- detect if 2fa by checking is a session has a 2fa - remove 2fa boolean from prisma - mobile will not use boolean, it will check if the 2fa token exists - server checks if any sessions have a 2fa, if yes then 2fa true - when removing 2fa delete all 2fa tokens - when mobile shows up if server says 2fa is disabled then delete local 2fa token