ScreenConnect: Add an Authenticator App (No QR Code)

Most apps hand you a QR code the moment you turn on two-factor. ScreenConnect doesn't — and that's why setting it up stops people cold.

When you set a user's OTP method to Google Authenticator, ScreenConnect shows an "Enter OTP secret/key" box and refuses to save until it's filled in. But it never generates the key or shows a QR code for you. There's no button to look for — it isn't there.

The trick: you create the secret yourself, then put the same value in two places — ScreenConnect and your authenticator app. Here's how.

Step 1 — Generate a secret

Authenticator secrets are "Base32" — letters A–Z and the digits 2 through 7. You just need a random one. Pick your platform:

On a Mac — open Terminal and run:

python3 -c "import base64,os; print(base64.b32encode(os.urandom(20)).decode())"

On Windows — open PowerShell and paste this in as one line (copy the whole thing):

$b=New-Object byte[] 20;[Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($b);$a='ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';$bits='';$b|%{$bits+=[Convert]::ToString($_,2).PadLeft(8,'0')};-join(0..31|%{$a[[Convert]::ToInt32($bits.Substring($_*5,5),2)]})

Either one prints a 32-character string like JBSWY3DPEHPK3PXPK5AVQORS.... That's your key. Keep it private — it's the seed to your 2FA, so treat it like a password.

Step 2 — Put it in ScreenConnect

1. In the user's Edit User window, set OTP Method to Google Authenticator.
2. Paste your secret into the Enter OTP secret/key box.
3. Click Save User. The "OTP secret/key cannot be empty" error clears as soon as the box has a value.

Step 3 — Add the same key to your authenticator app

In Google Authenticator (Microsoft Authenticator, Authy, and 1Password work the same way):

1. Tap + → Enter a setup key — the manual option, not "Scan a QR code."
2. Account name: something you'll recognize, like ScreenConnect.
3. Key: paste the exact same secret from Step 1.
4. Type of key: Time based.
5. Tap Add.

The app now shows a rolling 6-digit code that matches what ScreenConnect expects.

Step 4 — Test it

Sign out of ScreenConnect and back in. It'll ask for the 6-digit code — enter the current one from your app. If it takes it, you're done.

If it rejects the code, it's one of two things:

• The secret doesn't match — it was mistyped in one of the two places. Generate a fresh one and redo both sides.
• The clock is off — TOTP codes are time-based, so a phone or computer whose clock is more than about 30 seconds out will fail. Turn on automatic date & time on both, then try again.

Don't lock yourself out

That secret is the whole key — anyone who has it can generate your codes. If it ever ends up somewhere it shouldn't (a screenshot, an email, a sticky note), generate a new one and update both sides.

For an admin account especially: make sure there's a second admin user or a recovery path before you lean on this, so a lost or wiped phone doesn't lock you out of ScreenConnect entirely.