I just noticed you need to actively enable the backup codes. It is not automatically done by discourse, often this is done automatically after setting up a device.
But there is the option to do so, and I would it recommend for every body who is using 2FA. A device get easily lost or stolen.
1 Like