Authenticator Apps arenaBuyer checklist
Every requirement we judge authenticator apps products against, as a ready-to-send RFP checklist — with each item's priority, why it matters, and how the top-ranked products score on it today.
55 requirements · 12 themes · verdicts for 8 products · updated 2026-09-15 · priorities mirror the story weights our scoring uses (methodology)
Show the markdown export
# Authenticator Apps — buyer checklist (RFP) Derived from ProductArena's evidence-graded user-story taxonomy for Authenticator Apps: 55 judged requirements. Priorities mirror story weights (3 = must-have, 2 = should-have, 1 = nice-to-have). ## Agenticness - [ ] **[must-have]** Plug MCP servers into this product so it can use their tools - [ ] **[must-have]** Connect an agent via an official MCP server - [ ] **[must-have]** Drive the product through a documented public API - [ ] **[must-have]** Delegate tasks to a built-in AI assistant inside the product - [ ] **[should-have]** Point an agent at llms.txt or agent-oriented docs - [ ] **[should-have]** Run the product headlessly / in CI for automation - [ ] **[should-have]** Use an official CLI - [ ] **[should-have]** Issue scoped/least-privilege API credentials for an agent - [ ] **[should-have]** Build against official SDKs - [ ] **[should-have]** Subscribe to events via webhooks - [ ] **[should-have]** Get AI-generated insights and suggestions from my data inside the product - [ ] **[should-have]** Set up automations that run autonomously in the background - [ ] **[should-have]** Operate the product with natural-language commands - [ ] **[should-have]** Explore an interactive API reference with runnable examples - [ ] **[should-have]** Download a machine-readable API spec (OpenAPI or equivalent) - [ ] **[should-have]** Rely on versioned APIs with a documented deprecation policy - [ ] **[nice-to-have]** Test against a sandbox environment without touching production data ## Automation depth - [ ] **[must-have]** Define rules that trigger actions automatically on events - [ ] **[should-have]** Perform bulk operations across many items at once - [ ] **[should-have]** Schedule recurring jobs or workflows - [ ] **[nice-to-have]** Version, review, and roll back my automations ## Openness - [ ] **[must-have]** Export all of my data in open formats and leave - [ ] **[must-have]** Self-host the core product - [ ] **[should-have]** Do everything through the API that I can do in the UI - [ ] **[should-have]** Read the product's source under an open license ## Passkey support - [ ] **[must-have]** The app stores passkeys and signs me into websites and apps with them, not just TOTP codes - [ ] **[should-have]** My passkeys sync across ecosystems — iOS, Android, Windows, Linux, browsers — instead of being locked to one platform vendor ## Portability - [ ] **[must-have]** Export all my TOTP secrets in an open, readable format and leave for another app whenever I choose — no lock-in - [ ] **[should-have]** Import tokens in bulk from other authenticator apps instead of re-enrolling every account by hand - [ ] **[should-have]** Moving to a new phone transfers all my tokens in one guided step ## Privacy posture - [ ] **[must-have]** Prevent my data from being used to train AI models - [ ] **[should-have]** Choose where my data is stored (region/residency) - [ ] **[should-have]** Control data retention and deletion - [ ] **[should-have]** Opt out of telemetry and usage tracking ## Security posture - [ ] **[should-have]** The app itself locks behind biometrics or a PIN, so a borrowed phone doesn't expose my codes - [ ] **[should-have]** The vendor publishes independent security audits of the app and its sync protocol - [ ] **[should-have]** The app warns me when a service I use is breached or a stored credential is weak, reused, or exposed - [ ] **[should-have]** Push-based sign-in includes phishing defenses — number matching, location context, and admin-enforced MFA policies ## Self hosting - [ ] **[should-have]** Self-host the sync server on my own infrastructure and keep every secret inside my perimeter - [ ] **[should-have]** The client apps are open source, so the code handling my seeds can be inspected and community-reviewed ## Surfaces - [ ] **[should-have]** An agent can fetch a current TOTP code programmatically — via CLI or API — to complete a 2FA login inside an automated workflow - [ ] **[should-have]** A browser extension autofills my TOTP codes and passkeys during login instead of making me retype them - [ ] **[should-have]** A first-class desktop app gives me codes and vault access on my computer, not just on mobile - [ ] **[nice-to-have]** Expose the vault through a local programmatic endpoint an agent can query for codes and secrets without screen-scraping the app - [ ] **[nice-to-have]** Read my codes from my smartwatch without pulling out my phone ## Sync backup - [ ] **[must-have]** Backups are end-to-end encrypted with a key the vendor never holds, and the encryption design is documented - [ ] **[must-have]** Losing my phone doesn't lose my accounts — a documented recovery path restores my tokens on a new device - [ ] **[should-have]** My tokens are available on my phone, tablet, and computer at the same time, kept in sync automatically ## Team admin - [ ] **[should-have]** An agent can create and update vault entries — seeding new TOTP secrets, storing credentials — through documented programmatic surfaces - [ ] **[should-have]** My team can share TOTP-protected logins through shared vaults or collections with per-member access control - [ ] **[nice-to-have]** Enforce org-wide policies — require app lock, restrict export, mandate strong master credentials — across every member's app ## Totp core - [ ] **[must-have]** Scan a QR code and immediately start generating TOTP codes for a new account - [ ] **[should-have]** Codes generate fully offline — no network, no vendor account required just to see my TOTP codes - [ ] **[should-have]** Keep dozens of tokens organized — search, folders or groups, and service icons — so the right code is always two taps away - [ ] **[should-have]** Non-standard tokens work too — Steam Guard, HOTP counters, custom periods and digit lengths --- Source: https://ultrametric.ai/productarena/arena/authenticator-apps (evidence-graded verdicts for 8 products) · methodology: https://ultrametric.ai/productarena/methodology
Chips show the top 5 ranked products' current verdict on each requirement — ✓ full · ~ partial · ! disputed · — none · n/a not applicable.
Agenticness — how well agents can access and operate the productAgenticness· 17 items
How well agents can access and operate the product
- must-have
ai-native userPlug MCP servers into this product so it can use their tools
Core requirement — weighs 3× in arena scoring
- must-have
ai-native userConnect an agent via an official MCP server
Core requirement — weighs 3× in arena scoring · 2 of 8 products fully deliver this today
- must-have
ai-native userDrive the product through a documented public API
Core requirement — weighs 3× in arena scoring · 2 of 8 products fully deliver this today
- must-have
ai-native userDelegate tasks to a built-in AI assistant inside the product
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
- should-have
ai-native userPoint an agent at llms.txt or agent-oriented docs
Important, not disqualifying — weighs 2× in arena scoring · 4 of 8 products fully deliver this today
- should-have
ai-native userRun the product headlessly / in CI for automation
Important, not disqualifying — weighs 2× in arena scoring · 2 of 8 products fully deliver this today
- should-have
ai-native userUse an official CLI
Important, not disqualifying — weighs 2× in arena scoring · 3 of 8 products fully deliver this today
- should-have
ai-native userIssue scoped/least-privilege API credentials for an agent
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userBuild against official SDKs
Important, not disqualifying — weighs 2× in arena scoring · 1 of 8 products fully deliver this today
- should-have
ai-native userSubscribe to events via webhooks
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userGet AI-generated insights and suggestions from my data inside the product
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userSet up automations that run autonomously in the background
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userOperate the product with natural-language commands
Important, not disqualifying — weighs 2× in arena scoring · 1 of 8 products fully deliver this today
- should-have
ai-native userExplore an interactive API reference with runnable examples
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userRely on versioned APIs with a documented deprecation policy
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- nice-to-have
ai-native userTest against a sandbox environment without touching production data
Differentiator, not a dealbreaker — weighs 1× in arena scoring · no product fully delivers this yet
Automation depth — how much of the product can run unattendedAutomation depth· 4 items
How much of the product can run unattended
- must-have
ai-native userDefine rules that trigger actions automatically on events
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
- should-have
ai-native userPerform bulk operations across many items at once
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userSchedule recurring jobs or workflows
Important, not disqualifying — weighs 2× in arena scoring
- nice-to-have
ai-native userVersion, review, and roll back my automations
Differentiator, not a dealbreaker — weighs 1× in arena scoring · no product fully delivers this yet
Openness — open source, data portability, and self-hosting storiesOpenness· 4 items
Open source, data portability, and self-hosting stories
- must-have
ai-native userExport all of my data in open formats and leave
Core requirement — weighs 3× in arena scoring · 2 of 8 products fully deliver this today
- must-have
ai-native userSelf-host the core product
Core requirement — weighs 3× in arena scoring · 2 of 8 products fully deliver this today
- should-have
ai-native userDo everything through the API that I can do in the UI
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userRead the product's source under an open license
Important, not disqualifying — weighs 2× in arena scoring · 2 of 8 products fully deliver this today
Passkey support — passkeys in the vault — storage, sign-in, cross-ecosystem syncPasskey support· 2 items
Passkeys in the vault — storage, sign-in, cross-ecosystem sync
- must-have
everyday userThe app stores passkeys and signs me into websites and apps with them, not just TOTP codes
Core requirement — weighs 3× in arena scoring · 2 of 8 products fully deliver this today
- should-have
power userMy passkeys sync across ecosystems — iOS, Android, Windows, Linux, browsers — instead of being locked to one platform vendor
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Portability — your secrets stay yours — open export, bulk import, device migrationPortability· 3 items
Your secrets stay yours — open export, bulk import, device migration
- must-have
power userExport all my TOTP secrets in an open, readable format and leave for another app whenever I choose — no lock-in
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
- should-have
power userImport tokens in bulk from other authenticator apps instead of re-enrolling every account by hand
Important, not disqualifying — weighs 2× in arena scoring · 2 of 8 products fully deliver this today
- should-have
everyday userMoving to a new phone transfers all my tokens in one guided step
Important, not disqualifying — weighs 2× in arena scoring · 3 of 8 products fully deliver this today
Privacy posture — data-handling and privacy storiesPrivacy posture· 4 items
Data-handling and privacy stories
- must-have
ai-native userPrevent my data from being used to train AI models
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
- should-have
ai-native userChoose where my data is stored (region/residency)
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userControl data retention and deletion
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userOpt out of telemetry and usage tracking
Important, not disqualifying — weighs 2× in arena scoring · 1 of 8 products fully deliver this today
Security posture — how it protects itself — app lock, E2EE design, audits, breach alertingSecurity posture· 4 items
How it protects itself — app lock, E2EE design, audits, breach alerting
- should-have
everyday userThe app itself locks behind biometrics or a PIN, so a borrowed phone doesn't expose my codes
Important, not disqualifying — weighs 2× in arena scoring · 4 of 8 products fully deliver this today
- should-have
security engineerThe vendor publishes independent security audits of the app and its sync protocol
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
power userThe app warns me when a service I use is breached or a stored credential is weak, reused, or exposed
Important, not disqualifying — weighs 2× in arena scoring · 2 of 8 products fully deliver this today
- should-have
it adminPush-based sign-in includes phishing defenses — number matching, location context, and admin-enforced MFA policies
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Self hosting — running it yourself — self-hosted servers, open-source clientsSelf hosting· 2 items
Running it yourself — self-hosted servers, open-source clients
- should-have
it adminSelf-host the sync server on my own infrastructure and keep every secret inside my perimeter
Important, not disqualifying — weighs 2× in arena scoring · 1 of 8 products fully deliver this today
- should-have
security engineerThe client apps are open source, so the code handling my seeds can be inspected and community-reviewed
Important, not disqualifying — weighs 2× in arena scoring · 2 of 8 products fully deliver this today
Surfaces — where it meets your workflow — IDE, CLI, web, PR comments, CI checksSurfaces· 5 items
Where it meets your workflow — IDE, CLI, web, PR comments, CI checks
- should-have
ai-native userAn agent can fetch a current TOTP code programmatically — via CLI or API — to complete a 2FA login inside an automated workflow
Important, not disqualifying — weighs 2× in arena scoring · 1 of 8 products fully deliver this today
- should-have
everyday userA browser extension autofills my TOTP codes and passkeys during login instead of making me retype them
Important, not disqualifying — weighs 2× in arena scoring · 4 of 8 products fully deliver this today
- should-have
power userA first-class desktop app gives me codes and vault access on my computer, not just on mobile
Important, not disqualifying — weighs 2× in arena scoring · 1 of 8 products fully deliver this today
- nice-to-have
ai-native userExpose the vault through a local programmatic endpoint an agent can query for codes and secrets without screen-scraping the app
Differentiator, not a dealbreaker — weighs 1× in arena scoring · 2 of 8 products fully deliver this today
- nice-to-have
everyday userRead my codes from my smartwatch without pulling out my phone
Differentiator, not a dealbreaker — weighs 1× in arena scoring · 1 of 8 products fully deliver this today
Sync backup — not losing your accounts — encrypted backup, multi-device sync, recoverySync backup· 3 items
Not losing your accounts — encrypted backup, multi-device sync, recovery
- must-have
security engineerBackups are end-to-end encrypted with a key the vendor never holds, and the encryption design is documented
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
- must-have
everyday userLosing my phone doesn't lose my accounts — a documented recovery path restores my tokens on a new device
Core requirement — weighs 3× in arena scoring · 3 of 8 products fully deliver this today
- should-have
everyday userMy tokens are available on my phone, tablet, and computer at the same time, kept in sync automatically
Important, not disqualifying — weighs 2× in arena scoring · 2 of 8 products fully deliver this today
Team admin — shared and managed use — shared vaults, org policies, programmatic provisioningTeam admin· 3 items
Shared and managed use — shared vaults, org policies, programmatic provisioning
- should-have
ai-native userAn agent can create and update vault entries — seeding new TOTP secrets, storing credentials — through documented programmatic surfaces
Important, not disqualifying — weighs 2× in arena scoring · 2 of 8 products fully deliver this today
- should-have
it adminMy team can share TOTP-protected logins through shared vaults or collections with per-member access control
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- nice-to-have
it adminEnforce org-wide policies — require app lock, restrict export, mandate strong master credentials — across every member's app
Differentiator, not a dealbreaker — weighs 1× in arena scoring · no product fully delivers this yet
Totp core — the TOTP fundamentals — QR enrollment, organization, offline codes, non-standard tokensTotp core· 4 items
The TOTP fundamentals — QR enrollment, organization, offline codes, non-standard tokens
- must-have
everyday userScan a QR code and immediately start generating TOTP codes for a new account
Core requirement — weighs 3× in arena scoring · 3 of 8 products fully deliver this today
- should-have
power userCodes generate fully offline — no network, no vendor account required just to see my TOTP codes
Important, not disqualifying — weighs 2× in arena scoring · 3 of 8 products fully deliver this today
- should-have
power userKeep dozens of tokens organized — search, folders or groups, and service icons — so the right code is always two taps away
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
power userNon-standard tokens work too — Steam Guard, HOTP counters, custom periods and digit lengths
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Full evidence behind every verdict lives on the arena page and each product page — chips above deep-link straight to the judged story.