This surface places orders. Your password and a code from your authenticator are both required — after that this device stays signed in.
Lost your authenticator? Re-run app.authsetup on the server.