Required if two-factor authentication is enabled. A recovery code is accepted in place of the 6-digit code.