Make 2FA enabled, but optional - and how to change 2FA secret once it was applied

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Problem Description

Hi,

i tried to enable https://github.com/dexidp/dex/pull/3712 and it works very good. But i have questions / feature request for it:

• how to change the 2FA secret, once it was provided. I need to be able to change the secret, in case i lost my secret. therefore some backup codes would be good too
• how to make it optional: i want to enable 2FA globally, but not for every user. i want to make it optional per user. so the user can decide if he/she wants to have a second factor or not. now at the moment, if enabled, everybode is forced to use 2FA
• show the secret plaintext below the QR code in case we have no device to scan it.
• the config settings are not in official docs yet - maybe due to these reasons?

Proposed Solution

see problem description

Alternatives Considered

No response

Additional Information

Dex Version: v2.46.0-20260708110934-ec1a183e
Go Version: go1.26.0
Go OS/ARCH: linux amd64