There are hardware TOTP tokens that don't allow export of the secret, that makes them something you have. For example: https://en.wikipedia.org/wiki/Digipass h

There are hardware TOTP tokens that don't allow export of the secret, that makes them something you have. For example: https://en.wikipedia.org/wiki/Digipass https://en.wikipedia.org/wiki/Digipass