Google Authenticator is a offline authenticator. It can both be time-based or event based. Time-based means it will use a Clock to detect the correct code to display.
To prevent desynchronization because the Clocks are imprecise, you simply have a correction factor, so you configure the server to accept a previous code, current code, or a later code.
If a previous code is used, you store "-1" in database. If a later code is used, you store "+1" in a database. And then you decrease or increse the number according to syncronization.
"-1" would then mean you accept the code corresponding to time -2, time -1 and time.
"+2" would then mean you accept the code corresponding to time +1, time +2, and time +3
A important thing is to store the time of the last accepted code, so codes that are equal or previous to the used code cannot be reused.
Since the authenticator is completely time-based, it will mean the same key can be used for unlimited number of servers. Please note that if servers are offline or cannot talk with each other, then a spent code from a machine can be reused at Another machine, provided it hasnt expired in time.
You can also use a Event-based setting, with a counter that Counts up for each display of the code, and then you simply accept all codes that are up to lets say 50 events in future, and then store the Count of the last used code so codes cannot be reused, but then you need one unique key for each machine.
The KeyURI format is to initalize the Google Authenticator, normally you embed the KeyURI in a QR code displayed on screen on account setup, and then you scan it with Google Authenticator to add the seed to Google Authenticator. You simply type a friendly name as "label", for example:
"Server at 192.168.10.3"
And then when you look in Google authenticator, you might see:
542208 (pie of decreasing time)
Server at 192.168.10.3
389578 (pie of decreasing time)
Server at 192.168.10.4
and so on.
Then you know which code you should type in.
