Hardware token for Ubiquiti Account 2FA

This article describes the steps on how to enable  Two-Factor Authentication (2FA) of a Ubiquiti Account using Token2 programmable hardware tokens. It is also important to create backup codes and keep them safe in case you need to reset your 2FA. This article will demonstrate the process using NFC Burner app for iPhone - the procedures for Windows and Android apps are almost identical.

Requirements: 

• Access to your Ubiquiti account  
• A Token2 programmable token (the guide below shows C301i as an example)
• An iPhone (8 or newer), with Token2 NFC Burner app installed - this is needed for the enrollment only, subsequent logins will only require the hardware token

Enabling 2FA

• Go to https://account.ui.com and sign in
• Select Security from the left-hand menu. In this section you can change your account password and session timeout period as well as enable two-factor authentication. 
  
  
•  Enable two-factor authentication by clicking on the toggle. This will bring up a small pop-up window with a QR code and a Secret Code under it.
  (Different from many others, the guide on Ubiquiti website recommends to "Save this Secret Code somewhere safe")
  
  
  
  

• Launch the NFC burner app on your iPhone, click on 'scan QR' button and scan the QR code shown on the Ubiquiti page as described in  the previous step. The seed field will be populated with the secret code value in hex format. 
  
  
• Once the seed field has been filled, touch the "Burn seed" button, then turn the hardware token on and touch the top of the device. the process completion (or any errors) will be shown in the 'Results' area. Turn the token off and on again.
  
  
• Enter the 6-digit authentication code generated on the  into the pop-up window on the Ubiquiti page.
  
  
• Click Submit to complete the enrollment process.
  
  
  
• On your next login, after entering your username and password, the system will ask for the 6-digit OTP generated by your hardware token to complete the process
  
•