The four things that go wrong most often.
Almost always device clock drift. Authenticator codes are computed from the time; a phone more than thirty seconds off will produce codes that are correct and rejected. Turn automatic time back on.
Usually blocked cookies. The application needs a first-party cookie to hold the session; if it cannot set one, sign-in appears to succeed and the next page has forgotten.
An out-of-date browser, or a private window on some browsers. Try a normal window first.
Codes are consumed on entry rather than on success, so a mistyped attempt burns one. Use the next code down.
Account help