Setup safety
otpauth URI: import it accurately
Understand what an otpauth URI contains, import its TOTP settings accurately, and confirm the account label, digits, period, and algorithm before sign-in.
An otpauth URI is a setup record
An otpauth URI is the text form of an authenticator setup QR code. It commonly includes the account label, issuer, secret, type of one-time password, and configuration such as digits, period, or algorithm. Keeping those details together avoids a manual setup that silently uses the wrong defaults.
The URI is sensitive because it contains the secret. Treat it exactly like the QR code it represents: do not paste it into an issue tracker, email thread, or shared document, and remove temporary copies after a successful import.
Import the complete record when possible
A compatible authenticator can read the URI directly or scan the QR code that contains it. This preserves settings that may be lost when only the secret is copied. The common defaults are often correct, but an account can specify a different digit count, period, or algorithm.
After import, inspect the account label and issuer so you do not confuse a work and personal account. If the service offers a one-time verification step, complete it immediately while the original setup screen is still available.
Keep setup and recovery separate
Do not rely on a saved URI as your recovery plan. The account provider's backup codes, trusted devices, and verified recovery flow are the methods designed for a lost authenticator. Store those recovery details separately from the everyday device where possible.
If a setup needs to be repeated, generate a new record from the provider after you have authenticated. This gives you a controlled reset path instead of circulating an old secret across more devices.