Proof of possession
You can choose to require proof that the user possesses the credential by passing up to two security codes in the
addCredential
request. You can obtain these security codes from the user directly.For SMS, Voice, Email, and System-generated credentials, the response to the register request includes a security code that you can use for proof of possession. You can also send security codes directly to a user through an SMS text message, voice call, or email message.