Hi there @benjamin_mumma!
This is admittedly a bit of a tricky topic - I believe the following posts may prove helpful:
Basically, obtaining an MFA API token cannot be fully decoupled from the login flow.
Hope this helps to clarify!