After implementing the showSignInToGetTokens I run into the error error.description: The client specified not to prompt, but the client app requires re-authentication or MFA..
Looking at this post - Javascript Okta Sign-In Widget - MFA not properly working - Questions - Okta Developer Community - it seems as my initial assumption was correct based on the comment
Try using showSignInAndRedirect instead of showSignInToGetTokens. A self-hosted widget cannot prompt a user for app-level MFA, they must be redirected to Okta (via the /authorize URL) to get prompted accordingly.
I’m still not understanding though why if the browser is in a private mode the widget MFA is available compared to it redirecting to Okta for MFA auth when not in private mode.