I have a question about these tokens - what happens if they break? Are you effectively locked out? Is it possible to have two identical tokens so that if one breaks you can use the other?
You can often times have multiple different keys registered to a single account. I have a yubikey nano stashed away as my backup key if the one on my keychain breaks or is lost.
Thanks. I have quite a few services that only let me register one key. I always worry that if I lose my phone (or break it) I am going to be locked out.
Are you sure? I think you might be confusing OTP codes (what you get from an authenticator app on a phone) with U2F (a device like this that communicates via USB or NFC). Most services I know of only support one OTP seed (you can use it with multiple devices, though - just scan the QR code with all of them, the entire secrets are encoded in it. Of course, this makes it very cumbersome to add or remove a device, as you have to re-enrol all of them). But only allowing one U2F token is a bad idea, as losing (or breaking, depending on construction) it is very easy.
A good idea is to store backup codes some place safe. You can use them as one time 2nd factors. Then you can then either disable 2FA, or more preferably, register a different 2FA option.