Re: Shared Library Accounts & Multi-Factor Authentication

Alicia,
We've had to deal with the same issue and have used an approach that relies on capturing and recording the One Time Password (OTP) secret/seed then (carefully, responsibly, treated as a password) sharing that with those who need it.

The authenticators you are using (like Authy, etc.) typically read the OTP secret via a QR code created by the service you're setting up. Rather than do that, you first need to extract the secret encoded in the QR code, either by screenshotting it and reading it later, or using another QR code reader (not your MFA app). After you have that code, you can continue setting up your initial MFA app by scanning the QR code. But for setting up subsequent apps on other devices you have to enter the OTP secret either by scanning the screenshot with your MFA app or manually entering the code. Auty for example has an option below the "Scan QR Code" button - "No QR code? enter key manually".

If you are using MFA in an automated workflow, there are tools that can generate an access code from the OTP secret, for example with Python you can use PyOTP (https://pyauth.github.io/pyotp/).

Hopefully this explanation wasn't too convoluted, please let me know if you have any questions.

Thanks,
Jason

Jason Best
Director of Biodiversity Informatics
Botanical Research Institute of Texas at the
Fort Worth Botanic Garden
1700 University Drive
Fort Worth, Texas 76107-3400

817-332-4441 ext. 230
http://www.fwbg.org


From: Code for Libraries <CODE4LIB_at_LISTS.CLIR.ORG> on behalf of Alicia Ikerd <aliciaikerd_at_DEPAUW.EDU>
Date: Wednesday, July 22, 2026 at 10:18 AM
To: CODE4LIB_at_LISTS.CLIR.ORG <CODE4LIB_at_LISTS.CLIR.ORG>
Subject: [CODE4LIB] Shared Library Accounts & Multi-Factor Authentication

Hi Code4Lib Community,

We currently use a handful of shared accounts across our library for
different systems/workflows. As time has passed we've seen an influx of
multi-factor authentication requirements across our accounts/systems. We
inquired with our IT about bypassing or disabling this, but unfortunately,
we cannot. We have successfully tied some department accounts to department
phones. However, we still have a couple of accounts that are more free
floating accounts and thus hard to tie to a specific phone. I've included
some example scenarios below. What are other libraries doing to work around
these MFA issues with shared accounts?

   - Faculty Librarian Applicants: In the past we provided a login/password
   to applicants so they could access our e-resources off campus when
   preparing an instruction presentation. Currently, it would require our team
   be available off hours on their personal phones to text a MFA code to an
   applicant.
   - Community Users: We used to have a user login/password to log a
   community patron into and out of a library computer. Now, if we tie it to a
   department phone our workers would have to run across the library to
   retrieve the MFA phone prompt from the access services phone.
      - I'm aware some public libraries use software that generates
      temporary usernames/passwords for community borrowers. We do not
have that
      software, and acquiring it anytime soon is unlikely.

We would love to hear your workflows and workarounds!

Thanks,
Alicia
--
Alicia Ikerd
Reference and Instruction Librarian
Coordinator of Library Technology
DePauw University
(765) 658-4410