diff --git a/apps/login/src/lib/server/session.ts b/apps/login/src/lib/server/session.ts
index 3e217316c1a..3220ab408d4 100644
--- a/apps/login/src/lib/server/session.ts
+++ b/apps/login/src/lib/server/session.ts
@@ -103,38 +103,6 @@ export async function updateSession(options: UpdateSessionCommand) {
 
   const recent = await sessionPromise;
 
-  // if (
-  //   (recent &&
-  //     challenges &&
-  //     challenges.otpEmail &&
-  //     !challenges.otpEmail?.deliveryType) ||
-  //   (challenges?.otpSms && !challenges.otpSms.returnCode)
-  // ) {
-  //   const sessionResponse = await getSession(recent.id, recent.token);
-
-  //   if (sessionResponse && sessionResponse?.session?.factors?.user?.id) {
-  //     const userResponse = await getUserByID(
-  //       sessionResponse.session.factors.user.id,
-  //     );
-  //     const humanUser =
-  //       userResponse.user?.type.case === "human"
-  //         ? userResponse.user.type.value
-  //         : undefined;
-
-  //     if (!challenges.otpEmail && humanUser?.email?.email) {
-  //       challenges = create(RequestChallengesSchema, {
-  //         otpEmail: { deliveryType: { case: "sendCode", value: {} } },
-  //       });
-  //     }
-
-  //     if (!challenges.otpEmail && humanUser?.email?.email) {
-  //       challenges = create(RequestChallengesSchema, {
-  //         otpSms: { returnCode: true },
-  //       });
-  //     }
-  //   }
-  // }
-
   const session = await setSessionAndUpdateCookie(
     recent,
     checks,
diff --git a/apps/login/src/ui/LoginOTP.tsx b/apps/login/src/ui/LoginOTP.tsx
index 8caf80a7db3..0abbbdee21d 100644
--- a/apps/login/src/ui/LoginOTP.tsx
+++ b/apps/login/src/ui/LoginOTP.tsx
@@ -1,7 +1,9 @@
 "use client";
 
-import { ChallengesJson } from "@zitadel/proto/zitadel/session/v2/challenge_pb";
-import { ChecksJson } from "@zitadel/proto/zitadel/session/v2/session_service_pb";
+import {
+  ChecksJson,
+  ChecksSchema,
+} from "@zitadel/proto/zitadel/session/v2/session_service_pb";
 import { useRouter } from "next/navigation";
 import { useEffect, useRef, useState } from "react";
 import { useForm } from "react-hook-form";
@@ -10,6 +12,9 @@ import BackButton from "./BackButton";
 import { Button, ButtonVariants } from "./Button";
 import { TextInput } from "./Input";
 import { Spinner } from "./Spinner";
+import { create } from "@zitadel/client";
+import { RequestChallengesSchema } from "@zitadel/proto/zitadel/session/v2/challenge_pb";
+import { updateSession } from "@/lib/server/session";
 
 // either loginName or sessionId must be provided
 type Props = {
@@ -63,36 +68,35 @@ export default function LoginOTP({
   }, []);
 
   async function updateSessionForOTPChallenge() {
-    const challenges: ChallengesJson = {};
+    let challenges;
 
     if (method === "email") {
-      challenges.otpEmail = "";
+      challenges = create(RequestChallengesSchema, {
+        otpEmail: { deliveryType: { case: "sendCode", value: {} } },
+      });
     }
 
     if (method === "sms") {
-      challenges.otpSms = "";
+      challenges = create(RequestChallengesSchema, {
+        otpSms: { returnCode: true },
+      });
     }
+
     setLoading(true);
-    const res = await fetch("/api/session", {
-      method: "PUT",
-      headers: {
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify({
-        loginName,
-        sessionId,
-        organization,
-        challenges,
-        authRequestId,
-      }),
+    const response = await updateSession({
+      loginName,
+      sessionId,
+      organization,
+      challenges,
+      authRequestId,
+    }).catch((error) => {
+      setError(error.message ?? "Could not request OTP challenge");
+      setLoading(false);
     });
 
     setLoading(false);
-    if (!res.ok) {
-      const error = await res.json();
-      throw error.details.details;
-    }
-    return res.json();
+
+    return response;
   }
 
   async function submitCode(values: Inputs, organization?: string) {
@@ -111,41 +115,38 @@ export default function LoginOTP({
       body.authRequestId = authRequestId;
     }
 
-    const checks: ChecksJson = {};
+    let checks;
+
     if (method === "sms") {
-      checks.otpSms = { code: values.code };
+      checks = create(ChecksSchema, {
+        otpSms: { code: values.code },
+      });
     }
     if (method === "email") {
-      checks.otpEmail = { code: values.code };
+      checks = create(ChecksSchema, {
+        otpEmail: { code: values.code },
+      });
     }
     if (method === "time-based") {
-      checks.totp = { code: values.code };
+      checks = create(ChecksSchema, {
+        totp: { code: values.code },
+      });
     }
 
-    const res = await fetch("/api/session", {
-      method: "PUT",
-      headers: {
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify({
-        loginName,
-        sessionId,
-        organization,
-        checks,
-        authRequestId,
-      }),
+    const response = await updateSession({
+      loginName,
+      sessionId,
+      organization,
+      checks,
+      authRequestId,
+    }).catch((error) => {
+      setError(error.message ?? "Could not verify OTP code");
+      setLoading(false);
     });
 
     setLoading(false);
-    if (!res.ok) {
-      const response = await res.json();
 
-      setError(response.details.details ?? "An internal error occurred");
-      return Promise.reject(
-        response.details.details ?? "An internal error occurred",
-      );
-    }
-    return res.json();
+    return response;
   }
 
   function setCodeAndContinue(values: Inputs, organization?: string) {
@@ -162,16 +163,13 @@ export default function LoginOTP({
 
         return router.push(`/login?` + params);
       } else {
-        const params = new URLSearchParams(
-          authRequestId
-            ? {
-                loginName: response.factors.user.loginName,
-                authRequestId,
-              }
-            : {
-                loginName: response.factors.user.loginName,
-              },
-        );
+        const params = new URLSearchParams();
+        if (response?.factors?.user?.loginName) {
+          params.append("loginName", response.factors.user.loginName);
+        }
+        if (authRequestId) {
+          params.append("authRequestId", authRequestId);
+        }
 
         if (organization) {
           params.append("organization", organization);
@@ -182,8 +180,6 @@ export default function LoginOTP({
     });
   }
 
-  const { errors } = formState;
-
   return (
     <form className="w-full">
       {["email", "sms"].includes(method) && (
diff --git a/apps/login/src/ui/PasswordForm.tsx b/apps/login/src/ui/PasswordForm.tsx
index b908525b040..4127d8fcaae 100644
--- a/apps/login/src/ui/PasswordForm.tsx
+++ b/apps/login/src/ui/PasswordForm.tsx
@@ -108,6 +108,8 @@ export default function PasswordForm({
         m !== AuthenticationMethodType.PASSKEY,
     );
 
+    console.log(availableSecondFactors, loginSettings);
+
     if (availableSecondFactors.length == 1) {
       const params = new URLSearchParams({
         loginName: submitted.factors.user.loginName,