Hi @assafw4, thanks for getting in touch.
There’s a setting to require 2FA for XML-RPC Authentication in Wordfence > Login Security > Settings but in terms of actually logging in, our 2FA is currently only compatible with the default WordPress and WooCommerce login pages rather than custom built pages.
A possible workaround if the REST API calls will be occurring from a consistent IP, is using Wordfence > Login Security > Settings > Allowlisted IP addresses that bypass 2FA and reCAPTCHA. If you plan on having wp-login.php or other methods still available, they would allow logging in with a 2FA code if the IP ever changes.
I’m not certain that WordPress Application Passwords would be appropriate for your use-case but that might be an option too as they won’t require 2FA.
Thanks,
Peter.