCreationResponseBody(strings.NewReader(p.Register))
 	if err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &p, errors.WithStack(
+		return s.handleRegistrationError(r, regFlow, p, errors.WithStack(
 			herodot.ErrBadRequest.WithReasonf("Unable to parse WebAuthn response: %s", err)))
 	}
 
-	web, err := webauthn.New(s.d.Config().WebAuthnConfig(r.Context()))
+	web, err := webauthn.New(s.d.Config().WebAuthnConfig(ctx))
 	if err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &p, errors.WithStack(
+		return s.handleRegistrationError(r, regFlow, p, errors.WithStack(
 			herodot.ErrInternalServerError.WithReasonf("Unable to get webAuthn config.").WithDebug(err.Error())))
 	}
 
@@ -152,7 +158,7 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, regFlow *reg
 		if devErr := new(protocol.Error); errors.As(err, &devErr) {
 			s.d.Logger().WithError(err).WithField("error_devinfo", devErr.DevInfo).Error("Failed to create WebAuthn credential")
 		}
-		return s.handleRegistrationError(w, r, regFlow, &p, errors.WithStack(
+		return s.handleRegistrationError(r, regFlow, p, errors.WithStack(
 			herodot.ErrInternalServerError.WithReasonf("Unable to create WebAuthn credential: %s", err)))
 	}
 
@@ -163,23 +169,23 @@ func (s *Strategy) Register(w http.ResponseWriter, r *http.Request, regFlow *reg
 		UserHandle:  webAuthnSess.UserID,
 	})
 	if err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &p, errors.WithStack(
+		return s.handleRegistrationError(r, regFlow, p, errors.WithStack(
 			herodot.ErrInternalServerError.WithReasonf("Unable to encode identity credentials.").WithDebug(err.Error())))
 	}
 
 	i.UpsertCredentialsConfig(s.ID(), credentialWebAuthnConfig, 1)
 	if err := s.validateCredentials(ctx, i); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &p, err)
+		return s.handleRegistrationError(r, regFlow, p, err)
 	}
 
 	// Remove the WebAuthn URL from the internal context now that it is set!
 	regFlow.InternalContext, err = sjson.DeleteBytes(regFlow.InternalContext, flow.PrefixInternalContextKey(s.ID(), InternalContextKeySessionData))
 	if err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &p, err)
+		return s.handleRegistrationError(r, regFlow, p, err)
 	}
 
 	if err := s.d.RegistrationFlowPersister().UpdateRegistrationFlow(ctx, regFlow); err != nil {
-		return s.handleRegistrationError(w, r, regFlow, &p, err)
+		return s.handleRegistrationError(r, regFlow, p, err)
 	}
 
 	return nil
@@ -192,7 +198,7 @@ func (s *Strategy) PopulateRegistrationMethod(r *http.Request, f *registration.F
 		return nil
 	}
 
-	ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(r.Context())
+	ds, err := s.d.Config().DefaultIdentityTraitsSchemaURL(ctx)
 	if err != nil {
 		return err
 	}
diff --git a/selfservice/strategy/webauthn/registration_test.go b/selfservice/strategy/webauthn/registration_test.go
index c0503b151ed8..8dd3e38bd036 100644
--- a/selfservice/strategy/webauthn/registration_test.go
+++ b/selfservice/strategy/webauthn/registration_test.go
@@ -145,6 +145,7 @@ func TestRegistration(t *testing.T) {
 				testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{
 					"2.attributes.value",
 					"5.attributes.onclick",
+					"5.attributes.value",
 					"6.attributes.nonce",
 					"6.attributes.src",
 				})
@@ -367,6 +368,13 @@ func TestRegistration(t *testing.T) {
 					i, _, err := reg.PrivilegedIdentityPool().FindByCredentialsIdentifier(context.Background(), identity.CredentialsTypeWebAuthn, email)
 					require.NoError(t, err)
 					assert.Equal(t, email, gjson.GetBytes(i.Traits, "username").String(), "%s", actual)
+
+					if f == "spa" {
+						assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(actual, "continue_with.0.action").String(), "%s", actual)
+						assert.Contains(t, gjson.Get(actual, "continue_with.0.redirect_browser_to").String(), redirNoSessionTS.URL+"/registration-return-ts", "%s", actual)
+					} else {
+						assert.Empty(t, gjson.Get(actual, "continue_with").Array(), "%s", actual)
+					}
 				})
 			}
 		})
diff --git a/selfservice/strategy/webauthn/settings.go b/selfservice/strategy/webauthn/settings.go
index 3626b3fbe61c..b488c136ac51 100644
--- a/selfservice/strategy/webauthn/settings.go
+++ b/selfservice/strategy/webauthn/settings.go
@@ -4,12 +4,17 @@
 package webauthn
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"net/http"
 	"strings"
 	"time"
 
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/ory/x/otelx"
+
 	"github.com/ory/kratos/text"
 	"github.com/ory/kratos/ui/node"
 	"github.com/ory/kratos/x/webauthnx"
@@ -98,36 +103,41 @@ func (p *updateSettingsFlowWithWebAuthnMethod) SetFlowID(rid uuid.UUID) {
 	p.Flow = rid.String()
 }
 
-func (s *Strategy) Settings(w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (*settings.UpdateContext, error) {
+func (s *Strategy) Settings(ctx context.Context, w http.ResponseWriter, r *http.Request, f *settings.Flow, ss *session.Session) (_ *settings.UpdateContext, err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.webauthn.Strategy.Settings")
+	defer otelx.End(span, &err)
+
 	if f.Type != flow.TypeBrowser {
+		span.SetAttributes(attribute.String("not_responsible_reason", "flow is not a browser flow"))
 		return nil, flow.ErrStrategyNotResponsible
 	}
 	var p updateSettingsFlowWithWebAuthnMethod
 	ctxUpdate, err := settings.PrepareUpdate(s.d, w, r, f, ss, settings.ContinuityKey(s.SettingsStrategyID()), &p)
 	if errors.Is(err, settings.ErrContinuePreviousAction) {
-		return ctxUpdate, s.continueSettingsFlow(w, r, ctxUpdate, &p)
+		return ctxUpdate, s.continueSettingsFlow(ctx, w, r, ctxUpdate, p)
 	} else if err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	if err := s.decodeSettingsFlow(r, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
-	if len(p.Register+p.Remove) > 0 {
+	if len(p.Register)+len(p.Remove) > 0 {
 		// This method has only two submit buttons
 		p.Method = s.SettingsStrategyID()
-		if err := flow.MethodEnabledAndAllowed(r.Context(), f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
-			return nil, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+		if err := flow.MethodEnabledAndAllowed(ctx, f.GetFlowName(), s.SettingsStrategyID(), p.Method, s.d); err != nil {
+			return nil, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 		}
 	} else {
+		span.SetAttributes(attribute.String("not_responsible_reason", "neither register nor remove is set"))
 		return nil, errors.WithStack(flow.ErrStrategyNotResponsible)
 	}
 
 	// This does not come from the payload!
 	p.Flow = ctxUpdate.Flow.ID.String()
-	if err := s.continueSettingsFlow(w, r, ctxUpdate, &p); err != nil {
-		return ctxUpdate, s.handleSettingsError(w, r, ctxUpdate, &p, err)
+	if err := s.continueSettingsFlow(ctx, w, r, ctxUpdate, p); err != nil {
+		return ctxUpdate, s.handleSettingsError(ctx, w, r, ctxUpdate, p, err)
 	}
 
 	return ctxUpdate, nil
@@ -140,6 +150,7 @@ func (s *Strategy) decodeSettingsFlow(r *http.Request, dest interface{}) error {
 	}
 
 	return decoderx.NewHTTP().Decode(r, dest, compiler,
+		decoderx.HTTPKeepRequestBody(true),
 		decoderx.HTTPDecoderAllowedMethods("POST", "GET"),
 		decoderx.HTTPDecoderSetValidatePayloads(true),
 		decoderx.HTTPDecoderJSONFollowsFormFormat(),
@@ -147,19 +158,20 @@ func (s *Strategy) decodeSettingsFlow(r *http.Request, dest interface{}) error {
 }
 
 func (s *Strategy) continueSettingsFlow(
+	ctx context.Context,
 	w http.ResponseWriter, r *http.Request,
-	ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithWebAuthnMethod,
+	ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithWebAuthnMethod,
 ) error {
 	if len(p.Register+p.Remove) > 0 {
-		if err := flow.MethodEnabledAndAllowed(r.Context(), flow.SettingsFlow, s.SettingsStrategyID(), s.SettingsStrategyID(), s.d); err != nil {
+		if err := flow.MethodEnabledAndAllowed(ctx, flow.SettingsFlow, s.SettingsStrategyID(), s.SettingsStrategyID(), s.d); err != nil {
 			return err
 		}
 
-		if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(r.Context()), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
+		if err := flow.EnsureCSRF(s.d, r, ctxUpdate.Flow.Type, s.d.Config().DisableAPIFlowEnforcement(ctx), s.d.GenerateCSRFToken, p.CSRFToken); err != nil {
 			return err
 		}
 
-		if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(r.Context())).Before(time.Now()) {
+		if ctxUpdate.Session.AuthenticatedAt.Add(s.d.Config().SelfServiceFlowSettingsPrivilegedSessionMaxAge(ctx)).Before(time.Now()) {
 			return errors.WithStack(settings.NewFlowNeedsReAuth())
 		}
 	} else {
@@ -167,16 +179,16 @@ func (s *Strategy) continueSettingsFlow(
 	}
 
 	if len(p.Register) > 0 {
-		return s.continueSettingsFlowAdd(r, ctxUpdate, p)
+		return s.continueSettingsFlowAdd(ctx, ctxUpdate, p)
 	} else if len(p.Remove) > 0 {
-		return s.continueSettingsFlowRemove(w, r, ctxUpdate, p)
+		return s.continueSettingsFlowRemove(ctx, w, r, ctxUpdate, p)
 	}
 
 	return errors.New("ended up in unexpected state")
 }
 
-func (s *Strategy) continueSettingsFlowRemove(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithWebAuthnMethod) error {
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.IdentityID)
+func (s *Strategy) continueSettingsFlowRemove(ctx context.Context, w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithWebAuthnMethod) error {
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.IdentityID)
 	if err != nil {
 		return err
 	}
@@ -205,13 +217,13 @@ func (s *Strategy) continueSettingsFlowRemove(w http.ResponseWriter, r *http.Req
 		return errors.WithStack(herodot.ErrBadRequest.WithReasonf("You tried to remove a WebAuthn credential which does not exist."))
 	}
 
-	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(r.Context(), i)
+	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(ctx, i)
 	if err != nil {
 		return err
 	}
 
 	if count < 2 && wasPasswordless {
-		return s.handleSettingsError(w, r, ctxUpdate, p, errors.WithStack(webauthnx.ErrNotEnoughCredentials))
+		return s.handleSettingsError(ctx, w, r, ctxUpdate, p, errors.WithStack(webauthnx.ErrNotEnoughCredentials))
 	}
 
 	if len(updated) == 0 {
@@ -231,7 +243,7 @@ func (s *Strategy) continueSettingsFlowRemove(w http.ResponseWriter, r *http.Req
 	return nil
 }
 
-func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithWebAuthnMethod) error {
+func (s *Strategy) continueSettingsFlowAdd(ctx context.Context, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithWebAuthnMethod) error {
 	webAuthnSession := gjson.GetBytes(ctxUpdate.Flow.InternalContext, flow.PrefixInternalContextKey(s.ID(), InternalContextKeySessionData))
 	if !webAuthnSession.IsObject() {
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Expected WebAuthN in internal context to be an object."))
@@ -247,7 +259,7 @@ func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.
 		return errors.WithStack(herodot.ErrBadRequest.WithReasonf("Unable to parse WebAuthn response: %s", err))
 	}
 
-	web, err := webauthn.New(s.d.Config().WebAuthnConfig(r.Context()))
+	web, err := webauthn.New(s.d.Config().WebAuthnConfig(ctx))
 	if err != nil {
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to get webAuthn config.").WithDebug(err.Error()))
 	}
@@ -257,7 +269,7 @@ func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to create WebAuthn credential: %s", err))
 	}
 
-	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), ctxUpdate.Session.IdentityID)
+	i, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, ctxUpdate.Session.IdentityID)
 	if err != nil {
 		return err
 	}
@@ -269,10 +281,10 @@ func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.
 		return errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to decode identity credentials.").WithDebug(err.Error()))
 	}
 
-	wc := identity.CredentialFromWebAuthn(credential, s.d.Config().WebAuthnForPasswordless(r.Context()))
+	wc := identity.CredentialFromWebAuthn(credential, s.d.Config().WebAuthnForPasswordless(ctx))
 	wc.AddedAt = time.Now().UTC().Round(time.Second)
 	wc.DisplayName = p.RegisterDisplayName
-	wc.IsPasswordless = s.d.Config().WebAuthnForPasswordless(r.Context())
+	wc.IsPasswordless = s.d.Config().WebAuthnForPasswordless(ctx)
 	cc.UserHandle = ctxUpdate.Session.IdentityID[:]
 
 	cc.Credentials = append(cc.Credentials, *wc)
@@ -282,7 +294,7 @@ func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.
 	}
 
 	i.UpsertCredentialsConfig(s.ID(), co, 1)
-	if err := s.validateCredentials(r.Context(), i); err != nil {
+	if err := s.validateCredentials(ctx, i); err != nil {
 		return err
 	}
 
@@ -292,17 +304,17 @@ func (s *Strategy) continueSettingsFlowAdd(r *http.Request, ctxUpdate *settings.
 		return err
 	}
 
-	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(r.Context(), ctxUpdate.Flow); err != nil {
+	if err := s.d.SettingsFlowPersister().UpdateSettingsFlow(ctx, ctxUpdate.Flow); err != nil {
 		return err
 	}
 
 	aal := identity.AuthenticatorAssuranceLevel1
-	if !s.d.Config().WebAuthnForPasswordless(r.Context()) {
+	if !s.d.Config().WebAuthnForPasswordless(ctx) {
 		aal = identity.AuthenticatorAssuranceLevel2
 	}
 
 	// Since we added the method, it also means that we have authenticated it
-	if err := s.d.SessionManager().SessionAddAuthenticationMethods(r.Context(), ctxUpdate.Session.ID, session.AuthenticationMethod{
+	if err := s.d.SessionManager().SessionAddAuthenticationMethods(ctx, ctxUpdate.Session.ID, session.AuthenticationMethod{
 		Method: s.ID(),
 		AAL:    aal,
 	}); err != nil {
@@ -327,24 +339,21 @@ func (s *Strategy) identityListWebAuthn(id *identity.Identity) (*identity.Creden
 	return &cc, nil
 }
 
-func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity, f *settings.Flow) error {
+func (s *Strategy) PopulateSettingsMethod(ctx context.Context, r *http.Request, id *identity.Identity, f *settings.Flow) (err error) {
+	ctx, span := s.d.Tracer(ctx).Tracer().Start(ctx, "selfservice.strategy.webauthn.Strategy.PopulateSettingsMethod")
+	defer otelx.End(span, &err)
+
 	if f.Type != flow.TypeBrowser {
 		return nil
 	}
 
 	f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
-
-	confidentialIdentity, err := s.d.PrivilegedIdentityPool().GetIdentityConfidential(r.Context(), id.ID)
-	if err != nil {
-		return err
-	}
-
-	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(r.Context(), confidentialIdentity)
+	count, err := s.d.IdentityManager().CountActiveFirstFactorCredentials(ctx, id)
 	if err != nil {
 		return err
 	}
 
-	if webAuthns, err := s.identityListWebAuthn(confidentialIdentity); errors.Is(err, sqlcon.ErrNoRows) {
+	if webAuthns, err := s.identityListWebAuthn(id); errors.Is(err, sqlcon.ErrNoRows) {
 		// Do nothing
 	} else if err != nil {
 		return err
@@ -360,7 +369,7 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 		}
 	}
 
-	web, err := webauthn.New(s.d.Config().WebAuthnConfig(r.Context()))
+	web, err := webauthn.New(s.d.Config().WebAuthnConfig(ctx))
 	if err != nil {
 		return errors.WithStack(err)
 	}
@@ -380,7 +389,7 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 		return errors.WithStack(err)
 	}
 
-	f.UI.Nodes.Upsert(webauthnx.NewWebAuthnScript(s.d.Config().SelfPublicURL(r.Context())))
+	f.UI.Nodes.Upsert(webauthnx.NewWebAuthnScript(s.d.Config().SelfPublicURL(ctx)))
 	f.UI.Nodes.Upsert(webauthnx.NewWebAuthnConnectionName())
 	f.UI.Nodes.Upsert(webauthnx.NewWebAuthnConnectionTrigger(string(injectWebAuthnOptions)).
 		WithMetaLabel(text.NewInfoSelfServiceSettingsRegisterWebAuthn()))
@@ -388,10 +397,10 @@ func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity
 	return nil
 }
 
-func (s *Strategy) handleSettingsError(w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p *updateSettingsFlowWithWebAuthnMethod, err error) error {
+func (s *Strategy) handleSettingsError(ctx context.Context, w http.ResponseWriter, r *http.Request, ctxUpdate *settings.UpdateContext, p updateSettingsFlowWithWebAuthnMethod, err error) error {
 	// Do not pause flow if the flow type is an API flow as we can't save cookies in those flows.
 	if e := new(settings.FlowNeedsReAuth); errors.As(err, &e) && ctxUpdate.Flow != nil && ctxUpdate.Flow.Type == flow.TypeBrowser {
-		if err := s.d.ContinuityManager().Pause(r.Context(), w, r, settings.ContinuityKey(s.SettingsStrategyID()), settings.ContinuityOptions(p, ctxUpdate.GetSessionIdentity())...); err != nil {
+		if err := s.d.ContinuityManager().Pause(ctx, w, r, settings.ContinuityKey(s.SettingsStrategyID()), settings.ContinuityOptions(p, ctxUpdate.GetSessionIdentity())...); err != nil {
 			return err
 		}
 	}
diff --git a/selfservice/strategy/webauthn/settings_test.go b/selfservice/strategy/webauthn/settings_test.go
index acf4fd357b1d..bf37258d5706 100644
--- a/selfservice/strategy/webauthn/settings_test.go
+++ b/selfservice/strategy/webauthn/settings_test.go
@@ -53,19 +53,21 @@ var settingsFixtureSuccessInternalContext []byte
 const registerDisplayNameGJSONQuery = "ui.nodes.#(attributes.name==" + node.WebAuthnRegisterDisplayName + ")"
 
 func createIdentityWithoutWebAuthn(t *testing.T, reg driver.Registry) *identity.Identity {
-	id := createIdentity(t, reg)
+	id := createIdentity(t, ctx, reg)
 	delete(id.Credentials, identity.CredentialsTypeWebAuthn)
 	require.NoError(t, reg.PrivilegedIdentityPool().UpdateIdentity(context.Background(), id))
 	return id
 }
 
-func createIdentityAndReturnIdentifier(t *testing.T, reg driver.Registry, conf []byte) (*identity.Identity, string) {
+func createIdentityAndReturnIdentifier(t *testing.T, ctx context.Context, reg driver.Registry, conf []byte) (*identity.Identity, string) {
 	identifier := x.NewUUID().String() + "@ory.sh"
 	password := x.NewUUID().String()
-	p, err := reg.Hasher(ctx).Generate(context.Background(), []byte(password))
+	p, err := reg.Hasher(ctx).Generate(ctx, []byte(password))
 	require.NoError(t, err)
 	i := &identity.Identity{
-		Traits: identity.Traits(fmt.Sprintf(`{"subject":"%s"}`, identifier)),
+		SchemaID: "default",
+		NID:      uuid.Must(uuid.NewV4()),
+		Traits:   identity.Traits(fmt.Sprintf(`{"subject":"%s"}`, identifier)),
 		VerifiableAddresses: []identity.VerifiableAddress{
 			{
 				Value:     identifier,
@@ -77,7 +79,7 @@ func createIdentityAndReturnIdentifier(t *testing.T, reg driver.Registry, conf [
 	if conf == nil {
 		conf = []byte(`{"credentials":[{"id":"Zm9vZm9v","display_name":"foo"},{"id":"YmFyYmFy","display_name":"bar"}]}`)
 	}
-	require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), i))
+	require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(ctx, i))
 	i.Credentials = map[identity.CredentialsType]identity.Credentials{
 		identity.CredentialsTypePassword: {
 			Type:        identity.CredentialsTypePassword,
@@ -90,12 +92,12 @@ func createIdentityAndReturnIdentifier(t *testing.T, reg driver.Registry, conf [
 			Config:      conf,
 		},
 	}
-	require.NoError(t, reg.PrivilegedIdentityPool().UpdateIdentity(context.Background(), i))
+	require.NoError(t, reg.PrivilegedIdentityPool().UpdateIdentity(ctx, i))
 	return i, identifier
 }
 
-func createIdentity(t *testing.T, reg driver.Registry) *identity.Identity {
-	id, _ := createIdentityAndReturnIdentifier(t, reg, nil)
+func createIdentity(t *testing.T, ctx context.Context, reg driver.Registry) *identity.Identity {
+	id, _ := createIdentityAndReturnIdentifier(t, ctx, reg, nil)
 	return id
 }
 
@@ -136,48 +138,50 @@ func TestCompleteSettings(t *testing.T) {
 	conf.MustSet(ctx, config.ViperKeySecretsDefault, []string{"not-a-secure-session-key"})
 
 	t.Run("case=a device is shown which can be unlinked", func(t *testing.T) {
-		id := createIdentity(t, reg)
+		id := createIdentity(t, ctx, reg)
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaBrowser(t, apiClient, true, publicTS)
 
 		testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{
 			"0.attributes.value",
-			"4.attributes.onclick",
+			"5.attributes.onclick",
+			"5.attributes.value",
 			"6.attributes.src",
 			"6.attributes.nonce",
 		})
-		ensureReplacement(t, "4", f.Ui, "Ory Corp")
+		ensureReplacement(t, "5", f.Ui, "Ory Corp")
 	})
 
 	t.Run("case=one activation element is shown", func(t *testing.T) {
 		id := createIdentityWithoutWebAuthn(t, reg)
 		require.NoError(t, reg.PrivilegedIdentityPool().UpdateIdentity(context.Background(), id))
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaBrowser(t, apiClient, true, publicTS)
 
 		testhelpers.SnapshotTExcept(t, f.Ui.Nodes, []string{
 			"0.attributes.value",
-			"2.attributes.onload",
-			"2.attributes.onclick",
+			"3.attributes.onload",
+			"3.attributes.onclick",
+			"3.attributes.value",
 			"4.attributes.src",
 			"4.attributes.nonce",
 		})
-		ensureReplacement(t, "2", f.Ui, "Ory Corp")
+		ensureReplacement(t, "3", f.Ui, "Ory Corp")
 	})
 
 	t.Run("case=webauthn only works for browsers", func(t *testing.T) {
 		id := createIdentityWithoutWebAuthn(t, reg)
 		require.NoError(t, reg.PrivilegedIdentityPool().UpdateIdentity(context.Background(), id))
 
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 		assert.Empty(t, f.Ui.Nodes)
 	})
 
 	doAPIFlow := func(t *testing.T, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, reg, id)
+		apiClient := testhelpers.NewHTTPClientWithIdentitySessionToken(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaAPI(t, apiClient, publicTS)
 		values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 		v(values)
@@ -186,7 +190,7 @@ func TestCompleteSettings(t *testing.T) {
 	}
 
 	doBrowserFlow := func(t *testing.T, spa bool, v func(url.Values), id *identity.Identity) (string, *http.Response) {
-		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, id)
+		browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, id)
 		f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, spa, publicTS)
 		values := testhelpers.SDKFormFieldsToURLValues(f.Ui.Nodes)
 		v(values)
@@ -313,8 +317,9 @@ func TestCompleteSettings(t *testing.T) {
 			// We load our identity which we will use to replay the webauth session
 			var id identity.Identity
 			require.NoError(t, json.Unmarshal(settingsFixtureSuccessIdentity, &id))
+			id.NID = uuid.Must(uuid.NewV4())
 			_ = reg.PrivilegedIdentityPool().DeleteIdentity(context.Background(), id.ID)
-			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, &id)
+			browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, &id)
 			f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, spa, publicTS)
 
 			// We inject the session to replay
@@ -329,6 +334,7 @@ func TestCompleteSettings(t *testing.T) {
 			values.Set(node.WebAuthnRegister, string(settingsFixtureSuccessResponse))
 			values.Set(node.WebAuthnRegisterDisplayName, "foobar")
 			body, res := testhelpers.SettingsMakeRequest(t, false, spa, f, browserClient, testhelpers.EncodeFormAsJSON(t, spa, values))
+			require.Equal(t, http.StatusOK, res.StatusCode, body)
 
 			if spa {
 				assert.Contains(t, res.Request.URL.String(), publicTS.URL+settings.RouteSubmitFlow)
@@ -340,7 +346,7 @@ func TestCompleteSettings(t *testing.T) {
 			actual, err := reg.Persister().GetIdentityConfidential(context.Background(), id.ID)
 			require.NoError(t, err)
 			cred, ok := actual.GetCredentials(identity.CredentialsTypeWebAuthn)
-			assert.True(t, ok)
+			require.True(t, ok)
 			assert.Len(t, gjson.GetBytes(cred.Config, "credentials").Array(), 1)
 
 			actualFlow, err := reg.SettingsFlowPersister().GetSettingsFlow(context.Background(), uuid.FromStringOrNil(f.Id))
@@ -367,7 +373,7 @@ func TestCompleteSettings(t *testing.T) {
 		})
 
 		run := func(t *testing.T, spa bool) {
-			id := createIdentity(t, reg)
+			id := createIdentity(t, ctx, reg)
 			id.DeleteCredentialsType(identity.CredentialsTypePassword)
 			conf := sqlxx.JSONRawMessage(`{"credentials":[{"id":"Zm9vZm9v","display_name":"foo","is_passwordless":true}]}`)
 			id.UpsertCredentialsConfig(identity.CredentialsTypeWebAuthn, conf, 0)
@@ -375,7 +381,7 @@ func TestCompleteSettings(t *testing.T) {
 
 			body, res := doBrowserFlow(t, spa, func(v url.Values) {
 				// The remove key should be empty
-				snapshotx.SnapshotTExcept(t, v, []string{"csrf_token"})
+				snapshotx.SnapshotTExcept(t, v, []string{"csrf_token", "webauthn_register_trigger"})
 
 				v.Set(node.WebAuthnRemove, "666f6f666f6f")
 			}, id)
@@ -409,14 +415,17 @@ func TestCompleteSettings(t *testing.T) {
 
 	t.Run("case=possible to remove webauthn credential if it is MFA at all times", func(t *testing.T) {
 		run := func(t *testing.T, spa bool) {
-			id := createIdentity(t, reg)
+			id := createIdentity(t, ctx, reg)
 			id.DeleteCredentialsType(identity.CredentialsTypePassword)
 			id.UpsertCredentialsConfig(identity.CredentialsTypeWebAuthn, sqlxx.JSONRawMessage(`{"credentials":[{"id":"Zm9vZm9v","display_name":"foo","is_passwordless":false}]}`), 0)
 			require.NoError(t, reg.IdentityManager().Update(ctx, id, identity.ManagerAllowWriteProtectedTraits))
 
 			body, res := doBrowserFlow(t, spa, func(v url.Values) {
 				// The remove key should be set
-				snapshotx.SnapshotTExcept(t, v, []string{"csrf_token"})
+				snapshotx.SnapshotTExcept(t, v, []string{
+					"csrf_token",
+					"webauthn_register_trigger",
+				})
 				v.Set(node.WebAuthnRemove, "666f6f666f6f")
 			}, id)
 
@@ -446,7 +455,7 @@ func TestCompleteSettings(t *testing.T) {
 
 	t.Run("case=remove all security keys", func(t *testing.T) {
 		run := func(t *testing.T, spa bool) {
-			id := createIdentity(t, reg)
+			id := createIdentity(t, ctx, reg)
 			allCred, ok := id.GetCredentials(identity.CredentialsTypeWebAuthn)
 			assert.True(t, ok)
 
@@ -465,6 +474,13 @@ func TestCompleteSettings(t *testing.T) {
 					assert.Contains(t, res.Request.URL.String(), uiTS.URL)
 				}
 				assert.EqualValues(t, flow.StateSuccess, gjson.Get(body, "state").String(), body)
+
+				if spa {
+					assert.EqualValues(t, flow.ContinueWithActionRedirectBrowserToString, gjson.Get(body, "continue_with.0.action").String(), "%s", body)
+					assert.Contains(t, gjson.Get(body, "continue_with.0.redirect_browser_to").String(), uiTS.URL, "%s", body)
+				} else {
+					assert.Empty(t, gjson.Get(body, "continue_with").Array(), "%s", body)
+				}
 			}
 
 			actual, err := reg.Persister().GetIdentityConfidential(context.Background(), id.ID)
@@ -487,7 +503,7 @@ func TestCompleteSettings(t *testing.T) {
 
 	t.Run("case=fails with browser submit register payload is invalid", func(t *testing.T) {
 		run := func(t *testing.T, spa bool) {
-			id := createIdentity(t, reg)
+			id := createIdentity(t, ctx, reg)
 			body, res := doBrowserFlow(t, spa, func(v url.Values) {
 				v.Set(node.WebAuthnRemove, fmt.Sprintf("%x", []byte("foofoo")))
 			}, id)
@@ -524,9 +540,10 @@ func TestCompleteSettings(t *testing.T) {
 				isSPA := f == "spa"
 
 				var id identity.Identity
+				id.NID = uuid.Must(uuid.NewV4())
 				require.NoError(t, json.Unmarshal(settingsFixtureSuccessIdentity, &id))
 				_ = reg.PrivilegedIdentityPool().DeleteIdentity(context.Background(), id.ID)
-				browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, &id)
+				browserClient := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, ctx, reg, &id)
 				f := testhelpers.InitializeSettingsFlowViaBrowser(t, browserClient, isSPA, publicTS)
 
 				// We inject the session to replay
diff --git a/selfservice/strategy/webauthn/strategy.go b/selfservice/strategy/webauthn/strategy.go
index 998490055996..82a0b7df9b2a 100644
--- a/selfservice/strategy/webauthn/strategy.go
+++ b/selfservice/strategy/webauthn/strategy.go
@@ -6,6 +6,7 @@ package webauthn
 import (
 	"context"
 	"encoding/json"
+	"strings"
 
 	"github.com/pkg/errors"
 
@@ -34,6 +35,7 @@ type webauthnStrategyDependencies interface {
 	x.WriterProvider
 	x.CSRFTokenGeneratorProvider
 	x.CSRFProvider
+	x.TracingProvider
 
 	config.Provider
 
@@ -80,26 +82,37 @@ func NewStrategy(d any) *Strategy {
 	}
 }
 
-func (s *Strategy) CountActiveMultiFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveMultiFactorCredentials(_ context.Context, cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	return s.countCredentials(cc, false)
 }
 
-func (s *Strategy) CountActiveFirstFactorCredentials(cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
+func (s *Strategy) CountActiveFirstFactorCredentials(_ context.Context, cc map[identity.CredentialsType]identity.Credentials) (count int, err error) {
 	return s.countCredentials(cc, true)
 }
 
-func (s *Strategy) countCredentials(cc map[identity.CredentialsType]identity.Credentials, passwordless bool) (count int, err error) {
+func (s *Strategy) countCredentials(cc map[identity.CredentialsType]identity.Credentials, onlyPasswordlessCredentials bool) (count int, err error) {
 	for _, c := range cc {
-		if c.Type == s.ID() && len(c.Config) > 0 && len(c.Identifiers) > 0 {
+		if c.Type == s.ID() && len(c.Config) > 0 {
 			var conf identity.CredentialsWebAuthnConfig
 			if err = json.Unmarshal(c.Config, &conf); err != nil {
 				return 0, errors.WithStack(err)
 			}
 
-			for _, c := range conf.Credentials {
-				if c.IsPasswordless == passwordless {
-					count++
+			for _, cred := range conf.Credentials {
+				if cred.IsPasswordless && len(strings.Join(c.Identifiers, "")) == 0 {
+					// If this is a passwordless credential, it will only work if the identifier is set, as
+					// we use the identifier to look up the identity. If the identifier is not set, we can
+					// assume that the user can't sign in using this method.
+					continue
 				}
+
+				if cred.IsPasswordless != onlyPasswordlessCredentials {
+					continue
+				}
+
+				// If the credential is passwordless and we require passwordless credentials, or if the credential is not
+				// passwordless and we require non-passwordless credentials, we count it.
+				count++
 			}
 		}
 	}
@@ -114,7 +127,7 @@ func (s *Strategy) NodeGroup() node.UiNodeGroup {
 	return node.WebAuthnGroup
 }
 
-func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context, _ session.AuthenticationMethods) session.AuthenticationMethod {
+func (s *Strategy) CompletedAuthenticationMethod(ctx context.Context) session.AuthenticationMethod {
 	aal := identity.AuthenticatorAssuranceLevel1
 	if !s.d.Config().WebAuthnForPasswordless(ctx) {
 		aal = identity.AuthenticatorAssuranceLevel2
diff --git a/selfservice/strategy/webauthn/strategy_test.go b/selfservice/strategy/webauthn/strategy_test.go
index cc5f6fafb475..5ce70310d9e9 100644
--- a/selfservice/strategy/webauthn/strategy_test.go
+++ b/selfservice/strategy/webauthn/strategy_test.go
@@ -26,13 +26,13 @@ func TestCompletedAuthenticationMethod(t *testing.T) {
 	assert.Equal(t, session.AuthenticationMethod{
 		Method: strategy.ID(),
 		AAL:    identity.AuthenticatorAssuranceLevel2,
-	}, strategy.CompletedAuthenticationMethod(context.Background(), session.AuthenticationMethods{}))
+	}, strategy.CompletedAuthenticationMethod(context.Background()))
 
 	conf.MustSet(ctx, config.ViperKeyWebAuthnPasswordless, true)
 	assert.Equal(t, session.AuthenticationMethod{
 		Method: strategy.ID(),
 		AAL:    identity.AuthenticatorAssuranceLevel1,
-	}, strategy.CompletedAuthenticationMethod(context.Background(), session.AuthenticationMethods{}))
+	}, strategy.CompletedAuthenticationMethod(context.Background()))
 }
 
 func TestCountActiveFirstFactorCredentials(t *testing.T) {
@@ -64,6 +64,14 @@ func TestCountActiveFirstFactorCredentials(t *testing.T) {
 			}},
 			expectedMulti: 1,
 		},
+		{
+			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+				Type:        strategy.ID(),
+				Identifiers: []string{}, // also works without identifier
+				Config:      []byte(`{"credentials": [{}]}`),
+			}},
+			expectedMulti: 1,
+		},
 		{
 			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
 				Type:        strategy.ID(),
@@ -72,6 +80,13 @@ func TestCountActiveFirstFactorCredentials(t *testing.T) {
 			}},
 			expectedFirst: 1,
 		},
+		{
+			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
+				Type:   strategy.ID(),
+				Config: []byte(`{"credentials": [{"is_passwordless": true}]}`),
+			}},
+			expectedFirst: 0, // missing identifier
+		},
 		{
 			in: map[identity.CredentialsType]identity.Credentials{strategy.ID(): {
 				Type:        strategy.ID(),
@@ -105,11 +120,11 @@ func TestCountActiveFirstFactorCredentials(t *testing.T) {
 				cc[c.Type] = c
 			}
 
-			actual, err := strategy.CountActiveFirstFactorCredentials(cc)
+			actual, err := strategy.CountActiveFirstFactorCredentials(ctx, cc)
 			require.NoError(t, err)
 			assert.Equal(t, tc.expectedFirst, actual)
 
-			actual, err = strategy.CountActiveMultiFactorCredentials(cc)
+			actual, err = strategy.CountActiveMultiFactorCredentials(ctx, cc)
 			require.NoError(t, err)
 			assert.Equal(t, tc.expectedMulti, actual)
 		})
diff --git a/session/handler.go b/session/handler.go
index 5e75136ae894..818fab4e58a4 100644
--- a/session/handler.go
+++ b/session/handler.go
@@ -4,6 +4,7 @@
 package session
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 	"strconv"
@@ -233,7 +234,7 @@ func (h *Handler) whoami(w http.ResponseWriter, r *http.Request, _ httprouter.Pa
 	}
 
 	var aalErr *ErrAALNotSatisfied
-	if err := h.r.SessionManager().DoesSessionSatisfy(r, s, c.SessionWhoAmIAAL(ctx),
+	if err := h.r.SessionManager().DoesSessionSatisfy(ctx, s, c.SessionWhoAmIAAL(ctx),
 		// For the time being we want to update the AAL in the database if it is unset.
 		UpsertAAL,
 	); errors.As(err, &aalErr) {
@@ -421,13 +422,12 @@ func (h *Handler) adminListSessions(w http.ResponseWriter, r *http.Request, ps h
 		}
 	}
 
-	sess, total, nextPage, err := h.r.SessionPersister().ListSessions(r.Context(), active, opts, expandables)
+	sess, nextPage, err := h.r.SessionPersister().ListSessions(r.Context(), active, opts, expandables)
 	if err != nil {
 		h.r.Writer().WriteError(w, r, err)
 		return
 	}
 
-	w.Header().Set("x-total-count", fmt.Sprint(total))
 	u := *r.URL
 	keysetpagination.Header(w, &u, nextPage)
 	h.r.Writer().Write(w, r, sess)
@@ -845,9 +845,17 @@ func (h *Handler) listMySessions(w http.ResponseWriter, r *http.Request, _ httpr
 	h.r.Writer().Write(w, r, sess)
 }
 
+type sessionInContext int
+
+const (
+	sessionInContextKey sessionInContext = iota
+)
+
 func (h *Handler) IsAuthenticated(wrap httprouter.Handle, onUnauthenticated httprouter.Handle) httprouter.Handle {
 	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
-		if _, err := h.r.SessionManager().FetchFromRequest(r.Context(), r); err != nil {
+		ctx := r.Context()
+		sess, err := h.r.SessionManager().FetchFromRequest(ctx, r)
+		if err != nil {
 			if onUnauthenticated != nil {
 				onUnauthenticated(w, r, ps)
 				return
@@ -857,7 +865,7 @@ func (h *Handler) IsAuthenticated(wrap httprouter.Handle, onUnauthenticated http
 			return
 		}
 
-		wrap(w, r, ps)
+		wrap(w, r.WithContext(context.WithValue(ctx, sessionInContextKey, sess)), ps)
 	}
 }
 
diff --git a/session/handler_test.go b/session/handler_test.go
index 3c61b7764832..62385b8b37c2 100644
--- a/session/handler_test.go
+++ b/session/handler_test.go
@@ -253,7 +253,7 @@ func TestSessionWhoAmI(t *testing.T) {
 
 				i := identity.Identity{Traits: []byte("{}"), State: identity.StateActive}
 				require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &i))
-				s, err := session.NewActiveSession(&i, conf, time.Now(), identity.CredentialsTypePassword)
+				s, err := testhelpers.NewActiveSession(&i, conf, time.Now(), identity.CredentialsTypePassword)
 				require.NoError(t, err)
 				require.NoError(t, reg.SessionPersister().UpsertSession(context.Background(), s))
 				require.NotEmpty(t, s.Token)
@@ -560,7 +560,7 @@ func TestHandlerAdminSessionManagement(t *testing.T) {
 		})
 
 		t.Run("should redirect to public for whoami", func(t *testing.T) {
-			client := testhelpers.NewHTTPClientWithSessionToken(t, reg, s)
+			client := testhelpers.NewHTTPClientWithSessionToken(t, ctx, reg, s)
 			client.CheckRedirect = func(req *http.Request, via []*http.Request) error {
 				return http.ErrUseLastResponse
 			}
@@ -590,7 +590,6 @@ func TestHandlerAdminSessionManagement(t *testing.T) {
 			res, err := client.Do(req)
 			require.NoError(t, err)
 			assert.Equal(t, http.StatusOK, res.StatusCode)
-			assert.Equal(t, "1", res.Header.Get("X-Total-Count"))
 
 			assertPageToken(t, uuid.Nil.String(), res.Header.Get("Link"))
 
@@ -639,7 +638,6 @@ func TestHandlerAdminSessionManagement(t *testing.T) {
 					res, err := client.Do(req)
 					require.NoError(t, err)
 					assert.Equal(t, http.StatusOK, res.StatusCode)
-					assert.Equal(t, "1", res.Header.Get("X-Total-Count"))
 					assertPageToken(t, uuid.Nil.String(), res.Header.Get("Link"))
 
 					body := ioutilx.MustReadAll(res.Body)
@@ -812,7 +810,7 @@ func TestHandlerAdminSessionManagement(t *testing.T) {
 			t.Run(fmt.Sprintf("active=%#v", tc.activeOnly), func(t *testing.T) {
 				sessions, _, _ := reg.SessionPersister().ListSessionsByIdentity(ctx, i.ID, nil, 1, 10, uuid.Nil, ExpandEverything)
 				require.Equal(t, 5, len(sessions))
-				assert.True(t, sort.IsSorted(sort.Reverse(byAuthenticatedAt(sessions))))
+				assert.True(t, sort.IsSorted(sort.Reverse(byCreatedAt(sessions))))
 
 				reqURL := ts.URL + "/admin/identities/" + i.ID.String() + "/sessions"
 				if tc.activeOnly != "" {
@@ -830,9 +828,6 @@ func TestHandlerAdminSessionManagement(t *testing.T) {
 					actualSessionIds = append(actualSessionIds, s.ID)
 				}
 
-				totalCount, err := strconv.Atoi(res.Header.Get("X-Total-Count"))
-				require.NoError(t, err)
-				assert.Equal(t, len(tc.expectedSessionIds), totalCount)
 				assert.NotEqual(t, "", res.Header.Get("Link"))
 				assert.ElementsMatch(t, tc.expectedSessionIds, actualSessionIds)
 			})
@@ -895,9 +890,6 @@ func TestHandlerSelfServiceSessionManagement(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, http.StatusOK, res.StatusCode)
 
-		totalCount, err := strconv.Atoi(res.Header.Get("X-Total-Count"))
-		require.NoError(t, err)
-		require.Equal(t, numSessionsActive, totalCount)
 		require.NotEqual(t, "", res.Header.Get("Link"))
 	})
 
@@ -1088,10 +1080,10 @@ func TestHandlerRefreshSessionBySessionID(t *testing.T) {
 	})
 }
 
-type byAuthenticatedAt []Session
+type byCreatedAt []Session
 
-func (s byAuthenticatedAt) Len() int      { return len(s) }
-func (s byAuthenticatedAt) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
-func (s byAuthenticatedAt) Less(i, j int) bool {
-	return s[i].AuthenticatedAt.Before(s[j].AuthenticatedAt)
+func (s byCreatedAt) Len() int      { return len(s) }
+func (s byCreatedAt) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
+func (s byCreatedAt) Less(i, j int) bool {
+	return s[i].CreatedAt.Before(s[j].CreatedAt)
 }
diff --git a/session/manager.go b/session/manager.go
index d82cf002c5b4..e6409c21dfd9 100644
--- a/session/manager.go
+++ b/session/manager.go
@@ -7,6 +7,9 @@ import (
 	"context"
 	"net/http"
 	"net/url"
+	"time"
+
+	"github.com/ory/kratos/identity"
 
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/text"
@@ -130,11 +133,23 @@ type Manager interface {
 	// FetchFromRequest creates an HTTP session using cookies.
 	FetchFromRequest(context.Context, *http.Request) (*Session, error)
 
+	// FetchFromRequestContext returns the session from the context or if that is unset, falls back to FetchFromRequest.
+	FetchFromRequestContext(context.Context, *http.Request) (*Session, error)
+
 	// PurgeFromRequest removes an HTTP session.
 	PurgeFromRequest(context.Context, http.ResponseWriter, *http.Request) error
 
-	// DoesSessionSatisfy answers if a session is satisfying the AAL.
-	DoesSessionSatisfy(r *http.Request, sess *Session, requestedAAL string, opts ...ManagerOptions) error
+	// DoesSessionSatisfy answers if a session is satisfying the AAL of a user.
+	//
+	// The matcher value can be one of:
+	//
+	// - `highest_available`: If set requires the user to upgrade their session to the highest available AAL for that user.
+	// - `aal1`: Requires the user to have authenticated with at least one authentication factor.
+	//
+	// This method is implemented in such a way, that if a second factor is found for the user, it is always assumed
+	// that the user is able to authenticate with it. This means that if a user has a second factor, the user is always
+	// asked to authenticate with it if `highest_available` is set and the session's AAL is `aal1`.
+	DoesSessionSatisfy(ctx context.Context, sess *Session, matcher string, opts ...ManagerOptions) error
 
 	// SessionAddAuthenticationMethods adds one or more authentication method to the session.
 	SessionAddAuthenticationMethods(ctx context.Context, sid uuid.UUID, methods ...AuthenticationMethod) error
@@ -142,6 +157,13 @@ type Manager interface {
 	// MaybeRedirectAPICodeFlow for API+Code flows redirects the user to the return_to URL and adds the code query parameter.
 	// `handled` is true if the request a redirect was written, false otherwise.
 	MaybeRedirectAPICodeFlow(w http.ResponseWriter, r *http.Request, f flow.Flow, sessionID uuid.UUID, uiNode node.UiNodeGroup) (handled bool, err error)
+
+	// ActivateSession activates a session.
+	//
+	// This method is used to activate a session after a user authenticated with a first or second factor. It sets
+	// all computed values (e.g. authenticator assurance level) and updates the session object but does not store
+	// the session in the database or on the client device.
+	ActivateSession(r *http.Request, session *Session, i *identity.Identity, authenticatedAt time.Time) error
 }
 
 type ManagementProvider interface {
diff --git a/session/manager_http.go b/session/manager_http.go
index fbd6574e0b2c..7fbaeff5fd98 100644
--- a/session/manager_http.go
+++ b/session/manager_http.go
@@ -9,6 +9,8 @@ import (
 	"net/url"
 	"time"
 
+	"go.opentelemetry.io/otel/attribute"
+
 	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/kratos/x/events"
@@ -38,6 +40,8 @@ import (
 	"github.com/ory/kratos/x"
 )
 
+var ErrNoAALAvailable = herodot.ErrForbidden.WithReasonf("Unable to detect available authentication methods. Perform account recovery or contact support.")
+
 type (
 	managerHTTPDependencies interface {
 		config.Provider
@@ -45,8 +49,10 @@ type (
 		identity.PrivilegedPoolProvider
 		identity.ManagementProvider
 		x.CookieProvider
+		x.LoggingProvider
 		x.CSRFProvider
 		x.TracingProvider
+		x.TransactionPersistenceProvider
 		PersistenceProvider
 		sessiontokenexchange.PersistenceProvider
 	}
@@ -221,6 +227,17 @@ func (s *ManagerHTTP) extractToken(r *http.Request) string {
 	return token
 }
 
+func (s *ManagerHTTP) FetchFromRequestContext(ctx context.Context, r *http.Request) (_ *Session, err error) {
+	ctx, span := s.r.Tracer(ctx).Tracer().Start(ctx, "sessions.ManagerHTTP.FetchFromRequestContext")
+	otelx.End(span, &err)
+
+	if sess, ok := ctx.Value(sessionInContextKey).(*Session); ok {
+		return sess, nil
+	}
+
+	return s.FetchFromRequest(ctx, r)
+}
+
 func (s *ManagerHTTP) FetchFromRequest(ctx context.Context, r *http.Request) (_ *Session, err error) {
 	ctx, span := s.r.Tracer(ctx).Tracer().Start(ctx, "sessions.ManagerHTTP.FetchFromRequest")
 	defer func() {
@@ -236,7 +253,9 @@ func (s *ManagerHTTP) FetchFromRequest(ctx context.Context, r *http.Request) (_
 		return nil, errors.WithStack(NewErrNoCredentialsForSession())
 	}
 
-	se, err := s.r.SessionPersister().GetSessionByToken(ctx, token, ExpandEverything, identity.ExpandDefault)
+	se, err := s.r.SessionPersister().GetSessionByToken(ctx, token,
+		// Don't change this unless you want bad performance down the line (because we constantly are unsure if we have the full data fetched or not).
+		ExpandEverything, identity.ExpandEverything)
 	if err != nil {
 		if errors.Is(err, herodot.ErrNotFound) || errors.Is(err, sqlcon.ErrNoRows) {
 			return nil, errors.WithStack(NewErrNoActiveSessionFound())
@@ -278,74 +297,94 @@ func (s *ManagerHTTP) PurgeFromRequest(ctx context.Context, w http.ResponseWrite
 	return nil
 }
 
-func (s *ManagerHTTP) DoesSessionSatisfy(r *http.Request, sess *Session, requestedAAL string, opts ...ManagerOptions) (err error) {
-	ctx, span := s.r.Tracer(r.Context()).Tracer().Start(r.Context(), "sessions.ManagerHTTP.DoesSessionSatisfy")
+func (s *ManagerHTTP) DoesSessionSatisfy(ctx context.Context, sess *Session, requestedAAL string, opts ...ManagerOptions) (err error) {
+	ctx, span := s.r.Tracer(ctx).Tracer().Start(ctx, "sessions.ManagerHTTP.DoesSessionSatisfy")
 	defer otelx.End(span, &err)
 
+	sess.SetAuthenticatorAssuranceLevel()
+
 	// If we already have AAL2 there is no need to check further because it is the highest AAL.
-	if sess.AuthenticatorAssuranceLevel > identity.AuthenticatorAssuranceLevel1 {
+	if sess.AuthenticatorAssuranceLevel == identity.AuthenticatorAssuranceLevel2 {
 		return nil
 	}
 
 	managerOpts := &options{}
-
 	for _, o := range opts {
 		o(managerOpts)
 	}
 
-	sess.SetAuthenticatorAssuranceLevel()
+	loginURL := urlx.CopyWithQuery(urlx.AppendPaths(s.r.Config().SelfPublicURL(ctx), "/self-service/login/browser"), url.Values{"aal": {"aal2"}})
+
+	// return to the requestURL if it was set
+	if managerOpts.requestURL != "" {
+		loginURL = urlx.CopyWithQuery(loginURL, url.Values{"return_to": {managerOpts.requestURL}})
+	}
+
 	switch requestedAAL {
 	case string(identity.AuthenticatorAssuranceLevel1):
 		if sess.AuthenticatorAssuranceLevel >= identity.AuthenticatorAssuranceLevel1 {
 			return nil
 		}
+		return NewErrAALNotSatisfied(loginURL.String())
 	case config.HighestAvailableAAL:
+		if sess.AuthenticatorAssuranceLevel == identity.AuthenticatorAssuranceLevel2 {
+			// The session has AAL2, nothing to check.
+			return nil
+		}
+
+		// The session is AAL1, we asked for `highest_available` AAL, so the only thing we can do
+		// is actually check what authentication methods the identity has.
 		if sess.Identity == nil {
+			// This is nil if the session did not expand the identity field.
 			sess.Identity, err = s.r.IdentityPool().GetIdentity(ctx, sess.IdentityID, identity.ExpandNothing)
 			if err != nil {
 				return err
 			}
 		}
 
-		i := sess.Identity
-		available, valid := i.AvailableAAL.ToAAL()
-		if !valid {
-			// Available is 0 if the identity was created before the AAL feature was introduced, or if the identity
-			// was directly created in the persister and not the identity manager.
-			//
-			// aal0 indicates that the AAL state of the identity is probably unknown.
-			//
-			// In either case, we need to fetch the credentials from the database to determine the AAL.
-			if len(i.Credentials) == 0 {
-				// The identity was apparently fetched without credentials. Let's hydrate them.
-				if err := s.r.PrivilegedIdentityPool().HydrateIdentityAssociations(ctx, i, identity.ExpandCredentials); err != nil {
-					return err
-				}
-			}
+		if aal, ok := sess.Identity.InternalAvailableAAL.ToAAL(); ok && aal == identity.AuthenticatorAssuranceLevel2 {
+			// Identity gives us AAL2, but the session is still AAL1. We need to upgrade the session.
+			return NewErrAALNotSatisfied(loginURL.String())
+		}
 
-			if err := i.SetAvailableAAL(ctx, s.r.IdentityManager()); err != nil {
+		// Identity AAL is not 2, we refresh:
+
+		// The identity was apparently fetched without credentials. Let's hydrate them.
+		if len(sess.Identity.Credentials) == 0 {
+			if err := s.r.PrivilegedIdentityPool().HydrateIdentityAssociations(ctx, sess.Identity, identity.ExpandCredentials); err != nil {
 				return err
 			}
+		}
 
-			available, _ = i.AvailableAAL.ToAAL()
-
-			// This is the migration strategy for identities that already exist.
-			if managerOpts.upsertAAL {
-				if _, err := s.r.SessionPersister().GetConnection(ctx).Where("id = ? AND nid = ?", i.ID, i.NID).UpdateQuery(i, "available_aal"); err != nil {
-					return err
-				}
-			}
+		// Great, now we determine the identity's available AAL
+		if err := sess.Identity.SetAvailableAAL(ctx, s.r.IdentityManager()); err != nil {
+			return err
 		}
 
-		if sess.AuthenticatorAssuranceLevel >= available {
-			return nil
+		// We override the result with our newly computed values
+		available, valid := sess.Identity.InternalAvailableAAL.ToAAL()
+		if !valid {
+			// Unlikely to happen because SetAvailableAAL will either return an error, or a valid value - but not no error and an invalid value.
+			return errors.WithStack(x.PseudoPanic.WithReasonf("Unable to determine available authentication methods for session: %s", sess.ID))
 		}
 
-		loginURL := urlx.CopyWithQuery(urlx.AppendPaths(s.r.Config().SelfPublicURL(ctx), "/self-service/login/browser"), url.Values{"aal": {"aal2"}})
+		switch available {
+		case identity.NoAuthenticatorAssuranceLevel:
+			// The identity has AAL0, the session has AAL1, we're good.
+			return nil
+		case identity.AuthenticatorAssuranceLevel1:
+			// The identity has AAL1, the session has AAL1, we're good.
+			return nil
+		case identity.AuthenticatorAssuranceLevel2:
+			// The identity has AAL2, the session has AAL1, we need to upgrade the session.
 
-		// return to the requestURL if it was set
-		if managerOpts.requestURL != "" {
-			loginURL = urlx.CopyWithQuery(loginURL, url.Values{"return_to": {managerOpts.requestURL}})
+			// Since we ended up here, it also means that `sess.Identity.InternalAvailableAAL` was `aal1` and is now `aal2`.
+			// Let's update the database.
+			if managerOpts.upsertAAL {
+				if err := s.r.PrivilegedIdentityPool().UpdateIdentityColumns(ctx, sess.Identity, "available_aal"); err != nil {
+					return err
+				}
+			}
 		}
 
 		return NewErrAALNotSatisfied(loginURL.String())
@@ -402,3 +441,41 @@ func (s *ManagerHTTP) MaybeRedirectAPICodeFlow(w http.ResponseWriter, r *http.Re
 
 	return true, nil
 }
+
+func (s *ManagerHTTP) ActivateSession(r *http.Request, session *Session, i *identity.Identity, authenticatedAt time.Time) (err error) {
+	ctx, span := s.r.Tracer(r.Context()).Tracer().Start(r.Context(), "sessions.ManagerHTTP.ActivateSession", trace.WithAttributes(
+		attribute.String("session.id", session.ID.String()),
+		attribute.String("identity.id", session.ID.String()),
+		attribute.String("authenticated_at", session.ID.String()),
+	))
+	defer otelx.End(span, &err)
+
+	if i == nil {
+		return errors.WithStack(x.PseudoPanic.WithReasonf("Identity must not be nil when activating a session."))
+	}
+
+	if !i.IsActive() {
+		return errors.WithStack(ErrIdentityDisabled.WithDetail("identity_id", i.ID))
+	}
+
+	if err := s.r.IdentityManager().RefreshAvailableAAL(ctx, i); err != nil {
+		return err
+	}
+
+	session.Identity = i
+	session.IdentityID = i.ID
+
+	session.Active = true
+	session.IssuedAt = authenticatedAt
+	session.ExpiresAt = authenticatedAt.Add(s.r.Config().SessionLifespan(ctx))
+	session.AuthenticatedAt = authenticatedAt
+
+	session.SetSessionDeviceInformation(r.WithContext(ctx))
+	session.SetAuthenticatorAssuranceLevel()
+
+	span.SetAttributes(
+		attribute.String("identity.available_aal", session.Identity.InternalAvailableAAL.String),
+	)
+
+	return nil
+}
diff --git a/session/manager_http_test.go b/session/manager_http_test.go
index 8a1e166da25c..0bbfdd625461 100644
--- a/session/manager_http_test.go
+++ b/session/manager_http_test.go
@@ -13,6 +13,8 @@ import (
 	"testing"
 	"time"
 
+	confighelpers "github.com/ory/kratos/driver/config/testhelpers"
+
 	"github.com/ory/nosurf"
 	"github.com/ory/x/urlx"
 
@@ -150,6 +152,40 @@ func TestManagerHTTP(t *testing.T) {
 		})
 	})
 
+	t.Run("suite=SessionActivate", func(t *testing.T) {
+		req := testhelpers.NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
+
+		conf, reg := internal.NewFastRegistryWithMocks(t)
+		testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/identity.schema.json")
+
+		i := &identity.Identity{
+			Traits: []byte("{}"), State: identity.StateActive,
+			Credentials: map[identity.CredentialsType]identity.Credentials{
+				identity.CredentialsTypePassword: {Type: identity.CredentialsTypePassword, Identifiers: []string{x.NewUUID().String()}, Config: []byte(`{"hashed_password":"foo"}`)},
+			},
+		}
+		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), i))
+		assert.EqualValues(t, i.InternalAvailableAAL.String, "")
+
+		sess := session.NewInactiveSession()
+		require.NoError(t, reg.SessionManager().ActivateSession(req, sess, i, time.Now().UTC()))
+		require.NoError(t, reg.SessionPersister().UpsertSession(context.Background(), sess))
+
+		actual, err := reg.SessionPersister().GetSession(context.Background(), sess.ID, session.ExpandEverything)
+		require.NoError(t, err)
+
+		assert.EqualValues(t, true, actual.Active)
+		assert.NotZero(t, actual.IssuedAt)
+		assert.True(t, time.Now().Before(actual.ExpiresAt))
+		require.Len(t, actual.Devices, 1)
+		assert.EqualValues(t, identity.AuthenticatorAssuranceLevel1, i.InternalAvailableAAL.String)
+
+		actualIdentity, err := reg.IdentityPool().GetIdentity(ctx, i.ID, identity.ExpandNothing)
+		require.NoError(t, err)
+		assert.EqualValues(t, identity.AuthenticatorAssuranceLevel1, actualIdentity.InternalAvailableAAL.String)
+
+	})
+
 	t.Run("suite=SessionAddAuthenticationMethod", func(t *testing.T) {
 		req := testhelpers.NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
 
@@ -159,7 +195,7 @@ func TestManagerHTTP(t *testing.T) {
 		i := &identity.Identity{Traits: []byte("{}"), State: identity.StateActive}
 		require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), i))
 		sess := session.NewInactiveSession()
-		require.NoError(t, sess.Activate(req, i, conf, time.Now()))
+		require.NoError(t, reg.SessionManager().ActivateSession(req, sess, i, time.Now().UTC()))
 		require.NoError(t, reg.SessionPersister().UpsertSession(context.Background(), sess))
 		require.NoError(t, reg.SessionManager().SessionAddAuthenticationMethods(context.Background(), sess.ID,
 			session.AuthenticationMethod{
@@ -208,6 +244,16 @@ func TestManagerHTTP(t *testing.T) {
 			reg.Writer().Write(w, r, sess)
 		})
 
+		rp.GET("/session/get-middleware", reg.SessionHandler().IsAuthenticated(func(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
+			sess, err := reg.SessionManager().FetchFromRequestContext(r.Context(), r)
+			if err != nil {
+				t.Logf("Got error on lookup: %s %T", err, errors.Unwrap(err))
+				reg.Writer().WriteError(w, r, err)
+				return
+			}
+			reg.Writer().Write(w, r, sess)
+		}, session.RedirectOnUnauthenticated("https://failed.com")))
+
 		pts := httptest.NewServer(x.NewTestCSRFHandler(rp, reg))
 		t.Cleanup(pts.Close)
 		conf.MustSet(ctx, config.ViperKeyPublicBaseURL, pts.URL)
@@ -219,7 +265,7 @@ func TestManagerHTTP(t *testing.T) {
 
 			i := identity.Identity{Traits: []byte("{}")}
 			require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &i))
-			s, _ = session.NewActiveSession(req, &i, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+			s, _ = testhelpers.NewActiveSession(req, reg, &i, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 
 			c := testhelpers.NewClientWithCookies(t)
 			testhelpers.MockHydrateCookieClient(t, c, pts.URL+"/session/set")
@@ -227,6 +273,10 @@ func TestManagerHTTP(t *testing.T) {
 			res, err := c.Get(pts.URL + "/session/get")
 			require.NoError(t, err)
 			assert.EqualValues(t, http.StatusOK, res.StatusCode)
+
+			res, err = c.Get(pts.URL + "/session/get-middleware")
+			require.NoError(t, err)
+			assert.EqualValues(t, http.StatusOK, res.StatusCode)
 		})
 
 		t.Run("case=key rotation", func(t *testing.T) {
@@ -240,7 +290,7 @@ func TestManagerHTTP(t *testing.T) {
 
 			i := identity.Identity{Traits: []byte("{}")}
 			require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &i))
-			s, _ = session.NewActiveSession(req, &i, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+			s, _ = testhelpers.NewActiveSession(req, reg, &i, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 
 			c := testhelpers.NewClientWithCookies(t)
 			testhelpers.MockHydrateCookieClient(t, c, pts.URL+"/session/set")
@@ -270,7 +320,7 @@ func TestManagerHTTP(t *testing.T) {
 
 			i := identity.Identity{Traits: []byte("{}")}
 			require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &i))
-			s, _ = session.NewActiveSession(req, &i, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+			s, _ = testhelpers.NewActiveSession(req, reg, &i, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 
 			c := testhelpers.NewClientWithCookies(t)
 			res, err := c.Get(pts.URL + "/session/set/invalid")
@@ -284,7 +334,7 @@ func TestManagerHTTP(t *testing.T) {
 
 			i := identity.Identity{Traits: []byte("{}"), State: identity.StateActive}
 			require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &i))
-			s, err := session.NewActiveSession(req, &i, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+			s, err := testhelpers.NewActiveSession(req, reg, &i, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 			require.NoError(t, err)
 			require.NoError(t, reg.SessionPersister().UpsertSession(context.Background(), s))
 			require.NotEmpty(t, s.Token)
@@ -305,7 +355,7 @@ func TestManagerHTTP(t *testing.T) {
 
 			i := identity.Identity{Traits: []byte("{}"), State: identity.StateActive}
 			require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &i))
-			s, err := session.NewActiveSession(req, &i, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+			s, err := testhelpers.NewActiveSession(req, reg, &i, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 			require.NoError(t, err)
 			require.NoError(t, reg.SessionPersister().UpsertSession(context.Background(), s))
 
@@ -329,7 +379,7 @@ func TestManagerHTTP(t *testing.T) {
 
 			i := identity.Identity{Traits: []byte("{}")}
 			require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &i))
-			s, _ = session.NewActiveSession(req, &i, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+			s, _ = testhelpers.NewActiveSession(req, reg, &i, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 
 			c := testhelpers.NewClientWithCookies(t)
 			testhelpers.MockHydrateCookieClient(t, c, pts.URL+"/session/set")
@@ -345,9 +395,9 @@ func TestManagerHTTP(t *testing.T) {
 			req := testhelpers.NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
 			i := identity.Identity{Traits: []byte("{}")}
 			require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(context.Background(), &i))
-			s, _ = session.NewActiveSession(req, &i, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+			s, _ = testhelpers.NewActiveSession(req, reg, &i, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 
-			s, _ = session.NewActiveSession(req, &i, conf, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+			s, _ = testhelpers.NewActiveSession(req, reg, &i, time.Now(), identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 
 			c := testhelpers.NewClientWithCookies(t)
 			testhelpers.MockHydrateCookieClient(t, c, pts.URL+"/session/set")
@@ -371,8 +421,8 @@ func TestManagerHTTP(t *testing.T) {
 					for _, m := range complete {
 						s.CompletedLoginFor(m, "")
 					}
-					require.NoError(t, s.Activate(req, i, conf, time.Now().UTC()))
-					err := reg.SessionManager().DoesSessionSatisfy((&http.Request{}).WithContext(context.Background()), s, requested)
+					require.NoError(t, reg.SessionManager().ActivateSession(req, s, i, time.Now().UTC()))
+					err := reg.SessionManager().DoesSessionSatisfy(ctx, s, requested)
 					if expectedError != nil {
 						require.ErrorAs(t, err, &expectedError)
 					} else {
@@ -418,22 +468,22 @@ func TestManagerHTTP(t *testing.T) {
 
 					s := session.NewInactiveSession()
 					s.CompletedLoginFor(identity.CredentialsTypePassword, "")
-					require.NoError(t, s.Activate(req, idAAL1, conf, time.Now().UTC()))
-					require.Error(t, reg.SessionManager().DoesSessionSatisfy((&http.Request{}).WithContext(context.Background()), s, config.HighestAvailableAAL, session.UpsertAAL))
+					require.NoError(t, reg.SessionManager().ActivateSession(req, s, idAAL1, time.Now().UTC()))
+					require.Error(t, reg.SessionManager().DoesSessionSatisfy(ctx, s, config.HighestAvailableAAL, session.UpsertAAL))
 
 					result, err := reg.IdentityPool().GetIdentity(context.Background(), idAAL1.ID, identity.ExpandNothing)
 					require.NoError(t, err)
-					assert.EqualValues(t, identity.AuthenticatorAssuranceLevel2, result.AvailableAAL.String)
+					assert.EqualValues(t, identity.AuthenticatorAssuranceLevel2, result.InternalAvailableAAL.String)
 				})
 
 				t.Run("identity available AAL is hydrated without DB", func(t *testing.T) {
 					// We do not create the identity in the database, proving that we do not need
 					// to do any DB roundtrips in this case.
 					idAAL2 := createAAL2Identity(t, reg)
-					idAAL2.AvailableAAL = identity.NewNullableAuthenticatorAssuranceLevel(identity.AuthenticatorAssuranceLevel2)
+					idAAL2.InternalAvailableAAL = identity.NewNullableAuthenticatorAssuranceLevel(identity.AuthenticatorAssuranceLevel2)
 
 					idAAL1 := createAAL1Identity(t, reg)
-					idAAL1.AvailableAAL = identity.NewNullableAuthenticatorAssuranceLevel(identity.AuthenticatorAssuranceLevel1)
+					idAAL1.InternalAvailableAAL = identity.NewNullableAuthenticatorAssuranceLevel(identity.AuthenticatorAssuranceLevel1)
 
 					test(t, idAAL1, idAAL2)
 				})
@@ -443,19 +493,76 @@ func TestManagerHTTP(t *testing.T) {
 }
 
 func TestDoesSessionSatisfy(t *testing.T) {
+	ctx := context.Background()
 	conf, reg := internal.NewFastRegistryWithMocks(t)
 	testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/identity.schema.json")
+	ctx = testhelpers.WithDefaultIdentitySchema(ctx, "file://./stub/identity.schema.json")
 
+	passwordEmpty := identity.Credentials{Type: identity.CredentialsTypePassword, Config: []byte(`{}`), Identifiers: []string{testhelpers.RandomEmail()}}
 	password := identity.Credentials{
 		Type:        identity.CredentialsTypePassword,
 		Identifiers: []string{testhelpers.RandomEmail()},
 		Config:      []byte(`{"hashed_password": "$argon2id$v=19$m=32,t=2,p=4$cm94YnRVOW5jZzFzcVE4bQ$MNzk5BtR2vUhrp6qQEjRNw"}`),
 	}
+	passwordMigration := identity.Credentials{
+		Type:        identity.CredentialsTypePassword,
+		Identifiers: []string{testhelpers.RandomEmail()},
+		Config:      []byte(`{"use_password_migration_hook":true}`),
+	}
+
+	code := identity.Credentials{
+		Type:        identity.CredentialsTypeCodeAuth,
+		Identifiers: []string{testhelpers.RandomEmail()},
+		Config:      []byte(`{"address_type":"email","used_at":{"Time":"0001-01-01T00:00:00Z","Valid":false}}`),
+	}
+	//codeEmpty := identity.Credentials{
+	//	Type:        identity.CredentialsTypeCodeAuth,
+	//	Identifiers: []string{testhelpers.RandomEmail()},
+	//	Config:      []byte(`{}`),
+	//}
+
 	oidc := identity.Credentials{
 		Type:        identity.CredentialsTypeOIDC,
 		Config:      []byte(`{"providers":[{"subject":"0.fywegkf7hd@ory.sh","provider":"hydra","initial_id_token":"65794a68624763694f694a53557a49314e694973496d74705a434936496e4231596d7870597a706f6557527959533576634756756157517561575174644739725a5734694c434a30655841694f694a4b5631516966512e65794a686446396f59584e6f496a6f6956484650616b6f324e6c397a613046436555643662315679576b466655534973496d46315a43493657794a72636d463062334d74593278705a573530496c3073496d46316447686664476c745a5349364d5459304e6a55314e6a59784e4377695a586877496a6f784e6a51324e5459774d6a45314c434a70595851694f6a45324e4459314e5459324d545573496d6c7a63794936496d6830644841364c79397362324e6862476876633351364e4451304e4338694c434a7164476b694f694a6a596a4d784d6a51794e6930314e7a4d774c5451314d546374596a51335a53316b4d446379596a51334d6a6b344d4759694c434a79595851694f6a45324e4459314e5459324d544d73496e4e705a434936496a677a4e5755344e47526a4c5463344d544d744e4749324f4330354d544a6d4c5446684d7a646d4e444d354d4463304e534973496e4e3159694936496a41755a6e6c335a5764725a6a646f5a454276636e6b75633267694c434a335a574a7a6158526c496a6f696148523063484d364c7939336433637562334a354c6e4e6f4c794a392e506850623770456358544c3456647730427959686f30794a7232714b794b4f7373646c4b6c74716b4953693762414e58776a7635686538506e6d7a586e713538556f5739657754584a485a33425651614d4e79612d755f5933584a4a61665673543347476c52776f376f5261707a6a564836502d72447657385649524d5361356f783242397164416d796659505734376e56782d4e68787247564c56464b526b5866324e4448534e6d435968524963455539724331366235385331344c314367776972624d507662797870644c63764f4a4546554238324c794574525a786f644748354c69394d6b5f4d6137363969583254776758434179306734475a625957337137317466574c37736d5342394669785076434b6a3738433753546b762d764f737a4e6533523864676133775471466e6253797a6a614f4b47626e424a4a77423869306e416c48496d425337587146645f666d556d4e62377a372d63716e593374395069306248466b46596e6746545279664d4c6f466f576956784842704b4d6c6b304d4e7a5155414e5368546e346769544d5547454a4f6372346f6f445f6770344768734c44542d54465f6f73486c304832544237777a6d546d735f3150506547424e716a316b61576a467038567247726e4a6b354f594c643152473152464c794535544c4d47315f62744762447137334450784c334b3657387348507242504b654133344377373371584e5247724e73574e69496e775f4e596a65554d484b6351436c4e51445a49725339794962456a485a78476a34546e4367664f5974694e76527a4c6c36616a73614265464b7a45592d6348416e6e42694c75744439373168697241684f5463544a42783672716f67717764755356726551456f565a5735616e4a7a7575775234685453354d44314d64457045437471526d416c71555459644e5a365778514d","initial_access_token":"52344752743736552d634a2d4a2d424372447159634967464652446c6455455a6a526e534d62336e3242732e47324f444d64303544774b4e67395649476e306e496b3877324e72444f48384a78635042635a4a58336d63","initial_refresh_token":"327872337a4d382d654273674b6d61644a624e5a497572473374545154615070313264514a314476544d632e77326d34747a6e7950584c38324b794563716468685068635156314f77386a535a345355496f3544744a51"}]}`),
 		Identifiers: []string{"hydra:0.fywegkf7hd@ory.sh"},
 	}
+	//oidcEmpty := identity.Credentials{
+	//	Type:        identity.CredentialsTypeOIDC,
+	//	Config:      []byte(`{}`),
+	//	Identifiers: []string{"hydra:0.fywegkf7hd@ory.sh"},
+	//}
+
+	lookupSecrets := identity.Credentials{
+		Type:   identity.CredentialsTypeLookup,
+		Config: []byte(`{"recovery_codes": [{"code": "abcde", "used_at": null}]}`),
+	}
+	//lookupSecretsEmpty := identity.Credentials{
+	//	Type:   identity.CredentialsTypeLookup,
+	//	Config: []byte(`{}`),
+	//}
+
+	totp := identity.Credentials{
+		Type:   identity.CredentialsTypeTOTP,
+		Config: []byte(`{"totp_url": "otpauth://totp/..."}`),
+	}
+	//totpEmpty := identity.Credentials{
+	//	Type:   identity.CredentialsTypeTOTP,
+	//	Config: []byte(`{}`),
+	//}
+
+	// passkey
+	passkey := identity.Credentials{ // passkey
+		Type:        identity.CredentialsTypePasskey,
+		Config:      []byte(`{"credentials":[{}]}`),
+		Identifiers: []string{testhelpers.RandomEmail()},
+	}
+	//passkeyEmpty := identity.Credentials{ // passkey
+	//	Type:        identity.CredentialsTypePasskey,
+	//	Config:      []byte(`{"credentials":null}`),
+	//	Identifiers: []string{testhelpers.RandomEmail()},
+	//}
+
+	// webAuthn
 	mfaWebAuth := identity.Credentials{
 		Type:        identity.CredentialsTypeWebAuthn,
 		Config:      []byte(`{"credentials":[{"is_passwordless":false}]}`),
@@ -467,106 +574,265 @@ func TestDoesSessionSatisfy(t *testing.T) {
 		Identifiers: []string{testhelpers.RandomEmail()},
 	}
 	webAuthEmpty := identity.Credentials{Type: identity.CredentialsTypeWebAuthn, Config: []byte(`{}`), Identifiers: []string{testhelpers.RandomEmail()}}
-	passwordEmpty := identity.Credentials{Type: identity.CredentialsTypePassword, Config: []byte(`{}`), Identifiers: []string{testhelpers.RandomEmail()}}
 
-	amrPassword := session.AuthenticationMethod{Method: identity.CredentialsTypePassword, AAL: identity.AuthenticatorAssuranceLevel1}
+	amrs := map[identity.CredentialsType]session.AuthenticationMethod{}
+	for _, strat := range reg.AllLoginStrategies() {
+		amrs[strat.ID()] = strat.CompletedAuthenticationMethod(ctx)
+	}
 
 	for k, tc := range []struct {
-		d                     string
-		err                   error
-		requested             identity.AuthenticatorAssuranceLevel
+		desc                  string
+		withContext           func(*testing.T, context.Context) context.Context
+		errAs                 error
+		errIs                 error
+		matcher               identity.AuthenticatorAssuranceLevel
 		creds                 []identity.Credentials
-		amr                   session.AuthenticationMethods
+		withAMR               session.AuthenticationMethods
 		sessionManagerOptions []session.ManagerOptions
 		expectedFunc          func(t *testing.T, err error, tcError error)
 	}{
 		{
-			d:         "has=aal1, requested=highest, available=aal1, credential=password",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password},
-			amr:       session.AuthenticationMethods{amrPassword},
+			desc:    "with highest_available a password user is aal1",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword]},
+			// No error
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal1, credential=password, legacy=true",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password},
-			amr:       session.AuthenticationMethods{{Method: identity.CredentialsTypePassword}},
+			desc:    "with highest_available a password migration user is aal1 if password migration is enabled",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{passwordMigration},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword]},
+			withContext: func(t *testing.T, ctx context.Context) context.Context {
+				return confighelpers.WithConfigValues(ctx, map[string]any{
+					"selfservice.methods.password_migration.enabled": true,
+				})
+			},
+			// No error
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal1, credential=password+webauth_empty",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, webAuthEmpty},
-			amr:       session.AuthenticationMethods{amrPassword},
+			// This is not an error because DoesSessionSatisfy always assumes at least aal1
+			desc:    "with highest_available a password migration user is aal1 if password migration is disabled",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{passwordMigration},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword]},
+			withContext: func(t *testing.T, ctx context.Context) context.Context {
+				return confighelpers.WithConfigValues(ctx, map[string]any{
+					"selfservice.methods.password_migration.enabled": false,
+				})
+			},
+			// No error
+		},
+		{
+			desc:    "with highest_available a otp code user is aal1",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{code},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypeCodeAuth]},
+			// No error
+		},
+		{
+			desc:    "with highest_available a oidc user is aal1",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{oidc},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypeOIDC]},
+			// No error
+		},
+		{
+			desc:    "with highest_available a passkey user is aal1",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{passkey},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePasskey]},
+			// No error
+		},
+		{
+			desc:    "with highest_available a recovery token user is aal1 even if they have no credentials",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypeRecoveryLink]},
+			// No error
+		},
+		{
+			desc:    "with highest_available a recovery code user is aal1 even if they have no credentials",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypeRecoveryCode]},
+			// No error
+		},
+		// Test a recovery method with an identity that has only 2fa methods enabled.
+		{
+			desc:    "with highest_available a recovery link user requires aal2 if they have 2fa totp configured",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{totp},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypeRecoveryLink]},
+			errIs:   new(session.ErrAALNotSatisfied),
+		},
+		{
+			desc:    "with highest_available a recovery code user requires aal2 if they have 2fa lookup configured",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{lookupSecrets},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypeRecoveryCode]},
+			errIs:   new(session.ErrAALNotSatisfied),
+		},
+		{
+			desc:    "with highest_available a recovery code user requires aal2 if they have 2fa lookup configured",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{mfaWebAuth},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypeRecoveryCode]},
+			errIs:   new(session.ErrAALNotSatisfied),
+		},
+		{
+			desc:    "with highest_available a recovery code user requires aal2 if they have many 2fa methods configured",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{lookupSecrets, mfaWebAuth, totp},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypeRecoveryCode]},
+			errIs:   new(session.ErrAALNotSatisfied),
+		},
+		{
+			desc:    "with highest_available a recovery link user requires aal2 if they have 2fa code configured",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypeRecoveryLink]},
+			withContext: func(t *testing.T, ctx context.Context) context.Context {
+				return confighelpers.WithConfigValues(ctx, map[string]any{
+					"selfservice.methods.code.passwordless_enabled": false,
+					"selfservice.methods.code.mfa_enabled":          true,
+				})
+			},
+			errIs: new(session.ErrAALNotSatisfied),
+		},
+
+		// Legacy tests
+		{
+			desc:    "has=aal1, requested=highest, available=aal0, credential=code",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{totp},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypeRecoveryCode]},
+			errIs:   session.ErrNoAALAvailable,
+		},
+
+		{
+			desc:    "has=aal1, requested=highest, available=aal1, credential=password",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword]},
+		},
+		{
+			desc:    "has=aal1, requested=highest, available=aal1, credential=password, legacy=true",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password},
+			withAMR: session.AuthenticationMethods{{Method: identity.CredentialsTypePassword}},
+		},
+		{
+			desc:    "has=aal1, requested=highest, available=aal1, credential=password+webauth_empty",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, webAuthEmpty},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword]},
+		},
+		{
+			desc:    "has=aal1, requested=highest, available=aal1, credential=password+webauth_empty, legacy=true",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, webAuthEmpty},
+			withAMR: session.AuthenticationMethods{{Method: identity.CredentialsTypePassword}},
+		},
+		{
+			desc:    "has=aal1, requested=highest, available=aal1, credential=password+webauth_passwordless",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, passwordlessWebAuth},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword]},
+		},
+		{
+			desc:    "has=aal1, requested=highest, available=aal1, credential=password+webauth_passwordless, legacy=true",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, passwordlessWebAuth},
+			withAMR: session.AuthenticationMethods{{Method: identity.CredentialsTypePassword}},
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal1, credential=password+webauth_empty, legacy=true",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, webAuthEmpty},
-			amr:       session.AuthenticationMethods{{Method: identity.CredentialsTypePassword}},
+			desc:    "has=aal1, requested=highest, available=aal2, credential=password+webauth_mfa",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, mfaWebAuth},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword]},
+			errAs:   new(session.ErrAALNotSatisfied),
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal1, credential=password+webauth_passwordless",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, passwordlessWebAuth},
-			amr:       session.AuthenticationMethods{amrPassword},
+			desc:    "has=aal1, requested=highest, available=aal2, credential=password+totp",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, totp},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword]},
+			errAs:   new(session.ErrAALNotSatisfied),
+		},
+		{
+			desc:    "has=aal1, requested=highest, available=aal2, credential=password+code-mfa",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, code},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword]},
+			errAs:   new(session.ErrAALNotSatisfied),
+			withContext: func(t *testing.T, ctx context.Context) context.Context {
+				return confighelpers.WithConfigValues(ctx, map[string]any{
+					"selfservice.methods.code.passwordless_enabled": false,
+					"selfservice.methods.code.mfa_enabled":          true,
+				})
+			},
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal1, credential=password+webauth_passwordless, legacy=true",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, passwordlessWebAuth},
-			amr:       session.AuthenticationMethods{{Method: identity.CredentialsTypePassword}},
+			desc:    "has=aal1, requested=highest, available=aal2, credential=password+lookup_secrets",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, lookupSecrets},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword]},
+			errAs:   new(session.ErrAALNotSatisfied),
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal2, credential=password+webauth_mfa",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, mfaWebAuth},
-			amr:       session.AuthenticationMethods{amrPassword},
-			err:       new(session.ErrAALNotSatisfied),
+			desc:    "has=aal1, requested=highest, available=aal2, credential=password+webauth_mfa, legacy=true",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, mfaWebAuth},
+			withAMR: session.AuthenticationMethods{{Method: identity.CredentialsTypePassword}},
+			errAs:   new(session.ErrAALNotSatisfied),
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal2, credential=password+webauth_mfa, legacy=true",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, mfaWebAuth},
-			amr:       session.AuthenticationMethods{{Method: identity.CredentialsTypePassword}},
-			err:       new(session.ErrAALNotSatisfied),
+			desc:    "has=aal1, requested=highest, available=aal2, credential=password+webauth_mfa",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, mfaWebAuth},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword], {Method: identity.CredentialsTypeWebAuthn, AAL: identity.AuthenticatorAssuranceLevel1}},
+			errAs:   new(session.ErrAALNotSatisfied),
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal2, credential=password+webauth_mfa",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, mfaWebAuth},
-			amr:       session.AuthenticationMethods{amrPassword, {Method: identity.CredentialsTypeWebAuthn, AAL: identity.AuthenticatorAssuranceLevel1}},
-			err:       new(session.ErrAALNotSatisfied),
+			desc:    "has=aal1, requested=highest, available=aal2, credential=password+webauth_passwordless",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, passwordlessWebAuth},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword], {Method: identity.CredentialsTypeWebAuthn, AAL: identity.AuthenticatorAssuranceLevel1}},
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal2, credential=password+webauth_passwordless",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, passwordlessWebAuth},
-			amr:       session.AuthenticationMethods{amrPassword, {Method: identity.CredentialsTypeWebAuthn, AAL: identity.AuthenticatorAssuranceLevel1}},
+			desc:    "has=aal2, requested=highest, available=aal2, credential=password+webauth_mfa",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, mfaWebAuth},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword], {Method: identity.CredentialsTypeWebAuthn, AAL: identity.AuthenticatorAssuranceLevel2}},
 		},
 		{
-			d:         "has=aal2, requested=highest, available=aal2, credential=password+webauth_mfa",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, mfaWebAuth},
-			amr:       session.AuthenticationMethods{amrPassword, {Method: identity.CredentialsTypeWebAuthn, AAL: identity.AuthenticatorAssuranceLevel2}},
+			desc:    "has=aal2, requested=highest, available=aal2, credential=password+webauth_mfa, legacy=true",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, mfaWebAuth},
+			withAMR: session.AuthenticationMethods{amrs[identity.CredentialsTypePassword], {Method: identity.CredentialsTypeWebAuthn}},
 		},
+
+		// oidc
 		{
-			d:         "has=aal2, requested=highest, available=aal2, credential=password+webauth_mfa, legacy=true",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, mfaWebAuth},
-			amr:       session.AuthenticationMethods{amrPassword, {Method: identity.CredentialsTypeWebAuthn}},
+			desc:    "has=aal1, requested=highest, available=aal1, credential=oidc_and_empties",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{oidc, webAuthEmpty, passwordEmpty},
+			withAMR: session.AuthenticationMethods{{Method: identity.CredentialsTypeOIDC, AAL: identity.AuthenticatorAssuranceLevel1}},
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal1, credential=oidc_and_empties",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{oidc, webAuthEmpty, passwordEmpty},
-			amr:       session.AuthenticationMethods{{Method: identity.CredentialsTypeOIDC, AAL: identity.AuthenticatorAssuranceLevel1}},
+			desc:    "has=aal1, requested=highest, available=aal1, credential=code and totp",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{code, totp},
+			withAMR: session.AuthenticationMethods{{Method: identity.CredentialsTypeCodeAuth, AAL: identity.AuthenticatorAssuranceLevel1}},
+			errAs:   session.NewErrAALNotSatisfied(urlx.CopyWithQuery(urlx.AppendPaths(conf.SelfPublicURL(ctx), "/self-service/login/browser"), url.Values{"aal": {"aal2"}, "return_to": {"https://myapp.com/settings?id=123"}}).String()),
 		},
 		{
-			d:                     "has=aal1, requested=highest, available=aal1, credentials=password+webauthn_mfa, recovery with session manager options",
-			requested:             config.HighestAvailableAAL,
+			desc:                  "has=aal1, requested=highest, available=aal1, credentials=password+webauthn_mfa, recovery with session manager options",
+			matcher:               config.HighestAvailableAAL,
 			creds:                 []identity.Credentials{password, mfaWebAuth},
-			amr:                   session.AuthenticationMethods{{Method: identity.CredentialsTypeRecoveryCode}},
-			err:                   session.NewErrAALNotSatisfied(urlx.CopyWithQuery(urlx.AppendPaths(conf.SelfPublicURL(context.Background()), "/self-service/login/browser"), url.Values{"aal": {"aal2"}, "return_to": {"https://myapp.com/settings?id=123"}}).String()),
+			withAMR:               session.AuthenticationMethods{{Method: identity.CredentialsTypeRecoveryCode}},
+			errAs:                 session.NewErrAALNotSatisfied(urlx.CopyWithQuery(urlx.AppendPaths(conf.SelfPublicURL(ctx), "/self-service/login/browser"), url.Values{"aal": {"aal2"}, "return_to": {"https://myapp.com/settings?id=123"}}).String()),
 			sessionManagerOptions: []session.ManagerOptions{session.WithRequestURL("https://myapp.com/settings?id=123")},
 			expectedFunc: func(t *testing.T, err error, tcError error) {
 				require.Contains(t, err.(*session.ErrAALNotSatisfied).RedirectTo, "myapp.com")
@@ -574,64 +840,74 @@ func TestDoesSessionSatisfy(t *testing.T) {
 			},
 		},
 		{
-			d:         "has=aal1, requested=highest, available=aal1, credentials=password+webauthn_mfa, recovery without session manager options",
-			requested: config.HighestAvailableAAL,
-			creds:     []identity.Credentials{password, mfaWebAuth},
-			amr:       session.AuthenticationMethods{{Method: identity.CredentialsTypeRecoveryCode}},
-			err:       session.NewErrAALNotSatisfied(urlx.CopyWithQuery(urlx.AppendPaths(conf.SelfPublicURL(context.Background()), "/self-service/login/browser"), url.Values{"aal": {"aal2"}}).String()),
+			desc:    "has=aal1, requested=highest, available=aal1, credentials=password+webauthn_mfa, recovery without session manager options",
+			matcher: config.HighestAvailableAAL,
+			creds:   []identity.Credentials{password, mfaWebAuth},
+			withAMR: session.AuthenticationMethods{{Method: identity.CredentialsTypeRecoveryCode}},
+			errAs:   session.NewErrAALNotSatisfied(urlx.CopyWithQuery(urlx.AppendPaths(conf.SelfPublicURL(ctx), "/self-service/login/browser"), url.Values{"aal": {"aal2"}}).String()),
 			expectedFunc: func(t *testing.T, err error, tcError error) {
 				require.Equal(t, tcError.(*session.ErrAALNotSatisfied).RedirectTo, err.(*session.ErrAALNotSatisfied).RedirectTo)
 			},
 		},
 	} {
-		t.Run(fmt.Sprintf("run=%d/desc=%s", k, tc.d), func(t *testing.T) {
-			id := identity.NewIdentity("")
+		t.Run(fmt.Sprintf("run=%d/desc=%s", k, tc.desc), func(t *testing.T) {
+			ctx := ctx
+			if tc.withContext != nil {
+				ctx = tc.withContext(t, ctx)
+			}
+
+			id := identity.NewIdentity("default")
 			for _, c := range tc.creds {
 				id.SetCredentials(c.Type, c)
 			}
-			require.NoError(t, reg.IdentityManager().Create(context.Background(), id, identity.ManagerAllowWriteProtectedTraits))
+			require.NoError(t, reg.IdentityManager().Create(ctx, id, identity.ManagerAllowWriteProtectedTraits))
 			t.Cleanup(func() {
-				require.NoError(t, reg.PrivilegedIdentityPool().DeleteIdentity(context.Background(), id.ID))
+				require.NoError(t, reg.PrivilegedIdentityPool().DeleteIdentity(ctx, id.ID))
 			})
 
 			req := testhelpers.NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
 			s := session.NewInactiveSession()
-			for _, m := range tc.amr {
+			for _, m := range tc.withAMR {
 				s.CompletedLoginFor(m.Method, m.AAL)
 			}
-			require.NoError(t, s.Activate(req, id, conf, time.Now().UTC()))
+			require.NoError(t, reg.SessionManager().ActivateSession(req, s, id, time.Now().UTC()))
 
-			err := reg.SessionManager().DoesSessionSatisfy((&http.Request{}).WithContext(context.Background()), s, string(tc.requested), tc.sessionManagerOptions...)
-			if tc.err != nil {
+			err := reg.SessionManager().DoesSessionSatisfy(ctx, s, string(tc.matcher), tc.sessionManagerOptions...)
+			if tc.errAs != nil || tc.errIs != nil {
+				if tc.expectedFunc != nil {
+					tc.expectedFunc(t, err, tc.errAs)
+				}
+				require.ErrorAs(t, err, &tc.errAs)
+			} else if tc.errIs != nil {
 				if tc.expectedFunc != nil {
-					tc.expectedFunc(t, err, tc.err)
+					tc.expectedFunc(t, err, tc.errIs)
 				}
-				require.ErrorAs(t, err, &tc.err)
+				require.ErrorIs(t, err, tc.errIs)
 			} else {
 				require.NoError(t, err)
 			}
 
-			// This should still work even if the session does not have identity data attached yet...
+			// This should still work even if the session does not have identity data attached yet ...
 			s.Identity = nil
-			err = reg.SessionManager().DoesSessionSatisfy((&http.Request{}).WithContext(context.Background()), s, string(tc.requested), tc.sessionManagerOptions...)
-			if tc.err != nil {
+			err = reg.SessionManager().DoesSessionSatisfy(ctx, s, string(tc.matcher), tc.sessionManagerOptions...)
+			if tc.errAs != nil {
 				if tc.expectedFunc != nil {
-					tc.expectedFunc(t, err, tc.err)
+					tc.expectedFunc(t, err, tc.errAs)
 				}
-				require.ErrorAs(t, err, &tc.err)
+				require.ErrorAs(t, err, &tc.errAs)
 			} else {
 				require.NoError(t, err)
 			}
 
-			// ..or no credentials attached.
+			// ... or no credentials attached.
 			s.Identity = id
 			s.Identity.Credentials = nil
-			err = reg.SessionManager().DoesSessionSatisfy((&http.Request{}).WithContext(context.Background()), s, string(tc.requested), tc.sessionManagerOptions...)
-			if tc.err != nil {
+			err = reg.SessionManager().DoesSessionSatisfy(ctx, s, string(tc.matcher), tc.sessionManagerOptions...)
+			if tc.errAs != nil {
 				if tc.expectedFunc != nil {
-					tc.expectedFunc(t, err, tc.err)
+					tc.expectedFunc(t, err, tc.errAs)
 				}
-				require.ErrorAs(t, err, &tc.err)
+				require.ErrorAs(t, err, &tc.errAs)
 			} else {
 				require.NoError(t, err)
 			}
diff --git a/session/persistence.go b/session/persistence.go
index ab5ec0a47735..abe793a50882 100644
--- a/session/persistence.go
+++ b/session/persistence.go
@@ -27,7 +27,7 @@ type Persister interface {
 	GetSession(ctx context.Context, sid uuid.UUID, expandables Expandables) (*Session, error)
 
 	// ListSessions retrieves all sessions.
-	ListSessions(ctx context.Context, active *bool, paginatorOpts []keysetpagination.Option, expandables Expandables) ([]Session, int64, *keysetpagination.Paginator, error)
+	ListSessions(ctx context.Context, active *bool, paginatorOpts []keysetpagination.Option, expandables Expandables) ([]Session, *keysetpagination.Paginator, error)
 
 	// ListSessionsByIdentity retrieves sessions for an identity from the store.
 	ListSessionsByIdentity(ctx context.Context, iID uuid.UUID, active *bool, page, perPage int, except uuid.UUID, expandables Expandables) ([]Session, int64, error)
diff --git a/session/session.go b/session/session.go
index 84f64ceec0d6..63261dce807f 100644
--- a/session/session.go
+++ b/session/session.go
@@ -16,7 +16,7 @@ import (
 
 	"github.com/ory/x/httpx"
 	"github.com/ory/x/pagination/keysetpagination"
-	"github.com/ory/x/stringsx"
+	"github.com/ory/x/pointerx"
 
 	"github.com/pkg/errors"
 
@@ -210,6 +210,9 @@ func (s *Session) SetAuthenticatorAssuranceLevel() {
 			isAAL1 = true
 		case identity.AuthenticatorAssuranceLevel2:
 			isAAL2 = true
+		// The following section is a graceful migration from Ory Kratos v0.9.
+		//
+		// TODO remove this section, it is already over 2 years old.
 		case "":
 			// Sessions before Ory Kratos 0.9 did not have the AAL
 			// be part of the AMR.
@@ -238,20 +241,11 @@ func (s *Session) SetAuthenticatorAssuranceLevel() {
 	} else if isAAL1 {
 		s.AuthenticatorAssuranceLevel = identity.AuthenticatorAssuranceLevel1
 	} else if len(s.AMR) > 0 {
-		// A fallback. If an AMR is set but we did not satisfy the above, gracefully fall back to level 1.
+		// A fallback. If an AMR is set, but we did not satisfy the above, gracefully fall back to level 1.
 		s.AuthenticatorAssuranceLevel = identity.AuthenticatorAssuranceLevel1
 	}
 }
 
-func NewActiveSession(r *http.Request, i *identity.Identity, c lifespanProvider, authenticatedAt time.Time, completedLoginFor identity.CredentialsType, completedLoginAAL identity.AuthenticatorAssuranceLevel) (*Session, error) {
-	s := NewInactiveSession()
-	s.CompletedLoginFor(completedLoginFor, completedLoginAAL)
-	if err := s.Activate(r, i, c, authenticatedAt); err != nil {
-		return nil, err
-	}
-	return s, nil
-}
-
 func NewInactiveSession() *Session {
 	return &Session{
 		ID:                          uuid.Nil,
@@ -262,32 +256,15 @@ func NewInactiveSession() *Session {
 	}
 }
 
-func (s *Session) Activate(r *http.Request, i *identity.Identity, c lifespanProvider, authenticatedAt time.Time) error {
-	if i != nil && !i.IsActive() {
-		return ErrIdentityDisabled.WithDetail("identity_id", i.ID)
-	}
-
-	s.Active = true
-	s.ExpiresAt = authenticatedAt.Add(c.SessionLifespan(r.Context()))
-	s.AuthenticatedAt = authenticatedAt
-	s.IssuedAt = authenticatedAt
-	s.Identity = i
-	s.IdentityID = i.ID
-
-	s.SetSessionDeviceInformation(r)
-	s.SetAuthenticatorAssuranceLevel()
-	return nil
-}
-
 func (s *Session) SetSessionDeviceInformation(r *http.Request) {
 	device := Device{
 		SessionID: s.ID,
-		IPAddress: stringsx.GetPointer(httpx.ClientIP(r)),
+		IPAddress: pointerx.Ptr(httpx.ClientIP(r)),
 	}
 
 	agent := r.Header["User-Agent"]
 	if len(agent) > 0 {
-		device.UserAgent = stringsx.GetPointer(strings.Join(agent, " "))
+		device.UserAgent = pointerx.Ptr(strings.Join(agent, " "))
 	}
 
 	var clientGeoLocation []string
@@ -297,7 +274,7 @@ func (s *Session) SetSessionDeviceInformation(r *http.Request) {
 	if r.Header.Get("Cf-Ipcountry") != "" {
 		clientGeoLocation = append(clientGeoLocation, r.Header.Get("Cf-Ipcountry"))
 	}
-	device.Location = stringsx.GetPointer(strings.Join(clientGeoLocation, ", "))
+	device.Location = pointerx.Ptr(strings.Join(clientGeoLocation, ", "))
 
 	s.Devices = append(s.Devices, device)
 }
diff --git a/session/session_test.go b/session/session_test.go
index 4e1efe3b647a..75fc61ea300a 100644
--- a/session/session_test.go
+++ b/session/session_test.go
@@ -9,6 +9,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/x"
+
 	"github.com/stretchr/testify/require"
 
 	"github.com/stretchr/testify/assert"
@@ -22,7 +24,8 @@ import (
 
 func TestSession(t *testing.T) {
 	ctx := context.Background()
-	conf, _ := internal.NewFastRegistryWithMocks(t)
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/identity.schema.json")
 	authAt := time.Now()
 
 	t.Run("case=active session", func(t *testing.T) {
@@ -30,14 +33,17 @@ func TestSession(t *testing.T) {
 
 		i := new(identity.Identity)
 		i.State = identity.StateActive
-		s, _ := session.NewActiveSession(req, i, conf, authAt, identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+		i.NID = x.NewUUID()
+		s, err := testhelpers.NewActiveSession(req, reg, i, authAt, identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+		require.NoError(t, err)
 		assert.True(t, s.IsActive())
 		require.NotEmpty(t, s.Token)
 		require.NotEmpty(t, s.LogoutToken)
 		assert.EqualValues(t, identity.CredentialsTypePassword, s.AMR[0].Method)
 
 		i = new(identity.Identity)
-		s, err := session.NewActiveSession(req, i, conf, authAt, identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+		i.NID = x.NewUUID()
+		s, err = testhelpers.NewActiveSession(req, reg, i, authAt, identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 		assert.Nil(t, s)
 		assert.ErrorIs(t, err, session.ErrIdentityDisabled)
 	})
@@ -62,13 +68,13 @@ func TestSession(t *testing.T) {
 		req := testhelpers.NewTestHTTPRequest(t, "GET", "/sessions/whoami", nil)
 
 		s := session.NewInactiveSession()
-		require.NoError(t, s.Activate(req, &identity.Identity{State: identity.StateActive}, conf, authAt))
+		require.NoError(t, reg.SessionManager().ActivateSession(req, s, &identity.Identity{NID: x.NewUUID(), State: identity.StateActive}, authAt))
 		assert.True(t, s.Active)
 		assert.Equal(t, identity.NoAuthenticatorAssuranceLevel, s.AuthenticatorAssuranceLevel)
 		assert.Equal(t, authAt, s.AuthenticatedAt)
 
 		s = session.NewInactiveSession()
-		require.ErrorIs(t, s.Activate(req, &identity.Identity{State: identity.StateInactive}, conf, authAt), session.ErrIdentityDisabled)
+		require.ErrorIs(t, reg.SessionManager().ActivateSession(req, s, &identity.Identity{NID: x.NewUUID(), State: identity.StateInactive}, authAt), session.ErrIdentityDisabled)
 		assert.False(t, s.Active)
 		assert.Equal(t, identity.NoAuthenticatorAssuranceLevel, s.AuthenticatorAssuranceLevel)
 		assert.Empty(t, s.AuthenticatedAt)
@@ -98,7 +104,7 @@ func TestSession(t *testing.T) {
 				req.Header.Set("X-Forwarded-For", tc.input)
 
 				s := session.NewInactiveSession()
-				require.NoError(t, s.Activate(req, &identity.Identity{State: identity.StateActive}, conf, authAt))
+				require.NoError(t, reg.SessionManager().ActivateSession(req, s, &identity.Identity{NID: x.NewUUID(), State: identity.StateActive}, authAt))
 				assert.True(t, s.Active)
 				assert.Equal(t, identity.NoAuthenticatorAssuranceLevel, s.AuthenticatorAssuranceLevel)
 				assert.Equal(t, authAt, s.AuthenticatedAt)
@@ -118,7 +124,7 @@ func TestSession(t *testing.T) {
 		req.Header["X-Forwarded-For"] = []string{"54.155.246.232", "10.145.1.10"}
 
 		s := session.NewInactiveSession()
-		require.NoError(t, s.Activate(req, &identity.Identity{State: identity.StateActive}, conf, authAt))
+		require.NoError(t, reg.SessionManager().ActivateSession(req, s, &identity.Identity{NID: x.NewUUID(), State: identity.StateActive}, authAt))
 		assert.True(t, s.Active)
 		assert.Equal(t, identity.NoAuthenticatorAssuranceLevel, s.AuthenticatorAssuranceLevel)
 		assert.Equal(t, authAt, s.AuthenticatedAt)
@@ -138,7 +144,7 @@ func TestSession(t *testing.T) {
 		req.Header.Set("X-Forwarded-For", "217.73.188.139,162.158.203.149, 172.19.2.7")
 
 		s := session.NewInactiveSession()
-		require.NoError(t, s.Activate(req, &identity.Identity{State: identity.StateActive}, conf, authAt))
+		require.NoError(t, reg.SessionManager().ActivateSession(req, s, &identity.Identity{State: identity.StateActive, NID: x.NewUUID()}, authAt))
 		assert.True(t, s.Active)
 		assert.Equal(t, identity.NoAuthenticatorAssuranceLevel, s.AuthenticatorAssuranceLevel)
 		assert.Equal(t, authAt, s.AuthenticatedAt)
@@ -159,7 +165,7 @@ func TestSession(t *testing.T) {
 		req.Header.Set("Cf-Ipcountry", "Germany")
 
 		s := session.NewInactiveSession()
-		require.NoError(t, s.Activate(req, &identity.Identity{State: identity.StateActive}, conf, authAt))
+		require.NoError(t, reg.SessionManager().ActivateSession(req, s, &identity.Identity{NID: x.NewUUID(), State: identity.StateActive}, authAt))
 		assert.True(t, s.Active)
 		assert.Equal(t, identity.NoAuthenticatorAssuranceLevel, s.AuthenticatorAssuranceLevel)
 		assert.Equal(t, authAt, s.AuthenticatedAt)
@@ -350,7 +356,9 @@ func TestSession(t *testing.T) {
 		})
 		i := new(identity.Identity)
 		i.State = identity.StateActive
-		s, _ := session.NewActiveSession(req, i, conf, authAt, identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+		i.NID = x.NewUUID()
+		s, err := testhelpers.NewActiveSession(req, reg, i, authAt, identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+		require.NoError(t, err)
 		assert.False(t, s.CanBeRefreshed(ctx, conf), "fresh session is not refreshable")
 
 		s.ExpiresAt = s.ExpiresAt.Add(-12 * time.Hour)
diff --git a/session/test/persistence.go b/session/test/persistence.go
index d124aa23eb4f..41bcdd6a9fe4 100644
--- a/session/test/persistence.go
+++ b/session/test/persistence.go
@@ -295,11 +295,10 @@ func TestPersister(ctx context.Context, conf *config.Config, p interface {
 			} {
 				t.Run("case=all "+tc.desc, func(t *testing.T) {
 					paginatorOpts := make([]keysetpagination.Option, 0)
-					actual, total, nextPage, err := l.ListSessions(ctx, tc.active, paginatorOpts, session.ExpandEverything)
+					actual, nextPage, err := l.ListSessions(ctx, tc.active, paginatorOpts, session.ExpandEverything)
 					require.NoError(t, err, "%+v", err)
 
 					require.Equal(t, len(tc.expected), len(actual))
-					require.Equal(t, int64(len(tc.expected)), total)
 					assert.Equal(t, true, nextPage.IsLast())
 
 					mapPageToken := nextPage.Token().Parse("")
@@ -322,11 +321,10 @@ func TestPersister(ctx context.Context, conf *config.Config, p interface {
 
 			t.Run("case=all sessions pagination only one page", func(t *testing.T) {
 				paginatorOpts := make([]keysetpagination.Option, 0)
-				actual, total, page, err := l.ListSessions(ctx, nil, paginatorOpts, session.ExpandEverything)
+				actual, page, err := l.ListSessions(ctx, nil, paginatorOpts, session.ExpandEverything)
 				require.NoError(t, err)
 
 				require.Equal(t, 6, len(actual))
-				require.Equal(t, int64(6), total)
 				assert.Equal(t, true, page.IsLast())
 				mapPageToken := page.Token().Parse("")
 				assert.Equal(t, uuid.Nil.String(), mapPageToken["id"])
@@ -336,9 +334,8 @@ func TestPersister(ctx context.Context, conf *config.Config, p interface {
 			t.Run("case=all sessions pagination multiple pages", func(t *testing.T) {
 				paginatorOpts := make([]keysetpagination.Option, 0)
 				paginatorOpts = append(paginatorOpts, keysetpagination.WithSize(3))
-				firstPageItems, total, page1, err := l.ListSessions(ctx, nil, paginatorOpts, session.ExpandEverything)
+				firstPageItems, page1, err := l.ListSessions(ctx, nil, paginatorOpts, session.ExpandEverything)
 				require.NoError(t, err)
-				require.Equal(t, int64(6), total)
 				assert.Len(t, firstPageItems, 3)
 
 				assert.Equal(t, false, page1.IsLast())
@@ -347,9 +344,8 @@ func TestPersister(ctx context.Context, conf *config.Config, p interface {
 				assert.Equal(t, 3, page1.Size())
 
 				// Validate secondPageItems page
-				secondPageItems, total, page2, err := l.ListSessions(ctx, nil, page1.ToOptions(), session.ExpandEverything)
+				secondPageItems, page2, err := l.ListSessions(ctx, nil, page1.ToOptions(), session.ExpandEverything)
 				require.NoError(t, err)
-				require.Equal(t, int64(6), total)
 				assert.Len(t, secondPageItems, 3)
 
 				acutalIDs := make([]uuid.UUID, 0)
diff --git a/session/tokenizer.go b/session/tokenizer.go
index 85533f6e397e..721c94a54985 100644
--- a/session/tokenizer.go
+++ b/session/tokenizer.go
@@ -36,7 +36,7 @@ type (
 	Tokenizer struct {
 		r       tokenizerDependencies
 		nowFunc func() time.Time
-		cache   *ristretto.Cache
+		cache   *ristretto.Cache[[]byte, []byte]
 	}
 	TokenizerProvider interface {
 		SessionTokenizer() *Tokenizer
@@ -44,7 +44,7 @@ type (
 )
 
 func NewTokenizer(r tokenizerDependencies) *Tokenizer {
-	cache, _ := ristretto.NewCache(&ristretto.Config{
+	cache, _ := ristretto.NewCache(&ristretto.Config[[]byte, []byte]{
 		MaxCost:     50 << 20, // 50MB,
 		NumCounters: 500_000,  // 1kB per snippet -> 50k snippets -> 500k counters
 		BufferItems: 64,
diff --git a/session/tokenizer_test.go b/session/tokenizer_test.go
index fab54f09d99e..29a213f03142 100644
--- a/session/tokenizer_test.go
+++ b/session/tokenizer_test.go
@@ -10,10 +10,13 @@ import (
 	"testing"
 	"time"
 
+	"github.com/golang-jwt/jwt/v5"
+
+	"github.com/ory/kratos/internal/testhelpers"
+
 	"github.com/ory/herodot"
 
 	"github.com/gofrs/uuid"
-	"github.com/golang-jwt/jwt/v5"
 	"github.com/lestrrat-go/jwx/v2/jwk"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -68,6 +71,7 @@ func TestTokenizer(t *testing.T) {
 
 	conf, reg := internal.NewFastRegistryWithMocks(t)
 	conf.MustSet(ctx, config.ViperKeyPublicBaseURL, "http://localhost/")
+	testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/identity.schema.json")
 	tkn := session.NewTokenizer(reg)
 	nowDate := time.Date(2023, 02, 01, 00, 00, 00, 0, time.UTC)
 	tkn.SetNowFunc(func() time.Time {
@@ -77,8 +81,9 @@ func TestTokenizer(t *testing.T) {
 	r := httptest.NewRequest("GET", "/sessions/whoami", nil)
 	i := identity.NewIdentity("default")
 	i.ID = uuid.FromStringOrNil("7458af86-c1d8-401c-978a-8da89133f78b")
+	i.NID = uuid.Must(uuid.NewV4())
 
-	s, err := session.NewActiveSession(r, i, conf, now, identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
+	s, err := testhelpers.NewActiveSession(r, reg, i, now, identity.CredentialsTypePassword, identity.AuthenticatorAssuranceLevel1)
 	require.NoError(t, err)
 	s.ID = uuid.FromStringOrNil("432caf86-c1d8-401c-978a-8da89133f78b")
 
diff --git a/spec/api.json b/spec/api.json
index f8a84f6f7d97..7cdd1a4482bc 100644
--- a/spec/api.json
+++ b/spec/api.json
@@ -2,7 +2,7 @@
   "components": {
     "responses": {
       "emptyResponse": {
-        "description": "Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 201."
+        "description": "Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 204."
       },
       "identitySchemas": {
         "content": {
@@ -81,6 +81,9 @@
       }
     },
     "schemas": {
+      "CodeChannel": {
+        "type": "string"
+      },
       "DefaultError": {},
       "Duration": {
         "description": "A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.",
@@ -465,6 +468,7 @@
       "continueWith": {
         "discriminator": {
           "mapping": {
+            "redirect_browser_to": "#/components/schemas/continueWithRedirectBrowserTo",
             "set_ory_session_token": "#/components/schemas/continueWithSetOrySessionToken",
             "show_recovery_ui": "#/components/schemas/continueWithRecoveryUi",
             "show_settings_ui": "#/components/schemas/continueWithSettingsUi",
@@ -484,6 +488,9 @@
           },
           {
             "$ref": "#/components/schemas/continueWithRecoveryUi"
+          },
+          {
+            "$ref": "#/components/schemas/continueWithRedirectBrowserTo"
           }
         ]
       },
@@ -516,7 +523,7 @@
             "type": "string"
           },
           "url": {
-            "description": "The URL of the recovery flow",
+            "description": "The URL of the recovery flow\n\nIf this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.",
             "type": "string"
           }
         },
@@ -525,6 +532,28 @@
         ],
         "type": "object"
       },
+      "continueWithRedirectBrowserTo": {
+        "description": "Indicates, that the UI flow could be continued by showing a recovery ui",
+        "properties": {
+          "action": {
+            "description": "Action will always be `redirect_browser_to`\nredirect_browser_to ContinueWithActionRedirectBrowserToString",
+            "enum": [
+              "redirect_browser_to"
+            ],
+            "type": "string",
+            "x-go-enum-desc": "redirect_browser_to ContinueWithActionRedirectBrowserToString"
+          },
+          "redirect_browser_to": {
+            "description": "The URL to redirect the browser to",
+            "type": "string"
+          }
+        },
+        "required": [
+          "action",
+          "redirect_browser_to"
+        ],
+        "type": "object"
+      },
       "continueWithSetOrySessionToken": {
         "description": "Indicates that a session was issued, and the application should use this token for authenticated requests",
         "properties": {
@@ -574,6 +603,10 @@
             "description": "The ID of the settings flow",
             "format": "uuid",
             "type": "string"
+          },
+          "url": {
+            "description": "The URL of the settings flow\n\nIf this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.",
+            "type": "string"
           }
         },
         "required": [
@@ -610,7 +643,7 @@
             "type": "string"
           },
           "url": {
-            "description": "The URL of the verification flow",
+            "description": "The URL of the verification flow\n\nIf this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.",
             "type": "string"
           },
           "verifiable_address": {
@@ -997,7 +1030,7 @@
             "type": "array"
           },
           "type": {
-            "description": "Type discriminates between different types of credentials.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
+            "description": "Type discriminates between different types of credentials.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
             "enum": [
               "password",
               "oidc",
@@ -1007,11 +1040,12 @@
               "code",
               "passkey",
               "profile",
+              "saml",
               "link_recovery",
               "code_recovery"
             ],
             "type": "string",
-            "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
+            "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
           },
           "updated_at": {
             "description": "UpdatedAt is a helper struct field for gobuffalo.pop.",
@@ -1029,12 +1063,23 @@
       "identityCredentialsCode": {
         "description": "CredentialsCode represents a one time login/registration code",
         "properties": {
-          "address_type": {
-            "description": "The type of the address for this code",
+          "addresses": {
+            "items": {
+              "$ref": "#/components/schemas/identityCredentialsCodeAddress"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "identityCredentialsCodeAddress": {
+        "properties": {
+          "address": {
+            "description": "The address for this code",
             "type": "string"
           },
-          "used_at": {
-            "$ref": "#/components/schemas/NullTime"
+          "channel": {
+            "$ref": "#/components/schemas/CodeChannel"
           }
         },
         "type": "object"
@@ -1080,6 +1125,10 @@
           "hashed_password": {
             "description": "HashedPassword is a hash-representation of the password.",
             "type": "string"
+          },
+          "use_password_migration_hook": {
+            "description": "UsePasswordMigrationHook is set to true if the password should be migrated\nusing the password migration hook. If set, and the HashedPassword is empty, a\nwebhook will be called during login to migrate the password.",
+            "type": "boolean"
           }
         },
         "title": "CredentialsPassword is contains the configuration for credentials of the type password.",
@@ -1103,12 +1152,16 @@
         "description": "Response for a single identity patch",
         "properties": {
           "action": {
-            "description": "The action for this specific patch\ncreate ActionCreate  Create this identity.",
+            "description": "The action for this specific patch\ncreate ActionCreate  Create this identity.\nerror ActionError  Error indicates that the patch failed.",
             "enum": [
-              "create"
+              "create",
+              "error"
             ],
             "type": "string",
-            "x-go-enum-desc": "create ActionCreate  Create this identity."
+            "x-go-enum-desc": "create ActionCreate  Create this identity.\nerror ActionError  Error indicates that the patch failed."
+          },
+          "error": {
+            "$ref": "#/components/schemas/DefaultError"
           },
           "identity": {
             "description": "The identity ID payload of this patch",
@@ -1228,6 +1281,10 @@
           "password": {
             "description": "The password in plain text if no hash is available.",
             "type": "string"
+          },
+          "use_password_migration_hook": {
+            "description": "If set to true, the password will be migrated using the password migration hook.",
+            "type": "boolean"
           }
         },
         "type": "object"
@@ -1272,7 +1329,7 @@
         "description": "This object represents a login flow. A login flow is initiated at the \"Initiate Login API / Browser Flow\"\nendpoint by a client.\n\nOnce a login flow is completed successfully, a session cookie or session token will be issued.",
         "properties": {
           "active": {
-            "description": "The active login method\n\nIf set contains the login method used. If the flow is new, it is unset.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
+            "description": "The active login method\n\nIf set contains the login method used. If the flow is new, it is unset.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
             "enum": [
               "password",
               "oidc",
@@ -1282,11 +1339,12 @@
               "code",
               "passkey",
               "profile",
+              "saml",
               "link_recovery",
               "code_recovery"
             ],
             "type": "string",
-            "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
+            "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
           },
           "created_at": {
             "description": "CreatedAt is a helper struct field for gobuffalo.pop.",
@@ -1369,13 +1427,14 @@
         "type": "object"
       },
       "loginFlowState": {
-        "description": "The state represents the state of the login flow.\n\nchoose_method: ask the user to choose a method (e.g. login account via email)\nsent_email: the email has been sent to the user\npassed_challenge: the request was successful and the login challenge was passed.",
+        "description": "The experimental state represents the state of a login flow. This field is EXPERIMENTAL and subject to change!",
         "enum": [
           "choose_method",
           "sent_email",
           "passed_challenge"
         ],
-        "title": "Login Flow State"
+        "title": "Login flow state (experimental)",
+        "type": "string"
       },
       "logoutFlow": {
         "description": "Logout Flow",
@@ -1666,13 +1725,13 @@
         "type": "object"
       },
       "recoveryFlowState": {
-        "description": "The state represents the state of the recovery flow.\n\nchoose_method: ask the user to choose a method (e.g. recover account via email)\nsent_email: the email has been sent to the user\npassed_challenge: the request was successful and the recovery challenge was passed.",
+        "description": "The experimental state represents the state of a recovery flow. This field is EXPERIMENTAL and subject to change!",
         "enum": [
           "choose_method",
           "sent_email",
           "passed_challenge"
         ],
-        "title": "Recovery Flow State"
+        "title": "Recovery flow state (experimental)"
       },
       "recoveryIdentityAddress": {
         "properties": {
@@ -1726,7 +1785,7 @@
       "registrationFlow": {
         "properties": {
           "active": {
-            "description": "Active, if set, contains the registration method that is being used. It is initially\nnot set.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
+            "description": "Active, if set, contains the registration method that is being used. It is initially\nnot set.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
             "enum": [
               "password",
               "oidc",
@@ -1736,11 +1795,12 @@
               "code",
               "passkey",
               "profile",
+              "saml",
               "link_recovery",
               "code_recovery"
             ],
             "type": "string",
-            "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
+            "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
           },
           "expires_at": {
             "description": "ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in,\na new flow has to be initiated.",
@@ -1805,13 +1865,14 @@
         "type": "object"
       },
       "registrationFlowState": {
-        "description": "choose_method: ask the user to choose a method (e.g. registration with email)\nsent_email: the email has been sent to the user\npassed_challenge: the request was successful and the registration challenge was passed.",
+        "description": "The experimental state represents the state of a registration flow. This field is EXPERIMENTAL and subject to change!",
         "enum": [
           "choose_method",
           "sent_email",
           "passed_challenge"
         ],
-        "title": "State represents the state of this request:"
+        "title": "Registration flow state (experimental)",
+        "type": "string"
       },
       "selfServiceFlowExpiredError": {
         "description": "Is sent when a flow is expired",
@@ -2033,12 +2094,13 @@
         "type": "object"
       },
       "settingsFlowState": {
-        "description": "show_form: No user data has been collected, or it is invalid, and thus the form should be shown.\nsuccess: Indicates that the settings flow has been updated successfully with the provided data.\nDone will stay true when repeatedly checking. If set to true, done will revert back to false only\nwhen a flow with invalid (e.g. \"please use a valid phone number\") data was sent.",
+        "description": "The experimental state represents the state of a settings flow. This field is EXPERIMENTAL and subject to change!",
         "enum": [
           "show_form",
           "success"
         ],
-        "title": "State represents the state of this flow. It knows two states:"
+        "title": "Settings flow state (experimental)",
+        "type": "string"
       },
       "successfulCodeExchangeResponse": {
         "description": "The Response for Registration Flows via API",
@@ -2169,7 +2231,7 @@
             "$ref": "#/components/schemas/uiNodeAttributes"
           },
           "group": {
-            "description": "Group specifies which group (e.g. password authenticator) this node belongs to.\ndefault DefaultGroup\npassword PasswordGroup\noidc OpenIDConnectGroup\nprofile ProfileGroup\nlink LinkGroup\ncode CodeGroup\ntotp TOTPGroup\nlookup_secret LookupGroup\nwebauthn WebAuthnGroup\npasskey PasskeyGroup",
+            "description": "Group specifies which group (e.g. password authenticator) this node belongs to.\ndefault DefaultGroup\npassword PasswordGroup\noidc OpenIDConnectGroup\nprofile ProfileGroup\nlink LinkGroup\ncode CodeGroup\ntotp TOTPGroup\nlookup_secret LookupGroup\nwebauthn WebAuthnGroup\npasskey PasskeyGroup\nidentifier_first IdentifierFirstGroup",
             "enum": [
               "default",
               "password",
@@ -2180,10 +2242,11 @@
               "totp",
               "lookup_secret",
               "webauthn",
-              "passkey"
+              "passkey",
+              "identifier_first"
             ],
             "type": "string",
-            "x-go-enum-desc": "default DefaultGroup\npassword PasswordGroup\noidc OpenIDConnectGroup\nprofile ProfileGroup\nlink LinkGroup\ncode CodeGroup\ntotp TOTPGroup\nlookup_secret LookupGroup\nwebauthn WebAuthnGroup\npasskey PasskeyGroup"
+            "x-go-enum-desc": "default DefaultGroup\npassword PasswordGroup\noidc OpenIDConnectGroup\nprofile ProfileGroup\nlink LinkGroup\ncode CodeGroup\ntotp TOTPGroup\nlookup_secret LookupGroup\nwebauthn WebAuthnGroup\npasskey PasskeyGroup\nidentifier_first IdentifierFirstGroup"
           },
           "messages": {
             "$ref": "#/components/schemas/uiTexts"
@@ -2345,6 +2408,11 @@
           "label": {
             "$ref": "#/components/schemas/uiText"
           },
+          "maxlength": {
+            "description": "MaxLength may contain the input's maximum length.",
+            "format": "int64",
+            "type": "integer"
+          },
           "name": {
             "description": "The input's element name.",
             "type": "string"
@@ -2362,13 +2430,39 @@
             "x-go-enum-desc": "text Text\ninput Input\nimg Image\na Anchor\nscript Script"
           },
           "onclick": {
-            "description": "OnClick may contain javascript which should be executed on click. This is primarily\nused for WebAuthn.",
+            "description": "OnClick may contain javascript which should be executed on click. This is primarily\nused for WebAuthn.\n\nDeprecated: Using OnClick requires the use of eval() which is a security risk. Use OnClickTrigger instead.",
             "type": "string"
           },
+          "onclickTrigger": {
+            "description": "OnClickTrigger may contain a WebAuthn trigger which should be executed on click.\n\nThe trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login.\noryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration\noryWebAuthnLogin WebAuthnTriggersWebAuthnLogin\noryPasskeyLogin WebAuthnTriggersPasskeyLogin\noryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit\noryPasskeyRegistration WebAuthnTriggersPasskeyRegistration\noryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration",
+            "enum": [
+              "oryWebAuthnRegistration",
+              "oryWebAuthnLogin",
+              "oryPasskeyLogin",
+              "oryPasskeyLoginAutocompleteInit",
+              "oryPasskeyRegistration",
+              "oryPasskeySettingsRegistration"
+            ],
+            "type": "string",
+            "x-go-enum-desc": "oryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration\noryWebAuthnLogin WebAuthnTriggersWebAuthnLogin\noryPasskeyLogin WebAuthnTriggersPasskeyLogin\noryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit\noryPasskeyRegistration WebAuthnTriggersPasskeyRegistration\noryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration"
+          },
           "onload": {
-            "description": "OnLoad may contain javascript which should be executed on load. This is primarily\nused for WebAuthn.",
+            "description": "OnLoad may contain javascript which should be executed on load. This is primarily\nused for WebAuthn.\n\nDeprecated: Using OnLoad requires the use of eval() which is a security risk. Use OnLoadTrigger instead.",
             "type": "string"
           },
+          "onloadTrigger": {
+            "description": "OnLoadTrigger may contain a WebAuthn trigger which should be executed on load.\n\nThe trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login.\noryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration\noryWebAuthnLogin WebAuthnTriggersWebAuthnLogin\noryPasskeyLogin WebAuthnTriggersPasskeyLogin\noryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit\noryPasskeyRegistration WebAuthnTriggersPasskeyRegistration\noryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration",
+            "enum": [
+              "oryWebAuthnRegistration",
+              "oryWebAuthnLogin",
+              "oryPasskeyLogin",
+              "oryPasskeyLoginAutocompleteInit",
+              "oryPasskeyRegistration",
+              "oryPasskeySettingsRegistration"
+            ],
+            "type": "string",
+            "x-go-enum-desc": "oryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration\noryWebAuthnLogin WebAuthnTriggersWebAuthnLogin\noryPasskeyLogin WebAuthnTriggersPasskeyLogin\noryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit\noryPasskeyRegistration WebAuthnTriggersPasskeyRegistration\noryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration"
+          },
           "pattern": {
             "description": "The input's pattern.",
             "type": "string"
@@ -2597,6 +2691,7 @@
         "discriminator": {
           "mapping": {
             "code": "#/components/schemas/updateLoginFlowWithCodeMethod",
+            "identifier_first": "#/components/schemas/updateLoginFlowWithIdentifierFirstMethod",
             "lookup_secret": "#/components/schemas/updateLoginFlowWithLookupSecretMethod",
             "oidc": "#/components/schemas/updateLoginFlowWithOidcMethod",
             "passkey": "#/components/schemas/updateLoginFlowWithPasskeyMethod",
@@ -2627,12 +2722,19 @@
           },
           {
             "$ref": "#/components/schemas/updateLoginFlowWithPasskeyMethod"
+          },
+          {
+            "$ref": "#/components/schemas/updateLoginFlowWithIdentifierFirstMethod"
           }
         ]
       },
       "updateLoginFlowWithCodeMethod": {
         "description": "Update Login flow using the code method",
         "properties": {
+          "address": {
+            "description": "Address is the address to send the code to, in case that there are multiple addresses. This field\nis only used in two-factor flows and is ineffective for passwordless flows.",
+            "type": "string"
+          },
           "code": {
             "description": "Code is the 6 digits code sent to the user",
             "type": "string"
@@ -2664,6 +2766,32 @@
         ],
         "type": "object"
       },
+      "updateLoginFlowWithIdentifierFirstMethod": {
+        "description": "Update Login Flow with Multi-Step Method",
+        "properties": {
+          "csrf_token": {
+            "description": "Sending the anti-csrf token is only required for browser login flows.",
+            "type": "string"
+          },
+          "identifier": {
+            "description": "Identifier is the email or username of the user trying to log in.",
+            "type": "string"
+          },
+          "method": {
+            "description": "Method should be set to \"password\" when logging in using the identifier and password strategy.",
+            "type": "string"
+          },
+          "transient_payload": {
+            "description": "Transient data to pass along to any webhooks",
+            "type": "object"
+          }
+        },
+        "required": [
+          "method",
+          "identifier"
+        ],
+        "type": "object"
+      },
       "updateLoginFlowWithLookupSecretMethod": {
         "description": "Update Login Flow with Lookup Secret Method",
         "properties": {
@@ -2694,7 +2822,7 @@
             "type": "string"
           },
           "id_token": {
-            "description": "IDToken is an optional id token provided by an OIDC provider\n\nIf submitted, it is verified using the OIDC provider's public key set and the claims are used to populate\nthe OIDC credentials of the identity.\nIf the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use\nthe `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.\n\nSupported providers are\nApple",
+            "description": "IDToken is an optional id token provided by an OIDC provider\n\nIf submitted, it is verified using the OIDC provider's public key set and the claims are used to populate\nthe OIDC credentials of the identity.\nIf the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use\nthe `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.\n\nSupported providers are\nApple\nGoogle",
             "type": "string"
           },
           "id_token_nonce": {
@@ -2929,8 +3057,9 @@
           "mapping": {
             "code": "#/components/schemas/updateRegistrationFlowWithCodeMethod",
             "oidc": "#/components/schemas/updateRegistrationFlowWithOidcMethod",
-            "passKey": "#/components/schemas/updateRegistrationFlowWithPasskeyMethod",
+            "passkey": "#/components/schemas/updateRegistrationFlowWithPasskeyMethod",
             "password": "#/components/schemas/updateRegistrationFlowWithPasswordMethod",
+            "profile": "#/components/schemas/updateRegistrationFlowWithProfileMethod",
             "webauthn": "#/components/schemas/updateRegistrationFlowWithWebAuthnMethod"
           },
           "propertyName": "method"
@@ -2950,6 +3079,9 @@
           },
           {
             "$ref": "#/components/schemas/updateRegistrationFlowWithPasskeyMethod"
+          },
+          {
+            "$ref": "#/components/schemas/updateRegistrationFlowWithProfileMethod"
           }
         ]
       },
@@ -2995,7 +3127,7 @@
             "type": "string"
           },
           "id_token": {
-            "description": "IDToken is an optional id token provided by an OIDC provider\n\nIf submitted, it is verified using the OIDC provider's public key set and the claims are used to populate\nthe OIDC credentials of the identity.\nIf the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use\nthe `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.\n\nSupported providers are\nApple",
+            "description": "IDToken is an optional id token provided by an OIDC provider\n\nIf submitted, it is verified using the OIDC provider's public key set and the claims are used to populate\nthe OIDC credentials of the identity.\nIf the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use\nthe `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.\n\nSupported providers are\nApple\nGoogle",
             "type": "string"
           },
           "id_token_nonce": {
@@ -3102,8 +3234,13 @@
             "type": "string"
           },
           "screen": {
-            "description": "Screen requests navigation to a previous screen.\n\nThis must be set to credential-selection to go back to the credential\nselection screen.",
-            "type": "string"
+            "description": "Screen requests navigation to a previous screen.\n\nThis must be set to credential-selection to go back to the credential\nselection screen.\ncredential-selection RegistrationScreenCredentialSelection nolint:gosec // not a credential\nprevious RegistrationScreenPrevious",
+            "enum": [
+              "credential-selection",
+              "previous"
+            ],
+            "type": "string",
+            "x-go-enum-desc": "credential-selection RegistrationScreenCredentialSelection nolint:gosec // not a credential\nprevious RegistrationScreenPrevious"
           },
           "traits": {
             "description": "Traits\n\nThe identity's traits.",
@@ -3594,13 +3731,13 @@
         "type": "object"
       },
       "verificationFlowState": {
-        "description": "The state represents the state of the verification flow.\n\nchoose_method: ask the user to choose a method (e.g. recover account via email)\nsent_email: the email has been sent to the user\npassed_challenge: the request was successful and the recovery challenge was passed.",
+        "description": "The experimental state represents the state of a verification flow. This field is EXPERIMENTAL and subject to change!",
         "enum": [
           "choose_method",
           "sent_email",
           "passed_challenge"
         ],
-        "title": "Verification Flow State"
+        "title": "Verification flow state (experimental)"
       },
       "version": {
         "properties": {
@@ -3796,7 +3933,7 @@
     },
     "/admin/identities": {
       "get": {
-        "description": "Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system.",
+        "description": "Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system. Note: filters cannot be combined.",
         "operationId": "listIdentities",
         "parameters": [
           {
@@ -3857,7 +3994,7 @@
             "x-go-enum-desc": " ConsistencyLevelUnset  ConsistencyLevelUnset is the unset / default consistency level.\nstrong ConsistencyLevelStrong  ConsistencyLevelStrong is the strong consistency level.\neventual ConsistencyLevelEventual  ConsistencyLevelEventual is the eventual consistency level using follower read timestamps."
           },
           {
-            "description": "List of ids used to filter identities.\nIf this list is empty, then no filter will be applied.",
+            "description": "Retrieve multiple identities by their IDs.\n\nThis parameter has the following limitations:\n\nDuplicate or non-existent IDs are ignored.\nThe order of returned IDs may be different from the request.\nThis filter does not support pagination. You must implement your own pagination as the maximum number of items returned by this endpoint may not exceed a certain threshold (currently 500).",
             "in": "query",
             "name": "ids",
             "schema": {
@@ -3893,6 +4030,14 @@
               },
               "type": "array"
             }
+          },
+          {
+            "description": "List identities that belong to a specific organization.",
+            "in": "query",
+            "name": "organization_id",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -4129,6 +4274,7 @@
                   "code",
                   "passkey",
                   "profile",
+                  "saml",
                   "link_recovery",
                   "code_recovery"
                 ],
@@ -4368,7 +4514,7 @@
             }
           },
           {
-            "description": "Type is the type of credentials to delete.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
+            "description": "Type is the type of credentials to delete.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
             "in": "path",
             "name": "type",
             "required": true,
@@ -4382,12 +4528,13 @@
                 "code",
                 "passkey",
                 "profile",
+                "saml",
                 "link_recovery",
                 "code_recovery"
               ],
               "type": "string"
             },
-            "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
+            "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
           },
           {
             "description": "Identifier is the identifier of the OIDC credential to delete.\nFind the identifier by calling the `GET /admin/identities/{id}?include_credential=oidc` endpoint.",
@@ -5490,7 +5637,15 @@
             }
           },
           {
-            "description": "Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.",
+            "description": "An optional organization ID that should be used for logging this user in.\nThis parameter is only effective in the Ory Network.",
+            "in": "query",
+            "name": "organization",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.\n\nDEPRECATED: This field is deprecated. Please remove it from your requests. The user will now see a choice\nof MFA credentials to choose from to perform the second factor instead.",
             "in": "query",
             "name": "via",
             "schema": {
@@ -5590,7 +5745,7 @@
             }
           },
           {
-            "description": "Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.",
+            "description": "Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.\n\nDEPRECATED: This field is deprecated. Please remove it from your requests. The user will now see a choice\nof MFA credentials to choose from to perform the second factor instead.",
             "in": "query",
             "name": "via",
             "schema": {
@@ -6286,6 +6441,14 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "description": "An optional organization ID that should be used to register this user.\nThis parameter is only effective in the Ory Network.",
+            "in": "query",
+            "name": "organization",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -6356,6 +6519,7 @@
             }
           },
           {
+            "description": "An optional organization ID that should be used to register this user.\nThis parameter is only effective in the Ory Network.",
             "in": "query",
             "name": "organization",
             "schema": {
@@ -6944,6 +7108,16 @@
       "get": {
         "description": "This endpoint initiates a verification flow for API clients such as mobile devices, smart TVs, and so on.\n\nTo fetch an existing verification flow call `/self-service/verification/flows?flow=\u003cflow_id\u003e`.\n\nYou MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server\nPages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make\nyou vulnerable to a variety of CSRF attacks.\n\nThis endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).\n\nMore information can be found at [Ory Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).",
         "operationId": "createNativeVerificationFlow",
+        "parameters": [
+          {
+            "description": "A URL contained in the return_to key of the verification flow.\nThis piece of data has no effect on the actual logic of the flow and is purely informational.",
+            "in": "query",
+            "name": "return_to",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
diff --git a/spec/swagger.json b/spec/swagger.json
index 570cb4003d62..7fbee9f76ae6 100755
--- a/spec/swagger.json
+++ b/spec/swagger.json
@@ -171,7 +171,7 @@
             "oryAccessToken": []
           }
         ],
-        "description": "Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system.",
+        "description": "Lists all [identities](https://www.ory.sh/docs/kratos/concepts/identity-user-model) in the system. Note: filters cannot be combined.",
         "produces": [
           "application/json"
         ],
@@ -237,7 +237,7 @@
             "items": {
               "type": "string"
             },
-            "description": "List of ids used to filter identities.\nIf this list is empty, then no filter will be applied.",
+            "description": "Retrieve multiple identities by their IDs.\n\nThis parameter has the following limitations:\n\nDuplicate or non-existent IDs are ignored.\nThe order of returned IDs may be different from the request.\nThis filter does not support pagination. You must implement your own pagination as the maximum number of items returned by this endpoint may not exceed a certain threshold (currently 500).",
             "name": "ids",
             "in": "query"
           },
@@ -261,6 +261,12 @@
             "description": "Include Credentials in Response\n\nInclude any credential, for example `password` or `oidc`, in the response. When set to `oidc`, This will return\nthe initial OAuth 2.0 Access Token, OAuth 2.0 Refresh Token and the OpenID Connect ID Token if available.",
             "name": "include_credential",
             "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "List identities that belong to a specific organization.",
+            "name": "organization_id",
+            "in": "query"
           }
         ],
         "responses": {
@@ -435,6 +441,7 @@
                 "code",
                 "passkey",
                 "profile",
+                "saml",
                 "link_recovery",
                 "code_recovery"
               ],
@@ -696,12 +703,13 @@
               "code",
               "passkey",
               "profile",
+              "saml",
               "link_recovery",
               "code_recovery"
             ],
             "type": "string",
-            "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
-            "description": "Type is the type of credentials to delete.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
+            "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
+            "description": "Type is the type of credentials to delete.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
             "name": "type",
             "in": "path",
             "required": true
@@ -1604,7 +1612,13 @@
           },
           {
             "type": "string",
-            "description": "Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.",
+            "description": "An optional organization ID that should be used for logging this user in.\nThis parameter is only effective in the Ory Network.",
+            "name": "organization",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.\n\nDEPRECATED: This field is deprecated. Please remove it from your requests. The user will now see a choice\nof MFA credentials to choose from to perform the second factor instead.",
             "name": "via",
             "in": "query"
           }
@@ -1685,7 +1699,7 @@
           },
           {
             "type": "string",
-            "description": "Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.",
+            "description": "Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.\n\nDEPRECATED: This field is deprecated. Please remove it from your requests. The user will now see a choice\nof MFA credentials to choose from to perform the second factor instead.",
             "name": "via",
             "in": "query"
           }
@@ -2259,6 +2273,12 @@
             "description": "The URL to return the browser to after the flow was completed.",
             "name": "return_to",
             "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "An optional organization ID that should be used to register this user.\nThis parameter is only effective in the Ory Network.",
+            "name": "organization",
+            "in": "query"
           }
         ],
         "responses": {
@@ -2319,6 +2339,7 @@
           },
           {
             "type": "string",
+            "description": "An optional organization ID that should be used to register this user.\nThis parameter is only effective in the Ory Network.",
             "name": "organization",
             "in": "query"
           }
@@ -2780,6 +2801,14 @@
         ],
         "summary": "Create Verification Flow for Native Apps",
         "operationId": "createNativeVerificationFlow",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "A URL contained in the return_to key of the verification flow.\nThis piece of data has no effect on the actual logic of the flow and is purely informational.",
+            "name": "return_to",
+            "in": "query"
+          }
+        ],
         "responses": {
           "200": {
             "description": "verificationFlow",
@@ -3245,6 +3274,9 @@
     }
   },
   "definitions": {
+    "CodeChannel": {
+      "type": "string"
+    },
     "DefaultError": {},
     "Duration": {
       "description": "A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.",
@@ -3259,20 +3291,6 @@
       "type": "object",
       "title": "JSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger."
     },
-    "NullTime": {
-      "description": "NullTime implements the [Scanner] interface so\nit can be used as a scan destination, similar to [NullString].",
-      "type": "object",
-      "title": "NullTime represents a [time.Time] that may be null.",
-      "properties": {
-        "Time": {
-          "type": "string",
-          "format": "date-time"
-        },
-        "Valid": {
-          "type": "boolean"
-        }
-      }
-    },
     "NullUUID": {
       "description": "NullUUID can be used with the standard sql package to represent a\nUUID value that can be NULL in the database.",
       "type": "object",
@@ -3290,6 +3308,10 @@
       "type": "object",
       "title": "OAuth2Client OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.",
       "properties": {
+        "AdditionalProperties": {
+          "type": "object",
+          "additionalProperties": {}
+        },
         "access_token_strategy": {
           "description": "OAuth 2.0 Access Token Strategy  AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see https://www.ory.sh/docs/hydra/advanced#json-web-tokens Setting the stragegy here overrides the global setting in `strategies.access_token`.",
           "type": "string"
@@ -3504,6 +3526,10 @@
       "description": "OAuth2ConsentRequestOpenIDConnectContext struct for OAuth2ConsentRequestOpenIDConnectContext",
       "type": "object",
       "properties": {
+        "AdditionalProperties": {
+          "type": "object",
+          "additionalProperties": {}
+        },
         "acr_values": {
           "description": "ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request. It is a parameter defined by OpenID Connect and expresses which level of authentication (e.g. 2FA) is required.  OpenID Connect defines it as follows: \u003e Requested Authentication AuthorizationContext Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference. The Authentication AuthorizationContext Class satisfied by the authentication performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a Voluntary Claim by this parameter.",
           "type": "array",
@@ -3540,6 +3566,10 @@
       "description": "OAuth2LoginRequest struct for OAuth2LoginRequest",
       "type": "object",
       "properties": {
+        "AdditionalProperties": {
+          "type": "object",
+          "additionalProperties": {}
+        },
         "challenge": {
           "description": "ID is the identifier (\\\"login challenge\\\") of the login request. It is used to identify the session.",
           "type": "string"
@@ -3654,7 +3684,29 @@
           "format": "uuid"
         },
         "url": {
-          "description": "The URL of the recovery flow",
+          "description": "The URL of the recovery flow\n\nIf this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.",
+          "type": "string"
+        }
+      }
+    },
+    "continueWithRedirectBrowserTo": {
+      "description": "Indicates, that the UI flow could be continued by showing a recovery ui",
+      "type": "object",
+      "required": [
+        "action",
+        "redirect_browser_to"
+      ],
+      "properties": {
+        "action": {
+          "description": "Action will always be `redirect_browser_to`\nredirect_browser_to ContinueWithActionRedirectBrowserToString",
+          "type": "string",
+          "enum": [
+            "redirect_browser_to"
+          ],
+          "x-go-enum-desc": "redirect_browser_to ContinueWithActionRedirectBrowserToString"
+        },
+        "redirect_browser_to": {
+          "description": "The URL to redirect the browser to",
           "type": "string"
         }
       }
@@ -3712,6 +3764,10 @@
           "description": "The ID of the settings flow",
           "type": "string",
           "format": "uuid"
+        },
+        "url": {
+          "description": "The URL of the settings flow\n\nIf this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.",
+          "type": "string"
         }
       }
     },
@@ -3749,7 +3805,7 @@
           "format": "uuid"
         },
         "url": {
-          "description": "The URL of the verification flow",
+          "description": "The URL of the verification flow\n\nIf this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.",
           "type": "string"
         },
         "verifiable_address": {
@@ -4127,7 +4183,7 @@
           }
         },
         "type": {
-          "description": "Type discriminates between different types of credentials.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
+          "description": "Type discriminates between different types of credentials.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
           "type": "string",
           "enum": [
             "password",
@@ -4138,10 +4194,11 @@
             "code",
             "passkey",
             "profile",
+            "saml",
             "link_recovery",
             "code_recovery"
           ],
-          "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
+          "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
         },
         "updated_at": {
           "description": "UpdatedAt is a helper struct field for gobuffalo.pop.",
@@ -4159,12 +4216,23 @@
       "description": "CredentialsCode represents a one time login/registration code",
       "type": "object",
       "properties": {
-        "address_type": {
-          "description": "The type of the address for this code",
+        "addresses": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/identityCredentialsCodeAddress"
+          }
+        }
+      }
+    },
+    "identityCredentialsCodeAddress": {
+      "type": "object",
+      "properties": {
+        "address": {
+          "description": "The address for this code",
           "type": "string"
         },
-        "used_at": {
-          "$ref": "#/definitions/NullTime"
+        "channel": {
+          "$ref": "#/definitions/CodeChannel"
         }
       }
     },
@@ -4211,6 +4279,10 @@
         "hashed_password": {
           "description": "HashedPassword is a hash-representation of the password.",
           "type": "string"
+        },
+        "use_password_migration_hook": {
+          "description": "UsePasswordMigrationHook is set to true if the password should be migrated\nusing the password migration hook. If set, and the HashedPassword is empty, a\nwebhook will be called during login to migrate the password.",
+          "type": "boolean"
         }
       }
     },
@@ -4233,12 +4305,16 @@
       "type": "object",
       "properties": {
         "action": {
-          "description": "The action for this specific patch\ncreate ActionCreate  Create this identity.",
+          "description": "The action for this specific patch\ncreate ActionCreate  Create this identity.\nerror ActionError  Error indicates that the patch failed.",
           "type": "string",
           "enum": [
-            "create"
+            "create",
+            "error"
           ],
-          "x-go-enum-desc": "create ActionCreate  Create this identity."
+          "x-go-enum-desc": "create ActionCreate  Create this identity.\nerror ActionError  Error indicates that the patch failed."
+        },
+        "error": {
+          "$ref": "#/definitions/DefaultError"
         },
         "identity": {
           "description": "The identity ID payload of this patch",
@@ -4359,6 +4435,10 @@
         "password": {
           "description": "The password in plain text if no hash is available.",
           "type": "string"
+        },
+        "use_password_migration_hook": {
+          "description": "If set to true, the password will be migrated using the password migration hook.",
+          "type": "boolean"
         }
       }
     },
@@ -4413,7 +4493,7 @@
       ],
       "properties": {
         "active": {
-          "description": "The active login method\n\nIf set contains the login method used. If the flow is new, it is unset.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
+          "description": "The active login method\n\nIf set contains the login method used. If the flow is new, it is unset.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
           "type": "string",
           "enum": [
             "password",
@@ -4424,10 +4504,11 @@
             "code",
             "passkey",
             "profile",
+            "saml",
             "link_recovery",
             "code_recovery"
           ],
-          "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
+          "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
         },
         "created_at": {
           "description": "CreatedAt is a helper struct field for gobuffalo.pop.",
@@ -4498,10 +4579,6 @@
         }
       }
     },
-    "loginFlowState": {
-      "description": "The state represents the state of the login flow.\n\nchoose_method: ask the user to choose a method (e.g. login account via email)\nsent_email: the email has been sent to the user\npassed_challenge: the request was successful and the login challenge was passed.",
-      "title": "Login Flow State"
-    },
     "logoutFlow": {
       "description": "Logout Flow",
       "type": "object",
@@ -4781,10 +4858,6 @@
         }
       }
     },
-    "recoveryFlowState": {
-      "description": "The state represents the state of the recovery flow.\n\nchoose_method: ask the user to choose a method (e.g. recover account via email)\nsent_email: the email has been sent to the user\npassed_challenge: the request was successful and the recovery challenge was passed.",
-      "title": "Recovery Flow State"
-    },
     "recoveryIdentityAddress": {
       "type": "object",
       "required": [
@@ -4847,7 +4920,7 @@
       ],
       "properties": {
         "active": {
-          "description": "Active, if set, contains the registration method that is being used. It is initially\nnot set.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
+          "description": "Active, if set, contains the registration method that is being used. It is initially\nnot set.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
           "type": "string",
           "enum": [
             "password",
@@ -4858,10 +4931,11 @@
             "code",
             "passkey",
             "profile",
+            "saml",
             "link_recovery",
             "code_recovery"
           ],
-          "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
+          "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
         },
         "expires_at": {
           "description": "ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in,\na new flow has to be initiated.",
@@ -4915,10 +4989,6 @@
         }
       }
     },
-    "registrationFlowState": {
-      "description": "choose_method: ask the user to choose a method (e.g. registration with email)\nsent_email: the email has been sent to the user\npassed_challenge: the request was successful and the registration challenge was passed.",
-      "title": "State represents the state of this request:"
-    },
     "selfServiceFlowExpiredError": {
       "description": "Is sent when a flow is expired",
       "type": "object",
@@ -5013,7 +5083,7 @@
           "format": "date-time"
         },
         "method": {
-          "description": "The method used in this authenticator.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
+          "description": "The method used in this authenticator.\npassword CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode",
           "type": "string",
           "enum": [
             "password",
@@ -5024,10 +5094,11 @@
             "code",
             "passkey",
             "profile",
+            "saml",
             "link_recovery",
             "code_recovery"
           ],
-          "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
+          "x-go-enum-desc": "password CredentialsTypePassword\noidc CredentialsTypeOIDC\ntotp CredentialsTypeTOTP\nlookup_secret CredentialsTypeLookup\nwebauthn CredentialsTypeWebAuthn\ncode CredentialsTypeCodeAuth\npasskey CredentialsTypePasskey\nprofile CredentialsTypeProfile\nsaml CredentialsTypeSAML\nlink_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself.\ncode_recovery CredentialsTypeRecoveryCode"
         },
         "organization": {
           "description": "The Organization id used for authentication",
@@ -5140,10 +5211,6 @@
         }
       }
     },
-    "settingsFlowState": {
-      "description": "show_form: No user data has been collected, or it is invalid, and thus the form should be shown.\nsuccess: Indicates that the settings flow has been updated successfully with the provided data.\nDone will stay true when repeatedly checking. If set to true, done will revert back to false only\nwhen a flow with invalid (e.g. \"please use a valid phone number\") data was sent.",
-      "title": "State represents the state of this flow. It knows two states:"
-    },
     "successfulCodeExchangeResponse": {
       "description": "The Response for Registration Flows via API",
       "type": "object",
@@ -5282,7 +5349,7 @@
           "$ref": "#/definitions/uiNodeAttributes"
         },
         "group": {
-          "description": "Group specifies which group (e.g. password authenticator) this node belongs to.\ndefault DefaultGroup\npassword PasswordGroup\noidc OpenIDConnectGroup\nprofile ProfileGroup\nlink LinkGroup\ncode CodeGroup\ntotp TOTPGroup\nlookup_secret LookupGroup\nwebauthn WebAuthnGroup\npasskey PasskeyGroup",
+          "description": "Group specifies which group (e.g. password authenticator) this node belongs to.\ndefault DefaultGroup\npassword PasswordGroup\noidc OpenIDConnectGroup\nprofile ProfileGroup\nlink LinkGroup\ncode CodeGroup\ntotp TOTPGroup\nlookup_secret LookupGroup\nwebauthn WebAuthnGroup\npasskey PasskeyGroup\nidentifier_first IdentifierFirstGroup",
           "type": "string",
           "enum": [
             "default",
@@ -5294,9 +5361,10 @@
             "totp",
             "lookup_secret",
             "webauthn",
-            "passkey"
+            "passkey",
+            "identifier_first"
           ],
-          "x-go-enum-desc": "default DefaultGroup\npassword PasswordGroup\noidc OpenIDConnectGroup\nprofile ProfileGroup\nlink LinkGroup\ncode CodeGroup\ntotp TOTPGroup\nlookup_secret LookupGroup\nwebauthn WebAuthnGroup\npasskey PasskeyGroup"
+          "x-go-enum-desc": "default DefaultGroup\npassword PasswordGroup\noidc OpenIDConnectGroup\nprofile ProfileGroup\nlink LinkGroup\ncode CodeGroup\ntotp TOTPGroup\nlookup_secret LookupGroup\nwebauthn WebAuthnGroup\npasskey PasskeyGroup\nidentifier_first IdentifierFirstGroup"
         },
         "messages": {
           "$ref": "#/definitions/uiTexts"
@@ -5430,6 +5498,11 @@
         "label": {
           "$ref": "#/definitions/uiText"
         },
+        "maxlength": {
+          "description": "MaxLength may contain the input's maximum length.",
+          "type": "integer",
+          "format": "int64"
+        },
         "name": {
           "description": "The input's element name.",
           "type": "string"
@@ -5447,13 +5520,39 @@
           "x-go-enum-desc": "text Text\ninput Input\nimg Image\na Anchor\nscript Script"
         },
         "onclick": {
-          "description": "OnClick may contain javascript which should be executed on click. This is primarily\nused for WebAuthn.",
+          "description": "OnClick may contain javascript which should be executed on click. This is primarily\nused for WebAuthn.\n\nDeprecated: Using OnClick requires the use of eval() which is a security risk. Use OnClickTrigger instead.",
           "type": "string"
         },
+        "onclickTrigger": {
+          "description": "OnClickTrigger may contain a WebAuthn trigger which should be executed on click.\n\nThe trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login.\noryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration\noryWebAuthnLogin WebAuthnTriggersWebAuthnLogin\noryPasskeyLogin WebAuthnTriggersPasskeyLogin\noryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit\noryPasskeyRegistration WebAuthnTriggersPasskeyRegistration\noryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration",
+          "type": "string",
+          "enum": [
+            "oryWebAuthnRegistration",
+            "oryWebAuthnLogin",
+            "oryPasskeyLogin",
+            "oryPasskeyLoginAutocompleteInit",
+            "oryPasskeyRegistration",
+            "oryPasskeySettingsRegistration"
+          ],
+          "x-go-enum-desc": "oryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration\noryWebAuthnLogin WebAuthnTriggersWebAuthnLogin\noryPasskeyLogin WebAuthnTriggersPasskeyLogin\noryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit\noryPasskeyRegistration WebAuthnTriggersPasskeyRegistration\noryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration"
+        },
         "onload": {
-          "description": "OnLoad may contain javascript which should be executed on load. This is primarily\nused for WebAuthn.",
+          "description": "OnLoad may contain javascript which should be executed on load. This is primarily\nused for WebAuthn.\n\nDeprecated: Using OnLoad requires the use of eval() which is a security risk. Use OnLoadTrigger instead.",
           "type": "string"
         },
+        "onloadTrigger": {
+          "description": "OnLoadTrigger may contain a WebAuthn trigger which should be executed on load.\n\nThe trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login.\noryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration\noryWebAuthnLogin WebAuthnTriggersWebAuthnLogin\noryPasskeyLogin WebAuthnTriggersPasskeyLogin\noryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit\noryPasskeyRegistration WebAuthnTriggersPasskeyRegistration\noryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration",
+          "type": "string",
+          "enum": [
+            "oryWebAuthnRegistration",
+            "oryWebAuthnLogin",
+            "oryPasskeyLogin",
+            "oryPasskeyLoginAutocompleteInit",
+            "oryPasskeyRegistration",
+            "oryPasskeySettingsRegistration"
+          ],
+          "x-go-enum-desc": "oryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration\noryWebAuthnLogin WebAuthnTriggersWebAuthnLogin\noryPasskeyLogin WebAuthnTriggersPasskeyLogin\noryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit\noryPasskeyRegistration WebAuthnTriggersPasskeyRegistration\noryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration"
+        },
         "pattern": {
           "description": "The input's pattern.",
           "type": "string"
@@ -5683,6 +5782,10 @@
         "csrf_token"
       ],
       "properties": {
+        "address": {
+          "description": "Address is the address to send the code to, in case that there are multiple addresses. This field\nis only used in two-factor flows and is ineffective for passwordless flows.",
+          "type": "string"
+        },
         "code": {
           "description": "Code is the 6 digits code sent to the user",
           "type": "string"
@@ -5709,6 +5812,32 @@
         }
       }
     },
+    "updateLoginFlowWithIdentifierFirstMethod": {
+      "description": "Update Login Flow with Multi-Step Method",
+      "type": "object",
+      "required": [
+        "method",
+        "identifier"
+      ],
+      "properties": {
+        "csrf_token": {
+          "description": "Sending the anti-csrf token is only required for browser login flows.",
+          "type": "string"
+        },
+        "identifier": {
+          "description": "Identifier is the email or username of the user trying to log in.",
+          "type": "string"
+        },
+        "method": {
+          "description": "Method should be set to \"password\" when logging in using the identifier and password strategy.",
+          "type": "string"
+        },
+        "transient_payload": {
+          "description": "Transient data to pass along to any webhooks",
+          "type": "object"
+        }
+      }
+    },
     "updateLoginFlowWithLookupSecretMethod": {
       "description": "Update Login Flow with Lookup Secret Method",
       "type": "object",
@@ -5744,7 +5873,7 @@
           "type": "string"
         },
         "id_token": {
-          "description": "IDToken is an optional id token provided by an OIDC provider\n\nIf submitted, it is verified using the OIDC provider's public key set and the claims are used to populate\nthe OIDC credentials of the identity.\nIf the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use\nthe `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.\n\nSupported providers are\nApple",
+          "description": "IDToken is an optional id token provided by an OIDC provider\n\nIf submitted, it is verified using the OIDC provider's public key set and the claims are used to populate\nthe OIDC credentials of the identity.\nIf the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use\nthe `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.\n\nSupported providers are\nApple\nGoogle",
           "type": "string"
         },
         "id_token_nonce": {
@@ -6005,7 +6134,7 @@
           "type": "string"
         },
         "id_token": {
-          "description": "IDToken is an optional id token provided by an OIDC provider\n\nIf submitted, it is verified using the OIDC provider's public key set and the claims are used to populate\nthe OIDC credentials of the identity.\nIf the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use\nthe `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.\n\nSupported providers are\nApple",
+          "description": "IDToken is an optional id token provided by an OIDC provider\n\nIf submitted, it is verified using the OIDC provider's public key set and the claims are used to populate\nthe OIDC credentials of the identity.\nIf the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use\nthe `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken.\n\nSupported providers are\nApple\nGoogle",
           "type": "string"
         },
         "id_token_nonce": {
@@ -6112,8 +6241,13 @@
           "type": "string"
         },
         "screen": {
-          "description": "Screen requests navigation to a previous screen.\n\nThis must be set to credential-selection to go back to the credential\nselection screen.",
-          "type": "string"
+          "description": "Screen requests navigation to a previous screen.\n\nThis must be set to credential-selection to go back to the credential\nselection screen.\ncredential-selection RegistrationScreenCredentialSelection nolint:gosec // not a credential\nprevious RegistrationScreenPrevious",
+          "type": "string",
+          "enum": [
+            "credential-selection",
+            "previous"
+          ],
+          "x-go-enum-desc": "credential-selection RegistrationScreenCredentialSelection nolint:gosec // not a credential\nprevious RegistrationScreenPrevious"
         },
         "traits": {
           "description": "Traits\n\nThe identity's traits.",
@@ -6550,10 +6684,6 @@
         }
       }
     },
-    "verificationFlowState": {
-      "description": "The state represents the state of the verification flow.\n\nchoose_method: ask the user to choose a method (e.g. recover account via email)\nsent_email: the email has been sent to the user\npassed_challenge: the request was successful and the recovery challenge was passed.",
-      "title": "Verification Flow State"
-    },
     "version": {
       "type": "object",
       "properties": {
@@ -6569,7 +6699,7 @@
   },
   "responses": {
     "emptyResponse": {
-      "description": "Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 201."
+      "description": "Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 204."
     },
     "identitySchemas": {
       "description": "List Identity JSON Schemas Response",
diff --git a/test/e2e/cypress/helpers/index.ts b/test/e2e/cypress/helpers/index.ts
index 52bcb339ad50..ef61a5546bba 100644
--- a/test/e2e/cypress/helpers/index.ts
+++ b/test/e2e/cypress/helpers/index.ts
@@ -95,7 +95,7 @@ export const appPrefix = (app) => `[data-testid="app-${app}"] `
 
 export const codeRegex = /(\d{6})/
 
-export function extractRecoveryCode(body: string): string | null {
+export function extractOTPCode(body: string): string | null {
   const result = codeRegex.exec(body)
   if (result != null && result.length > 0) {
     return result[0]
diff --git a/test/e2e/cypress/integration/profiles/code/login/error.spec.ts b/test/e2e/cypress/integration/profiles/code/login/error.spec.ts
index 477a149f9b26..cf929a1df6fb 100644
--- a/test/e2e/cypress/integration/profiles/code/login/error.spec.ts
+++ b/test/e2e/cypress/integration/profiles/code/login/error.spec.ts
@@ -78,12 +78,9 @@ context("Login error messages with code method", () => {
 
         cy.submitCodeForm(app)
 
-        cy.get('[data-testid="ui/message/1010014"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1010014"]').should("exist")
 
-        cy.get(Selectors[app]["code"]).type("invalid-code")
+        cy.get(Selectors[app]["code"]).type("123456")
         cy.submitCodeForm(app)
 
         cy.get('[data-testid="ui/message/4010008"]').should(
@@ -113,7 +110,7 @@ context("Login error messages with code method", () => {
             .type(gen.email(), { force: true })
         }
 
-        cy.get(Selectors[app]["code"]).type("invalid-code")
+        cy.get(Selectors[app]["code"]).type("123456")
 
         cy.submitCodeForm(app)
         if (app !== "express") {
@@ -147,7 +144,7 @@ context("Login error messages with code method", () => {
           )
         }
 
-        cy.get(Selectors[app]["code"]).type("invalid-code")
+        cy.get(Selectors[app]["code"]).type("123456")
         cy.removeAttribute([Selectors[app]["identity"]], "required")
 
         cy.get(Selectors[app]["identity"]).type("{selectall}{backspace}", {
@@ -160,6 +157,12 @@ context("Login error messages with code method", () => {
             "contain",
             "Property identifier is missing",
           )
+        } else if (app === "react") {
+          // The backspace trick is not working in React.
+          cy.get('[data-testid="ui/message/4010008"]').should(
+            "contain",
+            "code is invalid",
+          )
         } else {
           cy.get('[data-testid="ui/message/4000002"]').should(
             "contain",
diff --git a/test/e2e/cypress/integration/profiles/code/registration/error.spec.ts b/test/e2e/cypress/integration/profiles/code/registration/error.spec.ts
index ef435991f736..a1e10a196c02 100644
--- a/test/e2e/cypress/integration/profiles/code/registration/error.spec.ts
+++ b/test/e2e/cypress/integration/profiles/code/registration/error.spec.ts
@@ -69,12 +69,9 @@ context("Registration error messages with code method", () => {
 
         cy.submitCodeForm(app)
 
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
-        cy.get(Selectors[app]["code"]).type("invalid-code")
+        cy.get(Selectors[app]["code"]).type("123456")
         cy.submitCodeForm(app)
 
         cy.get('[data-testid="ui/message/4040003"]').should(
@@ -90,10 +87,7 @@ context("Registration error messages with code method", () => {
         cy.get(Selectors[app]["tos"]).click()
 
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         if (app !== "express") {
           // the mobile app doesn't render hidden fields in the DOM
@@ -111,7 +105,7 @@ context("Registration error messages with code method", () => {
             .type("changed-email@email.com", { force: true })
         }
 
-        cy.get(Selectors[app]["code"]).type("invalid-code")
+        cy.get(Selectors[app]["code"]).type("123456")
         cy.submitCodeForm(app)
 
         if (app !== "express") {
@@ -131,10 +125,7 @@ context("Registration error messages with code method", () => {
         cy.get(Selectors[app]["tos"]).click()
 
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         cy.removeAttribute([Selectors[app]["code"]], "required")
 
@@ -174,7 +165,7 @@ context("Registration error messages with code method", () => {
           })
           cy.removeAttribute([Selectors[app]["email"]], "required")
         }
-        cy.get(Selectors[app]["code"]).type("invalid-code")
+        cy.get(Selectors[app]["code"]).type("123456")
 
         cy.submitCodeForm(app)
 
@@ -200,10 +191,7 @@ context("Registration error messages with code method", () => {
         cy.get(Selectors[app]["tos"]).click()
 
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         cy.getRegistrationCodeFromEmail(email).then((code) => {
           cy.get(Selectors[app]["code"]).type(code)
diff --git a/test/e2e/cypress/integration/profiles/code/registration/success.spec.ts b/test/e2e/cypress/integration/profiles/code/registration/success.spec.ts
index c715d80cd86e..91c48b760f1c 100644
--- a/test/e2e/cypress/integration/profiles/code/registration/success.spec.ts
+++ b/test/e2e/cypress/integration/profiles/code/registration/success.spec.ts
@@ -98,10 +98,7 @@ context("Registration success with code method", () => {
         cy.get(Selectors[app]["tos"]).click()
 
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         cy.getRegistrationCodeFromEmail(email).then((code) =>
           cy.wrap(code).as("code1"),
@@ -166,10 +163,7 @@ context("Registration success with code method", () => {
         cy.get(Selectors[app]["tos"]).click()
 
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         cy.getRegistrationCodeFromEmail(email).should((code) => {
           cy.get(Selectors[app]["code"]).type(code)
@@ -216,10 +210,7 @@ context("Registration success with code method", () => {
         cy.get(Selectors[app]["tos"]).click()
 
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         cy.getRegistrationCodeFromEmail(email).should((code) => {
           cy.get(Selectors[app]["code"]).type(code)
@@ -329,10 +320,7 @@ context("Registration success with code method", () => {
         cy.get(Selectors[app]["email2"]).type(email2)
 
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         // intentionally use email 1 to sign up for the account
         cy.getRegistrationCodeFromEmail(email, { expectedCount: 1 }).should(
diff --git a/test/e2e/cypress/integration/profiles/email/logout/success.spec.ts b/test/e2e/cypress/integration/profiles/email/logout/success.spec.ts
index f13358166afb..3926f21012b1 100644
--- a/test/e2e/cypress/integration/profiles/email/logout/success.spec.ts
+++ b/test/e2e/cypress/integration/profiles/email/logout/success.spec.ts
@@ -75,12 +75,12 @@ context("Testing logout flows", () => {
 
         cy.visit(settings, {
           qs: {
-            return_to: "https://www.ory.sh",
+            return_to: "https://www.example.org",
           },
         })
 
         cy.get("a[href*='logout']").click()
-        cy.location("host").should("eq", "www.ory.sh")
+        cy.location("host").should("eq", "www.example.org")
       })
 
       it("should be able to sign out on welcome page", () => {
@@ -94,12 +94,12 @@ context("Testing logout flows", () => {
 
         cy.visit(welcome, {
           qs: {
-            return_to: "https://www.ory.sh",
+            return_to: "https://www.example.org",
           },
         })
 
         cy.get("a[href*='logout']").click()
-        cy.location("host").should("eq", "www.ory.sh")
+        cy.location("host").should("eq", "www.example.org")
       })
 
       it("should be able to sign out at 2fa page", () => {
@@ -122,7 +122,7 @@ context("Testing logout flows", () => {
         cy.logout()
         cy.visit(route, {
           qs: {
-            return_to: "https://www.ory.sh",
+            return_to: "https://www.example.org",
           },
         })
 
@@ -135,7 +135,7 @@ context("Testing logout flows", () => {
 
         cy.get("a[href*='logout']").click()
 
-        cy.location("host").should("eq", "www.ory.sh")
+        cy.location("host").should("eq", "www.example.org")
         cy.useLookupSecrets(false)
       })
     })
diff --git a/test/e2e/cypress/integration/profiles/mfa/code.spec.ts b/test/e2e/cypress/integration/profiles/mfa/code.spec.ts
index 7961aa850de9..313e85e5382c 100644
--- a/test/e2e/cypress/integration/profiles/mfa/code.spec.ts
+++ b/test/e2e/cypress/integration/profiles/mfa/code.spec.ts
@@ -3,7 +3,6 @@
 
 import { gen, website } from "../../../helpers"
 import { routes as express } from "../../../helpers/express"
-import { routes as react } from "../../../helpers/react"
 
 context("2FA code", () => {
   ;[
@@ -31,72 +30,110 @@ context("2FA code", () => {
       let email: string
       let password: string
 
-      beforeEach(() => {
-        email = gen.email()
-        password = gen.password()
-        cy.useConfig((builder) =>
-          builder
-            .longPrivilegedSessionTime()
-            .useLaxAal()
-            .enableCode()
-            .enableCodeMFA(),
-        )
-
-        cy.register({
-          email,
-          password,
-          fields: { "traits.website": website },
+      describe("when using highest_available aal", () => {
+        beforeEach(() => {
+          cy.useConfig((builder) =>
+            builder
+              .longPrivilegedSessionTime()
+              .useHighestAvailable()
+              .enableCodeMFA(),
+          )
         })
-        cy.deleteMail()
-        cy.visit(login + "?aal=aal2&via=email")
-      })
 
-      it("should be asked to sign in with 2fa if set up", () => {
-        cy.get("input[name='identifier']").type(email)
-        cy.contains("Continue with code").click()
+        it("should show second factor screen on whoami call", () => {
+          email = gen.email()
+          password = gen.password()
+          cy.register({
+            email,
+            password,
+            fields: { "traits.website": website },
+          })
+          cy.deleteMail()
 
-        cy.get("input[name='code']").should("be.visible")
-        cy.getLoginCodeFromEmail(email).then((code) => {
-          cy.get("input[name='code']").type(code)
-          cy.contains("Submit").click()
-        })
+          cy.visit(settings)
+          cy.location("pathname").should("contain", "/login") // we get redirected to login
+
+          cy.get("[type='submit'][name='address']").should("be.visible").click()
+
+          cy.getLoginCodeFromEmail(email).then((code) => {
+            cy.get("input[name='code']").type(code)
+            cy.contains("Continue").click()
+          })
 
-        cy.getSession({
-          expectAal: "aal2",
-          expectMethods: ["password", "code"],
+          cy.getSession({
+            expectAal: "aal2",
+            expectMethods: ["password", "code"],
+          })
         })
       })
 
-      it("can't use different email in 2fa request", () => {
-        cy.get("input[name='identifier']").type(gen.email())
-        cy.contains("Continue with code").click()
+      describe("when using aal1 required aal", () => {
+        beforeEach(() => {
+          email = gen.email()
+          password = gen.password()
+          cy.useConfig((builder) =>
+            builder
+              .longPrivilegedSessionTime()
+              .useLaxAal()
+              .enableCode()
+              .enableCodeMFA(),
+          )
+
+          cy.register({
+            email,
+            password,
+            fields: { "traits.website": website },
+          })
+          cy.deleteMail()
+          cy.visit(login + "?aal=aal2&via=email")
+        })
+
+        it("should be asked to sign in with 2fa if set up", () => {
+          cy.get("*[name='address']").click()
 
-        cy.get("*[data-testid='ui/message/4010010']").should("be.visible")
-        cy.get("input[name='code']").should("not.exist")
-        cy.get("input[name='identifier']").should("be.visible")
+          cy.get("input[name='code']").should("be.visible")
+          cy.getLoginCodeFromEmail(email).then((code) => {
+            cy.get("input[name='code']").type(code)
+            cy.contains("Continue").click()
+          })
 
-        // The current session should be unchanged
-        cy.getSession({
-          expectAal: "aal1",
-          expectMethods: ["password"],
+          cy.getSession({
+            expectAal: "aal2",
+            expectMethods: ["password", "code"],
+          })
         })
-      })
 
-      it("entering wrong code should not invalidate correct codes", () => {
-        cy.get("input[name='identifier']").type(email)
-        cy.contains("Continue with code").click()
+        it("can't use different email in 2fa request", () => {
+          cy.get('[name="address"]').invoke("attr", "value", gen.email())
+
+          cy.get('[name="address"]').click()
+
+          cy.get("*[data-testid='ui/message/4000035']").should("be.visible")
+          cy.get("input[name='code']").should("not.exist")
+          cy.get("[name='address']").should("be.visible")
 
-        cy.get("input[name='code']").should("be.visible")
-        cy.get("input[name='code']").type("123456")
-        cy.contains("Submit").click()
-        cy.getLoginCodeFromEmail(email).then((code) => {
-          cy.get("input[name='code']").type(code)
-          cy.contains("Submit").click()
+          // The current session should be unchanged
+          cy.getSession({
+            expectAal: "aal1",
+            expectMethods: ["password"],
+          })
         })
 
-        cy.getSession({
-          expectAal: "aal2",
-          expectMethods: ["password", "code"],
+        it("entering wrong code should not invalidate correct codes", () => {
+          cy.get("*[name='address']").click()
+
+          cy.get("input[name='code']").should("be.visible").type("123456")
+
+          cy.contains("Continue").click()
+          cy.getLoginCodeFromEmail(email).then((code) => {
+            cy.get("input[name='code']").type(code)
+            cy.contains("Continue").click()
+          })
+
+          cy.getSession({
+            expectAal: "aal2",
+            expectMethods: ["password", "code"],
+          })
         })
       })
     })
diff --git a/test/e2e/cypress/integration/profiles/mfa/lookup.spec.ts b/test/e2e/cypress/integration/profiles/mfa/lookup.spec.ts
index 40e6c7e7984a..1bb4e2f94898 100644
--- a/test/e2e/cypress/integration/profiles/mfa/lookup.spec.ts
+++ b/test/e2e/cypress/integration/profiles/mfa/lookup.spec.ts
@@ -34,6 +34,7 @@ context("2FA lookup secrets", () => {
       beforeEach(() => {
         cy.visit(base)
         cy.clearAllCookies()
+        cy.useConfig((builder) => builder.disableCodeMfa())
         email = gen.email()
         password = gen.password()
         cy.registerApi({
@@ -191,10 +192,9 @@ context("2FA lookup secrets", () => {
         cy.visit(settings)
         cy.get('button[name="lookup_secret_reveal"]').click()
         cy.getLookupSecrets().should((c) => {
-          let newCodes = codes
-          newCodes[0] = "Used"
-          newCodes[1] = "Used"
-          expect(c).to.eql(newCodes)
+          expect(c.slice(2)).to.eql(codes.slice(2))
+          expect(c[0]).to.match(/(Secret was used at )|(Used)/g)
+          expect(c[1]).to.match(/(Secret was used at )|(Used)/g)
         })
 
         // Regenerating the codes means the old one become invalid
@@ -234,9 +234,8 @@ context("2FA lookup secrets", () => {
         cy.visit(settings)
         cy.get('button[name="lookup_secret_reveal"]').click()
         cy.getLookupSecrets().should((c) => {
-          let newCodes = regenCodes
-          newCodes[0] = "Used"
-          expect(c).to.eql(newCodes)
+          expect(c.slice(1)).to.eql(regenCodes.slice(1))
+          expect(c[0]).to.match(/(Secret was used at )|(Used)/g)
         })
       })
 
diff --git a/test/e2e/cypress/integration/profiles/mfa/settings.spec.ts b/test/e2e/cypress/integration/profiles/mfa/settings.spec.ts
index 2b2e312a136a..329cb0ffc04b 100644
--- a/test/e2e/cypress/integration/profiles/mfa/settings.spec.ts
+++ b/test/e2e/cypress/integration/profiles/mfa/settings.spec.ts
@@ -39,6 +39,7 @@ context("2FA UI settings tests", () => {
 
       beforeEach(() => {
         cy.clearAllCookies()
+        cy.useConfig((builder) => builder.disableCodeMfa())
         cy.login({ email, password, cookieUrl: base })
         cy.visit(settings)
       })
diff --git a/test/e2e/cypress/integration/profiles/mfa/totp.spec.ts b/test/e2e/cypress/integration/profiles/mfa/totp.spec.ts
index a193bcb6ceed..d3523dc241b1 100644
--- a/test/e2e/cypress/integration/profiles/mfa/totp.spec.ts
+++ b/test/e2e/cypress/integration/profiles/mfa/totp.spec.ts
@@ -34,7 +34,7 @@ context("2FA TOTP", () => {
 
       beforeEach(() => {
         cy.useConfig((builder) =>
-          builder.longPrivilegedSessionTime().useLaxAal(),
+          builder.longPrivilegedSessionTime().useLaxAal().disableCodeMfa(),
         )
         email = gen.email()
         password = gen.password()
diff --git a/test/e2e/cypress/integration/profiles/mfa/webauthn.spec.ts b/test/e2e/cypress/integration/profiles/mfa/webauthn.spec.ts
index 07be1001d323..9e6b260a7922 100644
--- a/test/e2e/cypress/integration/profiles/mfa/webauthn.spec.ts
+++ b/test/e2e/cypress/integration/profiles/mfa/webauthn.spec.ts
@@ -37,6 +37,7 @@ context("2FA WebAuthn", () => {
       beforeEach(() => {
         cy.clearAllCookies()
 
+        cy.useConfig((builder) => builder.disableCodeMfa())
         email = gen.email()
         password = gen.password()
         cy.registerApi({
diff --git a/test/e2e/cypress/integration/profiles/mobile/settings/success.spec.ts b/test/e2e/cypress/integration/profiles/mobile/settings/success.spec.ts
index 89d295bfba7f..fe65ac033e74 100644
--- a/test/e2e/cypress/integration/profiles/mobile/settings/success.spec.ts
+++ b/test/e2e/cypress/integration/profiles/mobile/settings/success.spec.ts
@@ -25,6 +25,7 @@ context("Mobile Profile", () => {
 
       beforeEach(() => {
         cy.loginMobile({ email, password })
+        cy.location("pathname").should("not.contain", "/Login")
         cy.visit(MOBILE_URL + "/Settings")
       })
 
@@ -67,6 +68,7 @@ context("Mobile Profile", () => {
           fields: { "traits.website": website },
         })
         cy.loginMobile({ email, password })
+        cy.location("pathname").should("not.contain", "/Login")
         cy.visit(MOBILE_URL + "/Settings")
       })
 
diff --git a/test/e2e/cypress/integration/profiles/oidc-provider/login.spec.ts b/test/e2e/cypress/integration/profiles/oidc-provider/login.spec.ts
index 861cfd0d2a79..d7f73f44872c 100644
--- a/test/e2e/cypress/integration/profiles/oidc-provider/login.spec.ts
+++ b/test/e2e/cypress/integration/profiles/oidc-provider/login.spec.ts
@@ -218,14 +218,20 @@ context("OpenID Provider - change between flows", () => {
   })
 
   it("switch to recovery flow with password reset", () => {
+    cy.updateConfigFile((config) => {
+      config.selfservice.flows.recovery.lifespan = "1m"
+      config.selfservice.methods.link.config.lifespan = "1m"
+      config.selfservice.flows.verification.enabled = false
+      if (!config.selfservice.flows.recovery) {
+        config.selfservice.flows.recovery = {}
+      }
+      config.selfservice.flows.recovery.enabled = true
+      config.selfservice.flows.settings.privileged_session_max_age = "5m"
+      return config
+    })
     cy.deleteMail()
-    cy.longRecoveryLifespan()
-    cy.longLinkLifespan()
-    cy.disableVerification()
-    cy.enableRecovery()
     cy.useRecoveryStrategy("code")
     cy.notifyUnknownRecipients("recovery", false)
-    cy.longPrivilegedSessionTime()
 
     const identity = gen.identityWithWebsite()
     cy.registerApi(identity)
diff --git a/test/e2e/cypress/integration/profiles/oidc/login/success.spec.ts b/test/e2e/cypress/integration/profiles/oidc/login/success.spec.ts
index 8e381e7acf5d..853c165df949 100644
--- a/test/e2e/cypress/integration/profiles/oidc/login/success.spec.ts
+++ b/test/e2e/cypress/integration/profiles/oidc/login/success.spec.ts
@@ -60,7 +60,6 @@ context("Social Sign In Successes", () => {
         cy.noSession()
 
         // Log in with the same identifier through the login flow. This should link the accounts.
-        cy.get(`${appPrefix(app)}input[name="identifier"]`).type(email)
         cy.get('input[name="password"]').type(password)
         cy.submitPasswordForm()
         cy.location("pathname").should("not.contain", "/login")
@@ -70,7 +69,7 @@ context("Social Sign In Successes", () => {
         cy.visit(settings)
         cy.get('[value="hydra"]')
           .should("have.attr", "name", "unlink")
-          .should("contain.text", "Unlink hydra")
+          .should("contain.text", "Unlink Ory")
       })
 
       it("should be able to sign up with redirects", () => {
diff --git a/test/e2e/cypress/integration/profiles/oidc/registration/success.spec.ts b/test/e2e/cypress/integration/profiles/oidc/registration/success.spec.ts
index 370d5f0ff253..132845623f31 100644
--- a/test/e2e/cypress/integration/profiles/oidc/registration/success.spec.ts
+++ b/test/e2e/cypress/integration/profiles/oidc/registration/success.spec.ts
@@ -194,9 +194,9 @@ context("Social Sign Up Successes", () => {
           app,
           email,
           website,
-          route: registration + "?return_to=https://www.ory.sh/",
+          route: registration + "?return_to=https://www.example.org/",
         })
-        cy.location("href").should("eq", "https://www.ory.sh/")
+        cy.location("href").should("eq", "https://www.example.org/")
         cy.logout()
       })
 
@@ -252,7 +252,6 @@ context("Social Sign Up Successes", () => {
 
         cy.location("href").should("contain", "/login")
 
-        cy.get("[name='provider'][value='hydra']").should("be.visible")
         cy.get("[name='provider'][value='google']").should("be.visible")
         cy.get("[name='provider'][value='github']").should("be.visible")
 
@@ -260,7 +259,6 @@ context("Social Sign Up Successes", () => {
           cy.get("[data-testid='forgot-password-link']").should("be.visible")
         }
 
-        cy.get("input[name='identifier']").type(email)
         cy.get("input[name='password']").type(password)
         cy.submitPasswordForm()
         cy.getSession()
diff --git a/test/e2e/cypress/integration/profiles/oidc/settings/success.spec.ts b/test/e2e/cypress/integration/profiles/oidc/settings/success.spec.ts
index 674e24e0d668..8eaec262b303 100644
--- a/test/e2e/cypress/integration/profiles/oidc/settings/success.spec.ts
+++ b/test/e2e/cypress/integration/profiles/oidc/settings/success.spec.ts
@@ -44,7 +44,7 @@ context("Social Sign In Settings Success", () => {
 
         cy.get('[data-testid="ui/message/1010016"]').should(
           "contain.text",
-          "Signing in will link your account",
+          "as another way to sign in.",
         )
 
         cy.noSession()
@@ -94,7 +94,7 @@ context("Social Sign In Settings Success", () => {
 
           cy.get('[value="hydra"]')
             .should("have.attr", "name", "unlink")
-            .should("contain.text", "Unlink hydra")
+            .should("contain.text", "Unlink Ory")
         })
 
         it("should link google", () => {
diff --git a/test/e2e/cypress/integration/profiles/recovery/code/errors.spec.ts b/test/e2e/cypress/integration/profiles/recovery/code/errors.spec.ts
index 23d877049e6c..8da454cfdfe7 100644
--- a/test/e2e/cypress/integration/profiles/recovery/code/errors.spec.ts
+++ b/test/e2e/cypress/integration/profiles/recovery/code/errors.spec.ts
@@ -1,7 +1,7 @@
 // Copyright © 2023 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
-import { appPrefix, email, extractRecoveryCode, gen } from "../../../../helpers"
+import { appPrefix, email, extractOTPCode, gen } from "../../../../helpers"
 import { routes as express } from "../../../../helpers/express"
 import { routes as react } from "../../../../helpers/react"
 
@@ -123,7 +123,7 @@ context("Account Recovery Errors", () => {
           expect(message.toAddresses).to.have.length(1)
           expect(message.toAddresses[0].trim()).to.equal(email)
 
-          const code = extractRecoveryCode(message.body)
+          const code = extractOTPCode(message.body)
           expect(code).to.be.null
         })
       })
diff --git a/test/e2e/cypress/integration/profiles/recovery/code/success.spec.ts b/test/e2e/cypress/integration/profiles/recovery/code/success.spec.ts
index a27bca61d967..baafe5a389c7 100644
--- a/test/e2e/cypress/integration/profiles/recovery/code/success.spec.ts
+++ b/test/e2e/cypress/integration/profiles/recovery/code/success.spec.ts
@@ -180,7 +180,7 @@ context("Account Recovery With Code Success", () => {
 
     const identity = gen.identityWithWebsite()
     cy.registerApi(identity)
-    cy.visit(express.recovery + "?return_to=https://www.ory.sh/")
+    cy.visit(express.recovery + "?return_to=https://www.example.org/")
     cy.get("input[name='email']").type(identity.email)
     cy.get("button[value='code']").click()
     cy.get('[data-testid="ui/message/1060003"]').should(
@@ -196,6 +196,6 @@ context("Account Recovery With Code Success", () => {
 
     cy.get('input[name="password"]').clear().type(gen.password())
     cy.get('button[value="password"]').click()
-    cy.url().should("eq", "https://www.ory.sh/")
+    cy.url().should("eq", "https://www.example.org/")
   })
 })
diff --git a/test/e2e/cypress/integration/profiles/recovery/link/success.spec.ts b/test/e2e/cypress/integration/profiles/recovery/link/success.spec.ts
index fc4137200b59..abfa089375b8 100644
--- a/test/e2e/cypress/integration/profiles/recovery/link/success.spec.ts
+++ b/test/e2e/cypress/integration/profiles/recovery/link/success.spec.ts
@@ -109,7 +109,10 @@ context("Account Recovery Success", () => {
     const identity = gen.identityWithWebsite()
     cy.registerApi(identity)
 
-    cy.recoverApi({ email: identity.email, returnTo: "https://www.ory.sh/" })
+    cy.recoverApi({
+      email: identity.email,
+      returnTo: "https://www.example.org/",
+    })
 
     cy.recoverEmail({ expect: identity })
 
@@ -120,7 +123,7 @@ context("Account Recovery Success", () => {
       .clear()
       .type(gen.password())
     cy.get('button[value="password"]').click()
-    cy.url().should("eq", "https://www.ory.sh/")
+    cy.url().should("eq", "https://www.example.org/")
   })
 
   it("should recover even if already logged into another account", () => {
diff --git a/test/e2e/cypress/integration/profiles/recovery/return-to/success.spec.ts b/test/e2e/cypress/integration/profiles/recovery/return-to/success.spec.ts
index 0fa3f12a9524..af5ffa0acd1c 100644
--- a/test/e2e/cypress/integration/profiles/recovery/return-to/success.spec.ts
+++ b/test/e2e/cypress/integration/profiles/recovery/return-to/success.spec.ts
@@ -63,7 +63,7 @@ context("Recovery with `return_to`", () => {
       }
 
       it("should return to the `return_to` url after successful account recovery and settings update", () => {
-        cy.visit(recovery + "?return_to=https://www.ory.sh/")
+        cy.visit(recovery + "?return_to=https://www.example.org/")
         doRecovery()
 
         cy.get('[data-testid="ui/message/1060001"]', { timeout: 30000 }).should(
@@ -80,7 +80,7 @@ context("Recovery with `return_to`", () => {
           .type(newPassword)
         cy.get('button[value="password"]').click()
 
-        cy.location("hostname").should("eq", "www.ory.sh")
+        cy.location("hostname").should("eq", "www.example.org")
       })
 
       it("should return to the `return_to` url even with mfa enabled after successful account recovery and settings update", () => {
@@ -108,7 +108,7 @@ context("Recovery with `return_to`", () => {
         cy.logout()
         cy.clearAllCookies()
 
-        cy.visit(recovery + "?return_to=https://www.ory.sh/")
+        cy.visit(recovery + "?return_to=https://www.example.org/")
         doRecovery()
 
         cy.shouldShow2FAScreen()
@@ -122,7 +122,7 @@ context("Recovery with `return_to`", () => {
           .clear()
           .type(newPassword)
         cy.get('button[value="password"]').click()
-        cy.location("hostname").should("eq", "www.ory.sh")
+        cy.location("hostname").should("eq", "www.example.org")
       })
     })
   })
diff --git a/test/e2e/cypress/integration/profiles/two-steps/registration/code.spec.ts b/test/e2e/cypress/integration/profiles/two-steps/registration/code.spec.ts
index bffafb36ee03..41cc98c03eb8 100644
--- a/test/e2e/cypress/integration/profiles/two-steps/registration/code.spec.ts
+++ b/test/e2e/cypress/integration/profiles/two-steps/registration/code.spec.ts
@@ -104,10 +104,7 @@ context("Registration success with code method", () => {
 
         cy.submitProfileForm(app)
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         cy.getRegistrationCodeFromEmail(email).then((code) =>
           cy.wrap(code).as("code1"),
@@ -187,10 +184,7 @@ context("Registration success with code method", () => {
         cy.submitProfileForm(app)
 
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         cy.getRegistrationCodeFromEmail(email).should((code) => {
           cy.get(Selectors[app]["code"]).type(code)
@@ -234,10 +228,7 @@ context("Registration success with code method", () => {
         cy.submitProfileForm(app)
 
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         cy.getRegistrationCodeFromEmail(email).should((code) => {
           cy.get(Selectors[app]["code"]).type(code)
@@ -305,10 +296,7 @@ context("Registration success with code method", () => {
 
         cy.submitProfileForm(app)
         cy.submitCodeForm(app)
-        cy.get('[data-testid="ui/message/1040005"]').should(
-          "contain",
-          "An email containing a code has been sent to the email address you provided",
-        )
+        cy.get('[data-testid="ui/message/1040005"]').should("be.visible")
 
         // intentionally use email 1 to sign up for the account
         cy.getRegistrationCodeFromEmail(email, { expectedCount: 1 }).should(
diff --git a/test/e2e/cypress/integration/profiles/two-steps/registration/oidc.spec.ts b/test/e2e/cypress/integration/profiles/two-steps/registration/oidc.spec.ts
index cd4cf069c556..ca2d5e57078a 100644
--- a/test/e2e/cypress/integration/profiles/two-steps/registration/oidc.spec.ts
+++ b/test/e2e/cypress/integration/profiles/two-steps/registration/oidc.spec.ts
@@ -194,9 +194,9 @@ context("Social Sign Up Successes", () => {
           app,
           email,
           website,
-          route: registration + "?return_to=https://www.ory.sh/",
+          route: registration + "?return_to=https://www.example.org/",
         })
-        cy.location("href").should("eq", "https://www.ory.sh/")
+        cy.location("href").should("eq", "https://www.example.org/")
         cy.logout()
       })
 
diff --git a/test/e2e/cypress/integration/profiles/two-steps/registration/password.spec.ts b/test/e2e/cypress/integration/profiles/two-steps/registration/password.spec.ts
index 975306f8c857..8621b7a69483 100644
--- a/test/e2e/cypress/integration/profiles/two-steps/registration/password.spec.ts
+++ b/test/e2e/cypress/integration/profiles/two-steps/registration/password.spec.ts
@@ -46,7 +46,7 @@ context("Registration success with two-step signup", () => {
         cy.get('[name="method"][value="profile"]').click()
 
         // navigate back, fill traits again
-        cy.get('[name="method"][value="profile:back"]').click()
+        cy.get('[name="screen"][value="previous"]').click()
         cy.get('input[name="traits.email"]').type(
           "{selectall}{backspace}" + email,
         )
diff --git a/test/e2e/cypress/integration/profiles/verification/registration/errors.spec.ts b/test/e2e/cypress/integration/profiles/verification/registration/errors.spec.ts
index 06a68f4af237..f8436c7eae1a 100644
--- a/test/e2e/cypress/integration/profiles/verification/registration/errors.spec.ts
+++ b/test/e2e/cypress/integration/profiles/verification/registration/errors.spec.ts
@@ -66,7 +66,7 @@ context("Account Verification Registration Errors", () => {
 
       it("is unable to verify the email address if the code is incorrect", () => {
         cy.getMail({
-          subject: "Please verify your email address",
+          body: "Verify your account",
           email: identity.email,
         }).then((mail) => {
           const link = parseHtml(mail.body).querySelector("a")
diff --git a/test/e2e/cypress/integration/profiles/verification/settings/error.spec.ts b/test/e2e/cypress/integration/profiles/verification/settings/error.spec.ts
index 287f63a931e0..91ae2c5e8259 100644
--- a/test/e2e/cypress/integration/profiles/verification/settings/error.spec.ts
+++ b/test/e2e/cypress/integration/profiles/verification/settings/error.spec.ts
@@ -72,7 +72,7 @@ context("Account Verification Settings Error", () => {
           cy.get('button[value="profile"]').click()
 
           cy.getMail({
-            subject: "Please verify your email address",
+            body: "Verify your account",
             email,
           }).then((mail) => {
             const link = parseHtml(mail.body).querySelector("a")
diff --git a/test/e2e/cypress/integration/profiles/verification/verify/errors.spec.ts b/test/e2e/cypress/integration/profiles/verification/verify/errors.spec.ts
index 97fd908a2e22..afb8d9730413 100644
--- a/test/e2e/cypress/integration/profiles/verification/verify/errors.spec.ts
+++ b/test/e2e/cypress/integration/profiles/verification/verify/errors.spec.ts
@@ -70,12 +70,9 @@ context("Account Verification Error", () => {
 
             cy.getMail({
               removeMail: true,
-              subject: "Please verify your email address",
+              body: "Verify your account",
               email: identity.email,
             }).then((message) => {
-              expect(message.subject).to.equal(
-                "Please verify your email address",
-              )
               expect(message.toAddresses[0].trim()).to.equal(identity.email)
 
               const link = parseHtml(message.body).querySelector("a")
@@ -136,7 +133,7 @@ context("Account Verification Error", () => {
 
             cy.getMail({
               email: identity.email,
-              subject: "Please verify your email address",
+              body: "Verify your account",
             }).then((mail) => {
               const link = parseHtml(mail.body).querySelector("a")
 
diff --git a/test/e2e/cypress/support/commands.ts b/test/e2e/cypress/support/commands.ts
index 0b4584646abc..2d933360c26e 100644
--- a/test/e2e/cypress/support/commands.ts
+++ b/test/e2e/cypress/support/commands.ts
@@ -4,7 +4,7 @@
 import {
   APP_URL,
   assertVerifiableAddress,
-  extractRecoveryCode,
+  extractOTPCode,
   gen,
   KRATOS_ADMIN,
   KRATOS_PUBLIC,
@@ -17,7 +17,7 @@ import {
 import dayjs from "dayjs"
 import YAML from "yamljs"
 import { MailMessage, Strategy } from "."
-import { OryKratosConfiguration } from "./config"
+import { OryKratosConfiguration } from "../../shared/config"
 import { UiNode } from "@ory/kratos-client"
 import { ConfigBuilder } from "./configHelpers"
 
@@ -429,7 +429,7 @@ Cypress.Commands.add(
                   f.group === "default" &&
                   "name" in f.attributes &&
                   f.attributes.name === "traits.email",
-              ).attributes.value,
+              )?.attributes.value,
             ).to.eq(email)
 
             return cy
@@ -1112,9 +1112,8 @@ Cypress.Commands.add(
   ({ expect: { email, redirectTo }, strategy = "code" }) => {
     cy.getMail({
       email,
-      subject: "Please verify your email address",
+      body: "Verify your account",
     }).then((message) => {
-      expect(message.subject).to.equal("Please verify your email address")
       expect(message.fromAddress.trim()).to.equal("no-reply@ory.kratos.sh")
       expect(message.toAddresses).to.have.length(1)
       expect(message.toAddresses[0].trim()).to.equal(email)
@@ -1176,9 +1175,9 @@ Cypress.Commands.add(
     cy.getMail({
       removeMail: true,
       email,
-      subject: "Recover access to your account",
+      body: "Recover access to your account",
     }).should((message) => {
-      const code = extractRecoveryCode(message.body)
+      const code = extractOTPCode(message.body)
       expect(code).to.not.be.undefined
       expect(code.length).to.equal(6)
       cy.wrap(code).as("recoveryCode")
@@ -1221,7 +1220,7 @@ Cypress.Commands.add(
     cy.getMail({
       removeMail: true,
       email,
-      subject: "Please verify your email address",
+      body: "Verify your account",
     }).should((message) => {
       expect(message.fromAddress.trim()).to.equal("no-reply@ory.kratos.sh")
       expect(message.toAddresses).to.have.length(1)
@@ -1286,6 +1285,7 @@ Cypress.Commands.add(
     expectedCount = 1,
     email = undefined,
     subject = undefined,
+    body = undefined,
   }) => {
     let tries = 0
     const req = () =>
@@ -1313,6 +1313,9 @@ Cypress.Commands.add(
             if (subject) {
               filters.push((m: MailMessage) => m.subject.includes(subject))
             }
+            if (body) {
+              filters.push((m: MailMessage) => m.body.includes(body))
+            }
             const filtered = response.body.mailItems.filter((m) => {
               return filters.every((f) => f(m))
             })
@@ -1525,13 +1528,13 @@ Cypress.Commands.add("getVerificationCodeFromEmail", (email) => {
     .getMail({
       removeMail: true,
       email,
-      subject: "Please verify your email address",
+      body: "Verify your account",
     })
     .should((message) => {
       expect(message.toAddresses[0].trim()).to.equal(email)
     })
     .then((message) => {
-      const code = extractRecoveryCode(message.body)
+      const code = extractOTPCode(message.body)
       expect(code).to.not.be.undefined
       expect(code.length).to.equal(6)
       return code
@@ -1543,14 +1546,14 @@ Cypress.Commands.add("getRegistrationCodeFromEmail", (email, opts) => {
     .getMail({
       removeMail: true,
       email,
-      subject: "Complete your account registration",
+      body: "Complete your account registration with the following code",
       ...opts,
     })
     .should((message) => {
       expect(message.toAddresses[0].trim()).to.equal(email)
     })
     .then((message) => {
-      const code = extractRecoveryCode(message.body)
+      const code = extractOTPCode(message.body)
       expect(code).to.not.be.undefined
       expect(code.length).to.equal(6)
       return code
@@ -1562,14 +1565,14 @@ Cypress.Commands.add("getLoginCodeFromEmail", (email, opts) => {
     .getMail({
       removeMail: true,
       email,
-      subject: "Login to your account",
+      body: "Login to your account with the following code",
       ...opts,
     })
     .should((message) => {
       expect(message.toAddresses[0].trim()).to.equal(email)
     })
     .then((message) => {
-      const code = extractRecoveryCode(message.body)
+      const code = extractOTPCode(message.body)
       expect(code).to.not.be.undefined
       expect(code.length).to.equal(6)
       return code
diff --git a/test/e2e/cypress/support/configHelpers.ts b/test/e2e/cypress/support/configHelpers.ts
index c8ccf05b70d2..566bb475fa58 100644
--- a/test/e2e/cypress/support/configHelpers.ts
+++ b/test/e2e/cypress/support/configHelpers.ts
@@ -1,7 +1,7 @@
 // Copyright © 2023 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
-import { OryKratosConfiguration } from "./config"
+import { OryKratosConfiguration } from "../../shared/config"
 
 export class ConfigBuilder {
   constructor(readonly config: OryKratosConfiguration) {}
@@ -25,6 +25,11 @@ export class ConfigBuilder {
     return this
   }
 
+  public disableCodeMfa() {
+    this.config.selfservice.methods.code.mfa_enabled = false
+    return this
+  }
+
   public enableRecovery() {
     if (!this.config.selfservice.flows.recovery) {
       this.config.selfservice.flows.recovery = {}
@@ -132,6 +137,13 @@ export class ConfigBuilder {
     this.config.session.whoami.required_aal = "aal1"
     return this
   }
+
+  public useHighestAvailable() {
+    this.config.selfservice.flows.settings.required_aal = "highest_available"
+    this.config.session.whoami.required_aal = "highest_available"
+    return this
+  }
+
   public enableCode() {
     this.config.selfservice.methods.code.enabled = true
     return this
diff --git a/test/e2e/cypress/support/index.d.ts b/test/e2e/cypress/support/index.d.ts
index 9cfeb083f12a..667360b32c66 100644
--- a/test/e2e/cypress/support/index.d.ts
+++ b/test/e2e/cypress/support/index.d.ts
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { Session as KratosSession } from "@ory/kratos-client"
-import { OryKratosConfiguration } from "./config"
+import { OryKratosConfiguration } from "../../shared/config"
 import { ConfigBuilder } from "./configHelpers"
 
 export interface MailMessage {
@@ -114,6 +114,7 @@ declare global {
         expectedCount?: number
         email?: string
         subject?: string
+        body?: string
       }): Chainable<MailMessage>
 
       performEmailVerification(opts?: {
diff --git a/test/e2e/cypress/tsconfig.json b/test/e2e/cypress/tsconfig.json
index 6042605a6887..dd9b96adae48 100644
--- a/test/e2e/cypress/tsconfig.json
+++ b/test/e2e/cypress/tsconfig.json
@@ -2,15 +2,9 @@
   "compilerOptions": {
     "baseUrl": "../../../node_modules",
     "target": "es5",
-    "lib": [
-      "es2015",
-      "dom"
-    ],
+    "lib": ["es2015", "dom"],
     "types": ["cypress", "node"],
-    "esModuleInterop": true,
+    "esModuleInterop": true
   },
-  "include": [
-    "**/*.ts",
-    "support/index.ts",
-  ],
+  "include": ["**/*.ts", "support/index.ts", "../shared/config.d.ts"]
 }
diff --git a/test/e2e/mock/httptarget/go.mod b/test/e2e/mock/httptarget/go.mod
new file mode 100644
index 000000000000..a82d636fb196
--- /dev/null
+++ b/test/e2e/mock/httptarget/go.mod
@@ -0,0 +1,10 @@
+module github.com/ory/mock
+
+go 1.23.1
+
+require (
+	github.com/julienschmidt/httprouter v1.3.0
+	github.com/ory/graceful v0.1.3
+)
+
+require github.com/pkg/errors v0.9.1 // indirect
diff --git a/test/e2e/mock/httptarget/go.sum b/test/e2e/mock/httptarget/go.sum
new file mode 100644
index 000000000000..e44bf27060c1
--- /dev/null
+++ b/test/e2e/mock/httptarget/go.sum
@@ -0,0 +1,16 @@
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
+github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/ory/graceful v0.1.3 h1:FaeXcHZh168WzS+bqruqWEw/HgXWLdNv2nJ+fbhxbhc=
+github.com/ory/graceful v0.1.3/go.mod h1:4zFz687IAF7oNHHiB586U4iL+/4aV09o/PYLE34t2bA=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
diff --git a/test/e2e/mock/httptarget/main.go b/test/e2e/mock/httptarget/main.go
new file mode 100644
index 000000000000..c95d0834fb76
--- /dev/null
+++ b/test/e2e/mock/httptarget/main.go
@@ -0,0 +1,79 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"cmp"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"sync"
+
+	"github.com/julienschmidt/httprouter"
+
+	"github.com/ory/graceful"
+)
+
+var (
+	documentsLock sync.RWMutex
+	documents     = make(map[string][]byte)
+)
+
+func main() {
+	port := cmp.Or(os.Getenv("PORT"), "4471")
+	server := graceful.WithDefaults(&http.Server{Addr: fmt.Sprintf(":%s", port)})
+	register(server)
+	if err := graceful.Graceful(server.ListenAndServe, server.Shutdown); err != nil {
+		log.Fatalln(err)
+	}
+}
+
+func register(server *http.Server) {
+	router := httprouter.New()
+
+	router.GET("/health", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		_, _ = w.Write([]byte("OK"))
+	})
+
+	router.GET("/documents/:id", func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+		id := ps.ByName("id")
+
+		documentsLock.RLock()
+		doc, ok := documents[id]
+		documentsLock.RUnlock()
+
+		if ok {
+			_, _ = w.Write(doc)
+		} else {
+			w.WriteHeader(http.StatusNotFound)
+		}
+	})
+
+	router.PUT("/documents/:id", func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+		documentsLock.Lock()
+		defer documentsLock.Unlock()
+		id := ps.ByName("id")
+
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		documents[id] = body
+	})
+
+	router.DELETE("/documents/:id", func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+		documentsLock.Lock()
+		defer documentsLock.Unlock()
+		id := ps.ByName("id")
+
+		delete(documents, id)
+		w.WriteHeader(http.StatusNoContent)
+	})
+
+	server.Handler = router
+}
diff --git a/test/e2e/package-lock.json b/test/e2e/package-lock.json
index e6b4470a469b..b46a7972e49e 100644
--- a/test/e2e/package-lock.json
+++ b/test/e2e/package-lock.json
@@ -8,13 +8,15 @@
       "name": "@ory/kratos-e2e-suite",
       "version": "0.0.1",
       "dependencies": {
-        "@faker-js/faker": "7.6.0",
+        "@faker-js/faker": "9.0.3",
+        "@types/promise-retry": "^1.1.6",
         "async-retry": "1.3.3",
-        "mailhog": "4.16.0"
+        "mailhog": "4.16.0",
+        "promise-retry": "^2.0.1"
       },
       "devDependencies": {
         "@ory/kratos-client": "1.2.1",
-        "@playwright/test": "1.34.0",
+        "@playwright/test": "1.48.0",
         "@types/async-retry": "1.4.5",
         "@types/node": "16.9.6",
         "@types/yamljs": "0.2.31",
@@ -25,6 +27,7 @@
         "got": "11.8.5",
         "json-schema-to-typescript": "12.0.0",
         "otplib": "12.0.1",
+        "phone-number-generator-js": "^1.2.12",
         "process": "0.11.10",
         "typescript": "4.7.4",
         "wait-on": "7.2.0",
@@ -98,12 +101,19 @@
       }
     },
     "node_modules/@faker-js/faker": {
-      "version": "7.6.0",
-      "resolved": "https://registry.npmjs.org/@faker-js/faker/-/faker-7.6.0.tgz",
-      "integrity": "sha512-XK6BTq1NDMo9Xqw/YkYyGjSsg44fbNwYRx7QK2CuoQgyy+f1rrTDHoExVM5PsyXCtfl2vs2vVJ0MN0yN6LppRw==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@faker-js/faker/-/faker-9.0.3.tgz",
+      "integrity": "sha512-lWrrK4QNlFSU+13PL9jMbMKLJYXDFu3tQfayBsMXX7KL/GiQeqfB1CzHkqD5UHBUtPAuPo6XwGbMFNdVMZObRA==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fakerjs"
+        }
+      ],
+      "license": "MIT",
       "engines": {
-        "node": ">=14.0.0",
-        "npm": ">=6.0.0"
+        "node": ">=18.0.0",
+        "npm": ">=9.0.0"
       }
     },
     "node_modules/@hapi/hoek": {
@@ -132,6 +142,7 @@
       "resolved": "https://registry.npmjs.org/@ory/kratos-client/-/kratos-client-1.2.1.tgz",
       "integrity": "sha512-HvipnVQotCKjEQC9I9DPjSlfBEww4pjDycMAKdUPj3g/0WkNSq6wbPDyqeclFz99rsOOsFMcpOO8qiCYHSgQeA==",
       "dev": true,
+      "license": "Apache-2.0",
       "dependencies": {
         "axios": "^1.6.1"
       }
@@ -184,22 +195,19 @@
       }
     },
     "node_modules/@playwright/test": {
-      "version": "1.34.0",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.34.0.tgz",
-      "integrity": "sha512-GIALJVODOIrMflLV54H3Cow635OfrTwOu24ZTDyKC66uchtFX2NcCRq83cLdakMjZKYK78lODNLQSYBj2OgaTw==",
+      "version": "1.48.0",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.48.0.tgz",
+      "integrity": "sha512-W5lhqPUVPqhtc/ySvZI5Q8X2ztBOUgZ8LbAFy0JQgrXZs2xaILrUcNO3rQjwbLPfGK13+rZsDa1FpG+tqYkT5w==",
       "dev": true,
+      "license": "Apache-2.0",
       "dependencies": {
-        "@types/node": "*",
-        "playwright-core": "1.34.0"
+        "playwright": "1.48.0"
       },
       "bin": {
         "playwright": "cli.js"
       },
       "engines": {
-        "node": ">=14"
-      },
-      "optionalDependencies": {
-        "fsevents": "2.3.2"
+        "node": ">=18"
       }
     },
     "node_modules/@sideway/address": {
@@ -323,6 +331,15 @@
       "integrity": "sha512-KufADq8uQqo1pYKVIYzfKbJfBAc0sOeXqGbFaSpv8MRmC/zXgowNZmFcbngndGk922QDmOASEXUZCaY48gs4cg==",
       "dev": true
     },
+    "node_modules/@types/promise-retry": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@types/promise-retry/-/promise-retry-1.1.6.tgz",
+      "integrity": "sha512-EC1+OMXV0PZb0pf+cmyxc43MEP2CDumZe4AfuxWboxxEixztIebknpJPZAX5XlodGF1OY+C1E/RAeNGzxf+bJA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/retry": "*"
+      }
+    },
     "node_modules/@types/responselike": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/@types/responselike/-/responselike-1.0.0.tgz",
@@ -335,8 +352,7 @@
     "node_modules/@types/retry": {
       "version": "0.12.2",
       "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.2.tgz",
-      "integrity": "sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow==",
-      "dev": true
+      "integrity": "sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow=="
     },
     "node_modules/@types/sinonjs__fake-timers": {
       "version": "8.1.1",
@@ -350,6 +366,13 @@
       "integrity": "sha512-JYM8x9EGF163bEyhdJBpR2QX1R5naCJHC8ucJylJ3w9/CVBaskdQ8WqBf8MmQrd1kRvp/a4TS8HJ+bxzR7ZJYQ==",
       "dev": true
     },
+    "node_modules/@types/validator": {
+      "version": "13.12.2",
+      "resolved": "https://registry.npmjs.org/@types/validator/-/validator-13.12.2.tgz",
+      "integrity": "sha512-6SlHBzUW8Jhf3liqrGGXyTJSIFe4nqlJ5A5KaMZ2l/vbM3Wh3KSybots/wfWVzNLK4D1NZluDlSQIbIEPx6oyA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/yamljs": {
       "version": "0.2.31",
       "resolved": "https://registry.npmjs.org/@types/yamljs/-/yamljs-0.2.31.tgz",
@@ -549,6 +572,7 @@
       "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.1.tgz",
       "integrity": "sha512-tzN8e4TX8+kkxGPK8D5u0FNmjPUjw3lwC9lSLxxoB/+GtsJG91CO8bSWy73APlgAZzZbXEYZJuxjkHH2w+Ezhw==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
@@ -562,7 +586,8 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
       "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "dev": true
+      "dev": true,
+      "license": "MIT"
     },
     "node_modules/balanced-match": {
       "version": "1.0.2",
@@ -771,6 +796,25 @@
       "integrity": "sha512-riT/3vI5YpVH6/qomlDnJow6TBee2PBKSEpx3O32EGPYbWGIRsIlGRms3Sm74wYE1JMo8RnO04Hb12+v1J5ICw==",
       "dev": true
     },
+    "node_modules/class-validator": {
+      "version": "0.14.1",
+      "resolved": "https://registry.npmjs.org/class-validator/-/class-validator-0.14.1.tgz",
+      "integrity": "sha512-2VEG9JICxIqTpoK1eMzZqaV+u/EiwEJkMGzTrZf6sU/fwsnOITVgYJ8yojSy6CaXtO9V0Cc6ZQZ8h8m4UBuLwQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/validator": "^13.11.8",
+        "libphonenumber-js": "^1.10.53",
+        "validator": "^13.9.0"
+      }
+    },
+    "node_modules/class-validator/node_modules/libphonenumber-js": {
+      "version": "1.11.9",
+      "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.11.9.tgz",
+      "integrity": "sha512-Zs5wf5HaWzW2/inlupe2tstl0I/Tbqo7lH20ZLr6Is58u7Dz2n+gRFGNlj9/gWxFvNfp9+YyDsiegjNhdixB9A==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/clean-stack": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz",
@@ -1143,15 +1187,22 @@
         "node": ">=8.6"
       }
     },
+    "node_modules/err-code": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
+      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA=="
+    },
     "node_modules/es5-ext": {
-      "version": "0.10.62",
-      "resolved": "https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.62.tgz",
-      "integrity": "sha512-BHLqn0klhEpnOKSrzn/Xsz2UIW8j+cGmo9JLzr8BiUapV8hPL9+FliFqjwr9ngW7jWdnxv6eO+/LqyhJVqgrjA==",
+      "version": "0.10.64",
+      "resolved": "https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.64.tgz",
+      "integrity": "sha512-p2snDhiLaXe6dahss1LddxqEm+SkuDvV8dnIQG0MWjyHpcMNfXKPE+/Cc0y+PhxJX3A4xGNeFCj5oc0BUh6deg==",
       "dev": true,
       "hasInstallScript": true,
+      "license": "ISC",
       "dependencies": {
         "es6-iterator": "^2.0.3",
         "es6-symbol": "^3.1.3",
+        "esniff": "^2.0.1",
         "next-tick": "^1.1.0"
       },
       "engines": {
@@ -1200,6 +1251,29 @@
         "node": ">=0.8.0"
       }
     },
+    "node_modules/esniff": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/esniff/-/esniff-2.0.1.tgz",
+      "integrity": "sha512-kTUIGKQ/mDPFoJ0oVfcmyJn4iBDRptjNVIzwIFR7tqWXdVI9xfA2RMwY/gbSpJG3lkdWNEjLap/NqVHZiJsdfg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "d": "^1.0.1",
+        "es5-ext": "^0.10.62",
+        "event-emitter": "^0.3.5",
+        "type": "^2.7.2"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/esniff/node_modules/type": {
+      "version": "2.7.3",
+      "resolved": "https://registry.npmjs.org/type/-/type-2.7.3.tgz",
+      "integrity": "sha512-8j+1QmAbPvLZow5Qpi6NCaN8FB60p/6x8/vfNqOk/hC+HuvFZhL4+WfekuhQLiqFZXOgQdrs3B+XxEmCc6b3FQ==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/event-emitter": {
       "version": "0.3.5",
       "resolved": "https://registry.npmjs.org/event-emitter/-/event-emitter-0.3.5.tgz",
@@ -1336,6 +1410,7 @@
           "url": "https://github.com/sponsors/RubenVerborgh"
         }
       ],
+      "license": "MIT",
       "engines": {
         "node": ">=4.0"
       },
@@ -1395,6 +1470,7 @@
       "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
       "dev": true,
       "hasInstallScript": true,
+      "license": "MIT",
       "optional": true,
       "os": [
         "darwin"
@@ -1950,6 +2026,13 @@
         "node": "> 0.8"
       }
     },
+    "node_modules/libphonenumber-js": {
+      "version": "1.10.30",
+      "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.10.30.tgz",
+      "integrity": "sha512-PLGc+xfrQrkya/YK2/5X+bPpxRmyJBHM+xxz9krUdSgk4Vs2ZwxX5/Ow0lv3r9PDlDtNWb4u+it8MY5rZ0IyGw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/listr2": {
       "version": "3.14.0",
       "resolved": "https://registry.npmjs.org/listr2/-/listr2-3.14.0.tgz",
@@ -2337,6 +2420,18 @@
       "integrity": "sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow==",
       "dev": true
     },
+    "node_modules/phone-number-generator-js": {
+      "version": "1.2.12",
+      "resolved": "https://registry.npmjs.org/phone-number-generator-js/-/phone-number-generator-js-1.2.12.tgz",
+      "integrity": "sha512-AtJpQjHFlXqD2ZMZLUlzrNKNTwwyn9gFASeTgfcGqdWUUHsddThKkCbsJ7VyDyj7C2Xo0oce/XOARH8eElas6A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "class-validator": "0.14.1",
+        "libphonenumber-js": "1.10.30",
+        "lodash": "4.17.21"
+      }
+    },
     "node_modules/pify": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
@@ -2346,13 +2441,36 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/playwright": {
+      "version": "1.48.0",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.48.0.tgz",
+      "integrity": "sha512-qPqFaMEHuY/ug8o0uteYJSRfMGFikhUysk8ZvAtfKmUK3kc/6oNl/y3EczF8OFGYIi/Ex2HspMfzYArk6+XQSA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.48.0"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
     "node_modules/playwright-core": {
-      "version": "1.34.0",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.34.0.tgz",
-      "integrity": "sha512-fMUY1+iR6kYbJF/EsOOqzBA99ZHXbw9sYPNjwA4X/oV0hVF/1aGlWYBGPVUEqxBkGANDKMziYoOdKGU5DIP5Gg==",
+      "version": "1.48.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.48.0.tgz",
+      "integrity": "sha512-RBvzjM9rdpP7UUFrQzRwR8L/xR4HyC1QXMzGYTbf1vjw25/ya9NRAVnXi/0fvFopjebvyPzsmoK58xxeEOaVvA==",
       "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
       "engines": {
-        "node": ">=14"
+        "node": ">=18"
       }
     },
     "node_modules/prettier": {
@@ -2391,6 +2509,27 @@
         "node": ">= 0.6.0"
       }
     },
+    "node_modules/promise-retry": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
+      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
+      "license": "MIT",
+      "dependencies": {
+        "err-code": "^2.0.2",
+        "retry": "^0.12.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/promise-retry/node_modules/retry": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
+      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/proxy-from-env": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.0.0.tgz",
@@ -2890,6 +3029,16 @@
         "uuid": "dist/bin/uuid"
       }
     },
+    "node_modules/validator": {
+      "version": "13.12.0",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-13.12.0.tgz",
+      "integrity": "sha512-c1Q0mCiPlgdTVVVIJIrBuxNicYE+t/7oKeI9MWLj3fh/uq2Pxh/3eeWbVZ4OcGW1TUf53At0njHw5SMdA3tmMg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
     "node_modules/verror": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.0.tgz",
@@ -2966,6 +3115,7 @@
       "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.10.tgz",
       "integrity": "sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==",
       "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">=8.3.0"
       },
@@ -3068,9 +3218,9 @@
       }
     },
     "@faker-js/faker": {
-      "version": "7.6.0",
-      "resolved": "https://registry.npmjs.org/@faker-js/faker/-/faker-7.6.0.tgz",
-      "integrity": "sha512-XK6BTq1NDMo9Xqw/YkYyGjSsg44fbNwYRx7QK2CuoQgyy+f1rrTDHoExVM5PsyXCtfl2vs2vVJ0MN0yN6LppRw=="
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@faker-js/faker/-/faker-9.0.3.tgz",
+      "integrity": "sha512-lWrrK4QNlFSU+13PL9jMbMKLJYXDFu3tQfayBsMXX7KL/GiQeqfB1CzHkqD5UHBUtPAuPo6XwGbMFNdVMZObRA=="
     },
     "@hapi/hoek": {
       "version": "9.3.0",
@@ -3150,14 +3300,12 @@
       }
     },
     "@playwright/test": {
-      "version": "1.34.0",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.34.0.tgz",
-      "integrity": "sha512-GIALJVODOIrMflLV54H3Cow635OfrTwOu24ZTDyKC66uchtFX2NcCRq83cLdakMjZKYK78lODNLQSYBj2OgaTw==",
+      "version": "1.48.0",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.48.0.tgz",
+      "integrity": "sha512-W5lhqPUVPqhtc/ySvZI5Q8X2ztBOUgZ8LbAFy0JQgrXZs2xaILrUcNO3rQjwbLPfGK13+rZsDa1FpG+tqYkT5w==",
       "dev": true,
       "requires": {
-        "@types/node": "*",
-        "fsevents": "2.3.2",
-        "playwright-core": "1.34.0"
+        "playwright": "1.48.0"
       }
     },
     "@sideway/address": {
@@ -3272,6 +3420,14 @@
       "integrity": "sha512-KufADq8uQqo1pYKVIYzfKbJfBAc0sOeXqGbFaSpv8MRmC/zXgowNZmFcbngndGk922QDmOASEXUZCaY48gs4cg==",
       "dev": true
     },
+    "@types/promise-retry": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@types/promise-retry/-/promise-retry-1.1.6.tgz",
+      "integrity": "sha512-EC1+OMXV0PZb0pf+cmyxc43MEP2CDumZe4AfuxWboxxEixztIebknpJPZAX5XlodGF1OY+C1E/RAeNGzxf+bJA==",
+      "requires": {
+        "@types/retry": "*"
+      }
+    },
     "@types/responselike": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/@types/responselike/-/responselike-1.0.0.tgz",
@@ -3284,8 +3440,7 @@
     "@types/retry": {
       "version": "0.12.2",
       "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.2.tgz",
-      "integrity": "sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow==",
-      "dev": true
+      "integrity": "sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow=="
     },
     "@types/sinonjs__fake-timers": {
       "version": "8.1.1",
@@ -3299,6 +3454,12 @@
       "integrity": "sha512-JYM8x9EGF163bEyhdJBpR2QX1R5naCJHC8ucJylJ3w9/CVBaskdQ8WqBf8MmQrd1kRvp/a4TS8HJ+bxzR7ZJYQ==",
       "dev": true
     },
+    "@types/validator": {
+      "version": "13.12.2",
+      "resolved": "https://registry.npmjs.org/@types/validator/-/validator-13.12.2.tgz",
+      "integrity": "sha512-6SlHBzUW8Jhf3liqrGGXyTJSIFe4nqlJ5A5KaMZ2l/vbM3Wh3KSybots/wfWVzNLK4D1NZluDlSQIbIEPx6oyA==",
+      "dev": true
+    },
     "@types/yamljs": {
       "version": "0.2.31",
       "resolved": "https://registry.npmjs.org/@types/yamljs/-/yamljs-0.2.31.tgz",
@@ -3616,6 +3777,25 @@
       "integrity": "sha512-riT/3vI5YpVH6/qomlDnJow6TBee2PBKSEpx3O32EGPYbWGIRsIlGRms3Sm74wYE1JMo8RnO04Hb12+v1J5ICw==",
       "dev": true
     },
+    "class-validator": {
+      "version": "0.14.1",
+      "resolved": "https://registry.npmjs.org/class-validator/-/class-validator-0.14.1.tgz",
+      "integrity": "sha512-2VEG9JICxIqTpoK1eMzZqaV+u/EiwEJkMGzTrZf6sU/fwsnOITVgYJ8yojSy6CaXtO9V0Cc6ZQZ8h8m4UBuLwQ==",
+      "dev": true,
+      "requires": {
+        "@types/validator": "^13.11.8",
+        "libphonenumber-js": "^1.10.53",
+        "validator": "^13.9.0"
+      },
+      "dependencies": {
+        "libphonenumber-js": {
+          "version": "1.11.9",
+          "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.11.9.tgz",
+          "integrity": "sha512-Zs5wf5HaWzW2/inlupe2tstl0I/Tbqo7lH20ZLr6Is58u7Dz2n+gRFGNlj9/gWxFvNfp9+YyDsiegjNhdixB9A==",
+          "dev": true
+        }
+      }
+    },
     "clean-stack": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz",
@@ -3912,14 +4092,20 @@
         "ansi-colors": "^4.1.1"
       }
     },
+    "err-code": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
+      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA=="
+    },
     "es5-ext": {
-      "version": "0.10.62",
-      "resolved": "https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.62.tgz",
-      "integrity": "sha512-BHLqn0klhEpnOKSrzn/Xsz2UIW8j+cGmo9JLzr8BiUapV8hPL9+FliFqjwr9ngW7jWdnxv6eO+/LqyhJVqgrjA==",
+      "version": "0.10.64",
+      "resolved": "https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.64.tgz",
+      "integrity": "sha512-p2snDhiLaXe6dahss1LddxqEm+SkuDvV8dnIQG0MWjyHpcMNfXKPE+/Cc0y+PhxJX3A4xGNeFCj5oc0BUh6deg==",
       "dev": true,
       "requires": {
         "es6-iterator": "^2.0.3",
         "es6-symbol": "^3.1.3",
+        "esniff": "^2.0.1",
         "next-tick": "^1.1.0"
       }
     },
@@ -3962,6 +4148,26 @@
       "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ=",
       "dev": true
     },
+    "esniff": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/esniff/-/esniff-2.0.1.tgz",
+      "integrity": "sha512-kTUIGKQ/mDPFoJ0oVfcmyJn4iBDRptjNVIzwIFR7tqWXdVI9xfA2RMwY/gbSpJG3lkdWNEjLap/NqVHZiJsdfg==",
+      "dev": true,
+      "requires": {
+        "d": "^1.0.1",
+        "es5-ext": "^0.10.62",
+        "event-emitter": "^0.3.5",
+        "type": "^2.7.2"
+      },
+      "dependencies": {
+        "type": {
+          "version": "2.7.3",
+          "resolved": "https://registry.npmjs.org/type/-/type-2.7.3.tgz",
+          "integrity": "sha512-8j+1QmAbPvLZow5Qpi6NCaN8FB60p/6x8/vfNqOk/hC+HuvFZhL4+WfekuhQLiqFZXOgQdrs3B+XxEmCc6b3FQ==",
+          "dev": true
+        }
+      }
+    },
     "event-emitter": {
       "version": "0.3.5",
       "resolved": "https://registry.npmjs.org/event-emitter/-/event-emitter-0.3.5.tgz",
@@ -4517,6 +4723,12 @@
       "integrity": "sha1-eZllXoZGwX8In90YfRUNMyTVRRM=",
       "dev": true
     },
+    "libphonenumber-js": {
+      "version": "1.10.30",
+      "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.10.30.tgz",
+      "integrity": "sha512-PLGc+xfrQrkya/YK2/5X+bPpxRmyJBHM+xxz9krUdSgk4Vs2ZwxX5/Ow0lv3r9PDlDtNWb4u+it8MY5rZ0IyGw==",
+      "dev": true
+    },
     "listr2": {
       "version": "3.14.0",
       "resolved": "https://registry.npmjs.org/listr2/-/listr2-3.14.0.tgz",
@@ -4808,16 +5020,37 @@
       "integrity": "sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow==",
       "dev": true
     },
+    "phone-number-generator-js": {
+      "version": "1.2.12",
+      "resolved": "https://registry.npmjs.org/phone-number-generator-js/-/phone-number-generator-js-1.2.12.tgz",
+      "integrity": "sha512-AtJpQjHFlXqD2ZMZLUlzrNKNTwwyn9gFASeTgfcGqdWUUHsddThKkCbsJ7VyDyj7C2Xo0oce/XOARH8eElas6A==",
+      "dev": true,
+      "requires": {
+        "class-validator": "0.14.1",
+        "libphonenumber-js": "1.10.30",
+        "lodash": "4.17.21"
+      }
+    },
     "pify": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
       "integrity": "sha1-7RQaasBDqEnqWISY59yosVMw6Qw=",
       "dev": true
     },
+    "playwright": {
+      "version": "1.48.0",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.48.0.tgz",
+      "integrity": "sha512-qPqFaMEHuY/ug8o0uteYJSRfMGFikhUysk8ZvAtfKmUK3kc/6oNl/y3EczF8OFGYIi/Ex2HspMfzYArk6+XQSA==",
+      "dev": true,
+      "requires": {
+        "fsevents": "2.3.2",
+        "playwright-core": "1.48.0"
+      }
+    },
     "playwright-core": {
-      "version": "1.34.0",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.34.0.tgz",
-      "integrity": "sha512-fMUY1+iR6kYbJF/EsOOqzBA99ZHXbw9sYPNjwA4X/oV0hVF/1aGlWYBGPVUEqxBkGANDKMziYoOdKGU5DIP5Gg==",
+      "version": "1.48.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.48.0.tgz",
+      "integrity": "sha512-RBvzjM9rdpP7UUFrQzRwR8L/xR4HyC1QXMzGYTbf1vjw25/ya9NRAVnXi/0fvFopjebvyPzsmoK58xxeEOaVvA==",
       "dev": true
     },
     "prettier": {
@@ -4838,6 +5071,22 @@
       "integrity": "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==",
       "dev": true
     },
+    "promise-retry": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
+      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
+      "requires": {
+        "err-code": "^2.0.2",
+        "retry": "^0.12.0"
+      },
+      "dependencies": {
+        "retry": {
+          "version": "0.12.0",
+          "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
+          "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow=="
+        }
+      }
+    },
     "proxy-from-env": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.0.0.tgz",
@@ -5217,6 +5466,12 @@
       "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
       "dev": true
     },
+    "validator": {
+      "version": "13.12.0",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-13.12.0.tgz",
+      "integrity": "sha512-c1Q0mCiPlgdTVVVIJIrBuxNicYE+t/7oKeI9MWLj3fh/uq2Pxh/3eeWbVZ4OcGW1TUf53At0njHw5SMdA3tmMg==",
+      "dev": true
+    },
     "verror": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.0.tgz",
diff --git a/test/e2e/package.json b/test/e2e/package.json
index f980e0a590a0..321005e6dbfb 100644
--- a/test/e2e/package.json
+++ b/test/e2e/package.json
@@ -11,13 +11,15 @@
     "wait-on": "wait-on"
   },
   "dependencies": {
-    "@faker-js/faker": "7.6.0",
+    "@faker-js/faker": "9.0.3",
+    "@types/promise-retry": "^1.1.6",
     "async-retry": "1.3.3",
-    "mailhog": "4.16.0"
+    "mailhog": "4.16.0",
+    "promise-retry": "^2.0.1"
   },
   "devDependencies": {
     "@ory/kratos-client": "1.2.1",
-    "@playwright/test": "1.34.0",
+    "@playwright/test": "1.48.0",
     "@types/async-retry": "1.4.5",
     "@types/node": "16.9.6",
     "@types/yamljs": "0.2.31",
@@ -28,6 +30,7 @@
     "got": "11.8.5",
     "json-schema-to-typescript": "12.0.0",
     "otplib": "12.0.1",
+    "phone-number-generator-js": "^1.2.12",
     "process": "0.11.10",
     "typescript": "4.7.4",
     "wait-on": "7.2.0",
diff --git a/test/e2e/playwright.config.ts b/test/e2e/playwright.config.ts
index 71a67dfd8795..2ace64395520 100644
--- a/test/e2e/playwright.config.ts
+++ b/test/e2e/playwright.config.ts
@@ -4,7 +4,7 @@
 import { defineConfig, devices } from "@playwright/test"
 import * as dotenv from "dotenv"
 
-dotenv.config({ path: "playwright/playwright.env" })
+dotenv.config({ path: __dirname + "/playwright/playwright.env" })
 
 /**
  * See https://playwright.dev/docs/test-configuration.
@@ -17,19 +17,28 @@ export default defineConfig({
   workers: 1,
   reporter: process.env.CI ? [["github"], ["html"], ["list"]] : "html",
 
-  globalSetup: "./playwright/setup/global_setup.ts",
-
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
     trace: process.env.CI ? "retain-on-failure" : "on",
-    baseURL: "http://localhost:19006",
   },
 
   /* Configure projects for major browsers */
   projects: [
     {
-      name: "Mobile Chrome",
-      use: { ...devices["Pixel 5"] },
+      name: "mobile-chrome",
+      testMatch: "mobile/**/*.spec.ts",
+      use: {
+        ...devices["Pixel 5"],
+        baseURL: "http://localhost:19006",
+      },
+    },
+    {
+      name: "chromium",
+      testMatch: "desktop/**/*.spec.ts",
+      use: {
+        ...devices["Desktop Chrome"],
+        baseURL: "http://localhost:4455",
+      },
     },
   ],
 
@@ -42,7 +51,6 @@ export default defineConfig({
       ].join(" && "),
       cwd: "../..",
       url: "http://localhost:4433/health/ready",
-      reuseExistingServer: false,
       env: {
         DSN: dbToDsn(),
         COURIER_SMTP_CONNECTION_URI:
@@ -57,6 +65,12 @@ export default defineConfig({
       reuseExistingServer: false,
       url: "http://localhost:8025/",
     },
+    {
+      command: "go run test/e2e/mock/httptarget/main.go",
+      cwd: "../..",
+      reuseExistingServer: false,
+      url: "http://localhost:4471/health",
+    },
   ],
 })
 
diff --git a/test/e2e/playwright/actions/identity.ts b/test/e2e/playwright/actions/identity.ts
new file mode 100644
index 000000000000..f05bc2f68a3e
--- /dev/null
+++ b/test/e2e/playwright/actions/identity.ts
@@ -0,0 +1,61 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { faker } from "@faker-js/faker"
+import { APIRequestContext } from "@playwright/test"
+import { CreateIdentityBody } from "@ory/kratos-client"
+import { generatePhoneNumber, CountryNames } from "phone-number-generator-js"
+import { expect } from "../fixtures"
+
+export async function createIdentity(
+  request: APIRequestContext,
+  data: Partial<CreateIdentityBody>,
+) {
+  const resp = await request.post("http://localhost:4434/admin/identities", {
+    data,
+  })
+  expect(resp.status()).toBe(201)
+  return await resp.json()
+}
+
+export async function createIdentityWithPhoneNumber(
+  request: APIRequestContext,
+) {
+  const phone = generatePhoneNumber({
+    countryName: CountryNames.Germany,
+    withoutCountryCode: false,
+  })
+  return {
+    identity: await createIdentity(request, {
+      schema_id: "sms",
+      traits: {
+        phone,
+      },
+    }),
+    phone,
+  }
+}
+
+export async function createIdentityWithPassword(request: APIRequestContext) {
+  const email = faker.internet.email({ provider: "ory.sh" })
+  const password = faker.internet.password()
+  return {
+    identity: await createIdentity(request, {
+      schema_id: "email",
+      traits: {
+        email,
+        website: faker.internet.url(),
+      },
+
+      credentials: {
+        password: {
+          config: {
+            password,
+          },
+        },
+      },
+    }),
+    email,
+    password,
+  }
+}
diff --git a/test/e2e/playwright/actions/login.ts b/test/e2e/playwright/actions/login.ts
new file mode 100644
index 000000000000..806f16466dc3
--- /dev/null
+++ b/test/e2e/playwright/actions/login.ts
@@ -0,0 +1,47 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APIRequestContext } from "@playwright/test"
+import { findCsrfToken } from "../lib/helper"
+import { LoginFlow, Session } from "@ory/kratos-client"
+import { expectJSONResponse } from "../lib/request"
+import { expect } from "../fixtures"
+
+export async function loginWithPassword(
+  user: { password: string; traits: { email: string } },
+  r: APIRequestContext,
+  baseUrl: string,
+): Promise<void> {
+  const { ui } = await expectJSONResponse<LoginFlow>(
+    await r.get(baseUrl + "/self-service/login/browser", {
+      headers: {
+        Accept: "application/json",
+      },
+    }),
+    {
+      message: "Initializing login flow failed",
+    },
+  )
+
+  const res = await r.post(ui.action, {
+    headers: {
+      Accept: "application/json",
+    },
+    data: {
+      identifier: user.traits.email,
+      password: user.password,
+      method: "password",
+      csrf_token: findCsrfToken(ui),
+    },
+  })
+  const { session } = await expectJSONResponse<{ session: Session }>(res)
+  expect(session?.identity?.traits.email).toEqual(user.traits.email)
+  expect(
+    res.headersArray().find(
+      ({ name, value }) =>
+        name.toLowerCase() === "set-cookie" &&
+        (value.indexOf("ory_session_") > -1 || // Ory Network
+          value.indexOf("ory_kratos_session") > -1), // Locally hosted
+    ),
+  ).toBeDefined()
+}
diff --git a/test/e2e/playwright/actions/mail.ts b/test/e2e/playwright/actions/mail.ts
index 871608bc204d..172c6d8ab849 100644
--- a/test/e2e/playwright/actions/mail.ts
+++ b/test/e2e/playwright/actions/mail.ts
@@ -8,14 +8,29 @@ const mh = mailhog({
   basePath: "http://localhost:8025/api",
 })
 
-export function search(...props: Parameters<typeof mh["search"]>) {
+type searchProps = {
+  query: string
+  kind: "to" | "from" | "containing"
+  /**
+   *
+   * @param message an email message
+   * @returns decide whether to include the message in the result
+   */
+  filter?: (message: mailhog.Message) => boolean
+}
+
+export function search({ query, kind, filter }: searchProps) {
   return retry(
     async () => {
-      const res = await mh.search(...props)
+      const res = await mh.search(query, kind)
       if (res.total === 0) {
         throw new Error("no emails found")
       }
-      return res.items
+      const result = filter ? res.items.filter(filter) : res.items
+      if (result.length === 0) {
+        throw new Error("no emails found")
+      }
+      return result
     },
     {
       retries: 3,
diff --git a/test/e2e/playwright/actions/session.ts b/test/e2e/playwright/actions/session.ts
new file mode 100644
index 000000000000..5d77b6de7b59
--- /dev/null
+++ b/test/e2e/playwright/actions/session.ts
@@ -0,0 +1,38 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APIRequestContext, expect } from "@playwright/test"
+import { Session } from "@ory/kratos-client"
+
+export async function hasSession(
+  r: APIRequestContext,
+  kratosPublicURL: string,
+): Promise<void> {
+  const resp = await r.get(kratosPublicURL + "/sessions/whoami", {
+    failOnStatusCode: true,
+  })
+  const session = await resp.json()
+  expect(session).toBeDefined()
+  expect(session.active).toBe(true)
+}
+
+export async function getSession(
+  r: APIRequestContext,
+  kratosPublicURL: string,
+): Promise<Session> {
+  const resp = await r.get(kratosPublicURL + "/sessions/whoami", {
+    failOnStatusCode: true,
+  })
+  return resp.json()
+}
+
+export async function hasNoSession(
+  r: APIRequestContext,
+  kratosPublicURL: string,
+): Promise<void> {
+  const resp = await r.get(kratosPublicURL + "/sessions/whoami", {
+    failOnStatusCode: false,
+  })
+  expect(resp.status()).toBe(401)
+  return resp.json()
+}
diff --git a/test/e2e/playwright/actions/webhook.ts b/test/e2e/playwright/actions/webhook.ts
new file mode 100644
index 000000000000..82b2511d5d90
--- /dev/null
+++ b/test/e2e/playwright/actions/webhook.ts
@@ -0,0 +1,57 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { request } from "@playwright/test"
+import retry from "promise-retry"
+import { retryOptions } from "../lib/config"
+
+export const WEBHOOK_TARGET = "http://127.0.0.1:4471"
+
+const baseUrl = WEBHOOK_TARGET
+
+/**
+ * Fetches a documented (hopefully) created by web hook
+ *
+ * @param key
+ */
+export async function fetchDocument(key: string) {
+  const r = await request.newContext()
+
+  return retry(async (retry) => {
+    const res = await r.get(documentUrl(key))
+    if (res.status() !== 200) {
+      const body = await res.text()
+      const message = `Expected response code 200 but received ${res.status()}: ${body}`
+      return retry(message)
+    }
+    return await res.json()
+  }, retryOptions)
+}
+
+/**
+ * Fetches a documented (hopefully) created by web hook
+ *
+ * @param key
+ */
+export async function deleteDocument(key: string) {
+  const r = await request.newContext()
+
+  return retry(async (retry) => {
+    const res = await r.delete(documentUrl(key))
+    if (res.status() !== 204) {
+      const body = await res.text()
+      const message = `Expected response code 204 but received ${res.status()}: ${body}`
+      return retry(message)
+    }
+    return
+  }, retryOptions)
+}
+
+/**
+ * Returns the URL for a specific document
+ *
+ * @param key
+ */
+export function documentUrl(key: string) {
+  return `${baseUrl}/documents/${key}`
+}
diff --git a/test/e2e/playwright/fixtures/index.ts b/test/e2e/playwright/fixtures/index.ts
index 3b1264e84c0a..7f227ac7b5ee 100644
--- a/test/e2e/playwright/fixtures/index.ts
+++ b/test/e2e/playwright/fixtures/index.ts
@@ -2,12 +2,23 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { Identity } from "@ory/kratos-client"
-import { test as base, expect } from "@playwright/test"
-import { OryKratosConfiguration } from "../../cypress/support/config"
+import {
+  APIRequestContext,
+  CDPSession,
+  expect as baseExpect,
+  Page,
+  test as base,
+} from "@playwright/test"
+import { writeFile } from "fs/promises"
 import { merge } from "lodash"
+import { OryKratosConfiguration } from "../../shared/config"
 import { default_config } from "../setup/default_config"
-import { writeFile } from "fs/promises"
-import { faker } from "@faker-js/faker"
+import { APIResponse } from "playwright-core"
+import { SessionWithResponse } from "../types"
+import { retryOptions } from "../lib/request"
+import promiseRetry from "promise-retry"
+import { Protocol } from "playwright-core/types/protocol"
+import { createIdentityWithPassword } from "../actions/identity"
 
 // from https://stackoverflow.com/questions/61132262/typescript-deep-partial
 type DeepPartial<T> = T extends object
@@ -17,12 +28,23 @@ type DeepPartial<T> = T extends object
   : T
 
 type TestFixtures = {
-  identity: Identity
+  identity: { oryIdentity: Identity; email: string; password: string }
   configOverride: DeepPartial<OryKratosConfiguration>
-  config: void
+  config: OryKratosConfiguration
+  virtualAuthenticatorOptions: Partial<Protocol.WebAuthn.VirtualAuthenticatorOptions>
+  pageCDPSession: CDPSession
+  virtualAuthenticator: Protocol.WebAuthn.addVirtualAuthenticatorReturnValue
 }
 
-type WorkerFixtures = {}
+type WorkerFixtures = {
+  kratosAdminURL: string
+  kratosPublicURL: string
+  mode:
+    | "reconfigure_kratos"
+    | "reconfigure_ory_network_project"
+    | "existing_kratos"
+    | "existing_ory_network_project"
+}
 
 export const test = base.extend<TestFixtures, WorkerFixtures>({
   configOverride: {},
@@ -34,9 +56,11 @@ export const test = base.extend<TestFixtures, WorkerFixtures>({
 
       const configRevision = await resp.body()
 
+      const fileDirectory = __dirname + "/../.."
+
       await writeFile(
-        "playwright/kratos.config.json",
-        JSON.stringify(configToWrite),
+        fileDirectory + "/playwright/kratos.config.json",
+        JSON.stringify(configToWrite, null, 2),
       )
       await expect(async () => {
         const resp = await request.get("http://localhost:4434/health/config")
@@ -44,21 +68,150 @@ export const test = base.extend<TestFixtures, WorkerFixtures>({
         expect(updatedRevision).not.toBe(configRevision)
       }).toPass()
 
-      await use()
+      await use(configToWrite)
     },
     { auto: true },
   ],
-  identity: async ({ request }, use) => {
-    const resp = await request.post("http://localhost:4434/admin/identities", {
-      data: {
-        schema_id: "email",
-        traits: {
-          email: faker.internet.email(undefined, undefined, "ory.sh"),
-          website: faker.internet.url(),
+  virtualAuthenticatorOptions: undefined,
+  pageCDPSession: async ({ page }, use) => {
+    const cdpSession = await page.context().newCDPSession(page)
+    await use(cdpSession)
+    await cdpSession.detach()
+  },
+  virtualAuthenticator: async (
+    { pageCDPSession, virtualAuthenticatorOptions },
+    use,
+  ) => {
+    await pageCDPSession.send("WebAuthn.enable")
+    const { authenticatorId } = await pageCDPSession.send(
+      "WebAuthn.addVirtualAuthenticator",
+      {
+        options: {
+          protocol: "ctap2",
+          transport: "internal",
+          hasResidentKey: true,
+          hasUserVerification: true,
+          isUserVerified: true,
+          ...virtualAuthenticatorOptions,
         },
       },
+    )
+    await use({ authenticatorId })
+    await pageCDPSession.send("WebAuthn.removeVirtualAuthenticator", {
+      authenticatorId,
     })
-    expect(resp.status()).toBe(201)
-    await use(await resp.json())
+
+    await pageCDPSession.send("WebAuthn.disable")
   },
+  identity: async ({ request }, use, i) => {
+    const {
+      identity: oryIdentity,
+      password,
+      email,
+    } = await createIdentityWithPassword(request)
+    i.attach("identity", {
+      body: JSON.stringify(oryIdentity, null, 2),
+      contentType: "application/json",
+    })
+    await use({
+      oryIdentity,
+      email,
+      password,
+    })
+  },
+  kratosAdminURL: ["http://localhost:4434", { option: true, scope: "worker" }],
+  kratosPublicURL: ["http://localhost:4433", { option: true, scope: "worker" }],
+})
+
+export const expect = baseExpect.extend({
+  toHaveSession,
+  toMatchResponseData,
 })
+
+async function toHaveSession(
+  requestOrPage: APIRequestContext | Page,
+  baseUrl: string,
+) {
+  let r: APIRequestContext
+  if ("request" in requestOrPage) {
+    r = requestOrPage.request
+  } else {
+    r = requestOrPage
+  }
+  let pass = true
+
+  let responseData: string
+  let response: APIResponse = null
+  try {
+    const result = await promiseRetry(
+      () =>
+        r
+          .get(baseUrl + "/sessions/whoami", {
+            failOnStatusCode: false,
+          })
+          .then<SessionWithResponse>(
+            async (res: APIResponse): Promise<SessionWithResponse> => {
+              return {
+                session: await res.json(),
+                response: res,
+              }
+            },
+          ),
+      retryOptions,
+    )
+    pass = !!result.session.active
+    responseData = await result.response.text()
+    response = result.response
+  } catch (e) {
+    pass = false
+    responseData = JSON.stringify(e.message, undefined, 2)
+  }
+
+  const message = () =>
+    this.utils.matcherHint("toHaveSession", undefined, undefined, {
+      isNot: this.isNot,
+    }) +
+    `\n
+    \n
+    Expected: ${this.isNot ? "not" : ""} to have session\n
+    Session data received: ${responseData}\n
+    Headers: ${JSON.stringify(response?.headers(), null, 2)}\n
+    `
+
+  return {
+    message,
+    pass,
+    name: "toHaveSession",
+  }
+}
+
+async function toMatchResponseData(
+  res: APIResponse,
+  options: {
+    statusCode?: number
+    failureHint?: string
+  },
+) {
+  const body = await res.text()
+  const statusCode = options.statusCode ?? 200
+  const failureHint = options.failureHint ?? ""
+  const message = () =>
+    this.utils.matcherHint("toMatch", undefined, undefined, {
+      isNot: this.isNot,
+    }) +
+    `\n
+    ${failureHint}
+    \n
+    Expected: ${this.isNot ? "not" : ""} to match\n
+    Status Code: ${statusCode}\n
+    Body: ${body}\n
+    Headers: ${JSON.stringify(res.headers(), null, 2)}\n
+    URL: ${JSON.stringify(res.url(), null, 2)}\n
+    `
+
+  return {
+    message,
+    pass: res.status() === statusCode,
+    name: "toMatch",
+  }
+}
diff --git a/test/e2e/playwright/fixtures/schemas/sms.ts b/test/e2e/playwright/fixtures/schemas/sms.ts
new file mode 100644
index 000000000000..0e5186633dfb
--- /dev/null
+++ b/test/e2e/playwright/fixtures/schemas/sms.ts
@@ -0,0 +1,35 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+export default {
+  $id: "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "Person",
+  type: "object",
+  properties: {
+    traits: {
+      type: "object",
+      properties: {
+        phone: {
+          type: "string",
+          format: "tel",
+          title: "Your Phone Number",
+          minLength: 3,
+          "ory.sh/kratos": {
+            credentials: {
+              code: {
+                identifier: true,
+                via: "sms",
+              },
+            },
+            verification: {
+              via: "sms",
+            },
+          },
+        },
+      },
+      required: ["phone"],
+      additionalProperties: false,
+    },
+  },
+}
diff --git a/test/e2e/playwright/kratos.base-config.json b/test/e2e/playwright/kratos.base-config.json
index 83b24587bd61..e9abcfd7f4f0 100644
--- a/test/e2e/playwright/kratos.base-config.json
+++ b/test/e2e/playwright/kratos.base-config.json
@@ -4,6 +4,10 @@
       {
         "id": "default",
         "url": "file://test/e2e/profiles/oidc/identity.traits.schema.json"
+      },
+      {
+        "id": "email",
+        "url": "file://test/e2e/profiles/email/identity.traits.schema.json"
       }
     ]
   },
diff --git a/test/e2e/playwright/lib/config.ts b/test/e2e/playwright/lib/config.ts
new file mode 100644
index 000000000000..4584d51f746e
--- /dev/null
+++ b/test/e2e/playwright/lib/config.ts
@@ -0,0 +1,14 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import type { OperationOptions } from "retry"
+
+export type RetryOptions = OperationOptions
+
+export const retryOptions: RetryOptions = {
+  retries: 20,
+  factor: 1,
+  maxTimeout: 500,
+  minTimeout: 250,
+  randomize: false,
+}
diff --git a/test/e2e/playwright/lib/helper.ts b/test/e2e/playwright/lib/helper.ts
index 929b39b74573..da5fb76c13ba 100644
--- a/test/e2e/playwright/lib/helper.ts
+++ b/test/e2e/playwright/lib/helper.ts
@@ -2,6 +2,13 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { Message } from "mailhog"
+import {
+  UiContainer,
+  UiNodeAttributes,
+  UiNodeInputAttributes,
+} from "@ory/kratos-client"
+import { expect } from "../fixtures"
+import { LoginFlowStyle, OryKratosConfiguration } from "../../shared/config"
 
 export const codeRegex = /(\d{6})/
 
@@ -18,3 +25,50 @@ export function extractCode(mail: Message) {
   }
   return null
 }
+
+export function findCsrfToken(ui: UiContainer) {
+  const csrf = ui.nodes
+    .filter((node) => isUiNodeInputAttributes(node.attributes))
+    // Since we filter all non-input attributes, the following as is ok:
+    .map(
+      (node): UiNodeInputAttributes => node.attributes as UiNodeInputAttributes,
+    )
+    .find(({ name }) => name === "csrf_token")?.value
+  expect(csrf).toBeDefined()
+  return csrf
+}
+
+export function isUiNodeInputAttributes(
+  attrs: UiNodeAttributes,
+): attrs is UiNodeInputAttributes & {
+  node_type: "input"
+} {
+  return attrs.node_type === "input"
+}
+
+export const toConfig = ({
+  style = "identifier_first",
+  mitigateEnumeration = false,
+  selfservice,
+}: {
+  style?: LoginFlowStyle
+  mitigateEnumeration?: boolean
+  selfservice?: Partial<OryKratosConfiguration["selfservice"]>
+}) => ({
+  selfservice: {
+    default_browser_return_url: "http://localhost:4455/welcome",
+    ...selfservice,
+    flows: {
+      login: {
+        ...selfservice?.flows?.login,
+        style,
+      },
+      ...selfservice?.flows,
+    },
+  },
+  security: {
+    account_enumeration: {
+      mitigate: mitigateEnumeration,
+    },
+  },
+})
diff --git a/test/e2e/playwright/lib/request.ts b/test/e2e/playwright/lib/request.ts
new file mode 100644
index 000000000000..5732e5a34aca
--- /dev/null
+++ b/test/e2e/playwright/lib/request.ts
@@ -0,0 +1,34 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APIResponse } from "playwright-core"
+import { expect } from "../fixtures"
+import { OperationOptions } from "retry"
+
+export type RetryOptions = OperationOptions
+
+export const retryOptions: RetryOptions = {
+  retries: 20,
+  factor: 1,
+  maxTimeout: 500,
+  minTimeout: 250,
+  randomize: false,
+}
+
+export async function expectJSONResponse<T>(
+  res: APIResponse,
+  { statusCode = 200, message }: { statusCode?: number; message?: string } = {},
+): Promise<T> {
+  await expect(res).toMatchResponseData({
+    statusCode,
+    failureHint: message,
+  })
+  try {
+    return (await res.json()) as T
+  } catch (e) {
+    const body = await res.text()
+    throw Error(
+      `Expected to be able to parse body as json: ${e} (body: ${body})`,
+    )
+  }
+}
diff --git a/test/e2e/playwright/models/elements/login.ts b/test/e2e/playwright/models/elements/login.ts
new file mode 100644
index 000000000000..a6ea12629db5
--- /dev/null
+++ b/test/e2e/playwright/models/elements/login.ts
@@ -0,0 +1,249 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect, Locator, Page } from "@playwright/test"
+import { createInputLocator, InputLocator } from "../../selectors/input"
+import { URLSearchParams } from "node:url"
+import { OryKratosConfiguration } from "../../../shared/config"
+
+enum LoginStyle {
+  IdentifierFirst = "identifier_first",
+  Unified = "unified",
+}
+
+type SubmitOptions = {
+  submitWithKeyboard?: boolean
+  waitForURL?: string | RegExp
+}
+
+export class LoginPage {
+  public submitPassword: Locator
+  public github: Locator
+  public google: Locator
+  public signup: Locator
+
+  public identifier: InputLocator
+  public password: InputLocator
+  public totpInput: InputLocator
+  public totpSubmit: Locator
+  public lookupInput: InputLocator
+  public lookupSubmit: Locator
+  public codeSubmit = this.page.locator('button[type="submit"][value="code"]')
+  public codeInput = createInputLocator(this.page, "code")
+
+  public alert: Locator
+
+  constructor(readonly page: Page, readonly config: OryKratosConfiguration) {
+    this.identifier = createInputLocator(page, "identifier")
+    this.password = createInputLocator(page, "password")
+    this.totpInput = createInputLocator(page, "totp_code")
+    this.lookupInput = createInputLocator(page, "lookup_secret")
+
+    this.submitPassword = page.locator(
+      '[type="submit"][name="method"][value="password"]',
+    )
+
+    this.github = page.locator('[name="provider"][value="github"]')
+    this.google = page.locator('[name="provider"][value="google"]')
+
+    this.totpSubmit = page.locator('[name="method"][value="totp"]')
+    this.lookupSubmit = page.locator('[name="method"][value="lookup_secret"]')
+
+    this.signup = page.locator('[data-testid="signup-link"]')
+
+    // this.submitHydra = page.locator('[name="provider"][value="hydra"]')
+    // this.forgotPasswordLink = page.locator(
+    //   "[data-testid='forgot-password-link']",
+    // )
+    // this.logoutLink = page.locator("[data-testid='logout-link']")
+  }
+
+  async submitIdentifierFirst(identifier: string) {
+    await this.inputField("identifier").fill(identifier)
+    await this.submit("identifier_first", {
+      waitForURL: new RegExp(this.config.selfservice.flows.login.ui_url),
+    })
+  }
+
+  async loginWithPassword(
+    identifier: string,
+    password: string,
+    opts?: SubmitOptions,
+  ) {
+    switch (this.config.selfservice.flows.login.style) {
+      case LoginStyle.IdentifierFirst:
+        await this.submitIdentifierFirst(identifier)
+        break
+      case LoginStyle.Unified:
+        await this.inputField("identifier").fill(identifier)
+        break
+    }
+
+    await this.inputField("password").fill(password)
+    await this.submit("password", opts)
+  }
+
+  async triggerLoginWithCode(identifier: string, opts?: SubmitOptions) {
+    switch (this.config.selfservice.flows.login.style) {
+      case LoginStyle.IdentifierFirst:
+        await this.submitIdentifierFirst(identifier)
+        break
+      case LoginStyle.Unified:
+        await this.inputField("identifier").fill(identifier)
+        break
+    }
+
+    await this.codeSubmit.click()
+  }
+
+  async open({
+    aal,
+    refresh,
+  }: {
+    aal?: string
+    refresh?: boolean
+  } = {}) {
+    const p = new URLSearchParams()
+    if (refresh) {
+      p.append("refresh", "true")
+    }
+
+    if (aal) {
+      p.append("aal", aal)
+    }
+
+    await Promise.all([
+      this.page.goto(
+        this.config.selfservice.flows.login.ui_url + "?" + p.toString(),
+      ),
+      this.isReady(),
+      this.page.waitForURL((url) =>
+        url.toString().includes(this.config.selfservice.flows.login.ui_url),
+      ),
+    ])
+    await this.isReady()
+  }
+
+  async isReady() {
+    await expect(this.inputField("csrf_token").nth(0)).toBeHidden()
+  }
+
+  submitMethod(method: string) {
+    switch (method) {
+      case "google":
+      case "github":
+      case "hydra":
+        return this.page.locator(`[name="provider"][value="${method}"]`)
+    }
+    return this.page.locator(`[name="method"][value="${method}"]`)
+  }
+
+  inputField(name: string) {
+    return this.page.locator(`input[name=${name}]`)
+  }
+
+  async submit(method: string, opts?: SubmitOptions) {
+    const waitFor = [
+      opts?.waitForURL
+        ? this.page.waitForURL(opts.waitForURL)
+        : Promise.resolve(),
+    ]
+
+    if (opts?.submitWithKeyboard) {
+      waitFor.push(this.page.keyboard.press("Enter"))
+    } else {
+      waitFor.push(this.submitMethod(method).click())
+    }
+
+    await Promise.all(waitFor)
+  }
+
+  //
+  // async submitPasswordForm(
+  //   id: string,
+  //   password: string,
+  //   expectURL: string | RegExp,
+  //   options: {
+  //     submitWithKeyboard?: boolean
+  //     style?: LoginStyle
+  //   } = {
+  //     submitWithKeyboard: false,
+  //     style: LoginStyle.OneStep,
+  //   },
+  // ) {
+  //   await this.isReady()
+  //   await this.inputField("identifier").fill(id)
+  //
+  //   if (options.style === LoginStyle.IdentifierFirst) {
+  //     await this.submitMethod("identifier_first").click()
+  //     await this.inputField("password").fill(password)
+  //   } else {
+  //     await this.inputField("password").fill(password)
+  //   }
+  //
+  //   const nav = this.page.waitForURL(expectURL)
+  //
+  //   if (submitWithKeyboard) {
+  //     await this.page.keyboard.press("Enter")
+  //   } else {
+  //     await this.submitPassword.click()
+  //   }
+  //
+  //   await nav
+  // }
+  //
+  // readonly baseURL: string
+  // readonly submitHydra: Locator
+  // readonly forgotPasswordLink: Locator
+  // readonly logoutLink: Locator
+  //
+  // async goto(returnTo?: string, refresh?: boolean) {
+  //   const u = new URL(routes.hosted.login(this.baseURL))
+  //   if (returnTo) {
+  //     u.searchParams.append("return_to", returnTo)
+  //   }
+  //   if (refresh) {
+  //     u.searchParams.append("refresh", refresh.toString())
+  //   }
+  //   await this.page.goto(u.toString())
+  //   await this.isReady()
+  // }
+  //
+  // async loginWithHydra(email: string, password: string) {
+  //   await this.submitHydra.click()
+  //   await this.page.waitForURL(new RegExp(OIDC_PROVIDER))
+  //
+  //   await this.page.locator("input[name=email]").fill(email)
+  //   await this.page.locator("input[name=password]").fill(password)
+  //
+  //   await this.page.locator("input[name=submit][id=accept]").click()
+  // }
+  //
+  // async loginWithOIDC(email = generateEmail(), password = generatePassword()) {
+  //   await this.page.fill('[name="email"]', email)
+  //   await this.page.fill('[name="password"]', password)
+  //   await this.page.click("#accept")
+  // }
+  //
+  // async loginAndAcceptConsent(
+  //   email = generateEmail(),
+  //   password = generatePassword(),
+  //   {rememberConsent = true, rememberLogin = false} = {},
+  // ) {
+  //   await this.page.fill('[name="email"]', email)
+  //   await this.page.fill('[name="password"]', password)
+  //   rememberLogin && (await this.page.check('[name="remember"]'))
+  //   await this.page.click("#accept")
+  //
+  //   await this.page.click("#offline")
+  //   await this.page.click("#openid")
+  //   rememberConsent && (await this.page.check("[name=remember]"))
+  //   await this.page.click("#accept")
+  //
+  //   return email
+  // }
+  //
+  // async expectAlert(id: string) {
+  //   await this.page.getByTestId(`ui/message/${id}`).waitFor()
+  // }
+}
diff --git a/test/e2e/playwright/models/elements/registration.ts b/test/e2e/playwright/models/elements/registration.ts
new file mode 100644
index 000000000000..029903f14e49
--- /dev/null
+++ b/test/e2e/playwright/models/elements/registration.ts
@@ -0,0 +1,45 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect, Page } from "@playwright/test"
+import { createInputLocator, InputLocator } from "../../selectors/input"
+import { OryKratosConfiguration } from "../../../shared/config"
+
+export class RegistrationPage {
+  public identifier: InputLocator
+
+  constructor(readonly page: Page, readonly config: OryKratosConfiguration) {
+    this.identifier = createInputLocator(page, "identifier")
+  }
+
+  async open() {
+    await Promise.all([
+      this.page.goto(this.config.selfservice.flows.registration.ui_url),
+      this.isReady(),
+      this.page.waitForURL((url) =>
+        url
+          .toString()
+          .includes(this.config.selfservice.flows.registration.ui_url),
+      ),
+    ])
+    await this.isReady()
+  }
+
+  inputField(name: string) {
+    return this.page.locator(`input[name="${name}"]`)
+  }
+
+  submitField(name: string) {
+    return this.page.locator(`[type="submit"][name="method"][value="${name}"]`)
+  }
+
+  async isReady() {
+    await expect(this.inputField("csrf_token").nth(0)).toBeHidden()
+  }
+
+  async triggerRegistrationWithCode(identifier: string) {
+    await this.inputField("traits.phone").fill(identifier)
+    await this.submitField("profile").click()
+    await this.submitField("code").click()
+  }
+}
diff --git a/test/e2e/playwright/selectors/input.ts b/test/e2e/playwright/selectors/input.ts
new file mode 100644
index 000000000000..c4f1f35d0271
--- /dev/null
+++ b/test/e2e/playwright/selectors/input.ts
@@ -0,0 +1,19 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { Locator, Page } from "@playwright/test"
+
+export interface InputLocator {
+  input: Locator
+  message: Locator
+  label: Locator
+}
+
+export const createInputLocator = (page: Page, field: string): InputLocator => {
+  const prefix = `[data-testid="node/input/${field}"]`
+  return {
+    input: page.locator(`${prefix} input`),
+    label: page.locator(`${prefix} label`),
+    message: page.locator(`${prefix} p`),
+  }
+}
diff --git a/test/e2e/playwright/setup/default_config.ts b/test/e2e/playwright/setup/default_config.ts
index b9249917b039..5e4f5d1e2e73 100644
--- a/test/e2e/playwright/setup/default_config.ts
+++ b/test/e2e/playwright/setup/default_config.ts
@@ -1,7 +1,7 @@
 // Copyright © 2023 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
-import { OryKratosConfiguration } from "../../cypress/support/config"
+import { OryKratosConfiguration } from "../../shared/config"
 
 export const default_config: OryKratosConfiguration = {
   dsn: "",
@@ -11,6 +11,10 @@ export const default_config: OryKratosConfiguration = {
         id: "default",
         url: "file://test/e2e/profiles/oidc/identity.traits.schema.json",
       },
+      {
+        id: "email",
+        url: "file://test/e2e/profiles/email/identity.traits.schema.json",
+      },
     ],
   },
   serve: {
@@ -40,7 +44,7 @@ export const default_config: OryKratosConfiguration = {
     cipher: ["secret-thirty-two-character-long"],
   },
   selfservice: {
-    default_browser_return_url: "http://localhost:4455/",
+    default_browser_return_url: "http://localhost:4455/welcome",
     allowed_return_urls: [
       "http://localhost:4455",
       "http://localhost:19006",
diff --git a/test/e2e/playwright/setup/global_setup.ts b/test/e2e/playwright/setup/global_setup.ts
deleted file mode 100644
index 92a42432fc96..000000000000
--- a/test/e2e/playwright/setup/global_setup.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright © 2023 Ory Corp
-// SPDX-License-Identifier: Apache-2.0
-
-import fs from "fs"
-import { default_config } from "./default_config"
-
-export default async function globalSetup() {
-  await fs.promises.writeFile(
-    "playwright/kratos.config.json",
-    JSON.stringify(default_config),
-  )
-}
diff --git a/test/e2e/playwright/tests/desktop/code/sms.spec.ts b/test/e2e/playwright/tests/desktop/code/sms.spec.ts
new file mode 100644
index 000000000000..8d374c2ce1b7
--- /dev/null
+++ b/test/e2e/playwright/tests/desktop/code/sms.spec.ts
@@ -0,0 +1,116 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import smsSchema from "../../../fixtures/schemas/sms"
+import { LoginPage } from "../../../models/elements/login"
+import { hasSession } from "../../../actions/session"
+import { createIdentityWithPhoneNumber } from "../../../actions/identity"
+import {
+  deleteDocument,
+  documentUrl,
+  fetchDocument,
+} from "../../../actions/webhook"
+import { RegistrationPage } from "../../../models/elements/registration"
+import { CountryNames, generatePhoneNumber } from "phone-number-generator-js"
+
+const documentId = "doc-" + Math.random().toString(36).substring(7)
+
+test.describe("account enumeration protection off", () => {
+  test.use({
+    configOverride: {
+      security: {
+        account_enumeration: {
+          enabled: false,
+        },
+      },
+      selfservice: {
+        flows: {
+          login: {
+            style: "unified",
+          },
+          registration: {
+            after: {
+              code: {
+                hooks: [
+                  {
+                    hook: "session",
+                  },
+                ],
+              },
+            },
+          },
+        },
+        methods: {
+          code: {
+            passwordless_enabled: true,
+          },
+          password: {
+            enabled: false,
+          },
+        },
+      },
+      courier: {
+        channels: [
+          {
+            id: "sms",
+            type: "http",
+            request_config: {
+              body: "base64://ZnVuY3Rpb24oY3R4KSB7DQpjdHg6IGN0eCwNCn0=",
+              method: "PUT",
+              url: documentUrl(documentId),
+            },
+          },
+        ],
+      },
+      identity: {
+        default_schema_id: "sms",
+        schemas: [
+          {
+            id: "sms",
+            url:
+              "base64://" +
+              Buffer.from(JSON.stringify(smsSchema), "ascii").toString(
+                "base64",
+              ),
+          },
+        ],
+      },
+    },
+  })
+
+  test.afterEach(async () => {
+    await deleteDocument(documentId)
+  })
+
+  test("login succeeds", async ({ page, config, kratosPublicURL }) => {
+    const identity = await createIdentityWithPhoneNumber(page.request)
+
+    const login = new LoginPage(page, config)
+    await login.open()
+    await login.triggerLoginWithCode(identity.phone)
+
+    const result = await fetchDocument(documentId)
+    await login.codeInput.input.fill(result.ctx.template_data.login_code)
+    await login.codeSubmit.getByText("Continue").click()
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("registration succeeds", async ({ page, config, kratosPublicURL }) => {
+    const phone = generatePhoneNumber({
+      countryName: CountryNames.Germany,
+      withoutCountryCode: false,
+    })
+
+    const registration = new RegistrationPage(page, config)
+    await registration.open()
+    await registration.triggerRegistrationWithCode(phone)
+
+    const result = await fetchDocument(documentId)
+    const code = result.ctx.template_data.registration_code
+    await registration.inputField("code").fill(code)
+    await registration.submitField("code").getByText("Continue").click()
+    await hasSession(page.request, kratosPublicURL)
+  })
+})
diff --git a/test/e2e/playwright/tests/desktop/identifier_first/code.login.spec.ts b/test/e2e/playwright/tests/desktop/identifier_first/code.login.spec.ts
new file mode 100644
index 000000000000..5cfe7c8f7045
--- /dev/null
+++ b/test/e2e/playwright/tests/desktop/identifier_first/code.login.spec.ts
@@ -0,0 +1,227 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect } from "@playwright/test"
+import { search } from "../../../actions/mail"
+import { getSession, hasNoSession, hasSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { extractCode, toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+
+test.describe("account enumeration protection off", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: false,
+      selfservice: {
+        methods: {
+          code: {
+            passwordless_enabled: true,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('[data-testid="ui/message/4000037"]'),
+      "expect account not exist message to be shown",
+    ).toBeVisible()
+  })
+
+  test("login with wrong code fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    await login.codeInput.input.fill("123123")
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4010008"]'),
+      "expect to be shown a wrong code error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    const mails = await search({ query: identity.email, kind: "to" })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+
+    await login.codeInput.input.fill(code)
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+})
+
+test.describe("account enumeration protection on", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: true,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: false,
+          },
+          code: {
+            passwordless_enabled: true,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('button[name="method"][value="code"]'),
+      "expect to show the code form",
+    ).toBeVisible()
+  })
+
+  test("login with wrong code fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    await login.codeInput.input.fill("123123")
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4010008"]'),
+      "expect to be shown a wrong code error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.triggerLoginWithCode(identity.email)
+
+    const mails = await search({ query: identity.email, kind: "to" })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+
+    await login.codeInput.input.fill(code)
+
+    await login.codeSubmit.getByText("Continue").click()
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+})
+
+test.describe(() => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: false,
+      selfservice: {
+        methods: {
+          code: {
+            passwordless_enabled: true,
+          },
+        },
+      },
+    }),
+  })
+  test("refresh", async ({ page, identity, config, kratosPublicURL }) => {
+    const login = new LoginPage(page, config)
+
+    const [initialSession, initialCode] =
+      await test.step("initial login", async () => {
+        await login.open()
+        await login.triggerLoginWithCode(identity.email)
+
+        const mails = await search({ query: identity.email, kind: "to" })
+        expect(mails).toHaveLength(1)
+
+        const code = extractCode(mails[0])
+
+        await login.codeInput.input.fill(code)
+
+        await login.codeSubmit.getByText("Continue").click()
+
+        const session = await getSession(page.request, kratosPublicURL)
+        expect(session).toBeDefined()
+        expect(session.active).toBe(true)
+        return [session, code]
+      })
+
+    await login.open({
+      refresh: true,
+    })
+    await login.inputField("identifier").fill(identity.email)
+    await login.submit("code")
+
+    const mails = await search({
+      query: identity.email,
+      kind: "to",
+      filter: (m) => !m.html.includes(initialCode),
+    })
+    expect(mails).toHaveLength(1)
+
+    const code = extractCode(mails[0])
+
+    await login.codeInput.input.fill(code)
+
+    await login.codeSubmit.getByText("Continue").click()
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+
+    const newSession = await getSession(page.request, kratosPublicURL)
+    expect(newSession).toBeDefined()
+    expect(newSession.active).toBe(true)
+
+    const initDate = Date.parse(initialSession.authenticated_at)
+    const newDate = Date.parse(newSession.authenticated_at)
+    expect(newDate).toBeGreaterThanOrEqual(initDate)
+  })
+})
diff --git a/test/e2e/playwright/tests/desktop/identifier_first/oidc.login.spec.ts b/test/e2e/playwright/tests/desktop/identifier_first/oidc.login.spec.ts
new file mode 100644
index 000000000000..5568b88a1aab
--- /dev/null
+++ b/test/e2e/playwright/tests/desktop/identifier_first/oidc.login.spec.ts
@@ -0,0 +1,171 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { faker } from "@faker-js/faker"
+import { expect, Page } from "@playwright/test"
+import { getSession, hasSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+import { OryKratosConfiguration } from "../../../../shared/config"
+
+async function loginHydra(page: Page) {
+  return test.step("login with hydra", async () => {
+    await page
+      .locator("input[name=username]")
+      .fill(faker.internet.email({ provider: "ory.sh" }))
+    await page.locator("button[name=action][value=accept]").click()
+    await page.locator("#offline").check()
+    await page.locator("#openid").check()
+
+    await page.locator("input[name=website]").fill(faker.internet.url())
+
+    await page.locator("button[name=action][value=accept]").click()
+  })
+}
+
+async function registerWithHydra(
+  page: Page,
+  config: OryKratosConfiguration,
+  kratosPublicURL: string,
+) {
+  return await test.step("register", async () => {
+    await page.goto("/registration")
+
+    await page.locator(`button[name=provider][value=hydra]`).click()
+
+    const email = faker.internet.email({ provider: "ory.sh" })
+    await page.locator("input[name=username]").fill(email)
+    await page.locator("#remember").check()
+    await page.locator("button[name=action][value=accept]").click()
+    await page.locator("#offline").check()
+    await page.locator("#openid").check()
+
+    await page.locator("input[name=website]").fill(faker.internet.url())
+
+    await page.locator("button[name=action][value=accept]").click()
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    await page.context().clearCookies({
+      domain: new URL(kratosPublicURL).hostname,
+    })
+
+    await expect(
+      getSession(page.request, kratosPublicURL),
+    ).rejects.toThrowError()
+    return email
+  })
+}
+
+for (const mitigateEnumeration of [true, false]) {
+  test.describe(`account enumeration protection ${
+    mitigateEnumeration ? "on" : "off"
+  }`, () => {
+    test.use({
+      configOverride: toConfig({
+        mitigateEnumeration,
+        selfservice: {
+          methods: {
+            password: {
+              enabled: true,
+            },
+          },
+        },
+      }),
+    })
+
+    test("login", async ({ page, config, kratosPublicURL }) => {
+      const login = new LoginPage(page, config)
+      await login.open()
+
+      await page.locator(`button[name=provider][value=hydra]`).click()
+
+      await loginHydra(page)
+
+      await page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      )
+
+      await hasSession(page.request, kratosPublicURL)
+    })
+
+    test("oidc sign in on second step", async ({
+      page,
+      config,
+      kratosPublicURL,
+    }) => {
+      const email = await registerWithHydra(page, config, kratosPublicURL)
+
+      const login = new LoginPage(page, config)
+      await login.open()
+
+      await login.submitIdentifierFirst(email)
+
+      // If account enumeration is mitigated, we should see the password method,
+      // because the identity has not set up a password
+      await expect(
+        page.locator('button[name="method"][value="password"]'),
+        "hide the password method",
+      ).toBeVisible({ visible: mitigateEnumeration })
+
+      await page.locator(`button[name=provider][value=hydra]`).click()
+
+      await loginHydra(page)
+
+      await page.waitForURL(
+        new RegExp(config.selfservice.default_browser_return_url),
+      )
+
+      const session = await getSession(page.request, kratosPublicURL)
+      expect(session).toBeDefined()
+      expect(session.active).toBe(true)
+    })
+  })
+}
+
+test("login with refresh", async ({ page, config, kratosPublicURL }) => {
+  await registerWithHydra(page, config, kratosPublicURL)
+
+  const login = new LoginPage(page, config)
+
+  const initialSession = await test.step("initial login", async () => {
+    await login.open()
+    await page.locator(`button[name=provider][value=hydra]`).click()
+
+    await loginHydra(page)
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    return await getSession(page.request, kratosPublicURL)
+  })
+
+  // This is required, because OIDC issues a new session on refresh (TODO), and MySQL does not store sub second timestamps, so we need to wait a bit
+  await page.waitForTimeout(1000)
+  await test.step("refresh login", async () => {
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    await page.locator(`button[name=provider][value=hydra]`).click()
+
+    await loginHydra(page)
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    const newSession = await getSession(page.request, kratosPublicURL)
+    // expect(newSession.authentication_methods).toHaveLength(
+    //   initialSession.authentication_methods.length + 1,
+    // )
+    expect(newSession.authenticated_at).not.toBe(
+      initialSession.authenticated_at,
+    )
+  })
+})
diff --git a/test/e2e/playwright/tests/desktop/identifier_first/passkeys.login.spec.ts b/test/e2e/playwright/tests/desktop/identifier_first/passkeys.login.spec.ts
new file mode 100644
index 000000000000..ecd4fe0ceaa5
--- /dev/null
+++ b/test/e2e/playwright/tests/desktop/identifier_first/passkeys.login.spec.ts
@@ -0,0 +1,238 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { faker } from "@faker-js/faker"
+import { CDPSession, expect, Page } from "@playwright/test"
+import { OryKratosConfiguration } from "../../../../shared/config"
+import { getSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+
+async function toggleAutomaticPresenceSimulation(
+  cdpSession: CDPSession,
+  authenticatorId: string,
+  enabled: boolean,
+) {
+  await cdpSession.send("WebAuthn.setAutomaticPresenceSimulation", {
+    authenticatorId,
+    enabled,
+  })
+}
+
+async function registerWithPasskey(
+  page: Page,
+  pageCDPSession: CDPSession,
+  config: OryKratosConfiguration,
+  authenticatorId: string,
+  simulatePresence: boolean,
+) {
+  return await test.step("create webauthn identity", async () => {
+    await page.goto("/registration")
+    const identifier = faker.internet.email()
+    await page.locator(`input[name="traits.email"]`).fill(identifier)
+    await page
+      .locator(`input[name="traits.website"]`)
+      .fill(faker.internet.url())
+    await page.locator("button[name=method][value=profile]").click()
+
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      authenticatorId,
+      true,
+    )
+    await page.locator("button[name=passkey_register_trigger]").click()
+
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      authenticatorId,
+      simulatePresence,
+    )
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    return identifier
+  })
+}
+
+const passkeyConfig = {
+  methods: {
+    passkey: {
+      enabled: true,
+      config: {
+        rp: {
+          display_name: "ORY",
+          id: "localhost",
+          origins: ["http://localhost:4455"],
+        },
+      },
+    },
+  },
+}
+
+for (const mitigateEnumeration of [true, false]) {
+  test.describe(`account enumeration protection ${
+    mitigateEnumeration ? "on" : "off"
+  }`, () => {
+    test.use({
+      configOverride: toConfig({
+        mitigateEnumeration,
+        style: "identifier_first",
+        selfservice: passkeyConfig,
+      }),
+    })
+
+    for (const simulatePresence of [true, false]) {
+      test.describe(`${
+        simulatePresence ? "with" : "without"
+      } automatic presence proof`, () => {
+        test.use({
+          virtualAuthenticatorOptions: {
+            automaticPresenceSimulation: simulatePresence,
+            // hasResidentKey: simulatePresence,
+          },
+        })
+        test("login", async ({
+          config,
+          page,
+          kratosPublicURL,
+          virtualAuthenticator,
+          pageCDPSession,
+        }) => {
+          const identifier = await registerWithPasskey(
+            page,
+            pageCDPSession,
+            config,
+            virtualAuthenticator.authenticatorId,
+            simulatePresence,
+          )
+          await page.context().clearCookies({})
+
+          const login = new LoginPage(page, config)
+          await login.open()
+
+          if (!simulatePresence) {
+            await login.submitIdentifierFirst(identifier)
+
+            const passkeyLoginTrigger = page.locator(
+              "button[name=passkey_login_trigger]",
+            )
+            await passkeyLoginTrigger.waitFor()
+
+            await page.waitForLoadState("load")
+
+            await toggleAutomaticPresenceSimulation(
+              pageCDPSession,
+              virtualAuthenticator.authenticatorId,
+              true,
+            )
+
+            await passkeyLoginTrigger.click()
+
+            await toggleAutomaticPresenceSimulation(
+              pageCDPSession,
+              virtualAuthenticator.authenticatorId,
+              false,
+            )
+          }
+
+          await page.waitForURL(
+            new RegExp(config.selfservice.default_browser_return_url),
+          )
+
+          await expect(
+            getSession(page.request, kratosPublicURL),
+          ).resolves.toMatchObject({
+            active: true,
+            identity: {
+              traits: {
+                email: identifier,
+              },
+            },
+          })
+        })
+      })
+    }
+  })
+}
+
+test.describe("without automatic presence simulation", () => {
+  test.use({
+    virtualAuthenticatorOptions: {
+      automaticPresenceSimulation: false,
+    },
+    configOverride: toConfig({
+      selfservice: passkeyConfig,
+    }),
+  })
+  test("login with refresh", async ({
+    page,
+    config,
+    kratosPublicURL,
+    pageCDPSession,
+    virtualAuthenticator,
+  }) => {
+    const identifier = await registerWithPasskey(
+      page,
+      pageCDPSession,
+      config,
+      virtualAuthenticator.authenticatorId,
+      true,
+    )
+
+    const login = new LoginPage(page, config)
+    // Due to resetting automatic presence simulating to "true" in the previous step,
+    // opening the login page automatically triggers the passkey login
+    await login.open()
+
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+
+    await expect(
+      getSession(page.request, kratosPublicURL),
+    ).resolves.toMatchObject({
+      active: true,
+      identity: {
+        traits: {
+          email: identifier,
+        },
+      },
+    })
+
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    const initialSession = await getSession(page.request, kratosPublicURL)
+
+    const passkeyLoginTrigger = page.locator(
+      "button[name=passkey_login_trigger]",
+    )
+    await passkeyLoginTrigger.waitFor()
+
+    await page.waitForLoadState("load")
+
+    await toggleAutomaticPresenceSimulation(
+      pageCDPSession,
+      virtualAuthenticator.authenticatorId,
+      true,
+    )
+
+    await passkeyLoginTrigger.click()
+    await page.waitForURL(
+      new RegExp(config.selfservice.default_browser_return_url),
+    )
+    const newSession = await getSession(page.request, kratosPublicURL)
+
+    expect(newSession.authentication_methods).toHaveLength(
+      initialSession.authentication_methods.length + 1,
+    )
+  })
+})
diff --git a/test/e2e/playwright/tests/desktop/identifier_first/password.login.spec.ts b/test/e2e/playwright/tests/desktop/identifier_first/password.login.spec.ts
new file mode 100644
index 000000000000..fd6026cb39fb
--- /dev/null
+++ b/test/e2e/playwright/tests/desktop/identifier_first/password.login.spec.ts
@@ -0,0 +1,236 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { expect } from "@playwright/test"
+import { loginWithPassword } from "../../../actions/login"
+import { getSession, hasNoSession, hasSession } from "../../../actions/session"
+import { test } from "../../../fixtures"
+import { toConfig } from "../../../lib/helper"
+import { LoginPage } from "../../../models/elements/login"
+
+// These can run in parallel because they use the same config.
+test.describe("account enumeration protection off", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: false,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: true,
+          },
+          code: {
+            passwordless_enabled: false,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('[data-testid="ui/message/4000037"]'),
+      "expect account not exist message to be shown",
+    ).toBeVisible()
+  })
+
+  test("login with wrong password fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.loginWithPassword(identity.email, "wrong-password")
+    await login.isReady()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4000006"]'),
+      "expect to be shown a credentials do not exist error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.inputField("identifier").fill(identity.email)
+    await login.submit("identifier_first", {
+      waitForURL: new RegExp(config.selfservice.flows.login.ui_url),
+    })
+
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("login with refresh", async ({
+    page,
+    config,
+    identity,
+    kratosPublicURL,
+  }) => {
+    await loginWithPassword(
+      {
+        password: identity.password,
+        traits: {
+          email: identity.email,
+        },
+      },
+      page.request,
+      kratosPublicURL,
+    )
+
+    const login = new LoginPage(page, config)
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    const initialSession = await getSession(page.request, kratosPublicURL)
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    const newSession = await getSession(page.request, kratosPublicURL)
+
+    expect(newSession.authentication_methods).toHaveLength(
+      initialSession.authentication_methods.length + 1,
+    )
+  })
+})
+
+test.describe("account enumeration protection on", () => {
+  test.use({
+    configOverride: toConfig({
+      style: "identifier_first",
+      mitigateEnumeration: true,
+      selfservice: {
+        methods: {
+          password: {
+            enabled: true,
+          },
+          code: {
+            passwordless_enabled: false,
+          },
+        },
+      },
+    }),
+  })
+
+  test("login fails because user does not exist", async ({ page, config }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.submitIdentifierFirst("i@donot.exist")
+
+    await expect(
+      page.locator('button[name="method"][value="password"]'),
+      "expect to show the password form",
+    ).toBeVisible()
+  })
+
+  test("login with wrong password fails", async ({
+    page,
+    identity,
+    kratosPublicURL,
+    config,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.loginWithPassword(identity.email, "wrong-password")
+    await login.isReady()
+
+    await hasNoSession(page.request, kratosPublicURL)
+    await expect(
+      page.locator('[data-testid="ui/message/4000006"]'),
+      "expect to be shown a credentials do not exist error",
+    ).toBeVisible()
+  })
+
+  test("login succeeds", async ({
+    page,
+    // projectFrontendClient,
+    identity,
+    config,
+    kratosPublicURL,
+  }) => {
+    const login = new LoginPage(page, config)
+    await login.open()
+
+    await login.inputField("identifier").fill(identity.email)
+    await login.submit("identifier_first", {
+      waitForURL: new RegExp(config.selfservice.flows.login.ui_url),
+    })
+
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    await hasSession(page.request, kratosPublicURL)
+  })
+
+  test("login with refresh", async ({
+    page,
+    config,
+    identity,
+    kratosPublicURL,
+  }) => {
+    await loginWithPassword(
+      {
+        password: identity.password,
+        traits: {
+          email: identity.email,
+        },
+      },
+      page.request,
+      kratosPublicURL,
+    )
+
+    const login = new LoginPage(page, config)
+    await login.open({
+      refresh: true,
+    })
+
+    await expect(
+      page.locator('[data-testid="ui/message/1010003"]'),
+      "show the refresh message",
+    ).toBeVisible()
+
+    const initialSession = await getSession(page.request, kratosPublicURL)
+
+    await login.inputField("password").fill(identity.password)
+    await login.submit("password", {
+      waitForURL: new RegExp(config.selfservice.default_browser_return_url),
+    })
+
+    const newSession = await getSession(page.request, kratosPublicURL)
+
+    expect(newSession.authentication_methods).toHaveLength(
+      initialSession.authentication_methods.length + 1,
+    )
+  })
+})
diff --git a/test/e2e/playwright/tests/app_login.spec.ts b/test/e2e/playwright/tests/mobile/app_login.spec.ts
similarity index 97%
rename from test/e2e/playwright/tests/app_login.spec.ts
rename to test/e2e/playwright/tests/mobile/app_login.spec.ts
index 600a49a48ce1..6dd6a93ba551 100644
--- a/test/e2e/playwright/tests/app_login.spec.ts
+++ b/test/e2e/playwright/tests/mobile/app_login.spec.ts
@@ -1,9 +1,8 @@
 // Copyright © 2023 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
-import { test, expect, Page } from "@playwright/test"
-
-test.describe.configure({ mode: "parallel" })
+import { expect, Page } from "@playwright/test"
+import { test } from "../../fixtures"
 
 async function performOidcLogin(popup: Page, username: string) {
   await popup.waitForLoadState()
diff --git a/test/e2e/playwright/tests/app_recovery.spec.ts b/test/e2e/playwright/tests/mobile/app_recovery.spec.ts
similarity index 78%
rename from test/e2e/playwright/tests/app_recovery.spec.ts
rename to test/e2e/playwright/tests/mobile/app_recovery.spec.ts
index 629abd3c05bc..c065e0965443 100644
--- a/test/e2e/playwright/tests/app_recovery.spec.ts
+++ b/test/e2e/playwright/tests/mobile/app_recovery.spec.ts
@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { expect } from "@playwright/test"
-import { test } from "../fixtures"
-import { search } from "../actions/mail"
-import { extractCode } from "../lib/helper"
+import { test } from "../../fixtures"
+import { search } from "../../actions/mail"
+import { extractCode } from "../../lib/helper"
 
 const schemaConfig = {
   default_schema_id: "email",
@@ -31,11 +31,11 @@ test.describe("Recovery", () => {
   test("succeeds with a valid email address", async ({ page, identity }) => {
     await page.goto("/Recovery")
 
-    await page.getByTestId("email").fill(identity.traits.email)
+    await page.getByTestId("email").fill(identity.email)
     await page.getByTestId("submit-form").click()
     await expect(page.getByTestId("ui/message/1060003")).toBeVisible()
 
-    const mails = await search(identity.traits.email, "to")
+    const mails = await search({ query: identity.email, kind: "to" })
     expect(mails).toHaveLength(1)
 
     const code = extractCode(mails[0])
@@ -43,13 +43,13 @@ test.describe("Recovery", () => {
 
     await test.step("enter wrong code", async () => {
       await page.getByTestId("code").fill(wrongCode)
-      await page.getByText("Submit").click()
+      await page.getByText("Continue").click()
       await expect(page.getByTestId("ui/message/4060006")).toBeVisible()
     })
 
     await test.step("enter correct code", async () => {
       await page.getByTestId("code").fill(code)
-      await page.getByText("Submit").click()
+      await page.getByText("Continue").click()
       await page.waitForURL(/Settings/)
       await expect(page.getByTestId("ui/message/1060001").first()).toBeVisible()
     })
@@ -58,13 +58,13 @@ test.describe("Recovery", () => {
   test("wrong email address does not get sent", async ({ page, identity }) => {
     await page.goto("/Recovery")
 
-    const wrongEmailAddress = "wrong-" + identity.traits.email
+    const wrongEmailAddress = "wrong-" + identity.email
     await page.getByTestId("email").fill(wrongEmailAddress)
     await page.getByTestId("submit-form").click()
     await expect(page.getByTestId("ui/message/1060003")).toBeVisible()
 
     try {
-      await search(identity.traits.email, "to")
+      await search({ query: identity.email, kind: "to" })
       expect(false).toBeTruthy()
     } catch (e) {
       // this is expected
@@ -74,11 +74,11 @@ test.describe("Recovery", () => {
   test("fails with an invalid code", async ({ page, identity }) => {
     await page.goto("/Recovery")
 
-    await page.getByTestId("email").fill(identity.traits.email)
+    await page.getByTestId("email").fill(identity.email)
     await page.getByTestId("submit-form").click()
     await page.getByTestId("ui/message/1060003").isVisible()
 
-    const mails = await search(identity.traits.email, "to")
+    const mails = await search({ query: identity.email, kind: "to" })
     expect(mails).toHaveLength(1)
 
     const code = extractCode(mails[0])
@@ -87,14 +87,14 @@ test.describe("Recovery", () => {
     await test.step("enter wrong repeatedly", async () => {
       for (let i = 0; i < 10; i++) {
         await page.getByTestId("code").fill(wrongCode)
-        await page.getByText("Submit", { exact: true }).click()
+        await page.getByText("Continue", { exact: true }).click()
         await expect(page.getByTestId("ui/message/4060006")).toBeVisible()
       }
     })
 
     await test.step("enter correct code fails", async () => {
       await page.getByTestId("code").fill(code)
-      await page.getByText("Submit", { exact: true }).click()
+      await page.getByText("Continue", { exact: true }).click()
       await expect(page.getByTestId("ui/message/4060006")).toBeVisible()
     })
   })
@@ -123,17 +123,17 @@ test.describe("Recovery", () => {
     test("fails with an expired code", async ({ page, identity }) => {
       await page.goto("/Recovery")
 
-      await page.getByTestId("email").fill(identity.traits.email)
+      await page.getByTestId("email").fill(identity.email)
       await page.getByTestId("submit-form").click()
       await page.getByTestId("ui/message/1060003").isVisible()
 
-      const mails = await search(identity.traits.email, "to")
+      const mails = await search({ query: identity.email, kind: "to" })
       expect(mails).toHaveLength(1)
 
       const code = extractCode(mails[0])
 
       await page.getByTestId("code").fill(code)
-      await page.getByText("Submit", { exact: true }).click()
+      await page.getByText("Continue", { exact: true }).click()
       await expect(page.getByTestId("email")).toBeVisible()
     })
   })
diff --git a/test/e2e/playwright/types/index.ts b/test/e2e/playwright/types/index.ts
new file mode 100644
index 000000000000..ddb3431774c0
--- /dev/null
+++ b/test/e2e/playwright/types/index.ts
@@ -0,0 +1,10 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { APIResponse } from "playwright-core"
+import { Session } from "@ory/kratos-client"
+
+export type SessionWithResponse = {
+  session: Session
+  response: APIResponse
+}
diff --git a/test/e2e/profiles/code/.kratos.yml b/test/e2e/profiles/code/.kratos.yml
index 3e98857e1628..a98e4979e730 100644
--- a/test/e2e/profiles/code/.kratos.yml
+++ b/test/e2e/profiles/code/.kratos.yml
@@ -38,7 +38,6 @@ selfservice:
       enabled: true
     code:
       passwordless_enabled: true
-      passwordless_login_fallback_enabled: false
       enabled: true
       config:
         lifespan: 1h
diff --git a/test/e2e/profiles/email/identity.traits.schema.json b/test/e2e/profiles/email/identity.traits.schema.json
index 59a799a43d20..e5d40a431bbd 100644
--- a/test/e2e/profiles/email/identity.traits.schema.json
+++ b/test/e2e/profiles/email/identity.traits.schema.json
@@ -17,6 +17,10 @@
               "password": {
                 "identifier": true
               },
+              "code": {
+                "identifier": true,
+                "via": "email"
+              },
               "webauthn": {
                 "identifier": true
               }
diff --git a/test/e2e/profiles/mfa/.kratos.yml b/test/e2e/profiles/mfa/.kratos.yml
index 99becd59a868..081b3bb541b7 100644
--- a/test/e2e/profiles/mfa/.kratos.yml
+++ b/test/e2e/profiles/mfa/.kratos.yml
@@ -27,6 +27,8 @@ selfservice:
       ui_url: http://localhost:4455/recovery
 
   methods:
+    code:
+      mfa_enabled: true
     totp:
       enabled: true
       config:
@@ -44,7 +46,7 @@ selfservice:
 identity:
   schemas:
     - id: default
-      url: file://test/e2e/profiles/email/identity.traits.schema.json
+      url: file://test/e2e/profiles/mfa/identity.traits.schema.json
 
 session:
   whoami:
diff --git a/test/e2e/profiles/mfa/identity.traits.schema.json b/test/e2e/profiles/mfa/identity.traits.schema.json
index 87db142ee8d2..36aef3680f4d 100644
--- a/test/e2e/profiles/mfa/identity.traits.schema.json
+++ b/test/e2e/profiles/mfa/identity.traits.schema.json
@@ -19,6 +19,10 @@
               },
               "webauthn": {
                 "identifier": true
+              },
+              "code": {
+                "identifier": true,
+                "via": "email"
               }
             }
           }
diff --git a/test/e2e/profiles/mobile/.kratos.yml b/test/e2e/profiles/mobile/.kratos.yml
index c0a46e57c197..ab927737337d 100644
--- a/test/e2e/profiles/mobile/.kratos.yml
+++ b/test/e2e/profiles/mobile/.kratos.yml
@@ -19,7 +19,6 @@ selfservice:
 
     verification:
       enabled: false
-
   methods:
     totp:
       enabled: true
diff --git a/test/e2e/profiles/oidc/identity-required.traits.schema.json b/test/e2e/profiles/oidc/identity-required.traits.schema.json
index 19241c7f2760..20b2b50e9995 100644
--- a/test/e2e/profiles/oidc/identity-required.traits.schema.json
+++ b/test/e2e/profiles/oidc/identity-required.traits.schema.json
@@ -19,6 +19,10 @@
               },
               "webauthn": {
                 "identifier": true
+              },
+              "code": {
+                "identifier": true,
+                "via": "email"
               }
             }
           }
diff --git a/test/e2e/profiles/oidc/identity.traits.schema.json b/test/e2e/profiles/oidc/identity.traits.schema.json
index 10fb49486aed..67857c8ab987 100644
--- a/test/e2e/profiles/oidc/identity.traits.schema.json
+++ b/test/e2e/profiles/oidc/identity.traits.schema.json
@@ -19,6 +19,10 @@
               },
               "webauthn": {
                 "identifier": true
+              },
+              "code": {
+                "identifier": true,
+                "via": "email"
               }
             },
             "verification": {
diff --git a/test/e2e/profiles/two-steps/.kratos.yml b/test/e2e/profiles/two-steps/.kratos.yml
index d23dd0bce07c..f5271792c0fc 100644
--- a/test/e2e/profiles/two-steps/.kratos.yml
+++ b/test/e2e/profiles/two-steps/.kratos.yml
@@ -66,7 +66,6 @@ selfservice:
     code:
       enabled: true
       passwordless_enabled: true
-      passwordless_login_fallback_enabled: false
       config:
         lifespan: 1h
 
diff --git a/test/e2e/proxy/package-lock.json b/test/e2e/proxy/package-lock.json
index 1e9a2708ca48..35de6dec9bb3 100644
--- a/test/e2e/proxy/package-lock.json
+++ b/test/e2e/proxy/package-lock.json
@@ -14,11 +14,6 @@
         "url-join": "5.0.0"
       }
     },
-    "node_modules/abbrev": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
-      "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q=="
-    },
     "node_modules/accepts": {
       "version": "1.3.8",
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
@@ -32,14 +27,18 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.4",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.4.tgz",
-      "integrity": "sha512-eienB2c9qVQs2KWexhkrdMLVDoIQCz5KSeLxwg9Lzk4DOfBtIK9PQwwufcsn1jjGuf9WZmqPMbGxOzfcuphJCQ==",
+      "version": "6.12.6",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
+      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
         "fast-json-stable-stringify": "^2.0.0",
         "json-schema-traverse": "^0.4.1",
         "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
       }
     },
     "node_modules/anymatch": {
@@ -57,12 +56,12 @@
     "node_modules/array-flatten": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
-      "integrity": "sha1-ml9pkFGx5wczKPKgCJaLZOopVdI="
+      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg=="
     },
     "node_modules/asn1": {
-      "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/asn1/-/asn1-0.2.4.tgz",
-      "integrity": "sha512-jxwzQpLQjSmWXgwaCZE9Nz+glAG01yF1QnWgbhGwHI5A6FRIEY6IVqtHhIepHqI7/kyEyQEagBC5mBEFlIYvdg==",
+      "version": "0.2.6",
+      "resolved": "https://registry.npmjs.org/asn1/-/asn1-0.2.6.tgz",
+      "integrity": "sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ==",
       "dependencies": {
         "safer-buffer": "~2.1.0"
       }
@@ -70,7 +69,7 @@
     "node_modules/assert-plus": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/assert-plus/-/assert-plus-1.0.0.tgz",
-      "integrity": "sha1-8S4PPF13sLHN2RRpQuTpbB5N1SU=",
+      "integrity": "sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw==",
       "engines": {
         "node": ">=0.8"
       }
@@ -78,20 +77,20 @@
     "node_modules/asynckit": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
-      "integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k="
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="
     },
     "node_modules/aws-sign2": {
       "version": "0.7.0",
       "resolved": "https://registry.npmjs.org/aws-sign2/-/aws-sign2-0.7.0.tgz",
-      "integrity": "sha1-tG6JCTSpWR8tL2+G1+ap8bP+dqg=",
+      "integrity": "sha512-08kcGqnYf/YmjoRhfxyu+CLxBjUtHLXLXX/vUfx9l2LYzG3c1m61nrpyFUZI6zeS+Li/wWMMidD9KgrqtGq3mA==",
       "engines": {
         "node": "*"
       }
     },
     "node_modules/aws4": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/aws4/-/aws4-1.10.1.tgz",
-      "integrity": "sha512-zg7Hz2k5lI8kb7U32998pRRFin7zJlkfezGJjUc2heaD4Pw2wObakCDVzkKztTm/Ln7eiVvYsjqak0Ed4LkMDA=="
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/aws4/-/aws4-1.13.2.tgz",
+      "integrity": "sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw=="
     },
     "node_modules/balanced-match": {
       "version": "1.0.2",
@@ -101,17 +100,20 @@
     "node_modules/bcrypt-pbkdf": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/bcrypt-pbkdf/-/bcrypt-pbkdf-1.0.2.tgz",
-      "integrity": "sha1-pDAdOJtqQ/m2f/PKEaP2Y342Dp4=",
+      "integrity": "sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==",
       "dependencies": {
         "tweetnacl": "^0.14.3"
       }
     },
     "node_modules/binary-extensions": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.2.0.tgz",
-      "integrity": "sha512-jDctJ/IVQbZoJykoeHbhXpOlNBqGNcwXJKJog42E5HDPUwQTSdjCHdihjj0DlnheQ7blbT6dHOafNAiS8ooQKA==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
+      "integrity": "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==",
       "engines": {
         "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/body-parser": {
@@ -195,18 +197,12 @@
     "node_modules/caseless": {
       "version": "0.12.0",
       "resolved": "https://registry.npmjs.org/caseless/-/caseless-0.12.0.tgz",
-      "integrity": "sha1-G2gcIf+EAzyCZUMJBolCDRhxUdw="
+      "integrity": "sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw=="
     },
     "node_modules/chokidar": {
-      "version": "3.5.3",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
-      "integrity": "sha512-Dr3sfKRP6oTcjf2JmUmFJfeVMvXBdegxB0iVQ5eb2V10uFJUCAS8OByZdVAyVb8xXNz3GjjTgj9kLWsZTqE6kw==",
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://paulmillr.com/funding/"
-        }
-      ],
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
+      "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==",
       "dependencies": {
         "anymatch": "~3.1.2",
         "braces": "~3.0.2",
@@ -219,6 +215,9 @@
       "engines": {
         "node": ">= 8.10.0"
       },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      },
       "optionalDependencies": {
         "fsevents": "~2.3.2"
       }
@@ -269,17 +268,17 @@
     "node_modules/cookie-signature": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
-      "integrity": "sha1-4wOogrNCzD7oylE6eZmXNNqzriw="
+      "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ=="
     },
     "node_modules/core-util-is": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
-      "integrity": "sha1-tf1UIgqivFq1eqtxQMlAdUUDwac="
+      "integrity": "sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ=="
     },
     "node_modules/dashdash": {
       "version": "1.14.1",
       "resolved": "https://registry.npmjs.org/dashdash/-/dashdash-1.14.1.tgz",
-      "integrity": "sha1-hTz6D3y+L+1d4gMmuN1YEDX24vA=",
+      "integrity": "sha512-jRFi8UDGo6j+odZiEpjazZaWqEal3w/basFjQHQEwVtZJGDpxbH1MeYluwCS8Xq5wmLJooDlMgvVarmWfGM44g==",
       "dependencies": {
         "assert-plus": "^1.0.0"
       },
@@ -298,7 +297,7 @@
     "node_modules/delayed-stream": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
-      "integrity": "sha1-3zrhmayt+31ECqrgsp4icrJOxhk=",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
       "engines": {
         "node": ">=0.4.0"
       }
@@ -336,7 +335,7 @@
     "node_modules/ecc-jsbn": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/ecc-jsbn/-/ecc-jsbn-0.1.2.tgz",
-      "integrity": "sha1-OoOpBOVDUyh4dMVkt1SThoSamMk=",
+      "integrity": "sha512-eh9O+hwRHNbG4BLTjEl3nw044CkGm5X6LoaCf7LPp7UU8Qrt47JYNi6nPX8xjW97TKGKm1ouctg0QSpZe9qrnw==",
       "dependencies": {
         "jsbn": "~0.1.0",
         "safer-buffer": "^2.1.0"
@@ -448,7 +447,7 @@
     "node_modules/extsprintf": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/extsprintf/-/extsprintf-1.3.0.tgz",
-      "integrity": "sha1-lpGEQOMEGnpBT4xS48V06zw+HgU=",
+      "integrity": "sha512-11Ndz7Nv+mvAC1j0ktTa7fAb0vLyGGX+rMHNBYQviQDGU0Hw7lhctJANqbPhu9nV9/izT/IntTgZ7Im/9LJs9g==",
       "engines": [
         "node >=0.6.0"
       ]
@@ -494,7 +493,7 @@
     "node_modules/forever-agent": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/forever-agent/-/forever-agent-0.6.1.tgz",
-      "integrity": "sha1-+8cfDEGt6zf5bFd60e1C2P2sypE=",
+      "integrity": "sha512-j0KLYPhm6zeac4lz3oJ3o65qvgQCcPubiyotZrXqEaG4hNagNYO8qdlUrX5vwqv9ohqeT/Z3j6+yW067yWWdUw==",
       "engines": {
         "node": "*"
       }
@@ -529,9 +528,9 @@
       }
     },
     "node_modules/fsevents": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
       "hasInstallScript": true,
       "optional": true,
       "os": [
@@ -575,7 +574,7 @@
     "node_modules/getpass": {
       "version": "0.1.7",
       "resolved": "https://registry.npmjs.org/getpass/-/getpass-0.1.7.tgz",
-      "integrity": "sha1-Xv+OPmhNVprkyysSgmBOi6YhSfo=",
+      "integrity": "sha512-0fzj9JxOLfJ+XGLhR8ze3unN0KZCgZwiSSDz168VERjK8Wl8kVSdcu2kspd4s4wtAa1y/qrVRiAA0WclVsu0ng==",
       "dependencies": {
         "assert-plus": "^1.0.0"
       }
@@ -605,7 +604,7 @@
     "node_modules/har-schema": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/har-schema/-/har-schema-2.0.0.tgz",
-      "integrity": "sha1-qUwiJOvKwEeCoNkDVSHyRzW37JI=",
+      "integrity": "sha512-Oqluz6zhGX8cyRaTQlFMPw80bSJVG2x/cFb8ZPhUILGgHka9SsokCCOQgpveePerqidZOrT14ipqfJb7ILcW5Q==",
       "engines": {
         "node": ">=4"
       }
@@ -614,6 +613,7 @@
       "version": "5.1.5",
       "resolved": "https://registry.npmjs.org/har-validator/-/har-validator-5.1.5.tgz",
       "integrity": "sha512-nmT2T0lljbxdQZfspsno9hgrG3Uir6Ks5afism62poxqBM6sDnMEuPmzTq8XN0OEwqKLLdh1jQI3qyE66Nzb3w==",
+      "deprecated": "this library is no longer supported",
       "dependencies": {
         "ajv": "^6.12.3",
         "har-schema": "^2.0.0"
@@ -625,7 +625,7 @@
     "node_modules/has-flag": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-      "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0=",
+      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
       "engines": {
         "node": ">=4"
       }
@@ -670,7 +670,7 @@
     "node_modules/http-signature": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/http-signature/-/http-signature-1.2.0.tgz",
-      "integrity": "sha1-muzZJRFHcvPZW2WmCruPfBj7rOE=",
+      "integrity": "sha512-CAbnr6Rz4CYQkLYUtSNXxQPUH2gK8f3iWexVlsnMeD+GjlsQ0Xsy1cOX+mN3dtxYomRy21CiOzU8Uhw6OwncEQ==",
       "dependencies": {
         "assert-plus": "^1.0.0",
         "jsprim": "^1.2.2",
@@ -695,7 +695,7 @@
     "node_modules/ignore-by-default": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/ignore-by-default/-/ignore-by-default-1.0.1.tgz",
-      "integrity": "sha1-SMptcvbGo68Aqa1K5odr44ieKwk="
+      "integrity": "sha512-Ius2VYcGNk7T90CppJqcIkS5ooHUZyIQK+ClZfMfMNFEF9VSE73Fq+906u/CWu92x4gzZMWOwfFYckPObzdEbA=="
     },
     "node_modules/inherits": {
       "version": "2.0.4",
@@ -751,17 +751,17 @@
     "node_modules/is-typedarray": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz",
-      "integrity": "sha1-5HnICFjfDBsR3dppQPlgEfzaSpo="
+      "integrity": "sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA=="
     },
     "node_modules/isstream": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/isstream/-/isstream-0.1.2.tgz",
-      "integrity": "sha1-R+Y/evVa+m+S4VAOaQ64uFKcCZo="
+      "integrity": "sha512-Yljz7ffyPbrLpLngrMtZ7NduUgVvi6wG9RJ9IUcyCd59YQ911PBJphODUcbOVbqYfxe1wuYf/LJ8PauMRwsM/g=="
     },
     "node_modules/jsbn": {
       "version": "0.1.1",
       "resolved": "https://registry.npmjs.org/jsbn/-/jsbn-0.1.1.tgz",
-      "integrity": "sha1-peZUwuWi3rXyAdls77yoDA7y9RM="
+      "integrity": "sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg=="
     },
     "node_modules/json-schema": {
       "version": "0.4.0",
@@ -776,7 +776,7 @@
     "node_modules/json-stringify-safe": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
-      "integrity": "sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus="
+      "integrity": "sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA=="
     },
     "node_modules/jsprim": {
       "version": "1.4.2",
@@ -819,7 +819,7 @@
     "node_modules/methods": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
-      "integrity": "sha1-VSmk1nZUE07cxSZmVoNbD4Ua/O4=",
+      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
       "engines": {
         "node": ">= 0.6"
       }
@@ -926,17 +926,6 @@
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
     },
-    "node_modules/nopt": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/nopt/-/nopt-1.0.10.tgz",
-      "integrity": "sha1-bd0hvSoxQXuScn3Vhfim83YI6+4=",
-      "dependencies": {
-        "abbrev": "1"
-      },
-      "bin": {
-        "nopt": "bin/nopt.js"
-      }
-    },
     "node_modules/normalize-path": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
@@ -991,7 +980,7 @@
     "node_modules/performance-now": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/performance-now/-/performance-now-2.1.0.tgz",
-      "integrity": "sha1-Ywn04OX6kT7BxpMHrjZLSzd8nns="
+      "integrity": "sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow=="
     },
     "node_modules/picomatch": {
       "version": "2.3.1",
@@ -1017,9 +1006,15 @@
       }
     },
     "node_modules/psl": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/psl/-/psl-1.8.0.tgz",
-      "integrity": "sha512-RIdOzyoavK+hA18OGGWDqUTsCLhtA7IcZ/6NCs4fFJaHBDab+pDDmDIByWFRQJq2Cd7r1OoQxBGKOaztq+hjIQ=="
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/psl/-/psl-1.15.0.tgz",
+      "integrity": "sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==",
+      "dependencies": {
+        "punycode": "^2.3.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/lupomontero"
+      }
     },
     "node_modules/pstree.remy": {
       "version": "1.1.8",
@@ -1027,9 +1022,9 @@
       "integrity": "sha512-77DZwxQmxKnu3aR542U+X8FypNzbfJ+C5XQDk3uWjWxn6151aIMGthWYRXTqT1E5oJvg+ljaa2OJi+VfvCOQ8w=="
     },
     "node_modules/punycode": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz",
-      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
       "engines": {
         "node": ">=6"
       }
@@ -1085,6 +1080,7 @@
       "version": "2.88.2",
       "resolved": "https://registry.npmjs.org/request/-/request-2.88.2.tgz",
       "integrity": "sha512-MsvtOrfG9ZcrOwAW+Qi+F6HbD0CWXEh9ou77uOb7FM2WPhwT7smM833PzanhJLsgXjN89Ir6V2PczXNnMpwKhw==",
+      "deprecated": "request has been deprecated, see https://github.com/request/request/issues/3142",
       "dependencies": {
         "aws-sign2": "~0.7.0",
         "aws4": "^1.8.0",
@@ -1289,9 +1285,9 @@
       }
     },
     "node_modules/sshpk": {
-      "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/sshpk/-/sshpk-1.16.1.tgz",
-      "integrity": "sha512-HXXqVUq7+pcKeLqqZj6mHFUMvXtOJt1uoUx09pFW6011inTMxqI8BA8PM95myrIyyKwdnzjdFjLiE6KBPVtJIg==",
+      "version": "1.18.0",
+      "resolved": "https://registry.npmjs.org/sshpk/-/sshpk-1.18.0.tgz",
+      "integrity": "sha512-2p2KJZTSqQ/I3+HX42EpYOa2l3f8Erv8MWKsy2I9uf4wA7yFIkXRffYdsx86y6z4vHtV8u7g+pPlr8/4ouAxsQ==",
       "dependencies": {
         "asn1": "~0.2.3",
         "assert-plus": "^1.0.0",
@@ -1351,12 +1347,9 @@
       }
     },
     "node_modules/touch": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/touch/-/touch-3.1.0.tgz",
-      "integrity": "sha512-WBx8Uy5TLtOSRtIq+M03/sKDrXCLHxwDcquSP2c43Le03/9serjQBIztjRz6FkJez9D/hleyAXTBGLwwZUw9lA==",
-      "dependencies": {
-        "nopt": "~1.0.10"
-      },
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/touch/-/touch-3.1.1.tgz",
+      "integrity": "sha512-r0eojU4bI8MnHr8c5bNo7lJDdI2qXlWWJk6a9EAFG7vbhTjElYhBVS3/miuE0uOuoLdb8Mc/rVfsmm6eo5o9GA==",
       "bin": {
         "nodetouch": "bin/nodetouch.js"
       }
@@ -1376,7 +1369,7 @@
     "node_modules/tunnel-agent": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
-      "integrity": "sha1-J6XeoGs2sEoKmWZ3SykIaPD8QP0=",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
       "dependencies": {
         "safe-buffer": "^5.0.1"
       },
@@ -1387,7 +1380,7 @@
     "node_modules/tweetnacl": {
       "version": "0.14.5",
       "resolved": "https://registry.npmjs.org/tweetnacl/-/tweetnacl-0.14.5.tgz",
-      "integrity": "sha1-WuaBd/GS1EViadEIr6k/+HQ/T2Q="
+      "integrity": "sha512-KXXFFdAbFXY4geFIwoyNK+f5Z1b7swfXABfL7HXCmoIWMKU3dmS26672A4EeQtDzLKy7SXmfBu51JolvEKwtGA=="
     },
     "node_modules/type-is": {
       "version": "1.6.18",
@@ -1415,9 +1408,9 @@
       }
     },
     "node_modules/uri-js": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.0.tgz",
-      "integrity": "sha512-B0yRTzYdUCCn9n+F4+Gh4yIDtMQcaJsmYBDsTSG8g/OejKBodLQ2IHfN3bM7jUsRXndopT7OIXWdYqc1fjmV6g==",
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
       "dependencies": {
         "punycode": "^2.1.0"
       }
@@ -1433,7 +1426,7 @@
     "node_modules/utils-merge": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
-      "integrity": "sha1-n5VxD1CiZ5R7LMwSR0HBAoQn5xM=",
+      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
       "engines": {
         "node": ">= 0.4.0"
       }
@@ -1442,6 +1435,7 @@
       "version": "3.4.0",
       "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
       "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==",
+      "deprecated": "Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.",
       "bin": {
         "uuid": "bin/uuid"
       }
@@ -1449,7 +1443,7 @@
     "node_modules/vary": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha1-IpnwLG3tMNSllhsLn3RSShj2NPw=",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
       "engines": {
         "node": ">= 0.8"
       }
@@ -1457,7 +1451,7 @@
     "node_modules/verror": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.0.tgz",
-      "integrity": "sha1-OhBcoXBTr1XW4nDB+CiGguGNpAA=",
+      "integrity": "sha512-ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw==",
       "engines": [
         "node >=0.6.0"
       ],
@@ -1469,11 +1463,6 @@
     }
   },
   "dependencies": {
-    "abbrev": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
-      "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q=="
-    },
     "accepts": {
       "version": "1.3.8",
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
@@ -1484,9 +1473,9 @@
       }
     },
     "ajv": {
-      "version": "6.12.4",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.4.tgz",
-      "integrity": "sha512-eienB2c9qVQs2KWexhkrdMLVDoIQCz5KSeLxwg9Lzk4DOfBtIK9PQwwufcsn1jjGuf9WZmqPMbGxOzfcuphJCQ==",
+      "version": "6.12.6",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
+      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
       "requires": {
         "fast-deep-equal": "^3.1.1",
         "fast-json-stable-stringify": "^2.0.0",
@@ -1506,12 +1495,12 @@
     "array-flatten": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
-      "integrity": "sha1-ml9pkFGx5wczKPKgCJaLZOopVdI="
+      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg=="
     },
     "asn1": {
-      "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/asn1/-/asn1-0.2.4.tgz",
-      "integrity": "sha512-jxwzQpLQjSmWXgwaCZE9Nz+glAG01yF1QnWgbhGwHI5A6FRIEY6IVqtHhIepHqI7/kyEyQEagBC5mBEFlIYvdg==",
+      "version": "0.2.6",
+      "resolved": "https://registry.npmjs.org/asn1/-/asn1-0.2.6.tgz",
+      "integrity": "sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ==",
       "requires": {
         "safer-buffer": "~2.1.0"
       }
@@ -1519,22 +1508,22 @@
     "assert-plus": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/assert-plus/-/assert-plus-1.0.0.tgz",
-      "integrity": "sha1-8S4PPF13sLHN2RRpQuTpbB5N1SU="
+      "integrity": "sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw=="
     },
     "asynckit": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
-      "integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k="
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="
     },
     "aws-sign2": {
       "version": "0.7.0",
       "resolved": "https://registry.npmjs.org/aws-sign2/-/aws-sign2-0.7.0.tgz",
-      "integrity": "sha1-tG6JCTSpWR8tL2+G1+ap8bP+dqg="
+      "integrity": "sha512-08kcGqnYf/YmjoRhfxyu+CLxBjUtHLXLXX/vUfx9l2LYzG3c1m61nrpyFUZI6zeS+Li/wWMMidD9KgrqtGq3mA=="
     },
     "aws4": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/aws4/-/aws4-1.10.1.tgz",
-      "integrity": "sha512-zg7Hz2k5lI8kb7U32998pRRFin7zJlkfezGJjUc2heaD4Pw2wObakCDVzkKztTm/Ln7eiVvYsjqak0Ed4LkMDA=="
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/aws4/-/aws4-1.13.2.tgz",
+      "integrity": "sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw=="
     },
     "balanced-match": {
       "version": "1.0.2",
@@ -1544,15 +1533,15 @@
     "bcrypt-pbkdf": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/bcrypt-pbkdf/-/bcrypt-pbkdf-1.0.2.tgz",
-      "integrity": "sha1-pDAdOJtqQ/m2f/PKEaP2Y342Dp4=",
+      "integrity": "sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==",
       "requires": {
         "tweetnacl": "^0.14.3"
       }
     },
     "binary-extensions": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.2.0.tgz",
-      "integrity": "sha512-jDctJ/IVQbZoJykoeHbhXpOlNBqGNcwXJKJog42E5HDPUwQTSdjCHdihjj0DlnheQ7blbT6dHOafNAiS8ooQKA=="
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
+      "integrity": "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw=="
     },
     "body-parser": {
       "version": "1.20.3",
@@ -1616,12 +1605,12 @@
     "caseless": {
       "version": "0.12.0",
       "resolved": "https://registry.npmjs.org/caseless/-/caseless-0.12.0.tgz",
-      "integrity": "sha1-G2gcIf+EAzyCZUMJBolCDRhxUdw="
+      "integrity": "sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw=="
     },
     "chokidar": {
-      "version": "3.5.3",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
-      "integrity": "sha512-Dr3sfKRP6oTcjf2JmUmFJfeVMvXBdegxB0iVQ5eb2V10uFJUCAS8OByZdVAyVb8xXNz3GjjTgj9kLWsZTqE6kw==",
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
+      "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==",
       "requires": {
         "anymatch": "~3.1.2",
         "braces": "~3.0.2",
@@ -1667,17 +1656,17 @@
     "cookie-signature": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
-      "integrity": "sha1-4wOogrNCzD7oylE6eZmXNNqzriw="
+      "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ=="
     },
     "core-util-is": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
-      "integrity": "sha1-tf1UIgqivFq1eqtxQMlAdUUDwac="
+      "integrity": "sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ=="
     },
     "dashdash": {
       "version": "1.14.1",
       "resolved": "https://registry.npmjs.org/dashdash/-/dashdash-1.14.1.tgz",
-      "integrity": "sha1-hTz6D3y+L+1d4gMmuN1YEDX24vA=",
+      "integrity": "sha512-jRFi8UDGo6j+odZiEpjazZaWqEal3w/basFjQHQEwVtZJGDpxbH1MeYluwCS8Xq5wmLJooDlMgvVarmWfGM44g==",
       "requires": {
         "assert-plus": "^1.0.0"
       }
@@ -1693,7 +1682,7 @@
     "delayed-stream": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
-      "integrity": "sha1-3zrhmayt+31ECqrgsp4icrJOxhk="
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ=="
     },
     "depd": {
       "version": "2.0.0",
@@ -1718,7 +1707,7 @@
     "ecc-jsbn": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/ecc-jsbn/-/ecc-jsbn-0.1.2.tgz",
-      "integrity": "sha1-OoOpBOVDUyh4dMVkt1SThoSamMk=",
+      "integrity": "sha512-eh9O+hwRHNbG4BLTjEl3nw044CkGm5X6LoaCf7LPp7UU8Qrt47JYNi6nPX8xjW97TKGKm1ouctg0QSpZe9qrnw==",
       "requires": {
         "jsbn": "~0.1.0",
         "safer-buffer": "^2.1.0"
@@ -1808,7 +1797,7 @@
     "extsprintf": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/extsprintf/-/extsprintf-1.3.0.tgz",
-      "integrity": "sha1-lpGEQOMEGnpBT4xS48V06zw+HgU="
+      "integrity": "sha512-11Ndz7Nv+mvAC1j0ktTa7fAb0vLyGGX+rMHNBYQviQDGU0Hw7lhctJANqbPhu9nV9/izT/IntTgZ7Im/9LJs9g=="
     },
     "fast-deep-equal": {
       "version": "3.1.3",
@@ -1845,7 +1834,7 @@
     "forever-agent": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/forever-agent/-/forever-agent-0.6.1.tgz",
-      "integrity": "sha1-+8cfDEGt6zf5bFd60e1C2P2sypE="
+      "integrity": "sha512-j0KLYPhm6zeac4lz3oJ3o65qvgQCcPubiyotZrXqEaG4hNagNYO8qdlUrX5vwqv9ohqeT/Z3j6+yW067yWWdUw=="
     },
     "form-data": {
       "version": "2.3.3",
@@ -1868,9 +1857,9 @@
       "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q=="
     },
     "fsevents": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
       "optional": true
     },
     "function-bind": {
@@ -1898,7 +1887,7 @@
     "getpass": {
       "version": "0.1.7",
       "resolved": "https://registry.npmjs.org/getpass/-/getpass-0.1.7.tgz",
-      "integrity": "sha1-Xv+OPmhNVprkyysSgmBOi6YhSfo=",
+      "integrity": "sha512-0fzj9JxOLfJ+XGLhR8ze3unN0KZCgZwiSSDz168VERjK8Wl8kVSdcu2kspd4s4wtAa1y/qrVRiAA0WclVsu0ng==",
       "requires": {
         "assert-plus": "^1.0.0"
       }
@@ -1919,7 +1908,7 @@
     "har-schema": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/har-schema/-/har-schema-2.0.0.tgz",
-      "integrity": "sha1-qUwiJOvKwEeCoNkDVSHyRzW37JI="
+      "integrity": "sha512-Oqluz6zhGX8cyRaTQlFMPw80bSJVG2x/cFb8ZPhUILGgHka9SsokCCOQgpveePerqidZOrT14ipqfJb7ILcW5Q=="
     },
     "har-validator": {
       "version": "5.1.5",
@@ -1933,7 +1922,7 @@
     "has-flag": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-      "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0="
+      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw=="
     },
     "has-symbols": {
       "version": "1.1.0",
@@ -1963,7 +1952,7 @@
     "http-signature": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/http-signature/-/http-signature-1.2.0.tgz",
-      "integrity": "sha1-muzZJRFHcvPZW2WmCruPfBj7rOE=",
+      "integrity": "sha512-CAbnr6Rz4CYQkLYUtSNXxQPUH2gK8f3iWexVlsnMeD+GjlsQ0Xsy1cOX+mN3dtxYomRy21CiOzU8Uhw6OwncEQ==",
       "requires": {
         "assert-plus": "^1.0.0",
         "jsprim": "^1.2.2",
@@ -1981,7 +1970,7 @@
     "ignore-by-default": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/ignore-by-default/-/ignore-by-default-1.0.1.tgz",
-      "integrity": "sha1-SMptcvbGo68Aqa1K5odr44ieKwk="
+      "integrity": "sha512-Ius2VYcGNk7T90CppJqcIkS5ooHUZyIQK+ClZfMfMNFEF9VSE73Fq+906u/CWu92x4gzZMWOwfFYckPObzdEbA=="
     },
     "inherits": {
       "version": "2.0.4",
@@ -2022,17 +2011,17 @@
     "is-typedarray": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz",
-      "integrity": "sha1-5HnICFjfDBsR3dppQPlgEfzaSpo="
+      "integrity": "sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA=="
     },
     "isstream": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/isstream/-/isstream-0.1.2.tgz",
-      "integrity": "sha1-R+Y/evVa+m+S4VAOaQ64uFKcCZo="
+      "integrity": "sha512-Yljz7ffyPbrLpLngrMtZ7NduUgVvi6wG9RJ9IUcyCd59YQ911PBJphODUcbOVbqYfxe1wuYf/LJ8PauMRwsM/g=="
     },
     "jsbn": {
       "version": "0.1.1",
       "resolved": "https://registry.npmjs.org/jsbn/-/jsbn-0.1.1.tgz",
-      "integrity": "sha1-peZUwuWi3rXyAdls77yoDA7y9RM="
+      "integrity": "sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg=="
     },
     "json-schema": {
       "version": "0.4.0",
@@ -2047,7 +2036,7 @@
     "json-stringify-safe": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
-      "integrity": "sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus="
+      "integrity": "sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA=="
     },
     "jsprim": {
       "version": "1.4.2",
@@ -2078,7 +2067,7 @@
     "methods": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
-      "integrity": "sha1-VSmk1nZUE07cxSZmVoNbD4Ua/O4="
+      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w=="
     },
     "mime": {
       "version": "1.6.0",
@@ -2148,14 +2137,6 @@
         }
       }
     },
-    "nopt": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/nopt/-/nopt-1.0.10.tgz",
-      "integrity": "sha1-bd0hvSoxQXuScn3Vhfim83YI6+4=",
-      "requires": {
-        "abbrev": "1"
-      }
-    },
     "normalize-path": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
@@ -2192,7 +2173,7 @@
     "performance-now": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/performance-now/-/performance-now-2.1.0.tgz",
-      "integrity": "sha1-Ywn04OX6kT7BxpMHrjZLSzd8nns="
+      "integrity": "sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow=="
     },
     "picomatch": {
       "version": "2.3.1",
@@ -2209,9 +2190,12 @@
       }
     },
     "psl": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/psl/-/psl-1.8.0.tgz",
-      "integrity": "sha512-RIdOzyoavK+hA18OGGWDqUTsCLhtA7IcZ/6NCs4fFJaHBDab+pDDmDIByWFRQJq2Cd7r1OoQxBGKOaztq+hjIQ=="
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/psl/-/psl-1.15.0.tgz",
+      "integrity": "sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==",
+      "requires": {
+        "punycode": "^2.3.1"
+      }
     },
     "pstree.remy": {
       "version": "1.1.8",
@@ -2219,9 +2203,9 @@
       "integrity": "sha512-77DZwxQmxKnu3aR542U+X8FypNzbfJ+C5XQDk3uWjWxn6151aIMGthWYRXTqT1E5oJvg+ljaa2OJi+VfvCOQ8w=="
     },
     "punycode": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz",
-      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A=="
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="
     },
     "qs": {
       "version": "6.13.0",
@@ -2405,9 +2389,9 @@
       }
     },
     "sshpk": {
-      "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/sshpk/-/sshpk-1.16.1.tgz",
-      "integrity": "sha512-HXXqVUq7+pcKeLqqZj6mHFUMvXtOJt1uoUx09pFW6011inTMxqI8BA8PM95myrIyyKwdnzjdFjLiE6KBPVtJIg==",
+      "version": "1.18.0",
+      "resolved": "https://registry.npmjs.org/sshpk/-/sshpk-1.18.0.tgz",
+      "integrity": "sha512-2p2KJZTSqQ/I3+HX42EpYOa2l3f8Erv8MWKsy2I9uf4wA7yFIkXRffYdsx86y6z4vHtV8u7g+pPlr8/4ouAxsQ==",
       "requires": {
         "asn1": "~0.2.3",
         "assert-plus": "^1.0.0",
@@ -2447,12 +2431,9 @@
       "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="
     },
     "touch": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/touch/-/touch-3.1.0.tgz",
-      "integrity": "sha512-WBx8Uy5TLtOSRtIq+M03/sKDrXCLHxwDcquSP2c43Le03/9serjQBIztjRz6FkJez9D/hleyAXTBGLwwZUw9lA==",
-      "requires": {
-        "nopt": "~1.0.10"
-      }
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/touch/-/touch-3.1.1.tgz",
+      "integrity": "sha512-r0eojU4bI8MnHr8c5bNo7lJDdI2qXlWWJk6a9EAFG7vbhTjElYhBVS3/miuE0uOuoLdb8Mc/rVfsmm6eo5o9GA=="
     },
     "tough-cookie": {
       "version": "2.5.0",
@@ -2466,7 +2447,7 @@
     "tunnel-agent": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
-      "integrity": "sha1-J6XeoGs2sEoKmWZ3SykIaPD8QP0=",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
       "requires": {
         "safe-buffer": "^5.0.1"
       }
@@ -2474,7 +2455,7 @@
     "tweetnacl": {
       "version": "0.14.5",
       "resolved": "https://registry.npmjs.org/tweetnacl/-/tweetnacl-0.14.5.tgz",
-      "integrity": "sha1-WuaBd/GS1EViadEIr6k/+HQ/T2Q="
+      "integrity": "sha512-KXXFFdAbFXY4geFIwoyNK+f5Z1b7swfXABfL7HXCmoIWMKU3dmS26672A4EeQtDzLKy7SXmfBu51JolvEKwtGA=="
     },
     "type-is": {
       "version": "1.6.18",
@@ -2496,9 +2477,9 @@
       "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="
     },
     "uri-js": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.0.tgz",
-      "integrity": "sha512-B0yRTzYdUCCn9n+F4+Gh4yIDtMQcaJsmYBDsTSG8g/OejKBodLQ2IHfN3bM7jUsRXndopT7OIXWdYqc1fjmV6g==",
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
       "requires": {
         "punycode": "^2.1.0"
       }
@@ -2511,7 +2492,7 @@
     "utils-merge": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
-      "integrity": "sha1-n5VxD1CiZ5R7LMwSR0HBAoQn5xM="
+      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA=="
     },
     "uuid": {
       "version": "3.4.0",
@@ -2521,12 +2502,12 @@
     "vary": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha1-IpnwLG3tMNSllhsLn3RSShj2NPw="
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg=="
     },
     "verror": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.0.tgz",
-      "integrity": "sha1-OhBcoXBTr1XW4nDB+CiGguGNpAA=",
+      "integrity": "sha512-ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw==",
       "requires": {
         "assert-plus": "^1.0.0",
         "core-util-is": "1.0.2",
diff --git a/test/e2e/render-kratos-config.sh b/test/e2e/render-kratos-config.sh
index 5867904216e2..b1895ecd882c 100755
--- a/test/e2e/render-kratos-config.sh
+++ b/test/e2e/render-kratos-config.sh
@@ -10,8 +10,8 @@ ory_x_version="$(cd $dir/../..; go list -f '{{.Version}}' -m github.com/ory/x)"
 
 curl -s https://raw.githubusercontent.com/ory/x/$ory_x_version/otelx/config.schema.json > $dir/.tracing-config.schema.json
 
-(cd $dir; sed "s!ory://tracing-config!.tracing-config.schema.json!g;" $dir/../../embedx/config.schema.json | npx json2ts --strictIndexSignatures > $dir/cypress/support/config.d.ts)
+(cd $dir; sed "s!ory://tracing-config!.tracing-config.schema.json!g;" $dir/../../embedx/config.schema.json | npx json2ts --strictIndexSignatures > $dir/shared/config.d.ts)
 
 rm $dir/.tracing-config.schema.json
 
-make format
+(cd $dir/../..; make format)
diff --git a/test/e2e/run.sh b/test/e2e/run.sh
index 62b5330adafc..a0a6d449fc6c 100755
--- a/test/e2e/run.sh
+++ b/test/e2e/run.sh
@@ -72,8 +72,8 @@ prepare() {
 
   if [ -z ${TEST_DATABASE_POSTGRESQL+x} ]; then
     docker rm -f kratos_test_database_mysql kratos_test_database_postgres kratos_test_database_cockroach || true
-    docker run --platform linux/amd64 --name kratos_test_database_mysql -p 3444:3306 -e MYSQL_ROOT_PASSWORD=secret -d mysql:5.7
-    docker run --name kratos_test_database_postgres -p 3445:5432 -e POSTGRES_PASSWORD=secret -e POSTGRES_DB=postgres -d postgres:9.6 postgres -c log_statement=all
+    docker run --name kratos_test_database_mysql -p 3444:3306 -e MYSQL_ROOT_PASSWORD=secret -d mysql:8.0
+    docker run --name kratos_test_database_postgres -p 3445:5432 -e POSTGRES_PASSWORD=secret -e POSTGRES_DB=postgres -d postgres:14 postgres -c log_statement=all
     docker run --name kratos_test_database_cockroach -p 3446:26257 -d cockroachdb/cockroach:v22.2.6 start-single-node --insecure
 
     export TEST_DATABASE_MYSQL="mysql://root:secret@(localhost:3444)/mysql?parseTime=true&multiStatements=true"
@@ -249,8 +249,8 @@ run() {
 
   export DSN=${1}
 
-  nc -zv localhost 4434 && exit 1
-  nc -zv localhost 4433 && exit 1
+  nc -zv localhost 4434 && (echo "Port 4434 unavailable, used by" ; lsof -i:4434 ; exit 1)
+  nc -zv localhost 4433 && (echo "Port 4433 unavailable, used by" ; lsof -i:4433 ; exit 1)
 
   ls -la .
   for profile in code email mobile oidc recovery recovery-mfa verification mfa spa network passwordless passkey webhooks oidc-provider oidc-provider-mfa two-steps; do
diff --git a/test/e2e/cypress/support/config.d.ts b/test/e2e/shared/config.d.ts
similarity index 88%
rename from test/e2e/cypress/support/config.d.ts
rename to test/e2e/shared/config.d.ts
index c7e9742aed39..9f3d60368bc7 100644
--- a/test/e2e/cypress/support/config.d.ts
+++ b/test/e2e/shared/config.d.ts
@@ -53,10 +53,18 @@ export type ProvideLoginHintsOnFailedRegistration = boolean
  * URL where the Registration UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).
  */
 export type RegistrationUIURL = string
+/**
+ * Two-step registration is a significantly improved sign up flow and recommended when using more than one sign up methods. To revert to one-step registration, set this to `true`.
+ */
+export type DisableTwoStepRegistration = boolean
 /**
  * URL where the Login UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).
  */
 export type LoginUIURL = string
+/**
+ * The style of the login flow. If set to `unified` the login flow will be a one-step process. If set to `identifier_first` (experimental!) the login flow will first ask for the identifier and then the credentials.
+ */
+export type LoginFlowStyle = "unified" | "identifier_first"
 /**
  * If set to true will enable [Email and Phone Verification and Account Activation](https://www.ory.sh/kratos/docs/self-service/flows/verify-email-account-activation/).
  */
@@ -110,14 +118,6 @@ export type EnablesLinkMethod = boolean
 export type OverrideTheBaseURLWhichShouldBeUsedAsTheBaseForRecoveryAndVerificationLinks =
   string
 export type HowLongALinkIsValidFor = string
-export type EnablesLoginAndRegistrationWithTheCodeMethod = boolean
-export type EnablesLoginFlowsCodeMethodToFulfilMFARequests = boolean
-/**
- * This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.
- */
-export type PasswordlessLoginFallbackEnabled = boolean
-export type EnablesCodeMethod = boolean
-export type HowLongACodeIsValidFor = string
 export type EnablesUsernameEmailAndPasswordMethod = boolean
 /**
  * Allows changing the default HIBP host to a self hosted version.
@@ -143,6 +143,16 @@ export type MinimumPasswordLength = number
  * If set to false the password validation does not check for similarity between the password and the user identifier.
  */
 export type EnablePasswordIdentifierSimilarityCheck = boolean
+/**
+ * If set to true will enable password migration.
+ */
+export type EnablePasswordMigration = boolean
+/**
+ * Define which auth mechanism the Web-Hook should use
+ */
+export type AuthMechanisms =
+  | WebHookAuthApiKeyProperties
+  | WebHookAuthBasicAuthProperties
 export type EnablesTheTOTPMethod = boolean
 /**
  * The issuer (e.g. a domain name) will be shown in the TOTP app (e.g. Google Authenticator). It helps the user differentiate between different codes.
@@ -178,6 +188,19 @@ export type RelyingPartyRPConfig =
       origins: string[]
       [k: string]: unknown | undefined
     }
+export type EnablesThePasskeyMethod = boolean
+/**
+ * A name to help the user identify this RP.
+ */
+export type RelyingPartyDisplayName = string
+/**
+ * The id must be a subset of the domain currently in the browser.
+ */
+export type RelyingPartyIdentifier = string
+/**
+ * A list of explicit RP origins. If left empty, this defaults to either `origin` or `id`, prepended with the current protocol schema (HTTP or HTTPS).
+ */
+export type RelyingPartyOrigins = string[]
 export type EnablesOpenIDConnectMethod = boolean
 /**
  * Can be used to modify the base URL for OAuth2 Redirect URLs. If unset, the Public Base URL will be used.
@@ -202,6 +225,7 @@ export type SelfServiceOIDCProvider = SelfServiceOIDCProvider1 & {
   requested_claims?: OpenIDConnectClaims
   organization_id?: OrganizationID
   additional_id_token_audiences?: AdditionalClientIdsAllowedWhenUsingIDTokenSubmission
+  claims_source?: ClaimsSource
 }
 export type SelfServiceOIDCProvider1 = {
   [k: string]: unknown | undefined
@@ -209,7 +233,7 @@ export type SelfServiceOIDCProvider1 = {
   [k: string]: unknown | undefined
 }
 /**
- * Can be one of github, github-app, gitlab, generic, google, microsoft, discord, slack, facebook, auth0, vk, yandex, apple, spotify, netid, dingtalk, patreon.
+ * Can be one of github, github-app, gitlab, generic, google, microsoft, discord, salesforce, slack, facebook, auth0, vk, yandex, apple, spotify, netid, dingtalk, patreon.
  */
 export type Provider =
   | "github"
@@ -219,6 +243,7 @@ export type Provider =
   | "google"
   | "microsoft"
   | "discord"
+  | "salesforce"
   | "slack"
   | "facebook"
   | "auth0"
@@ -230,7 +255,9 @@ export type Provider =
   | "dingtalk"
   | "patreon"
   | "linkedin"
+  | "linkedin_v2"
   | "lark"
+  | "x"
 export type OptionalStringWhichWillBeUsedWhenGeneratingLabelsForUIButtons =
   string
 /**
@@ -262,6 +289,10 @@ export type ApplePrivateKey = string
  */
 export type OrganizationID = string
 export type AdditionalClientIdsAllowedWhenUsingIDTokenSubmission = string[]
+/**
+ * Can be either `userinfo` (calls the userinfo endpoint to get the claims) or `id_token` (takes the claims from the id token). It defaults to `id_token`
+ */
+export type ClaimsSource = "id_token" | "userinfo"
 /**
  * A list and configuration of OAuth2 and OpenID Connect providers Ory Kratos should integrate with.
  */
@@ -297,7 +328,7 @@ export type HTTPAddressOfAPIEndpoint = string
 /**
  * Define which auth mechanism to use for auth with the HTTP email provider
  */
-export type AuthMechanisms =
+export type AuthMechanisms1 =
   | WebHookAuthApiKeyProperties
   | WebHookAuthBasicAuthProperties
 /**
@@ -335,7 +366,7 @@ export type HTTPAddressOfAPIEndpoint1 = string
 /**
  * Define which auth mechanism to use for auth with the SMS provider
  */
-export type AuthMechanisms1 =
+export type AuthMechanisms2 =
   | WebHookAuthApiKeyProperties
   | WebHookAuthBasicAuthProperties
 /**
@@ -517,14 +548,26 @@ export type AddExemptURLsToPrivateIPRanges = string[]
  * If enabled allows Ory Sessions to be cached. Only effective in the Ory Network.
  */
 export type EnableOrySessionsCaching = boolean
+/**
+ * Set how long Ory Sessions are cached on the edge. If unset, the session expiry will be used. Only effective in the Ory Network.
+ */
+export type SetOrySessionEdgeCachingMaximumAge = string
 /**
  * If enabled allows new flow transitions using `continue_with` items.
  */
 export type EnableNewFlowTransitionsUsingContinueWithItems = boolean
 /**
- * Secifies which organizations are available. Only effective in the Ory Network.
+ * If enabled allows faster session extension by skipping the session lookup. Disabling this feature will be deprecated in the future.
+ */
+export type EnableFasterSessionExtension = boolean
+/**
+ * Please use selfservice.methods.b2b instead. This key will be removed. Only effective in the Ory Network.
  */
 export type Organizations = unknown[]
+/**
+ * A fallback URL template used when looking up identity schemas.
+ */
+export type FallbackURLTemplateForIdentitySchemas = string
 
 export interface OryKratosConfiguration2 {
   selfservice: {
@@ -551,10 +594,12 @@ export interface OryKratosConfiguration2 {
         lifespan?: string
         before?: SelfServiceBeforeRegistration
         after?: SelfServiceAfterRegistration
+        enable_legacy_one_step?: DisableTwoStepRegistration
       }
       login?: {
         ui_url?: LoginUIURL
         lifespan?: string
+        style?: LoginFlowStyle
         before?: SelfServiceBeforeLogin
         after?: SelfServiceAfterLogin
       }
@@ -565,6 +610,7 @@ export interface OryKratosConfiguration2 {
       }
     }
     methods?: {
+      b2b?: SingleSignOnForB2B
       profile?: {
         enabled?: EnablesProfileManagementMethod
       }
@@ -572,13 +618,22 @@ export interface OryKratosConfiguration2 {
         enabled?: EnablesLinkMethod
         config?: LinkConfiguration
       }
-      code?: {
-        passwordless_enabled?: EnablesLoginAndRegistrationWithTheCodeMethod
-        mfa_enabled?: EnablesLoginFlowsCodeMethodToFulfilMFARequests
-        passwordless_login_fallback_enabled?: PasswordlessLoginFallbackEnabled
-        enabled?: EnablesCodeMethod
-        config?: CodeConfiguration
-      }
+      code?:
+        | {
+            passwordless_enabled?: true
+            mfa_enabled?: false
+            [k: string]: unknown | undefined
+          }
+        | {
+            mfa_enabled?: true
+            passwordless_enabled?: false
+            [k: string]: unknown | undefined
+          }
+        | {
+            mfa_enabled?: false
+            passwordless_enabled?: false
+            [k: string]: unknown | undefined
+          }
       password?: {
         enabled?: EnablesUsernameEmailAndPasswordMethod
         config?: PasswordConfiguration
@@ -594,6 +649,10 @@ export interface OryKratosConfiguration2 {
         enabled?: EnablesTheWebAuthnMethod
         config?: WebAuthnConfiguration
       }
+      passkey?: {
+        enabled?: EnablesThePasskeyMethod
+        config?: PasskeyConfiguration
+      }
       oidc?: SpecifyOpenIDConnectAndOAuth2Configuration
     }
   }
@@ -701,6 +760,16 @@ export interface OryKratosConfiguration2 {
     }
     earliest_possible_extend?: EarliestPossibleSessionExtension
   }
+  security?: {
+    account_enumeration?: {
+      /**
+       * Mitigate account enumeration by making it harder to figure out if an identifier (email, phone number) exists or not. Enabling this setting degrades user experience. This setting does not mitigate all possible attack vectors yet.
+       */
+      mitigate?: boolean
+      [k: string]: unknown | undefined
+    }
+    [k: string]: unknown | undefined
+  }
   version?: TheKratosVersionThisConfigIsWrittenFor
   dev?: boolean
   help?: boolean
@@ -720,6 +789,7 @@ export interface OryKratosConfiguration2 {
   clients?: GlobalOutgoingNetworkSettings
   feature_flags?: FeatureFlags
   organizations?: Organizations
+  enterprise?: EnterpriseFeatures
 }
 export interface SelfServiceAfterSettings {
   default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
@@ -727,6 +797,7 @@ export interface SelfServiceAfterSettings {
   totp?: SelfServiceAfterSettingsAuthMethod
   oidc?: SelfServiceAfterSettingsAuthMethod
   webauthn?: SelfServiceAfterSettingsAuthMethod
+  passkey?: SelfServiceAfterSettingsAuthMethod
   lookup_secret?: SelfServiceAfterSettingsAuthMethod
   profile?: SelfServiceAfterSettingsMethod
   hooks?: SelfServiceHooks
@@ -762,6 +833,7 @@ export interface SelfServiceAfterRegistration {
   default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
   password?: SelfServiceAfterRegistrationMethod
   webauthn?: SelfServiceAfterRegistrationMethod
+  passkey?: SelfServiceAfterRegistrationMethod
   oidc?: SelfServiceAfterRegistrationMethod
   code?: SelfServiceAfterRegistrationMethod
   hooks?: SelfServiceHooks
@@ -788,6 +860,7 @@ export interface SelfServiceAfterLogin {
   default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
   password?: SelfServiceAfterDefaultLoginMethod
   webauthn?: SelfServiceAfterDefaultLoginMethod
+  passkey?: SelfServiceAfterDefaultLoginMethod
   oidc?: SelfServiceAfterOIDCLoginMethod
   code?: SelfServiceAfterDefaultLoginMethod
   totp?: SelfServiceAfterDefaultLoginMethod
@@ -796,6 +869,8 @@ export interface SelfServiceAfterLogin {
     | SelfServiceWebHook
     | SelfServiceSessionRevokerHook
     | SelfServiceRequireVerifiedAddressHook
+    | SelfServiceVerificationHook
+    | SelfServiceShowVerificationUIHook
     | B2BSSOHook
   )[]
 }
@@ -805,11 +880,16 @@ export interface SelfServiceAfterDefaultLoginMethod {
     | SelfServiceSessionRevokerHook
     | SelfServiceRequireVerifiedAddressHook
     | SelfServiceWebHook
+    | SelfServiceVerificationHook
+    | SelfServiceShowVerificationUIHook
   )[]
 }
 export interface SelfServiceRequireVerifiedAddressHook {
   hook: "require_verified_address"
 }
+export interface SelfServiceVerificationHook {
+  hook: "verification"
+}
 export interface SelfServiceAfterOIDCLoginMethod {
   default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
   hooks?: (
@@ -851,6 +931,25 @@ export interface SelfServiceAfterRecovery {
 export interface SelfServiceBeforeRecovery {
   hooks?: SelfServiceHooks
 }
+/**
+ * Single Sign-On for B2B allows your customers to bring their own (workforce) identity server (e.g. OneLogin). This feature is not available in the open source licensed code.
+ */
+export interface SingleSignOnForB2B {
+  config?: {
+    organizations?: {
+      /**
+       * The ID of the organization.
+       */
+      id?: string
+      /**
+       * The label of the organization.
+       */
+      label?: string
+      domains?: string[]
+      [k: string]: unknown | undefined
+    }[]
+  }
+}
 /**
  * Additional configuration for the link strategy.
  */
@@ -859,13 +958,6 @@ export interface LinkConfiguration {
   lifespan?: HowLongALinkIsValidFor
   [k: string]: unknown | undefined
 }
-/**
- * Additional configuration for the code strategy.
- */
-export interface CodeConfiguration {
-  lifespan?: HowLongACodeIsValidFor
-  [k: string]: unknown | undefined
-}
 /**
  * Define how passwords are validated.
  */
@@ -876,6 +968,61 @@ export interface PasswordConfiguration {
   ignore_network_errors?: IgnoreLookupNetworkErrors
   min_password_length?: MinimumPasswordLength
   identifier_similarity_check_enabled?: EnablePasswordIdentifierSimilarityCheck
+  migrate_hook?: {
+    enabled?: EnablePasswordMigration
+    config?: {
+      /**
+       * The URL the password migration hook should call
+       */
+      url?: string
+      /**
+       * The HTTP method to use (GET, POST, etc).
+       */
+      method?: "POST"
+      /**
+       * The HTTP headers that must be applied to the password migration hook.
+       */
+      headers?: {
+        [k: string]: string | undefined
+      }
+      /**
+       * Emit tracing events for this hook on delivery or error
+       */
+      emit_analytics_event?: boolean
+      auth?: AuthMechanisms
+      additionalProperties?: false
+    }
+  }
+}
+export interface WebHookAuthApiKeyProperties {
+  type: "api_key"
+  config: {
+    /**
+     * The name of the api key
+     */
+    name: string
+    /**
+     * The value of the api key
+     */
+    value: string
+    /**
+     * How the api key should be transferred
+     */
+    in: "header" | "cookie"
+  }
+}
+export interface WebHookAuthBasicAuthProperties {
+  type: "basic_auth"
+  config: {
+    /**
+     * user name for basic auth
+     */
+    user: string
+    /**
+     * password for basic auth
+     */
+    password: string
+  }
 }
 export interface TOTPConfiguration {
   issuer?: TOTPIssuer
@@ -884,6 +1031,15 @@ export interface WebAuthnConfiguration {
   passwordless?: UseForPasswordlessFlows
   rp?: RelyingPartyRPConfig
 }
+export interface PasskeyConfiguration {
+  rp?: RelyingPartyRPConfig1
+}
+export interface RelyingPartyRPConfig1 {
+  display_name: RelyingPartyDisplayName
+  id: RelyingPartyIdentifier
+  origins?: RelyingPartyOrigins
+  [k: string]: unknown | undefined
+}
 export interface SpecifyOpenIDConnectAndOAuth2Configuration {
   enabled?: EnablesOpenIDConnectMethod
   config?: {
@@ -963,6 +1119,7 @@ export interface CourierConfiguration {
     login_code?: {
       valid?: {
         email: EmailCourierTemplate
+        sms?: SmsCourierTemplate
       }
     }
   }
@@ -1043,44 +1200,14 @@ export interface HttpRequestConfig {
    * URI pointing to the jsonnet template used for payload generation. Only used for those HTTP methods, which support HTTP body payloads
    */
   body?: string
-  auth?: AuthMechanisms
+  auth?: AuthMechanisms1
   additionalProperties?: false
 }
-export interface WebHookAuthApiKeyProperties {
-  type: "api_key"
-  config: {
-    /**
-     * The name of the api key
-     */
-    name: string
-    /**
-     * The value of the api key
-     */
-    value: string
-    /**
-     * How the api key should be transferred
-     */
-    in: "header" | "cookie"
-  }
-}
-export interface WebHookAuthBasicAuthProperties {
-  type: "basic_auth"
-  config: {
-    /**
-     * user name for basic auth
-     */
-    user: string
-    /**
-     * password for basic auth
-     */
-    password: string
-  }
-}
 /**
  * Configures outgoing emails using the SMTP protocol.
  */
 export interface SMTPConfiguration {
-  connection_uri: SMTPConnectionString
+  connection_uri?: SMTPConnectionString
   client_cert_path?: SMTPClientCertificatePath
   client_key_path?: SMTPClientPrivateKeyPath
   from_address?: SMTPSenderAddress
@@ -1119,7 +1246,7 @@ export interface SMSSenderConfiguration {
      * URI pointing to the jsonnet template used for payload generation. Only used for those HTTP methods, which support HTTP body payloads
      */
     body?: string
-    auth?: AuthMechanisms1
+    auth?: AuthMechanisms2
     additionalProperties?: false
   }
 }
@@ -1375,5 +1502,13 @@ export interface GlobalHTTPClientConfiguration {
 }
 export interface FeatureFlags {
   cacheable_sessions?: EnableOrySessionsCaching
+  cacheable_sessions_max_age?: SetOrySessionEdgeCachingMaximumAge
   use_continue_with_transitions?: EnableNewFlowTransitionsUsingContinueWithItems
+  faster_session_extend?: EnableFasterSessionExtension
+}
+/**
+ * Specifies enterprise features. Only effective in the Ory Network or with a valid license.
+ */
+export interface EnterpriseFeatures {
+  identity_schema_fallback_url_template?: FallbackURLTemplateForIdentitySchemas
 }
diff --git a/test/schema/fixtures/config.schema.test.success/root.courierSMS.yaml b/test/schema/fixtures/config.schema.test.success/root.courierSMS.yaml
index b9b73bcb10a0..dc015e064a2d 100644
--- a/test/schema/fixtures/config.schema.test.success/root.courierSMS.yaml
+++ b/test/schema/fixtures/config.schema.test.success/root.courierSMS.yaml
@@ -13,12 +13,7 @@ courier:
   smtp:
     connection_uri: smtps://foo:bar@my-mailserver:1234/
     from_address: no-reply@ory.kratos.sh
-  sms:
-    enabled: true
-    from: "+19592155527"
-    request_config:
-      url: https://sms.example.com
-      method: POST
-      body: file://request.config.twilio.jsonnet
-      headers:
-        'Content-Type': "application/x-www-form-urlencoded"
+  channels:
+    - id: sms
+      type: http
+      request_config: "#/definitions/httpRequestConfig"
diff --git a/text/id.go b/text/id.go
index a466caec0f8c..c6d26323f5e2 100644
--- a/text/id.go
+++ b/text/id.go
@@ -23,7 +23,7 @@ const (
 	InfoSelfServiceLoginContinueWebAuthn                         // 1010011
 	InfoSelfServiceLoginWebAuthnPasswordless                     // 1010012
 	InfoSelfServiceLoginContinue                                 // 1010013
-	InfoSelfServiceLoginEmailWithCodeSent                        // 1010014
+	InfoSelfServiceLoginCodeSent                                 // 1010014
 	InfoSelfServiceLoginCode                                     // 1010015
 	InfoSelfServiceLoginLink                                     // 1010016
 	InfoSelfServiceLoginAndLink                                  // 1010017
@@ -31,6 +31,8 @@ const (
 	InfoSelfServiceLoginCodeMFA                                  // 1010019
 	InfoSelfServiceLoginCodeMFAHint                              // 1010020
 	InfoSelfServiceLoginPasskey                                  // 1010021
+	InfoSelfServiceLoginPassword                                 // 1010022
+	InfoSelfServiceLoginAAL2CodeAddress                          // 1010023
 )
 
 const (
@@ -86,21 +88,22 @@ const (
 )
 
 const (
-	InfoNodeLabel                 ID = 1070000 + iota // 1070000
-	InfoNodeLabelInputPassword                        // 1070001
-	InfoNodeLabelGenerated                            // 1070002
-	InfoNodeLabelSave                                 // 1070003
-	InfoNodeLabelID                                   // 1070004
-	InfoNodeLabelSubmit                               // 1070005
-	InfoNodeLabelVerifyOTP                            // 1070006
-	InfoNodeLabelEmail                                // 1070007
-	InfoNodeLabelResendOTP                            // 1070008
-	InfoNodeLabelContinue                             // 1070009
-	InfoNodeLabelRecoveryCode                         // 1070010
-	InfoNodeLabelVerificationCode                     // 1070011
-	InfoNodeLabelRegistrationCode                     // 1070012
-	InfoNodeLabelLoginCode                            // 1070013
-	InfoNodeLabelLoginAndLinkCredential
+	InfoNodeLabel                       ID = 1070000 + iota // 1070000
+	InfoNodeLabelInputPassword                              // 1070001
+	InfoNodeLabelGenerated                                  // 1070002
+	InfoNodeLabelSave                                       // 1070003
+	InfoNodeLabelID                                         // 1070004
+	InfoNodeLabelSubmit                                     // 1070005
+	InfoNodeLabelVerifyOTP                                  // 1070006
+	InfoNodeLabelEmail                                      // 1070007
+	InfoNodeLabelResendOTP                                  // 1070008
+	InfoNodeLabelContinue                                   // 1070009
+	InfoNodeLabelRecoveryCode                               // 1070010
+	InfoNodeLabelVerificationCode                           // 1070011
+	InfoNodeLabelRegistrationCode                           // 1070012
+	InfoNodeLabelLoginCode                                  // 1070013
+	InfoNodeLabelLoginAndLinkCredential                     // 1070014
+	InfoNodeLabelCaptcha                                    // 1070015
 )
 
 const (
@@ -148,6 +151,8 @@ const (
 	ErrorValidationPasswordTooManyBreaches
 	ErrorValidationNoCodeUser
 	ErrorValidationTraitsMismatch
+	ErrorValidationAccountNotFound
+	ErrorValidationCaptchaError
 )
 
 const (
diff --git a/text/id_test.go b/text/id_test.go
index a0190a2c0d8e..2efe742c667e 100644
--- a/text/id_test.go
+++ b/text/id_test.go
@@ -71,4 +71,7 @@ func TestIDs(t *testing.T) {
 	assert.Equal(t, 1080001, int(InfoSelfServiceVerificationEmailSent))
 	assert.Equal(t, 1080002, int(InfoSelfServiceVerificationSuccessful))
 	assert.Equal(t, 1080003, int(InfoSelfServiceVerificationEmailWithCodeSent))
+
+	assert.Equal(t, 1070015, int(InfoNodeLabelCaptcha))
+	assert.Equal(t, 4000038, int(ErrorValidationCaptchaError))
 }
diff --git a/text/message_login.go b/text/message_login.go
index ec627458a028..f60761f49e69 100644
--- a/text/message_login.go
+++ b/text/message_login.go
@@ -56,19 +56,23 @@ func NewInfoLogin() *Message {
 	}
 }
 
-func NewInfoLoginLinkMessage(dupIdentifier, provider, newLoginURL string) *Message {
+func NewInfoLoginLinkMessage(dupIdentifier, provider, newLoginURL string, availableCredentials, availableProviders []string) *Message {
 	return &Message{
 		ID:   InfoSelfServiceLoginLink,
 		Type: Info,
 		Text: fmt.Sprintf(
-			"Signing in will link your account to %q at provider %q. If you do not wish to link that account, please start a new login flow.",
+			"You tried to sign in with %q, but that email is already used by another account. Sign in to your account with one of the options below to add your account %[1]q at %q as another way to sign in.",
 			dupIdentifier,
 			provider,
 		),
 		Context: context(map[string]any{
-			"duplicateIdentifier": dupIdentifier,
-			"provider":            provider,
-			"newLoginUrl":         newLoginURL,
+			"duplicateIdentifier":        dupIdentifier,
+			"provider":                   provider,
+			"newLoginUrl":                newLoginURL,
+			"duplicate_identifier":       dupIdentifier,
+			"new_login_url":              newLoginURL,
+			"available_credential_types": availableCredentials,
+			"available_providers":        availableProviders,
 		}),
 	}
 }
@@ -89,6 +93,14 @@ func NewInfoLoginTOTP() *Message {
 	}
 }
 
+func NewInfoLoginPassword() *Message {
+	return &Message{
+		ID:   InfoSelfServiceLoginPassword,
+		Text: "Sign in with password",
+		Type: Info,
+	}
+}
+
 func NewInfoLoginLookup() *Message {
 	return &Message{
 		ID:   InfoLoginLookup,
@@ -105,13 +117,14 @@ func NewInfoLoginVerify() *Message {
 	}
 }
 
-func NewInfoLoginWith(provider string) *Message {
+func NewInfoLoginWith(provider string, providerId string) *Message {
 	return &Message{
 		ID:   InfoSelfServiceLoginWith,
 		Text: fmt.Sprintf("Sign in with %s", provider),
 		Type: Info,
 		Context: context(map[string]any{
-			"provider": provider,
+			"provider":    provider,
+			"provider_id": providerId,
 		}),
 	}
 }
@@ -119,7 +132,7 @@ func NewInfoLoginWith(provider string) *Message {
 func NewInfoLoginWithAndLink(provider string) *Message {
 	return &Message{
 		ID:   InfoSelfServiceLoginWithAndLink,
-		Text: fmt.Sprintf("Sign in with %s and link credential", provider),
+		Text: fmt.Sprintf("Confirm with %s", provider),
 		Type: Info,
 		Context: context(map[string]any{
 			"provider": provider,
@@ -182,7 +195,7 @@ func NewErrorValidationVerificationNoStrategyFound() *Message {
 func NewInfoSelfServiceLoginWebAuthn() *Message {
 	return &Message{
 		ID:   InfoSelfServiceLoginWebAuthn,
-		Text: "Use security key",
+		Text: "Sign in with hardware key",
 		Type: Info,
 	}
 }
@@ -198,7 +211,7 @@ func NewInfoSelfServiceLoginPasskey() *Message {
 func NewInfoSelfServiceContinueLoginWebAuthn() *Message {
 	return &Message{
 		ID:   InfoSelfServiceLoginContinueWebAuthn,
-		Text: "Continue with security key",
+		Text: "Sign in with hardware key",
 		Type: Info,
 	}
 }
@@ -211,11 +224,11 @@ func NewInfoSelfServiceLoginContinue() *Message {
 	}
 }
 
-func NewLoginEmailWithCodeSent() *Message {
+func NewLoginCodeSent() *Message {
 	return &Message{
-		ID:   InfoSelfServiceLoginEmailWithCodeSent,
+		ID:   InfoSelfServiceLoginCodeSent,
 		Type: Info,
-		Text: "An email containing a code has been sent to the email address you provided. If you have not received an email, check the spelling of the address and retry the login.",
+		Text: "A code has been sent to the address you provided. If you have not received an message, check the spelling of the address and retry the login.",
 	}
 }
 
@@ -239,7 +252,7 @@ func NewInfoSelfServiceLoginCode() *Message {
 	return &Message{
 		ID:   InfoSelfServiceLoginCode,
 		Type: Info,
-		Text: "Sign in with code",
+		Text: "Send sign in code",
 	}
 }
 
@@ -263,17 +276,18 @@ func NewInfoSelfServiceLoginCodeMFA() *Message {
 	return &Message{
 		ID:   InfoSelfServiceLoginCodeMFA,
 		Type: Info,
-		Text: "Continue with code",
+		Text: "Request code to continue",
 	}
 }
 
-func NewInfoSelfServiceLoginCodeMFAHint(maskedTo string) *Message {
+func NewInfoSelfServiceLoginAAL2CodeAddress(channel string, to string) *Message {
 	return &Message{
-		ID:   InfoSelfServiceLoginCodeMFAHint,
+		ID:   InfoSelfServiceLoginAAL2CodeAddress,
 		Type: Info,
-		Text: fmt.Sprintf("We will send a code to %s. To verify that this is your address please enter it here.", maskedTo),
+		Text: fmt.Sprintf("Send code to %s", to),
 		Context: context(map[string]any{
-			"masked_to": maskedTo,
+			"address": to,
+			"channel": channel,
 		}),
 	}
 }
diff --git a/text/message_registration.go b/text/message_registration.go
index 7779143a1cc0..5249f21e3b8b 100644
--- a/text/message_registration.go
+++ b/text/message_registration.go
@@ -16,13 +16,14 @@ func NewInfoRegistration() *Message {
 	}
 }
 
-func NewInfoRegistrationWith(provider string) *Message {
+func NewInfoRegistrationWith(provider string, providerID string) *Message {
 	return &Message{
 		ID:   InfoSelfServiceRegistrationWith,
 		Text: fmt.Sprintf("Sign up with %s", provider),
 		Type: Info,
 		Context: context(map[string]any{
-			"provider": provider,
+			"provider":    provider,
+			"provider_id": providerID,
 		}),
 	}
 }
@@ -83,7 +84,7 @@ func NewRegistrationEmailWithCodeSent() *Message {
 	return &Message{
 		ID:   InfoSelfServiceRegistrationEmailWithCodeSent,
 		Type: Info,
-		Text: "An email containing a code has been sent to the email address you provided. If you have not received an email, check the spelling of the address and retry the registration.",
+		Text: "A code has been sent to the address(es) you provided. If you have not received a message, check the spelling of the address and retry the registration.",
 	}
 }
 
@@ -106,7 +107,7 @@ func NewErrorValidationRegistrationRetrySuccessful() *Message {
 func NewInfoSelfServiceRegistrationRegisterCode() *Message {
 	return &Message{
 		ID:   InfoSelfServiceRegistrationRegisterCode,
-		Text: "Sign up with code",
+		Text: "Send sign up code",
 		Type: Info,
 	}
 }
diff --git a/text/message_system.go b/text/message_system.go
index d94ce73f9872..07f30374495a 100644
--- a/text/message_system.go
+++ b/text/message_system.go
@@ -13,3 +13,11 @@ func NewErrorSystemGeneric(reason string) *Message {
 		}),
 	}
 }
+
+func NewCaptchaContainerMessage() *Message {
+	return &Message{
+		ID:   InfoNodeLabelCaptcha,
+		Text: "Please complete the captcha challenge to continue.",
+		Type: Info,
+	}
+}
diff --git a/text/message_validation.go b/text/message_validation.go
index c10fddead805..b8e689deee03 100644
--- a/text/message_validation.go
+++ b/text/message_validation.go
@@ -257,6 +257,14 @@ func NewErrorValidationInvalidCredentials() *Message {
 	}
 }
 
+func NewErrorValidationAccountNotFound() *Message {
+	return &Message{
+		ID:   ErrorValidationAccountNotFound,
+		Text: "This account does not exist or has no login method configured.",
+		Type: Error,
+	}
+}
+
 func NewErrorValidationDuplicateCredentials() *Message {
 	return &Message{
 		ID:   ErrorValidationDuplicateCredentials,
@@ -416,3 +424,11 @@ func NewErrorValidationTraitsMismatch() *Message {
 		Type: Error,
 	}
 }
+
+func NewErrorCaptchaFailed() *Message {
+	return &Message{
+		ID:   ErrorValidationCaptchaError,
+		Text: "Captcha verification failed, please try again.",
+		Type: Error,
+	}
+}
diff --git a/ui/node/attributes.go b/ui/node/attributes.go
index 9611b5828dff..6ad55d46a0e2 100644
--- a/ui/node/attributes.go
+++ b/ui/node/attributes.go
@@ -3,7 +3,12 @@
 
 package node
 
-import "github.com/ory/kratos/text"
+import (
+	"fmt"
+
+	"github.com/ory/kratos/text"
+	"github.com/ory/kratos/x/webauthnx/js"
+)
 
 const (
 	InputAttributeTypeText          UiNodeInputAttributeType = "text"
@@ -53,6 +58,9 @@ type Attributes interface {
 
 	// swagger:ignore
 	GetNodeType() UiNodeType
+
+	// swagger:ignore
+	Matches(other Attributes) bool
 }
 
 // InputAttributes represents the attributes of an input node
@@ -91,12 +99,29 @@ type InputAttributes struct {
 
 	// OnClick may contain javascript which should be executed on click. This is primarily
 	// used for WebAuthn.
+	//
+	// Deprecated: Using OnClick requires the use of eval() which is a security risk. Use OnClickTrigger instead.
 	OnClick string `json:"onclick,omitempty"`
 
+	// OnClickTrigger may contain a WebAuthn trigger which should be executed on click.
+	//
+	// The trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login.
+	OnClickTrigger js.WebAuthnTriggers `json:"onclickTrigger,omitempty"`
+
 	// OnLoad may contain javascript which should be executed on load. This is primarily
 	// used for WebAuthn.
+	//
+	// Deprecated: Using OnLoad requires the use of eval() which is a security risk. Use OnLoadTrigger instead.
 	OnLoad string `json:"onload,omitempty"`
 
+	// OnLoadTrigger may contain a WebAuthn trigger which should be executed on load.
+	//
+	// The trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login.
+	OnLoadTrigger js.WebAuthnTriggers `json:"onloadTrigger,omitempty"`
+
+	// MaxLength may contain the input's maximum length.
+	MaxLength int `json:"maxlength,omitempty"`
+
 	// NodeType represents this node's types. It is a mirror of `node.type` and
 	// is primarily used to allow compatibility with OpenAPI 3.0.  In this struct it technically always is "input".
 	//
@@ -267,6 +292,99 @@ func (a *ScriptAttributes) ID() string {
 	return a.Identifier
 }
 
+func (a *InputAttributes) Matches(other Attributes) bool {
+	ot, ok := other.(*InputAttributes)
+	if !ok {
+		return false
+	}
+
+	if len(ot.ID()) > 0 && a.ID() != ot.ID() {
+		return false
+	}
+
+	if len(ot.Type) > 0 && a.Type != ot.Type {
+		return false
+	}
+
+	if ot.FieldValue != nil && fmt.Sprintf("%v", a.FieldValue) != fmt.Sprintf("%v", ot.FieldValue) {
+		return false
+	}
+
+	if len(ot.Name) > 0 && a.Name != ot.Name {
+		return false
+	}
+
+	return true
+}
+
+func (a *ImageAttributes) Matches(other Attributes) bool {
+	ot, ok := other.(*ImageAttributes)
+	if !ok {
+		return false
+	}
+
+	if len(ot.ID()) > 0 && a.ID() != ot.ID() {
+		return false
+	}
+
+	if len(ot.Source) > 0 && a.Source != ot.Source {
+		return false
+	}
+
+	return true
+}
+
+func (a *AnchorAttributes) Matches(other Attributes) bool {
+	ot, ok := other.(*AnchorAttributes)
+	if !ok {
+		return false
+	}
+
+	if len(ot.ID()) > 0 && a.ID() != ot.ID() {
+		return false
+	}
+
+	if len(ot.HREF) > 0 && a.HREF != ot.HREF {
+		return false
+	}
+
+	return true
+}
+
+func (a *TextAttributes) Matches(other Attributes) bool {
+	ot, ok := other.(*TextAttributes)
+	if !ok {
+		return false
+	}
+
+	if len(ot.ID()) > 0 && a.ID() != ot.ID() {
+		return false
+	}
+
+	return true
+}
+
+func (a *ScriptAttributes) Matches(other Attributes) bool {
+	ot, ok := other.(*ScriptAttributes)
+	if !ok {
+		return false
+	}
+
+	if len(ot.ID()) > 0 && a.ID() != ot.ID() {
+		return false
+	}
+
+	if ot.Type != "" && a.Type != ot.Type {
+		return false
+	}
+
+	if ot.Source != "" && a.Source != ot.Source {
+		return false
+	}
+
+	return true
+}
+
 func (a *InputAttributes) SetValue(value interface{}) {
 	a.FieldValue = value
 }
diff --git a/ui/node/attributes_input.go b/ui/node/attributes_input.go
index b63ac9365a51..176c1a25b42e 100644
--- a/ui/node/attributes_input.go
+++ b/ui/node/attributes_input.go
@@ -38,6 +38,12 @@ func WithRequiredInputAttribute(a *InputAttributes) {
 	a.Required = true
 }
 
+func WithMaxLengthInputAttribute(maxLength int) func(a *InputAttributes) {
+	return func(a *InputAttributes) {
+		a.MaxLength = maxLength
+	}
+}
+
 func WithInputAttributes(f func(a *InputAttributes)) func(a *InputAttributes) {
 	return func(a *InputAttributes) {
 		f(a)
diff --git a/ui/node/attributes_test.go b/ui/node/attributes_test.go
index 218919e1145e..62c2316d3c9f 100644
--- a/ui/node/attributes_test.go
+++ b/ui/node/attributes_test.go
@@ -21,6 +21,70 @@ func TestIDs(t *testing.T) {
 	assert.EqualValues(t, "foo", (&ScriptAttributes{Identifier: "foo"}).ID())
 }
 
+func TestMatchesAnchorAttributes(t *testing.T) {
+	assert.True(t, (&AnchorAttributes{Identifier: "foo"}).Matches(&AnchorAttributes{Identifier: "foo"}))
+	assert.True(t, (&AnchorAttributes{HREF: "bar"}).Matches(&AnchorAttributes{HREF: "bar"}))
+	assert.False(t, (&AnchorAttributes{HREF: "foo"}).Matches(&AnchorAttributes{HREF: "bar"}))
+	assert.False(t, (&AnchorAttributes{Identifier: "foo"}).Matches(&AnchorAttributes{HREF: "bar"}))
+
+	assert.True(t, (&AnchorAttributes{Identifier: "foo", HREF: "bar"}).Matches(&AnchorAttributes{Identifier: "foo", HREF: "bar"}))
+	assert.False(t, (&AnchorAttributes{Identifier: "foo", HREF: "bar"}).Matches(&AnchorAttributes{Identifier: "foo", HREF: "baz"}))
+	assert.False(t, (&AnchorAttributes{Identifier: "foo", HREF: "bar"}).Matches(&AnchorAttributes{Identifier: "bar", HREF: "bar"}))
+
+	assert.False(t, (&AnchorAttributes{Identifier: "foo"}).Matches(&TextAttributes{Identifier: "foo"}))
+}
+
+func TestMatchesImageAttributes(t *testing.T) {
+	assert.True(t, (&ImageAttributes{Identifier: "foo"}).Matches(&ImageAttributes{Identifier: "foo"}))
+	assert.True(t, (&ImageAttributes{Source: "bar"}).Matches(&ImageAttributes{Source: "bar"}))
+	assert.False(t, (&ImageAttributes{Source: "foo"}).Matches(&ImageAttributes{Source: "bar"}))
+	assert.False(t, (&ImageAttributes{Identifier: "foo"}).Matches(&ImageAttributes{Source: "bar"}))
+
+	assert.True(t, (&ImageAttributes{Identifier: "foo", Source: "bar"}).Matches(&ImageAttributes{Identifier: "foo", Source: "bar"}))
+	assert.False(t, (&ImageAttributes{Identifier: "foo", Source: "bar"}).Matches(&ImageAttributes{Identifier: "foo", Source: "baz"}))
+	assert.False(t, (&ImageAttributes{Identifier: "foo", Source: "bar"}).Matches(&ImageAttributes{Identifier: "bar", Source: "bar"}))
+
+	assert.False(t, (&ImageAttributes{Identifier: "foo"}).Matches(&TextAttributes{Identifier: "foo"}))
+}
+
+func TestMatchesInputAttributes(t *testing.T) {
+	// Test when other is not of type *InputAttributes
+	var attr Attributes = &ImageAttributes{}
+	inputAttr := &InputAttributes{Name: "foo"}
+	assert.False(t, inputAttr.Matches(attr))
+
+	// Test when ID is different
+	attr = &InputAttributes{Name: "foo", Type: InputAttributeTypeText}
+	inputAttr = &InputAttributes{Name: "bar", Type: InputAttributeTypeText}
+	assert.False(t, inputAttr.Matches(attr))
+
+	// Test when Type is different
+	attr = &InputAttributes{Name: "foo", Type: InputAttributeTypeText}
+	inputAttr = &InputAttributes{Name: "foo", Type: InputAttributeTypeNumber}
+	assert.False(t, inputAttr.Matches(attr))
+
+	// Test when FieldValue is different
+	attr = &InputAttributes{Name: "foo", Type: InputAttributeTypeText, FieldValue: "bar"}
+	inputAttr = &InputAttributes{Name: "foo", Type: InputAttributeTypeText, FieldValue: "baz"}
+	assert.False(t, inputAttr.Matches(attr))
+
+	// Test when Name is different
+	attr = &InputAttributes{Name: "foo", Type: InputAttributeTypeText}
+	inputAttr = &InputAttributes{Name: "bar", Type: InputAttributeTypeText}
+	assert.False(t, inputAttr.Matches(attr))
+
+	// Test when all fields are the same
+	attr = &InputAttributes{Name: "foo", Type: InputAttributeTypeText, FieldValue: "bar"}
+	inputAttr = &InputAttributes{Name: "foo", Type: InputAttributeTypeText, FieldValue: "bar"}
+	assert.True(t, inputAttr.Matches(attr))
+}
+
+func TestMatchesTextAttributes(t *testing.T) {
+	assert.True(t, (&TextAttributes{Identifier: "foo"}).Matches(&TextAttributes{Identifier: "foo"}))
+	assert.True(t, (&TextAttributes{Identifier: "foo"}).Matches(&TextAttributes{Identifier: "foo"}))
+	assert.False(t, (&TextAttributes{Identifier: "foo"}).Matches(&ImageAttributes{Identifier: "foo"}))
+}
+
 func TestNodeEncode(t *testing.T) {
 	script := jsonx.TestMarshalJSONString(t, &Node{Attributes: &ScriptAttributes{}})
 	assert.EqualValues(t, Script, gjson.Get(script, "attributes.node_type").String())
diff --git a/ui/node/node.go b/ui/node/node.go
index e08295b827f4..66e1b72fa8b6 100644
--- a/ui/node/node.go
+++ b/ui/node/node.go
@@ -39,16 +39,17 @@ func (t UiNodeType) String() string {
 type UiNodeGroup string
 
 const (
-	DefaultGroup       UiNodeGroup = "default"
-	PasswordGroup      UiNodeGroup = "password"
-	OpenIDConnectGroup UiNodeGroup = "oidc"
-	ProfileGroup       UiNodeGroup = "profile"
-	LinkGroup          UiNodeGroup = "link"
-	CodeGroup          UiNodeGroup = "code"
-	TOTPGroup          UiNodeGroup = "totp"
-	LookupGroup        UiNodeGroup = "lookup_secret"
-	WebAuthnGroup      UiNodeGroup = "webauthn"
-	PasskeyGroup       UiNodeGroup = "passkey"
+	DefaultGroup         UiNodeGroup = "default"
+	PasswordGroup        UiNodeGroup = "password"
+	OpenIDConnectGroup   UiNodeGroup = "oidc"
+	ProfileGroup         UiNodeGroup = "profile"
+	LinkGroup            UiNodeGroup = "link"
+	CodeGroup            UiNodeGroup = "code"
+	TOTPGroup            UiNodeGroup = "totp"
+	LookupGroup          UiNodeGroup = "lookup_secret"
+	WebAuthnGroup        UiNodeGroup = "webauthn"
+	PasskeyGroup         UiNodeGroup = "passkey"
+	IdentifierFirstGroup UiNodeGroup = "identifier_first"
 )
 
 func (g UiNodeGroup) String() string {
@@ -218,6 +219,7 @@ func SortUseOrder(keysInOrder []string) func(*sortOptions) {
 		options.keysInOrder = keysInOrder
 	}
 }
+
 func SortUseOrderAppend(keysInOrder []string) func(*sortOptions) {
 	return func(options *sortOptions) {
 		options.keysInOrderAppend = keysInOrder
@@ -353,6 +355,37 @@ func (n *Nodes) Append(node *Node) {
 	*n = append(*n, node)
 }
 
+func (n *Nodes) RemoveMatching(node *Node) {
+	if n == nil {
+		return
+	}
+
+	var r Nodes
+	for k, v := range *n {
+		if !(*n)[k].Matches(node) {
+			r = append(r, v)
+		}
+	}
+
+	*n = r
+}
+
+func (n *Node) Matches(needle *Node) bool {
+	if len(needle.ID()) > 0 && n.ID() != needle.ID() {
+		return false
+	}
+
+	if needle.Type != "" && n.Type != needle.Type {
+		return false
+	}
+
+	if needle.Group != "" && n.Group != needle.Group {
+		return false
+	}
+
+	return n.Attributes.Matches(needle.Attributes)
+}
+
 func (n *Node) UnmarshalJSON(data []byte) error {
 	var attr Attributes
 	switch t := gjson.GetBytes(data, "type").String(); UiNodeType(t) {
diff --git a/ui/node/node_test.go b/ui/node/node_test.go
index f8867b98c2a3..e8a85bc9cd9f 100644
--- a/ui/node/node_test.go
+++ b/ui/node/node_test.go
@@ -11,6 +11,8 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/ory/kratos/text"
+
 	"github.com/ory/x/assertx"
 
 	"github.com/ory/kratos/corpx"
@@ -193,3 +195,64 @@ func TestNodeJSON(t *testing.T) {
 		require.EqualError(t, json.NewDecoder(bytes.NewReader(json.RawMessage(`{"type": "foo"}`))).Decode(&n), "unexpected node type: foo")
 	})
 }
+
+func TestMatchesNode(t *testing.T) {
+	// Test when ID is different
+	node1 := &node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "foo"}}
+	node2 := &node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "bar"}}
+	assert.False(t, node1.Matches(node2))
+
+	// Test when Type is different
+	node1 = &node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "foo"}}
+	node2 = &node.Node{Type: node.Text, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "foo"}}
+	assert.False(t, node1.Matches(node2))
+
+	// Test when Group is different
+	node1 = &node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "foo"}}
+	node2 = &node.Node{Type: node.Input, Group: node.OpenIDConnectGroup, Attributes: &node.InputAttributes{Name: "foo"}}
+	assert.False(t, node1.Matches(node2))
+
+	// Test when all fields are the same
+	node1 = &node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "foo"}}
+	node2 = &node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "foo"}}
+	assert.True(t, node1.Matches(node2))
+}
+
+func TestRemoveMatchingNodes(t *testing.T) {
+	nodes := node.Nodes{
+		&node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "foo"}},
+		&node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "bar"}},
+		&node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "baz"}},
+	}
+
+	// Test when node to remove is present
+	nodeToRemove := &node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "bar"}}
+	nodes.RemoveMatching(nodeToRemove)
+	assert.Len(t, nodes, 2)
+	for _, n := range nodes {
+		assert.NotEqual(t, nodeToRemove.ID(), n.ID())
+	}
+
+	// Test when node to remove is not present
+	nodeToRemove = &node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "qux"}}
+	nodes.RemoveMatching(nodeToRemove)
+	assert.Len(t, nodes, 2) // length should remain the same
+
+	// Test when node to remove is present
+	nodeToRemove = &node.Node{Type: node.Input, Group: node.PasswordGroup, Attributes: &node.InputAttributes{Name: "baz"}}
+	ui := &container.Container{
+		Nodes: nodes,
+	}
+
+	ui.GetNodes().RemoveMatching(nodeToRemove)
+	assert.Len(t, *ui.GetNodes(), 1)
+	for _, n := range *ui.GetNodes() {
+		assert.NotEqual(t, "bar", n.ID())
+		assert.NotEqual(t, "baz", n.ID())
+	}
+
+	ui.Nodes.Append(node.NewInputField("method", "foo", "bar", node.InputAttributeTypeSubmit).WithMetaLabel(text.NewInfoNodeLabelContinue()))
+	assert.NotNil(t, ui.Nodes.Find("method"))
+	ui.GetNodes().RemoveMatching(node.NewInputField("method", "foo", "bar", node.InputAttributeTypeSubmit))
+	assert.Nil(t, ui.Nodes.Find("method"))
+}
diff --git a/x/err.go b/x/err.go
index 2a42b3eb540b..5b3868734cca 100644
--- a/x/err.go
+++ b/x/err.go
@@ -10,12 +10,15 @@ import (
 	"github.com/ory/herodot"
 )
 
-var PseudoPanic = herodot.DefaultError{
-	StatusField: http.StatusText(http.StatusInternalServerError),
-	ErrorField:  "Code Bug Detected",
-	ReasonField: "The code ended up at a place where it should not have. Please report this as an issue at https://github.com/ory/kratos",
-	CodeField:   http.StatusInternalServerError,
-}
+var (
+	PseudoPanic = herodot.DefaultError{
+		StatusField: http.StatusText(http.StatusInternalServerError),
+		ErrorField:  "Code Bug Detected",
+		ReasonField: "The code ended up at a place where it should not have. Please report this as an issue at https://github.com/ory/kratos",
+		CodeField:   http.StatusInternalServerError,
+	}
+	PageTokenInvalid = herodot.ErrBadRequest.WithReason("The page token is invalid, do not craft your own page tokens")
+)
 
 func RecoverStatusCode(err error, fallback int) int {
 	var sc herodot.StatusCodeCarrier
diff --git a/x/events/events.go b/x/events/events.go
index 13ec16955539..ca7108e74abf 100644
--- a/x/events/events.go
+++ b/x/events/events.go
@@ -5,6 +5,7 @@ package events
 
 import (
 	"context"
+	"errors"
 	"net/url"
 	"time"
 
@@ -12,109 +13,133 @@ import (
 	otelattr "go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/trace"
 
+	"github.com/ory/herodot"
+	"github.com/ory/kratos/schema"
 	"github.com/ory/x/otelx/semconv"
 )
 
 const (
-	SessionIssued           semconv.Event = "SessionIssued"
-	SessionChanged          semconv.Event = "SessionChanged"
-	SessionLifespanExtended semconv.Event = "SessionLifespanExtended"
-	SessionRevoked          semconv.Event = "SessionRevoked"
-	SessionChecked          semconv.Event = "SessionChecked"
-	SessionTokenizedAsJWT   semconv.Event = "SessionTokenizedAsJWT"
-	RegistrationFailed      semconv.Event = "RegistrationFailed"
-	RegistrationSucceeded   semconv.Event = "RegistrationSucceeded"
-	LoginFailed             semconv.Event = "LoginFailed"
-	LoginSucceeded          semconv.Event = "LoginSucceeded"
-	SettingsFailed          semconv.Event = "SettingsFailed"
-	SettingsSucceeded       semconv.Event = "SettingsSucceeded"
-	RecoveryFailed          semconv.Event = "RecoveryFailed"
-	RecoverySucceeded       semconv.Event = "RecoverySucceeded"
-	VerificationFailed      semconv.Event = "VerificationFailed"
-	VerificationSucceeded   semconv.Event = "VerificationSucceeded"
-	IdentityCreated         semconv.Event = "IdentityCreated"
-	IdentityUpdated         semconv.Event = "IdentityUpdated"
-	WebhookDelivered        semconv.Event = "WebhookDelivered"
-	WebhookSucceeded        semconv.Event = "WebhookSucceeded"
-	WebhookFailed           semconv.Event = "WebhookFailed"
+	SessionIssued            semconv.Event = "SessionIssued"
+	SessionChanged           semconv.Event = "SessionChanged"
+	SessionLifespanExtended  semconv.Event = "SessionLifespanExtended"
+	SessionRevoked           semconv.Event = "SessionRevoked"
+	SessionChecked           semconv.Event = "SessionChecked"
+	SessionTokenizedAsJWT    semconv.Event = "SessionTokenizedAsJWT"
+	RegistrationFailed       semconv.Event = "RegistrationFailed"
+	RegistrationSucceeded    semconv.Event = "RegistrationSucceeded"
+	LoginFailed              semconv.Event = "LoginFailed"
+	LoginSucceeded           semconv.Event = "LoginSucceeded"
+	SettingsFailed           semconv.Event = "SettingsFailed"
+	SettingsSucceeded        semconv.Event = "SettingsSucceeded"
+	RecoveryFailed           semconv.Event = "RecoveryFailed"
+	RecoverySucceeded        semconv.Event = "RecoverySucceeded"
+	RecoveryInitiatedByAdmin semconv.Event = "RecoveryInitiatedByAdmin"
+	VerificationFailed       semconv.Event = "VerificationFailed"
+	VerificationSucceeded    semconv.Event = "VerificationSucceeded"
+	IdentityCreated          semconv.Event = "IdentityCreated"
+	IdentityUpdated          semconv.Event = "IdentityUpdated"
+	IdentityDeleted          semconv.Event = "IdentityDeleted"
+	WebhookDelivered         semconv.Event = "WebhookDelivered"
+	WebhookSucceeded         semconv.Event = "WebhookSucceeded"
+	WebhookFailed            semconv.Event = "WebhookFailed"
 )
 
 const (
-	attributeKeySessionID                       semconv.AttributeKey = "SessionID"
-	attributeKeySessionAAL                      semconv.AttributeKey = "SessionAAL"
-	attributeKeySessionExpiresAt                semconv.AttributeKey = "SessionExpiresAt"
-	attributeKeySelfServiceFlowType             semconv.AttributeKey = "SelfServiceFlowType"
-	attributeKeySelfServiceMethodUsed           semconv.AttributeKey = "SelfServiceMethodUsed"
-	attributeKeySelfServiceSSOProviderUsed      semconv.AttributeKey = "SelfServiceSSOProviderUsed"
-	attributeKeyLoginRequestedAAL               semconv.AttributeKey = "LoginRequestedAAL"
-	attributeKeyLoginRequestedPrivilegedSession semconv.AttributeKey = "LoginRequestedPrivilegedSession"
-	attributeKeyTokenizedSessionTTL             semconv.AttributeKey = "TokenizedSessionTTL"
-	attributeKeyWebhookURL                      semconv.AttributeKey = "WebhookURL"
-	attributeKeyWebhookRequestBody              semconv.AttributeKey = "WebhookRequestBody"
-	attributeKeyWebhookResponseBody             semconv.AttributeKey = "WebhookResponseBody"
-	attributeKeyWebhookResponseStatusCode       semconv.AttributeKey = "WebhookResponseStatusCode"
-	attributeKeyWebhookAttemptNumber            semconv.AttributeKey = "WebhookAttemptNumber"
-	attributeKeyWebhookRequestID                semconv.AttributeKey = "WebhookRequestID"
+	AttributeKeySessionID                       semconv.AttributeKey = "SessionID"
+	AttributeKeySessionAAL                      semconv.AttributeKey = "SessionAAL"
+	AttributeKeySessionExpiresAt                semconv.AttributeKey = "SessionExpiresAt"
+	AttributeKeySelfServiceFlowType             semconv.AttributeKey = "SelfServiceFlowType"
+	AttributeKeySelfServiceMethodUsed           semconv.AttributeKey = "SelfServiceMethodUsed"
+	AttributeKeySelfServiceSSOProviderUsed      semconv.AttributeKey = "SelfServiceSSOProviderUsed"
+	AttributeKeyLoginRequestedAAL               semconv.AttributeKey = "LoginRequestedAAL"
+	AttributeKeyLoginRequestedPrivilegedSession semconv.AttributeKey = "LoginRequestedPrivilegedSession"
+	AttributeKeyTokenizedSessionTTL             semconv.AttributeKey = "TokenizedSessionTTL"
+	AttributeKeyWebhookID                       semconv.AttributeKey = "WebhookID"
+	AttributeKeyWebhookURL                      semconv.AttributeKey = "WebhookURL"
+	AttributeKeyWebhookRequestBody              semconv.AttributeKey = "WebhookRequestBody"
+	AttributeKeyWebhookResponseBody             semconv.AttributeKey = "WebhookResponseBody"
+	AttributeKeyWebhookResponseStatusCode       semconv.AttributeKey = "WebhookResponseStatusCode"
+	AttributeKeyWebhookAttemptNumber            semconv.AttributeKey = "WebhookAttemptNumber"
+	AttributeKeyWebhookRequestID                semconv.AttributeKey = "WebhookRequestID"
+	AttributeKeyWebhookTriggerID                semconv.AttributeKey = "WebhookTriggerID"
+	AttributeKeyReason                          semconv.AttributeKey = "Reason"
+	AttributeKeyFlowID                          semconv.AttributeKey = "FlowID"
 )
 
 func attrSessionID(val uuid.UUID) otelattr.KeyValue {
-	return otelattr.String(attributeKeySessionID.String(), val.String())
+	return otelattr.String(AttributeKeySessionID.String(), val.String())
 }
 
 func attrTokenizedSessionTTL(ttl time.Duration) otelattr.KeyValue {
-	return otelattr.String(attributeKeyTokenizedSessionTTL.String(), ttl.String())
+	return otelattr.String(AttributeKeyTokenizedSessionTTL.String(), ttl.String())
 }
 
 func attrSessionAAL(val string) otelattr.KeyValue {
-	return otelattr.String(attributeKeySessionAAL.String(), val)
+	return otelattr.String(AttributeKeySessionAAL.String(), val)
 }
 
 func attLoginRequestedAAL(val string) otelattr.KeyValue {
-	return otelattr.String(attributeKeyLoginRequestedAAL.String(), val)
+	return otelattr.String(AttributeKeyLoginRequestedAAL.String(), val)
 }
 
 func attSessionExpiresAt(expiresAt time.Time) otelattr.KeyValue {
-	return otelattr.String(attributeKeySessionExpiresAt.String(), expiresAt.String())
+	return otelattr.String(AttributeKeySessionExpiresAt.String(), expiresAt.String())
 }
 
 func attLoginRequestedPrivilegedSession(val bool) otelattr.KeyValue {
-	return otelattr.Bool(attributeKeyLoginRequestedPrivilegedSession.String(), val)
+	return otelattr.Bool(AttributeKeyLoginRequestedPrivilegedSession.String(), val)
 }
 
 func attrSelfServiceFlowType(val string) otelattr.KeyValue {
-	return otelattr.String(attributeKeySelfServiceFlowType.String(), val)
+	return otelattr.String(AttributeKeySelfServiceFlowType.String(), val)
 }
 
 func attrSelfServiceMethodUsed(val string) otelattr.KeyValue {
-	return otelattr.String(attributeKeySelfServiceMethodUsed.String(), val)
+	return otelattr.String(AttributeKeySelfServiceMethodUsed.String(), val)
 }
 
 func attrSelfServiceSSOProviderUsed(val string) otelattr.KeyValue {
-	return otelattr.String(attributeKeySelfServiceSSOProviderUsed.String(), val)
+	return otelattr.String(AttributeKeySelfServiceSSOProviderUsed.String(), val)
+}
+
+func attrWebhookID(id string) otelattr.KeyValue {
+	return otelattr.String(AttributeKeyWebhookID.String(), id)
 }
 
 func attrWebhookURL(URL *url.URL) otelattr.KeyValue {
-	return otelattr.String(attributeKeyWebhookURL.String(), URL.Redacted())
+	return otelattr.String(AttributeKeyWebhookURL.String(), URL.Redacted())
 }
 
 func attrWebhookReq(body []byte) otelattr.KeyValue {
-	return otelattr.String(attributeKeyWebhookRequestBody.String(), string(body))
+	return otelattr.String(AttributeKeyWebhookRequestBody.String(), string(body))
 }
 
 func attrWebhookRes(body []byte) otelattr.KeyValue {
-	return otelattr.String(attributeKeyWebhookResponseBody.String(), string(body))
+	return otelattr.String(AttributeKeyWebhookResponseBody.String(), string(body))
 }
 
 func attrWebhookStatus(status int) otelattr.KeyValue {
-	return otelattr.Int(attributeKeyWebhookResponseStatusCode.String(), status)
+	return otelattr.Int(AttributeKeyWebhookResponseStatusCode.String(), status)
 }
 
 func attrWebhookAttempt(n int) otelattr.KeyValue {
-	return otelattr.Int(attributeKeyWebhookAttemptNumber.String(), n)
+	return otelattr.Int(AttributeKeyWebhookAttemptNumber.String(), n)
 }
 
 func attrWebhookRequestID(id uuid.UUID) otelattr.KeyValue {
-	return otelattr.String(attributeKeyWebhookRequestID.String(), id.String())
+	return otelattr.String(AttributeKeyWebhookRequestID.String(), id.String())
+}
+
+func attrWebhookTriggerID(id uuid.UUID) otelattr.KeyValue {
+	return otelattr.String(AttributeKeyWebhookTriggerID.String(), id.String())
+}
+
+func attrReason(err error) otelattr.KeyValue {
+	return otelattr.String(AttributeKeyReason.String(), reasonForError(err))
+}
+
+func attrFlowID(id uuid.UUID) otelattr.KeyValue {
+	return otelattr.String(AttributeKeyFlowID.String(), id.String())
 }
 
 func NewSessionIssued(ctx context.Context, aal string, sessionID, identityID uuid.UUID) (string, trace.EventOption) {
@@ -154,7 +179,7 @@ func NewSessionLifespanExtended(ctx context.Context, sessionID, identityID uuid.
 }
 
 type LoginSucceededOpts struct {
-	SessionID, IdentityID                       uuid.UUID
+	SessionID, IdentityID, FlowID               uuid.UUID
 	FlowType, RequestedAAL, Method, SSOProvider string
 	IsRefresh                                   bool
 }
@@ -171,11 +196,12 @@ func NewLoginSucceeded(ctx context.Context, o *LoginSucceededOpts) (string, trac
 				attLoginRequestedPrivilegedSession(o.IsRefresh),
 				attrSelfServiceMethodUsed(o.Method),
 				attrSelfServiceSSOProviderUsed(o.SSOProvider),
+				attrFlowID(o.FlowID),
 			)...,
 		)
 }
 
-func NewRegistrationSucceeded(ctx context.Context, identityID uuid.UUID, flowType string, method, provider string) (string, trace.EventOption) {
+func NewRegistrationSucceeded(ctx context.Context, flowID, identityID uuid.UUID, flowType, method, provider string) (string, trace.EventOption) {
 	return RegistrationSucceeded.String(),
 		trace.WithAttributes(append(
 			semconv.AttributesFromContext(ctx),
@@ -183,72 +209,95 @@ func NewRegistrationSucceeded(ctx context.Context, identityID uuid.UUID, flowTyp
 			semconv.AttrIdentityID(identityID),
 			attrSelfServiceMethodUsed(method),
 			attrSelfServiceSSOProviderUsed(provider),
+			attrFlowID(flowID),
 		)...)
 }
 
-func NewRecoverySucceeded(ctx context.Context, identityID uuid.UUID, flowType string, method string) (string, trace.EventOption) {
+func NewRecoverySucceeded(ctx context.Context, flowID, identityID uuid.UUID, flowType, method string) (string, trace.EventOption) {
 	return RecoverySucceeded.String(),
 		trace.WithAttributes(append(
 			semconv.AttributesFromContext(ctx),
 			attrSelfServiceFlowType(flowType),
 			semconv.AttrIdentityID(identityID),
 			attrSelfServiceMethodUsed(method),
+			attrFlowID(flowID),
 		)...)
 }
 
-func NewSettingsSucceeded(ctx context.Context, identityID uuid.UUID, flowType string, method string) (string, trace.EventOption) {
+func NewRecoveryInitiatedByAdmin(ctx context.Context, flowID, identityID uuid.UUID, flowType, method string) (string, trace.EventOption) {
+	return RecoveryInitiatedByAdmin.String(),
+		trace.WithAttributes(append(
+			semconv.AttributesFromContext(ctx),
+			attrSelfServiceFlowType(flowType),
+			semconv.AttrIdentityID(identityID),
+			attrSelfServiceMethodUsed(method),
+			attrFlowID(flowID),
+		)...)
+}
+
+func NewSettingsSucceeded(ctx context.Context, flowID, identityID uuid.UUID, flowType, method string) (string, trace.EventOption) {
 	return SettingsSucceeded.String(),
 		trace.WithAttributes(append(
 			semconv.AttributesFromContext(ctx),
 			attrSelfServiceFlowType(flowType),
 			semconv.AttrIdentityID(identityID),
 			attrSelfServiceMethodUsed(method),
+			attrFlowID(flowID),
 		)...)
 }
 
-func NewVerificationSucceeded(ctx context.Context, identityID uuid.UUID, flowType string, method string) (string, trace.EventOption) {
+func NewVerificationSucceeded(ctx context.Context, flowID, identityID uuid.UUID, flowType, method string) (string, trace.EventOption) {
 	return VerificationSucceeded.String(),
 		trace.WithAttributes(append(
 			semconv.AttributesFromContext(ctx),
 			attrSelfServiceMethodUsed(method),
 			attrSelfServiceFlowType(flowType),
 			semconv.AttrIdentityID(identityID),
+			attrFlowID(flowID),
 		)...)
 }
 
-func NewRegistrationFailed(ctx context.Context, flowType string, method string) (string, trace.EventOption) {
+func NewRegistrationFailed(ctx context.Context, flowID uuid.UUID, flowType, method string, err error) (string, trace.EventOption) {
 	return RegistrationFailed.String(),
 		trace.WithAttributes(append(
 			semconv.AttributesFromContext(ctx),
 			attrSelfServiceFlowType(flowType),
 			attrSelfServiceMethodUsed(method),
+			attrReason(err),
+			attrFlowID(flowID),
 		)...)
 }
 
-func NewRecoveryFailed(ctx context.Context, flowType string, method string) (string, trace.EventOption) {
+func NewRecoveryFailed(ctx context.Context, flowID uuid.UUID, flowType, method string, err error) (string, trace.EventOption) {
 	return RecoveryFailed.String(),
 		trace.WithAttributes(append(
 			semconv.AttributesFromContext(ctx),
 			attrSelfServiceFlowType(flowType),
 			attrSelfServiceMethodUsed(method),
+			attrReason(err),
+			attrFlowID(flowID),
 		)...)
 }
 
-func NewSettingsFailed(ctx context.Context, flowType string, method string) (string, trace.EventOption) {
+func NewSettingsFailed(ctx context.Context, flowID uuid.UUID, flowType, method string, err error) (string, trace.EventOption) {
 	return SettingsFailed.String(),
 		trace.WithAttributes(append(
 			semconv.AttributesFromContext(ctx),
 			attrSelfServiceFlowType(flowType),
 			attrSelfServiceMethodUsed(method),
+			attrReason(err),
+			attrFlowID(flowID),
 		)...)
 }
 
-func NewVerificationFailed(ctx context.Context, flowType string, method string) (string, trace.EventOption) {
+func NewVerificationFailed(ctx context.Context, flowID uuid.UUID, flowType, method string, err error) (string, trace.EventOption) {
 	return VerificationFailed.String(),
 		trace.WithAttributes(append(
 			semconv.AttributesFromContext(ctx),
 			attrSelfServiceFlowType(flowType),
 			attrSelfServiceMethodUsed(method),
+			attrReason(err),
+			attrFlowID(flowID),
 		)...)
 }
 
@@ -262,6 +311,16 @@ func NewIdentityCreated(ctx context.Context, identityID uuid.UUID) (string, trac
 		)
 }
 
+func NewIdentityDeleted(ctx context.Context, identityID uuid.UUID) (string, trace.EventOption) {
+	return IdentityDeleted.String(),
+		trace.WithAttributes(
+			append(
+				semconv.AttributesFromContext(ctx),
+				semconv.AttrIdentityID(identityID),
+			)...,
+		)
+}
+
 func NewIdentityUpdated(ctx context.Context, identityID uuid.UUID) (string, trace.EventOption) {
 	return IdentityUpdated.String(),
 		trace.WithAttributes(
@@ -272,13 +331,15 @@ func NewIdentityUpdated(ctx context.Context, identityID uuid.UUID) (string, trac
 		)
 }
 
-func NewLoginFailed(ctx context.Context, flowType string, requestedAAL string, isRefresh bool) (string, trace.EventOption) {
+func NewLoginFailed(ctx context.Context, flowID uuid.UUID, flowType, requestedAAL string, isRefresh bool, err error) (string, trace.EventOption) {
 	return LoginFailed.String(),
 		trace.WithAttributes(append(
 			semconv.AttributesFromContext(ctx),
 			attrSelfServiceFlowType(flowType),
 			attLoginRequestedAAL(requestedAAL),
 			attLoginRequestedPrivilegedSession(isRefresh),
+			attrReason(err),
+			attrFlowID(flowID),
 		)...)
 }
 
@@ -316,7 +377,7 @@ func NewSessionJWTIssued(ctx context.Context, sessionID, identityID uuid.UUID, t
 		)
 }
 
-func NewWebhookDelivered(ctx context.Context, URL *url.URL, reqBody []byte, status int, resBody []byte, attempt int, requestID uuid.UUID) (string, trace.EventOption) {
+func NewWebhookDelivered(ctx context.Context, URL *url.URL, reqBody []byte, status int, resBody []byte, attempt int, requestID, triggerID uuid.UUID, webhookID string) (string, trace.EventOption) {
 	return WebhookDelivered.String(),
 		trace.WithAttributes(
 			append(
@@ -327,21 +388,40 @@ func NewWebhookDelivered(ctx context.Context, URL *url.URL, reqBody []byte, stat
 				attrWebhookURL(URL),
 				attrWebhookAttempt(attempt),
 				attrWebhookRequestID(requestID),
+				attrWebhookID(webhookID),
+				attrWebhookTriggerID(triggerID),
 			)...,
 		)
 }
 
-func NewWebhookSucceeded(ctx context.Context) (string, trace.EventOption) {
+func NewWebhookSucceeded(ctx context.Context, triggerID uuid.UUID, webhookID string) (string, trace.EventOption) {
 	return WebhookSucceeded.String(),
-		trace.WithAttributes(semconv.AttributesFromContext(ctx)...)
+		trace.WithAttributes(
+			append(
+				semconv.AttributesFromContext(ctx),
+				attrWebhookID(webhookID),
+				attrWebhookTriggerID(triggerID),
+			)...)
 }
 
-func NewWebhookFailed(ctx context.Context, err error) (string, trace.EventOption) {
+func NewWebhookFailed(ctx context.Context, err error, triggerID uuid.UUID, id string) (string, trace.EventOption) {
 	return WebhookFailed.String(),
 		trace.WithAttributes(
 			append(
 				semconv.AttributesFromContext(ctx),
+				attrWebhookID(id),
+				attrWebhookTriggerID(triggerID),
 				otelattr.String("Error", err.Error()),
 			)...,
 		)
 }
+
+func reasonForError(err error) string {
+	if ve := new(schema.ValidationError); errors.As(err, &ve) {
+		return ve.Message
+	}
+	if r := *new(herodot.ReasonCarrier); errors.As(err, &r) {
+		return r.Reason()
+	}
+	return err.Error()
+}
diff --git a/x/http_secure_redirect.go b/x/http_secure_redirect.go
index 9851abc0f53e..1b86b00940db 100644
--- a/x/http_secure_redirect.go
+++ b/x/http_secure_redirect.go
@@ -17,8 +17,6 @@ import (
 	"github.com/ory/x/stringsx"
 	"github.com/ory/x/urlx"
 
-	"github.com/samber/lo"
-
 	"github.com/ory/kratos/driver/config"
 )
 
@@ -145,10 +143,8 @@ func SecureRedirectTo(r *http.Request, defaultReturnTo *url.URL, opts ...SecureR
 
 	return nil, errors.WithStack(herodot.ErrBadRequest.
 		WithID(text.ErrIDRedirectURLNotAllowed).
-		WithReasonf("Requested return_to URL %q is not allowed.", returnTo).
-		WithDebugf("Allowed domains are: %v", strings.Join(lo.Map(o.allowlist, func(u url.URL, _ int) string {
-			return u.String()
-		}), ", ")))
+		WithReasonf("Requested return_to URL %q is not allowed.", returnTo),
+	)
 }
 
 func SecureContentNegotiationRedirection(
diff --git a/x/normalize.go b/x/normalize.go
new file mode 100644
index 000000000000..9429fa12bd92
--- /dev/null
+++ b/x/normalize.go
@@ -0,0 +1,77 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package x
+
+import (
+	"strings"
+
+	"github.com/nyaruka/phonenumbers"
+	"github.com/pkg/errors"
+)
+
+// NormalizeEmailIdentifier normalizes an email address.
+func NormalizeEmailIdentifier(value string) string {
+	if strings.Contains(value, "@") {
+		value = strings.TrimSpace(strings.ToLower(value))
+	}
+	return value
+}
+
+// NormalizePhoneIdentifier normalizes a phone number.
+func NormalizePhoneIdentifier(value string) string {
+	if number, err := phonenumbers.Parse(value, ""); err == nil && phonenumbers.IsValidNumber(number) {
+		value = phonenumbers.Format(number, phonenumbers.E164)
+	}
+	return value
+}
+
+// NormalizeOtherIdentifier normalizes an identifier that is not an email or phone number.
+func NormalizeOtherIdentifier(value string) string {
+	return strings.TrimSpace(value)
+}
+
+// GracefulNormalization normalizes an identifier based on the format.
+//
+// Supported formats are:
+//
+// - email
+// - phone
+// - username
+func GracefulNormalization(value string) string {
+	if number, err := phonenumbers.Parse(value, ""); err == nil && phonenumbers.IsValidNumber(number) {
+		return phonenumbers.Format(number, phonenumbers.E164)
+	} else if strings.Contains(value, "@") {
+		return NormalizeEmailIdentifier(value)
+	}
+	return NormalizeOtherIdentifier(value)
+}
+
+// NormalizeIdentifier normalizes an identifier based on the format.
+//
+// Supported formats are:
+//
+// - email
+// - phone
+// - username
+func NormalizeIdentifier(value, format string) (string, error) {
+	switch format {
+	case "email":
+		return NormalizeEmailIdentifier(value), nil
+	case "sms":
+		number, err := phonenumbers.Parse(value, "")
+		if err != nil {
+			return "", err
+		}
+
+		if !phonenumbers.IsValidNumber(number) {
+			return "", errors.New("the provided number is not a valid phone number")
+		}
+
+		return phonenumbers.Format(number, phonenumbers.E164), nil
+	case "username":
+		fallthrough
+	default:
+		return NormalizeOtherIdentifier(value), nil
+	}
+}
diff --git a/x/normalize_test.go b/x/normalize_test.go
new file mode 100644
index 000000000000..3b7993527c28
--- /dev/null
+++ b/x/normalize_test.go
@@ -0,0 +1,95 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package x
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNormalizeEmailIdentifier(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"  EXAMPLE@DOMAIN.COM  ", "example@domain.com"},
+		{"user@domain.com", "user@domain.com"},
+		{"invalid-email", "invalid-email"},
+	}
+
+	for _, test := range tests {
+		assert.Equal(t, test.expected, NormalizeEmailIdentifier(test.input))
+	}
+}
+
+func TestNormalizePhoneIdentifier(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"+1 650-253-0000", "+16502530000"},
+		{"+1 (650) 253-0000", "+16502530000"},
+		{"invalid-phone", "invalid-phone"},
+	}
+
+	for _, test := range tests {
+		assert.Equal(t, test.expected, NormalizePhoneIdentifier(test.input))
+	}
+}
+
+func TestNormalizeOtherIdentifier(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"  username  ", "username"},
+		{"user123", "user123"},
+		{"  ", ""},
+	}
+
+	for _, test := range tests {
+		assert.Equal(t, test.expected, NormalizeOtherIdentifier(test.input))
+	}
+}
+
+func TestGracefulNormalization(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"+1 650-253-0000", "+16502530000"},
+		{"  EXAMPLE@DOMAIN.COM  ", "example@domain.com"},
+		{"  username  ", "username"},
+		{"invalid-phone", "invalid-phone"},
+	}
+
+	for _, test := range tests {
+		assert.Equal(t, test.expected, GracefulNormalization(test.input))
+	}
+}
+
+func TestNormalizeIdentifier(t *testing.T) {
+	tests := []struct {
+		input    string
+		format   string
+		expected string
+		err      bool
+	}{
+		{"  EXAMPLE@DOMAIN.COM  ", "email", "example@domain.com", false},
+		{"+1 650-253-0000", "sms", "+16502530000", false},
+		{"  username  ", "username", "username", false},
+		{"invalid-phone", "sms", "", true},
+	}
+
+	for _, test := range tests {
+		result, err := NormalizeIdentifier(test.input, test.format)
+		if test.err {
+			assert.Error(t, err)
+		} else {
+			assert.NoError(t, err)
+			assert.Equal(t, test.expected, result)
+		}
+	}
+}
diff --git a/x/nosurf.go b/x/nosurf.go
index 8169717fcda8..ce49f01d3cdd 100644
--- a/x/nosurf.go
+++ b/x/nosurf.go
@@ -138,7 +138,7 @@ func NosurfBaseCookieHandler(reg interface {
 	config.Provider
 }) func(w http.ResponseWriter, r *http.Request) http.Cookie {
 	return func(w http.ResponseWriter, r *http.Request) http.Cookie {
-		secure := !reg.Config().IsInsecureDevMode(r.Context())
+		secure := reg.Config().CookieSecure(r.Context())
 
 		sameSite := reg.Config().CookieSameSiteMode(r.Context())
 		if !secure {
diff --git a/x/swagger/swagger_types_global.go b/x/swagger/swagger_types_global.go
index 2175ff1eca4e..8057ee495dfa 100644
--- a/x/swagger/swagger_types_global.go
+++ b/x/swagger/swagger_types_global.go
@@ -10,9 +10,6 @@ import "github.com/ory/herodot"
 // The standard Ory JSON API error format.
 //
 // swagger:model errorGeneric
-//
-//nolint:deadcode,unused
-//lint:ignore U1000 Used to generate Swagger and OpenAPI definitions
 type ErrorGeneric struct {
 	// Contains error details
 	//
@@ -23,10 +20,7 @@ type ErrorGeneric struct {
 // swagger:model genericError
 type GenericError struct{ herodot.DefaultError }
 
-// Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 201.
+// Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 204.
 //
 // swagger:response emptyResponse
-//
-//nolint:deadcode,unused
-//lint:ignore U1000 Used to generate Swagger and OpenAPI definitions
-type emptyResponse struct{}
+type _ struct{}
diff --git a/x/sync_map.go b/x/sync_map.go
new file mode 100644
index 000000000000..4a343e932eb6
--- /dev/null
+++ b/x/sync_map.go
@@ -0,0 +1,66 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package x
+
+import (
+	"sync"
+)
+
+// SyncMap provides a thread-safe map with generic keys and values
+type SyncMap[K comparable, V any] struct {
+	mu   sync.RWMutex
+	data map[K]V
+}
+
+// NewSyncMap initializes a new SyncMap instance
+func NewSyncMap[K comparable, V any]() *SyncMap[K, V] {
+	return &SyncMap[K, V]{
+		data: make(map[K]V),
+	}
+}
+
+// Load retrieves a value for a key. It returns the value and a boolean indicating if the key exists.
+func (m *SyncMap[K, V]) Load(key K) (V, bool) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	val, ok := m.data[key]
+	return val, ok
+}
+
+// Store sets a value for a key, replacing any existing value.
+func (m *SyncMap[K, V]) Store(key K, value V) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.data[key] = value
+}
+
+// LoadOrStore retrieves the existing value for a key if it exists, or stores and returns a given value if it doesn't.
+func (m *SyncMap[K, V]) LoadOrStore(key K, value V) (V, bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if existing, ok := m.data[key]; ok {
+		return existing, true
+	}
+	m.data[key] = value
+	return value, false
+}
+
+// Delete removes a key-value pair from the map.
+func (m *SyncMap[K, V]) Delete(key K) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	delete(m.data, key)
+}
+
+// Range iterates over all entries in the map, calling the provided function for each key-value pair.
+// If the function returns false, the iteration stops.
+func (m *SyncMap[K, V]) Range(f func(key K, value V) bool) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	for k, v := range m.data {
+		if !f(k, v) {
+			break
+		}
+	}
+}
diff --git a/x/sync_map_test.go b/x/sync_map_test.go
new file mode 100644
index 000000000000..6da97c63c801
--- /dev/null
+++ b/x/sync_map_test.go
@@ -0,0 +1,98 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package x
+
+import (
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSyncMapStoreAndLoad(t *testing.T) {
+	m := NewSyncMap[int, string]()
+
+	m.Store(1, "one")
+
+	// Test Load for an existing key
+	val, ok := m.Load(1)
+	require.True(t, ok, "Expected key 1 to exist")
+	assert.Equal(t, "one", val, "Expected value 'one' for key 1")
+
+	// Test Load for a non-existing key
+	_, ok = m.Load(2)
+	assert.False(t, ok, "Expected key 2 to be absent")
+}
+
+func TestSyncMapLoadOrStore(t *testing.T) {
+	m := NewSyncMap[int, string]()
+
+	// Store a new key-value pair
+	val, loaded := m.LoadOrStore(1, "one")
+	require.False(t, loaded, "Expected key 1 to be newly stored")
+	assert.Equal(t, "one", val, "Expected value 'one' for key 1 after LoadOrStore")
+
+	// Attempt to store a new value for an existing key
+	val, loaded = m.LoadOrStore(1, "uno")
+	require.True(t, loaded, "Expected key 1 to already exist")
+	assert.Equal(t, "one", val, "Expected existing value 'one' for key 1")
+}
+
+func TestSyncMapDelete(t *testing.T) {
+	m := NewSyncMap[int, string]()
+
+	m.Store(1, "one")
+	m.Delete(1)
+
+	_, ok := m.Load(1)
+	assert.False(t, ok, "Expected key 1 to be deleted")
+}
+
+func TestSyncMapRange(t *testing.T) {
+	m := NewSyncMap[int, string]()
+
+	m.Store(1, "one")
+	m.Store(2, "two")
+	m.Store(3, "three")
+
+	expected := map[int]string{
+		1: "one",
+		2: "two",
+		3: "three",
+	}
+
+	m.Range(func(key int, value string) bool {
+		expectedVal, exists := expected[key]
+		require.True(t, exists, "Unexpected key found in map")
+		assert.Equal(t, expectedVal, value, "Unexpected value for key %d", key)
+		delete(expected, key)
+		return true
+	})
+
+	assert.Empty(t, expected, "Not all entries were iterated over")
+}
+
+func TestSyncMapConcurrentAccess(t *testing.T) {
+	m := NewSyncMap[int, int]()
+	var wg sync.WaitGroup
+
+	// Run multiple goroutines to test concurrent access
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			m.Store(i, i)
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Verify all stored values
+	for i := 0; i < 100; i++ {
+		val, ok := m.Load(i)
+		require.True(t, ok, "Expected key %d to exist", i)
+		assert.Equal(t, i, val, "Expected value %d for key %d", i, i)
+	}
+}
diff --git a/x/transaction.go b/x/transaction.go
new file mode 100644
index 000000000000..117a1bf5cb6e
--- /dev/null
+++ b/x/transaction.go
@@ -0,0 +1,20 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package x
+
+import (
+	"context"
+
+	"github.com/gobuffalo/pop/v6"
+)
+
+type (
+	TransactionPersistenceProvider interface {
+		TransactionalPersisterProvider() TransactionalPersister
+	}
+
+	TransactionalPersister interface {
+		Transaction(ctx context.Context, callback func(ctx context.Context, connection *pop.Connection) error) error
+	}
+)
diff --git a/x/webauthnx/aaguid/aaguid.go b/x/webauthnx/aaguid/aaguid.go
index 376303848bc9..b3875fdf1117 100644
--- a/x/webauthnx/aaguid/aaguid.go
+++ b/x/webauthnx/aaguid/aaguid.go
@@ -8,9 +8,9 @@ package aaguid
 import (
 	_ "embed"
 	"encoding/json"
+	"maps"
 
 	"github.com/gofrs/uuid"
-	"golang.org/x/exp/maps"
 )
 
 var (
diff --git a/x/webauthnx/js/trigger.go b/x/webauthnx/js/trigger.go
new file mode 100644
index 000000000000..7b236191ce8e
--- /dev/null
+++ b/x/webauthnx/js/trigger.go
@@ -0,0 +1,22 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package js
+
+import "fmt"
+
+// swagger:enum WebAuthnTriggers
+type WebAuthnTriggers string
+
+const (
+	WebAuthnTriggersWebAuthnRegistration         WebAuthnTriggers = "oryWebAuthnRegistration"
+	WebAuthnTriggersWebAuthnLogin                WebAuthnTriggers = "oryWebAuthnLogin"
+	WebAuthnTriggersPasskeyLogin                 WebAuthnTriggers = "oryPasskeyLogin"
+	WebAuthnTriggersPasskeyLoginAutocompleteInit WebAuthnTriggers = "oryPasskeyLoginAutocompleteInit"
+	WebAuthnTriggersPasskeyRegistration          WebAuthnTriggers = "oryPasskeyRegistration"
+	WebAuthnTriggersPasskeySettingsRegistration  WebAuthnTriggers = "oryPasskeySettingsRegistration"
+)
+
+func (r WebAuthnTriggers) String() string {
+	return fmt.Sprintf("window.%s", string(r))
+}
diff --git a/x/webauthnx/js/trigger_test.go b/x/webauthnx/js/trigger_test.go
new file mode 100644
index 000000000000..97f9dc00ee77
--- /dev/null
+++ b/x/webauthnx/js/trigger_test.go
@@ -0,0 +1,14 @@
+// Copyright © 2024 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package js
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestToString(t *testing.T) {
+	assert.Equal(t, "window.oryWebAuthnRegistration", WebAuthnTriggersWebAuthnRegistration.String())
+}
diff --git a/x/webauthnx/js/webauthn.js b/x/webauthnx/js/webauthn.js
index 61a7cb8f976d..790896c1926b 100644
--- a/x/webauthnx/js/webauthn.js
+++ b/x/webauthnx/js/webauthn.js
@@ -32,7 +32,7 @@
   }
 
   function __oryWebAuthnLogin(
-    opt,
+    options,
     resultQuerySelector = '*[name="webauthn_login"]',
     triggerQuerySelector = '*[name="webauthn_login_trigger"]',
   ) {
@@ -40,6 +40,12 @@
       alert("This browser does not support WebAuthn!")
     }
 
+    const triggerEl = document.querySelector(triggerQuerySelector)
+    let opt = options
+    if (!opt) {
+      opt = JSON.parse(triggerEl.value)
+    }
+
     opt.publicKey.challenge = __oryWebAuthnBufferDecode(opt.publicKey.challenge)
     opt.publicKey.allowCredentials = opt.publicKey.allowCredentials.map(
       function (value) {
@@ -71,7 +77,7 @@
           },
         })
 
-        document.querySelector(triggerQuerySelector).closest("form").submit()
+        triggerEl.closest("form").submit()
       })
       .catch((err) => {
         alert(err)
@@ -79,7 +85,7 @@
   }
 
   function __oryWebAuthnRegistration(
-    opt,
+    options,
     resultQuerySelector = '*[name="webauthn_register"]',
     triggerQuerySelector = '*[name="webauthn_register_trigger"]',
   ) {
@@ -87,6 +93,12 @@
       alert("This browser does not support WebAuthn!")
     }
 
+    const triggerEl = document.querySelector(triggerQuerySelector)
+    let opt = options
+    if (!opt) {
+      opt = JSON.parse(triggerEl.value)
+    }
+
     opt.publicKey.user.id = __oryWebAuthnBufferDecode(opt.publicKey.user.id)
     opt.publicKey.challenge = __oryWebAuthnBufferDecode(opt.publicKey.challenge)
 
@@ -118,21 +130,21 @@
           },
         })
 
-        document.querySelector(triggerQuerySelector).closest("form").submit()
+        triggerEl.closest("form").submit()
       })
       .catch((err) => {
         alert(err)
       })
   }
 
-  window.__oryPasskeyLoginAutocompleteInit = async function () {
+  async function __oryPasskeyLoginAutocompleteInit () {
     const dataEl = document.getElementsByName("passkey_challenge")[0]
     const resultEl = document.getElementsByName("passkey_login")[0]
     const identifierEl = document.getElementsByName("identifier")[0]
 
     if (!dataEl || !resultEl || !identifierEl) {
-      console.debug(
-        "__oryPasskeyLoginAutocompleteInit: mandatory fields not found",
+      console.error(
+        "Unable to initialize WebAuthn / Passkey autocomplete because one or more required form fields are missing.",
       )
       return
     }
@@ -142,9 +154,10 @@
       !window.PublicKeyCredential.isConditionalMediationAvailable ||
       window.Cypress // Cypress auto-fills the autocomplete, which we don't want
     ) {
-      console.log("This browser does not support WebAuthn!")
+      console.log("This browser does not support Passkey / WebAuthn!")
       return
     }
+
     const isCMA = await PublicKeyCredential.isConditionalMediationAvailable()
     if (!isCMA) {
       console.log(
@@ -160,6 +173,14 @@
     }
     opt.publicKey.challenge = __oryWebAuthnBufferDecode(opt.publicKey.challenge)
 
+    // If this is set we already have a request ongoing which we need to abort.
+    if (window.abortPasskeyConditionalUI) {
+      window.abortPasskeyConditionalUI.abort(
+        "Canceling Passkey autocomplete to complete trigger-based passkey login.",
+      )
+      window.abortPasskeyConditionalUI = undefined
+    }
+
     // Allow aborting through a global variable
     window.abortPasskeyConditionalUI = new AbortController()
 
@@ -191,16 +212,19 @@
         resultEl.closest("form").submit()
       })
       .catch((err) => {
+        console.trace(err)
         console.log(err)
       })
   }
 
-  window.__oryPasskeyLogin = function () {
+  function __oryPasskeyLogin () {
     const dataEl = document.getElementsByName("passkey_challenge")[0]
     const resultEl = document.getElementsByName("passkey_login")[0]
 
     if (!dataEl || !resultEl) {
-      console.debug("__oryPasskeyLogin: mandatory fields not found")
+      console.error(
+        "Unable to initialize WebAuthn / Passkey autocomplete because one or more required form fields are missing.",
+      )
       return
     }
     if (!window.PublicKeyCredential) {
@@ -225,16 +249,19 @@
       )
     }
 
-    window.abortPasskeyConditionalUI &&
+    if (window.abortPasskeyConditionalUI) {
       window.abortPasskeyConditionalUI.abort(
-        "only one credentials.get allowed at a time",
+        "Canceling Passkey autocomplete to complete trigger-based passkey login.",
       )
+      window.abortPasskeyConditionalUI = undefined
+    }
 
     navigator.credentials
       .get({
         publicKey: opt.publicKey,
       })
       .then(function (credential) {
+        console.trace('login',credential)
         resultEl.value = JSON.stringify({
           id: credential.id,
           rawId: __oryWebAuthnBufferEncode(credential.rawId),
@@ -257,12 +284,20 @@
       })
       .catch((err) => {
         // Calling this again will enable the autocomplete once again.
-        console.error(err)
-        window.abortPasskeyConditionalUI && __oryPasskeyLoginAutocompleteInit()
+        if (err instanceof DOMException && err.name === "SecurityError") {
+          console.error(`A security exception occurred while loading Passkeys / WebAuthn. To troubleshoot, please head over to https://www.ory.sh/docs/troubleshooting/passkeys-webauthn-security-error. The original error message is: ${err.message}`)
+        } else {
+          console.error("[Ory/Passkey] An unknown error occurred while getting passkey credentials", err)
+        }
+
+        console.trace(err)
+
+        // Try re-initializing autocomplete
+        return __oryPasskeyLoginAutocompleteInit()
       })
   }
 
-  window.__oryPasskeyRegistration = function () {
+  function __oryPasskeyRegistration () {
     const dataEl = document.getElementsByName("passkey_create_data")[0]
     const resultEl = document.getElementsByName("passkey_register")[0]
 
@@ -373,8 +408,21 @@
       })
   }
 
+  // Deprecated naming with underscores - kept for support with Ory Elements v0
   window.__oryWebAuthnLogin = __oryWebAuthnLogin
   window.__oryWebAuthnRegistration = __oryWebAuthnRegistration
   window.__oryPasskeySettingsRegistration = __oryPasskeySettingsRegistration
+  window.__oryPasskeyLogin = __oryPasskeyLogin
+  window.__oryPasskeyRegistration = __oryPasskeyRegistration
+  window.__oryPasskeyLoginAutocompleteInit = __oryPasskeyLoginAutocompleteInit
+
+  // Current naming - use with Ory Elements v1
+  window.oryWebAuthnLogin = __oryWebAuthnLogin
+  window.oryWebAuthnRegistration = __oryWebAuthnRegistration
+  window.oryPasskeySettingsRegistration = __oryPasskeySettingsRegistration
+  window.oryPasskeyLogin = __oryPasskeyLogin
+  window.oryPasskeyRegistration = __oryPasskeyRegistration
+  window.oryPasskeyLoginAutocompleteInit = __oryPasskeyLoginAutocompleteInit
+
   window.__oryWebAuthnInitialized = true
 })()
diff --git a/x/webauthnx/nodes.go b/x/webauthnx/nodes.go
index 76fac1c397cd..309f49f80e9d 100644
--- a/x/webauthnx/nodes.go
+++ b/x/webauthnx/nodes.go
@@ -10,6 +10,8 @@ import (
 	"fmt"
 	"net/url"
 
+	"github.com/ory/kratos/x/webauthnx/js"
+
 	"github.com/ory/x/stringsx"
 	"github.com/ory/x/urlx"
 
@@ -21,7 +23,10 @@ import (
 func NewWebAuthnConnectionTrigger(options string) *node.Node {
 	return node.NewInputField(node.WebAuthnRegisterTrigger, "", node.WebAuthnGroup,
 		node.InputAttributeTypeButton, node.WithInputAttributes(func(a *node.InputAttributes) {
-			a.OnClick = "window.__oryWebAuthnRegistration(" + options + ")"
+			//nolint:staticcheck
+			a.OnClick = fmt.Sprintf("%s(%s)", js.WebAuthnTriggersWebAuthnRegistration, options)
+			a.OnClickTrigger = js.WebAuthnTriggersWebAuthnRegistration
+			a.FieldValue = options
 		}))
 }
 
@@ -44,7 +49,10 @@ func NewWebAuthnConnectionInput() *node.Node {
 func NewWebAuthnLoginTrigger(options string) *node.Node {
 	return node.NewInputField(node.WebAuthnLoginTrigger, "", node.WebAuthnGroup,
 		node.InputAttributeTypeButton, node.WithInputAttributes(func(a *node.InputAttributes) {
-			a.OnClick = "window.__oryWebAuthnLogin(" + options + ")"
+			//nolint:staticcheck
+			a.OnClick = fmt.Sprintf("%s(%s)", js.WebAuthnTriggersWebAuthnLogin, options)
+			a.FieldValue = options
+			a.OnClickTrigger = js.WebAuthnTriggersWebAuthnLogin
 		}))
 }