[lye]

Either a couple of FIDO keys, if your website supports them, or one of these:

https://www.token2.com/shop/category/classic-tokens

https://www.token2.com/shop/category/c301-tokens

https://www.token2.com/shop/category/multi-profile-programma...

Other vendors probably have something like that, I link to what I've personally used.

[weinzierl]

How do these hardware devices pair. They probably can't read the QR code provided? They also seem to have just one button, so I need one device per account?

EDIT: I see the last link has a multi account device and some devices have USB. How does it work, when it says "factory programmed"? I've never seen that I can sync an app to an existing token.

[drhuseynov]

Factory-programmed ones are for systems supporting secret key import, i.e. Microsoft Entra ID . It is not for replacing your Authenticator apps (although based on the same algorithm, TOTP).