2FA KeyringCodes, push approvals and passkeys
Services offer several kinds of second step. 2FA Keyring handles only the first:
| Method | What you do | Works with 2FA Keyring? |
|---|---|---|
| Authenticator app codes (TOTP) | Type a 6 to 8 digit code that changes every 30 seconds or so | Yes |
| Push approval | Tap "Approve" or match a number in the company's own app | No, it needs that company's app |
| Passkeys and security keys | Confirm with your fingerprint, face, PIN or a USB/NFC key | No, these are stored by your device, password manager or key |
| Text message or email codes | Type a code sent to you | No, these arrive by message |
Passkeys and security keys resist phishing better than any code. Where a service offers them, they're a good choice alongside or instead of codes.
The general pattern
- In the service's security settings, choose two-factor or two-step verification, then the authenticator app option. If you're offered the company's own app, look for an option to use a different authenticator app.
- When the QR code appears, look for a link to show the key as text, often called "can't scan it?", "setup key" or "show secret key". Copy it into 2FA Keyring's Setup key field. You can also save a picture of the QR code and choose it in the Links or QR images tab.
- Enter the code 2FA Keyring shows back into the service to confirm.
- Save the recovery codes the service offers, then make a fresh backup of your vault.
In your Google Account, go to Security, then 2-Step Verification, and add an authenticator app. Google shows a QR code and an option for when you can't scan it, which reveals the key. Google may ask you to turn on 2-Step Verification with another method first.
GitHub
In GitHub's settings, open Password and authentication and enable two-factor authentication with an authenticator app. Under the QR code there's a link to show the setup key as text. GitHub then asks you to save recovery codes. Download them before you finish.
Microsoft
For a personal Microsoft account, open the security settings and add a new way to sign in with an app. Microsoft suggests its own Authenticator app; choose the option to set up a different authenticator app to get a QR code and key that work with 2FA Keyring. Microsoft Authenticator's "approve sign-in" notifications are push approvals and can't be used here.
AWS
In the IAM console, open the user (or the root user's security credentials) and assign an MFA device of the authenticator app type. AWS shows a QR code and an option to show the secret key. AWS may ask for two consecutive codes: enter one, wait for 2FA Keyring to show the next, then enter that.
Discord
In Discord's user settings, open My Account and enable an authenticator app. Discord shows a QR code with the key next to it, then asks for a code to confirm. Save the backup codes Discord offers.