A setup key in Google Authenticator is an alphanumeric secret key that a service provides during two-factor authentication (2FA) setup. It is the underlying data that a QR code represents, and it allows you to manually link your account to the app when you cannot scan the code.
What is a setup key in Google Authenticator?
A setup key, also called a secret key, manual entry code, or pairing key, is a string of letters and numbers generated by an online service when you enable two-factor authentication. The QR code you usually scan simply encodes this same key. By entering the setup key manually, you establish the same secure connection between your device and your account that scanning the QR code would create. The key itself remains constant and does not change, even though the six-digit verification codes it generates refresh approximately every 30 seconds.
When you need the setup key instead of the QR code
You need the setup key when scanning a QR code is not possible or practical. The primary use cases include:
- Your phone’s camera is broken or unavailable.
- You are setting up Google Authenticator on the same phone where you are viewing the setup page (so you cannot scan a code on the same screen).
- You want to configure the same 2FA account on multiple devices at once, since the same setup key works on each device.
How to use the setup key for manual entry
To manually add an account using the setup key, follow these steps:
- Open the Google Authenticator app on your mobile device.
- Tap the "+" icon to add a new account.
- Choose "Enter a setup key" (or "Enter a provided key").
- Type the account name (for example, your email address) exactly as you want it to appear in the app.
- Enter the setup key exactly as it is shown by the service, including any letters and numbers. A single mistake will prevent the codes from working.
- Ensure "Time based" is selected (this is the standard TOTP option).
- Tap "Add" or "Save" to complete the setup. The app will immediately begin generating six-digit codes that refresh every 30 seconds.
Where to find your setup key (it's not in the app)
The setup key is not stored inside Google Authenticator after you add an account. Instead, the service you are securing, such as Google, Facebook, or any other platform that supports TOTP, displays the key during the initial 2FA setup process. You will typically find it within the account's security or two-factor authentication settings, often printed directly below the QR code. If you need to integrate Google authenticator with a new service, look for the setup key on that service’s 2FA configuration page before you finalize the setup.
Using the setup key for account recovery
The setup key serves as your primary method for recovering 2FA access if you lose your phone or switch to a new device. This restores all your accounts and allows you to generate valid codes again. To recover your secret key, you must have recorded it at the time you first set up each account, since the service will not display it again after the initial configuration is complete.
Keeping your setup key secure
Treat your setup key like a master password for your 2FA. Anyone who obtains it can generate valid codes for that account. Store it safely offline, for example, written on paper or engraved on a metal plate kept in a secure location. Avoid storing it in unencrypted digital files or sharing it with anyone. Additionally, for the codes generated by the app to be accurate, your device’s time must be synchronized correctly. If the codes stop working, check that your phone’s date and time are set to automatic network time. Google Authenticator works offline once configured and requires Android 6.0 or above, or iOS 4.0 or above, to use features like syncing codes to a Google Account across multiple devices.
