For details, see Web APIs and challenging users in web APIs. Desktop applications should use broker-based authentication. Brokers use browser-based authentication, so they can enforce MFA, and also ...