6-digit code from Google / Microsoft Authenticator

Protected by JWT + TOTP two-factor authentication