The Flow of Password, MFA, and Session

Authentication confirms that a user is who they claim to be. After the password is checked against its hash, MFA adds a further check, making unauthorized login harder even if the password alone leaks. On success, the server issues a session ID, and later requests are verified using that session ID.