Update AuthServiceProvider

app/Providers/AuthServiceProvider.php

@@ -27,7 +27,7 @@ class AuthServiceProvider extends ServiceProvider
         $this->registerPolicies();
 
         if(config('pixelfed.oauth_enabled')) {
-            Passport::routes(null, ['middleware' => [ \Barryvdh\Cors\HandleCors::class ]]);
+            Passport::routes(null, ['middleware' => ['twofactor','validemail',\Barryvdh\Cors\HandleCors::class]]);
             Passport::tokensExpireIn(now()->addDays(15));
             Passport::refreshTokensExpireIn(now()->addDays(30));
             Passport::enableImplicitGrant();