Authenticator Sign In
Use the current 6-digit code from the approved Google Authenticator entry.
Recovery access should stay tightly controlled.
Authenticator sign-in requires the configured server-side secret and an active user account. Rotate the secret if a device is lost.