There are hardware TOTP tokens that don't allow export of the secret, that makes them something you have. For example:

https://en.wikipedia.org/wiki/Digipass