I'm trying to implement 2FA on my site, and cannot figure out how to generate and then securely store recovery tokens.
From what I've seen, if for whatever reason you cannot MFA (lost your device maybe) you can use a recovery token as your second factor. I am concerned about storing them securely. On sites like Github you can go and view your recovery tokens at any time, which means they are not hashed and stored. This does not seem very secure. And my google-fu seems to have abandoned me when searching for guidelines and best practices on this.
PS - I'm looking for guidelines on how to implement generation and storage of recovery tokens as a service.