- For each step (email/username, password, and TOTP code), it should have a single URL - Make sure the password manager prompts for the right data on each step