Generator/Setup guides
Every service hides the text key somewhere different, and a few issue parameters that break a default authenticator. One page each: where the key lives, what it looks like, and the recovery path before you need it.
The text key, not the QR code. Almost every 2FA setup screen shows a QR image and hides the Base32 key behind a link — “can’t scan the QR code?”, “enter this text instead”, “manual entry”. Reveal it and keep it. A key you hold can be enrolled on a second device later without touching the account; a QR code you only scanned once cannot.
The algorithm the service issues. Most use SHA-1 on a 30-second step with six digits, and most authenticators assume exactly that. A few do not — Kraken issues SHA-512, Steam uses a five-character alphabet instead of digits — and an authenticator told the wrong parameters produces codes that never work, from a key that is entirely correct. Each page below names what that service actually issues.
The standard is the same everywhere. Look on the 2FA screen for the link that reveals the text key, paste it into the generator, and compare the result against whatever authenticator you already have enrolled for that account. Matching codes confirm the key and the parameters in one step.
If they do not match, the cause is usually a device clock rather than the key — see why a code gets rejected. If you have no authenticator to compare against because the phone is gone, start with the lost-phone guide.