Register your security key first, then configure TOTP as controlled recovery.
Manual token entry is a fallback. Enrollment links automatically populate the token on open.