Example api client code

github_client.ts

import * as Octokit from '@octokit/rest'

const client = new Octokit()

export default class GithubClient {
    public static async authenticate({username, password, twoFactorCode}: any) {

        client.authenticate({
            type: 'basic',
            username: username,
            password: password
        })
        const {data: {token}} = await client.authorization.create({
            scopes: ['repo'],
            headers: {
                'x-github-otp': twoFactorCode
            }
        } as Octokit.AuthorizationCreateParams)

        return token
    }
}

Currently, calling GithubClient.authenticate with a bogus twoFactorCode, e.g. '000000' for users that do not have 2FA enabled successfully returns a personal access token. Is this undocumented but expected behavior?