Correct, unless you store it solely in a HSM like a Yubikey. One of the critical parts of "something you have" is that it is something only you have. If you ca

Correct, unless you store it solely in a HSM like a Yubikey. One of the critical parts of "something you have" is that it is something only you have. If you can copy it, there is no longer a guarantee that you are the sole person possessing it. This is also why Google Authenticator did not allow export for a very long time. If you want multiple TOTP tokens, you should enroll them separately, so that it is at all times possible to determine which exact token is being used to authenticate and revoke them individually if required.