Auth0 do the same thing though. They make library abstractions such as "passwordless" and make it a separate authentication flow altogether, where as in reality it is just a matter of generating temporary passwords. There is no need to not be able to just enable and disable temporary passwords for any user.

Also, try implementing generation of API-key like tokens for users that can be expired, revoked, authorized etc.

Auth0 have made products that hide complexity, in my opinion, but if those products fit your particular need, sure it works great.