I assume it is valid for only a short period like the code generated from the Google Authenticator app.