There are actually 3 categories (though the idea of 2FA is picking 2 out of 3):

• Something you know (passwords, PINs, security questions...)
• Something you have (hardware keys, TOTP, smartcards, SMS/push-notification...)
• Something you are (fingerprints, facial recognition, iris scans...)

But passkeys collapse 2 of those into one by having the passkey algorithm include (as a step of the key derivation) a passcode or some biometric data.. that's why most passkey systems require some form of verification. Though it's up to your authenticator which method is used.