Magic link is lazy 2fa. Implement TOTP support, you lazy fucks.

What’s the 2nd factor? Email and what else?

Email is considered insecure as a 2nd factor. TOTP stands for Time-based One-Time Password. Usually you store a seed and that combined with the time generates a time based password. If someone intercepts it, it's only valid for a certain time frame (I think about a minute or so), after which it's invalid.