There is no need to for the API Token screen if the OAuth login is available and prefered by the user, hence that step should be skipped. The user should have a preference where he can opt in for OAuth login over API tokens. mTLS will take precedence over both OAuth and API token methods.