Something about the flow of setting up 2-factor authentication is not clear to me.

This is the flow of setting up a Service* to use a 2-factor auth app**:

  1. Choose setup 2-factor auth in the account security section. This shows up with a long key.

  2. This key is copied and entered when adding a service account in a 2-factor auth app** that allows for having 2-factor auth for multiple accounts of different services.

  3. When it is added, it spits out a time-limited code that is entered back into the service app and 2-factor auth is set up.

  4. Codes like those are then used every time to do 2-factor auth.

What I don't understand is how does the service and a 2-factor auth app know/recognise each other in step 3.

*Instagram, Amazon etc.

**Duo Mobile, Microsoft Authenticator, 2FA

1 Answer 1


This is done by inference.

The code the app creates is based on the current time and the key. The key is unique to your account on that service.

When you enter a 2FA code (it doesn't matter when), the service checks that code against the key for your account and authenticates you (or, more technically, it authenticates the 2FA app, but that's a side issue).

Step 3 in your process is only a convenience. If the code works, then the service can infer that 2FA was set up properly and can continue the process to mark your account as using 2FA. If this check was not done and something went wrong in setting up your 2FA app, then you could be locked out of your account. However, if the code works once, then the service can infer that all future codes should work, too.

There is no "know/recognise each other" in this process. There is only checking the code against the key by the service.

  • So the Service knows that the code from the 2FA app is correct based on the long code the Service gives for setting up in the 2FA app in the first place, which is tied to my account. And the 2FA app and Service never communicate with each other. That's good but is there some convention somewhere on what a 2FA app needs to do with the original Service account code when being setup to then spit out codes? I am asking this because I want to build my own 2FA app if that helps you understand what I am trying to research. Thank you! Apr 20, 2021 at 12:22
  • 1
    If that has been your goal all along, then you should have mentioned that... There are well-documented algorithms and processes... tools.ietf.org/html/rfc6238 and tools.ietf.org/html/rfc4226
    – schroeder
    Apr 20, 2021 at 14:21
  • Heck, I googled "build my own 2fa app" and got tutorials and guides ...
    – schroeder
    Apr 20, 2021 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .