Your account: password, authenticators and the apps you use.
Each code works once and opens a one-hour session. Every use is logged.