Your DID is your account.
If your organisation has single sign-on, this sends you to it.
The message contains a link and a six-digit code. They are the same one-time secret — using either one spends it, and both expire in ten minutes.
Paste the base64 CACAO your key minted.
Mint one with kotoba cacao --aud https://authn.kotobase.net (kotoba-lang/org-chainagnostic-cacao). It authenticates once and is then burned, so a captured CACAO cannot be replayed.
kotoba cacao --aud https://authn.kotobase.net
Enter the 6-digit code from your authenticator app.
Use one of the recovery codes you saved when you turned this on. Each one works once.