---
title: "Ask everyone to keep two ways in · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-authenticators
updated: 2026-10-20
licence: "All rights reserved"
---

# Ask everyone to keep two ways in

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery)
- Rule: Prompt each person with one second factor to add another, such as a second passkey or a security key.
- How: NIST SP 800-63B-4 section 4.1.2.1 asks services to encourage at least two separate means of authentication. Offer a backup right after the first setup. Keep a reminder in settings while only one exists. A synced passkey survives a lost phone, and its backup state flag shows it. A device-bound key does not, so it needs a partner even more.
- Check: Sign in as a test user with one factor. Settings shows the reminder. Add a second factor, and the reminder goes away.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-authenticators`.

- Previous: [Give recovery codes with the first second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-codes)
- Next: [Plan for losing every factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-without-factors)
- [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery)