oathauth-step2alt doesn't seem to be in the right place... The secret is after the account name... So this feels a bit odd. Semantics
Also, some "hint" of the sitename (to be used as a prefix ie $wgOATHAuthAccountPrefix) might be useful to list to the users
'manual' => [ 'type' => 'info', 'label-message' => 'oathauth-step2alt', 'default' => '<strong>' . $this->msg( 'oathauth-account' )->escaped() . '</strong><br/>' . htmlspecialchars( $this->oathUser->getAccount() ) . '<br/><br/>' . '<strong>' . $this->msg( 'oathauth-secret' )->escaped() . '</strong><br/>' . '<kbd>' . $this->getSecretForDisplay( $key ) . '</kbd><br/>', 'raw' => true, 'section' => 'step2', ],