When you turn on two-factor authentication, you’re asked to choose either text message (SMS) codes or a third-party authentication app as your primary security method.A third-party authentication app (such as Google Authenticator or LastPass) can be used to generate login codes that help us confirm it’s you when you log in from a new device for the first time.
https://www.facebook.com/help/358336074294704?helpref=faq_content