diff --git a/pkg/commands/oscommands/cmd_obj_runner.go b/pkg/commands/oscommands/cmd_obj_runner.go
index 16257158e..1dd6ab2b2 100644
--- a/pkg/commands/oscommands/cmd_obj_runner.go
+++ b/pkg/commands/oscommands/cmd_obj_runner.go
@@ -284,6 +284,7 @@ const (
 	Username
 	Passphrase
 	PIN
+	Token
 )
 
 // Whenever we're asked for a password we just enter a newline, which will
@@ -376,6 +377,7 @@ func (self *cmdObjRunner) getCheckForCredentialRequestFunc() func([]byte) (Crede
 		`Username\s*for\s*'.+':`:                 Username,
 		`Enter\s*passphrase\s*for\s*key\s*'.+':`: Passphrase,
 		`Enter\s*PIN\s*for\s*.+\s*key\s*.+:`:     PIN,
+		`.*2FA Token.*`:                          Token,
 	}
 
 	compiledPrompts := map[*regexp.Regexp]CredentialType{}
diff --git a/pkg/commands/oscommands/cmd_obj_runner_test.go b/pkg/commands/oscommands/cmd_obj_runner_test.go
index 31966cec1..c906cea3f 100644
--- a/pkg/commands/oscommands/cmd_obj_runner_test.go
+++ b/pkg/commands/oscommands/cmd_obj_runner_test.go
@@ -39,6 +39,8 @@ func TestProcessOutput(t *testing.T) {
 			return "passphrase"
 		case PIN:
 			return "pin"
+		case Token:
+			return "token"
 		default:
 			panic("unexpected credential type")
 		}
@@ -92,6 +94,12 @@ func TestProcessOutput(t *testing.T) {
 			output:                  "Enter PIN for key '123':",
 			expectedToWrite:         "pin",
 		},
+		{
+			name:                    "2FA token prompt",
+			promptUserForCredential: defaultPromptUserForCredential,
+			output:                  "testuser 2FA Token (citadel)",
+			expectedToWrite:         "token",
+		},
 		{
 			name:                    "username and password prompt",
 			promptUserForCredential: defaultPromptUserForCredential,
diff --git a/pkg/gui/controllers/helpers/credentials_helper.go b/pkg/gui/controllers/helpers/credentials_helper.go
index 20fb59052..6050c9be8 100644
--- a/pkg/gui/controllers/helpers/credentials_helper.go
+++ b/pkg/gui/controllers/helpers/credentials_helper.go
@@ -56,6 +56,8 @@ func (self *CredentialsHelper) getTitleAndMask(passOrUname oscommands.Credential
 		return self.c.Tr.CredentialsPassphrase, true
 	case oscommands.PIN:
 		return self.c.Tr.CredentialsPIN, true
+	case oscommands.Token:
+		return self.c.Tr.CredentialsToken, true
 	}
 
 	// should never land here
diff --git a/pkg/i18n/english.go b/pkg/i18n/english.go
index 273dae530..62f429cde 100644
--- a/pkg/i18n/english.go
+++ b/pkg/i18n/english.go
@@ -36,6 +36,7 @@ type TranslationSet struct {
 	CredentialsPassword                   string
 	CredentialsPassphrase                 string
 	CredentialsPIN                        string
+	CredentialsToken                      string
 	PassUnameWrong                        string
 	Commit                                string
 	CommitTooltip                         string
@@ -1004,6 +1005,7 @@ func EnglishTranslationSet() *TranslationSet {
 		CredentialsPassword:                  "Password",
 		CredentialsPassphrase:                "Enter passphrase for SSH key",
 		CredentialsPIN:                       "Enter PIN for SSH key",
+		CredentialsToken:                     "Enter Token for SSH key",
 		PassUnameWrong:                       "Password, passphrase and/or username wrong",
 		Commit:                               "Commit",
 		CommitTooltip:                        "Commit staged changes.",