Sign in to your workspace.
Choose a time-based key. Keep this key private.
Keep access to your authenticator. Recovery requires your server operator; no email fallback or recovery codes are provided.