I think the clean way would be to have turnstile only active/checked, when doing a regular login, but not on Oauth2 logins.
For Oauth2 it’s the job of the Oauth2 provider to do these types of checks.
I assume there is no way to have turnstile conditionally only for regular form logins and not for Oauth2?
For our usecase I could probably disable the formlogin soon