Ideally use a dedicated hardware key, but if you can’t just use a 2fa app