Either generated by a two-factor mobile app or a token card