Use case
A shared authenticator app for your team
One place for your team's 2FA codes. Everyone reads the codes they need, nobody holds the secret, and every access is recorded.
A regular authenticator app lives on one phone. It holds the secrets for your accounts, turns them into six-digit codes offline, and shows them to whoever is holding that phone. That design is deliberate, and for one person it is the right one.
A team is not one person. The moment two people need the code for the same account, an app built around a single device stops being a solution and becomes the thing everyone works around.
What a shared authenticator app is
The same job, done for more than one person. The secrets live in one vault instead of on one device, the codes are generated there, and the people who need them read the current code without ever seeing what produced it.
Everything that follows comes from that separation. The secret is the permanent credential and cannot be revoked; the code is worth thirty seconds and one use. Sharing the second is cheap. Sharing the first is forever.
Why a normal authenticator app breaks in a team
Nothing in TOTP stops two devices from producing the same code, which is exactly why teams improvise. The improvisations are where it goes wrong.
- The QR code gets passed around. Once someone scans it, they hold the secret permanently. Leaving the company does not take it back, and the account has no record that a copy was ever made.
- One phone becomes a bottleneck. The person who set the account up is now on call for it, including on holiday, and their departure turns into a recovery operation.
- Codes travel through chat. They land in Slack, in WhatsApp, in a shared note, and stay there long after they expire, next to the account name that explains what they were for.
- Nothing is recorded. When something goes wrong on the account, there is no way to answer who reached the code, or when.
Share the code, not the secret
Share Auth keeps each TOTP secret encrypted and generates the codes on its side. A member opens the vault, sees the current code for an account and copies it. The secret is not displayed, not sent to their browser and not exportable as a QR code.
Because nobody holds a copy, removing someone’s access actually removes their access. That is the one guarantee a scanned QR code can never give you.
What the team gets
- Roles. Decide who can only read codes, who can add accounts and who administers the team. A new member starts with the accounts they need, not with everything.
- An access log. Every code read is recorded with who read it and when, so an incident on an account has an answer instead of a shrug.
- One vault per team. Accounts are grouped where the people working on them already are, rather than in one personal app that everyone has to ask.
- The same accounts as before. TOTP is a standard. Anything you can set up in Google Authenticator or Microsoft Authenticator goes in here from the same QR code or setup key.
What it replaces
The screenshot in the team channel. The colleague pinged at eleven at night for six digits. The shared password manager entry where somebody pasted the secret in a note field, which is the QR code problem wearing a better coat. The spreadsheet nobody admits to.
None of those are careless. They are what is left when the tool assumes one person and the work involves four.
Getting started
Add an account the way you would add it to any authenticator: scan the QR code the service shows, or paste the setup key. Invite the people who need it, give them a role, and they read codes from that moment on.
The accounts already set up on someone’s phone keep working. Moving them here means enrolling them once more from the provider, which is also the moment to reset the ones whose secret has been passed around.
Frequently asked questions
Not the app on a phone, which is built for one person. What a team can share is the vault the codes come from: the secrets stay in one place, and each member reads the current code for the accounts they are allowed to reach.
They describe the same thing from two angles. Shared TOTP is the mechanism, one secret producing codes that several people need. A shared authenticator app is where that mechanism is run so nobody has to copy the secret onto their own device.
It is safer than the alternatives teams fall back on. A code is valid for about thirty seconds and for one use, so passing it on costs little. A secret is permanent and cannot be revoked, which is why it is the thing that stays in the vault.
You remove their access and it ends there, because they never held a secret to keep. That is the difference with a scanned QR code, where the copy stays on their phone and the only real fix is resetting 2FA on the account.
It works with the same accounts they do. TOTP is a standard, so any account that can be set up in one of those apps can be added here instead, from the same QR code or setup key.