When several employees need to access an approved shared business account, passing verification codes around by text or email is inconvenient and risky. If the website supports time-based one-time passwords (TOTP), 1Password can store the account's verification-code setup in a shared vault and display a fresh code to authorized teammates. Here's how it works—and when sharing a code is not the right choice.
Many websites offer two-factor authentication, sometimes called 2FA or multi-factor authentication (MFA). Alongside a password, the site asks for a short verification code. With TOTP, an authenticator generates a new code at regular intervals—often every 30 seconds—based on a secret established when 2FA was enabled. 1Password can act as that authenticator for compatible websites. This is different from codes sent by SMS or email, which you normally cannot import into 1Password as TOTP.
Suppose an organization maintains an approved shared account for a vendor portal and two authorized administrators need access. Rather than tying its authenticator to one employee's phone, the organization may store the login and TOTP setup in a tightly restricted 1Password vault. Each permitted person can retrieve the currently valid code when signing in.
That is convenient, but there is a security trade-off: if a person can access both the account password and its TOTP secret, the two factors are no longer independent against compromise of that vault. Use individual employee accounts, single sign-on, passkeys, or a separate authenticator when the service supports them. Do not put privileged administrative or high-risk accounts into a widely shared vault.
In your organization's 1Password account, create a vault with a clear name such as Approved Shared Vendor Access. Grant access only to the team members who genuinely need it. 1Password's team and business plans allow administrators to manage vault permissions; use the narrowest access appropriate to each role. Avoid placing unrelated credentials in the same vault simply for convenience.
Sign in to the business service and find its account security or two-factor authentication settings. Choose an authenticator app or one-time password method if available. The site should display a QR code or setup key. If the site requires each user to authenticate individually, follow that policy instead of sharing credentials.
Open the matching Login item in the shared vault and choose Edit. In the 1Password app, select Add More > One-Time Password, then scan the site's QR code or enter the setup key if offered. Save the item. In the 1Password browser extension, you may also be able to open the Login item and choose Scan QR Code. Enter the current code back on the website to finish enabling 2FA.
Once configured, 1Password generates the current verification code automatically. There's no need to manually create a new code each time. The website determines how often the code changes and whether it is accepted.
Have an authorized teammate confirm that the shared Login item displays a usable code. Store any recovery or backup codes securely with access restricted to appropriate administrators. Do not share the QR code, TOTP secret, or recovery codes in email or chat messages. Make sure the organization can still regain access if a team member leaves or a device is lost.
Review vault membership when employees change roles or leave the organization. Removing someone from a vault restricts future access, but you should not assume it invalidates credentials or TOTP secrets they may have previously copied. Rotate affected credentials and reset 2FA enrollment when access may have been exposed.
CoreSolutions helps businesses deploy 1Password, design least-privilege shared vaults, and choose the right authentication method for each service. Schedule an appointment with CoreSolutions to review your team's setup.
Technical references: 1Password: Use as an authenticator and 1Password: Manage team vaults.