Authenticator codes and recovery codes both work here. Recovery codes are single-use.