From your authenticator app. Leave it empty on your very first sign-in, before two-factor is set up.