The code check needs to have some time value associated with it. I taped the link via app, which loaded it in an in-app browser. After getting by the code challenge, I have to back out from the in-app browser to receive the message. Upon returning, the site sends a new code invalidating the old one, which prevents me from logging in. Codes should be valid for X minutes, such that users can fumble around their apps.