The Authenticator app (https://apps.gnome.org/Authenticator) is super convenient to have when signing into various GNOME web services using GNOME's SSO service. Unfortunately, it's not that straightforward to set up additional 2FA apps for GNOME SSO due to subpar UX on Keycloak's side.
Because of that, I've written a section in the GNOME Project Handbook explaining how to do it: https://handbook.gnome.org/infrastructure/accounts/managing-accounts.html#manage-two-factor-authentication.