Set up 2FA (Two Factor Authentication) for PayPal with Google Authenticator (or other TOTP client)

You’d be forgiven for thinking PayPal didn’t support 2FA, let alone TOTP, as they make it difficult to find and set up.

First, log in to PayPal normally. Then, go to https://www.paypal.com/webscr?cmd=_setup-security-key to set up a new “security key”:

Select the second option (the one which isn’t SMS), and you’ll be asked for three pieces of information:

Now’s where it gets interesting. PayPal nominally only supports some dumb proprietary system from Symantec, but it turns out it’s just TOTP with a custom provisioning algorithm, which has been reversed engineered and made into a helpful open source tool which we can use: https://github.com/dlenski/python-vipaccess.

Step 1: Online Method

I’ve made a simple page to automate the process for you, which you can find at https://jakebarn.es/paypal. Just enter what you want and it’ll give you all the information you need. Enter the Serial Number into the form on PayPal and import the key into your TOTP app, either using the link or by scanning the QR code.

Step 1: Manual Method

There’s no distro provided packages as far as I can tell (even on the AUR!), so we’ll install it manually, which isn’t very hard. First install pip, a python package manager, usually available as python-pip in your system package manager (note: on distros still using Python 2 by default (such as Ubuntu), you want python3-pip and the command pip3). Then you can install it by running sudo pip install python-vipaccess. It should take a couple minutes to download and build all the depencencies.

You can now generate your “security key” by simply running vipaccess provision -p -t VSMT. This will print out all the information needed, including the otpauth://... URL and ID. The ID looks like VSMT12345678 and is what goes in the first field back on PayPal’s form.

Next we just need to import it into our TOTP app, such as Google Authenticator. The easiest way to do this is of course with a QR code, so we need to turn that otpauth://... URL into one. There’s probably websites to do it but I used qrencode which is a command line tool. You can edit the VIP%20Access:VSMT12345678 and issuer=Symantec parts of the URL to control the label shown in the app but I didn’t bother.

Step 2: PayPal

Now all that’s left is to put two consecutive codes generated by your app into the other two fields back on PayPal’s form, click “Activate”, and you’re done! You can now select this new security key when signing in from now on and use the code generated by your app. No more insecure SMSes!