[lkbm]

I was recently thinking something similar for implementing a 2fa similar to how Google and Apple do it: pop up a notification on your phone asking "Is this login you?"

Throw some structured data into the email. Email clients can detect and do the popup that hits a callback endpoint. Clients that don't support it still get the code via regular email.

I avoid the OS-layer implementation at the expense of the user having to confirm it's them, but this also means it works cross-device, which is what I'd want for 2fa anyway.