See Get a verification code and sign in with two-factor authentication https://support.apple.com/en-us/HT204974 Below is an excerpt, but read the whole document. See the bold italics below.
“Whenever you sign in with your Apple ID on a new device or browser, you'll confirm your identity with your password plus a six-digit verification code. There are a few ways you can get a verification code. You can use the code displayed on your trusted device, get a text or phone call, or generate a code from your trusted device [see the additional information in the article].” A trusted device is an iPhone, iPad, or iPod Touch with iOS 9 and later or a Mac with OS X El Capitan and later that you've already signed into using two-factor authentication.
Account Recovery—Two-Factor Authentication (i.e., Recover your Apple ID when you can’t reset your password https://support.apple.com/en-us/HT204921
“If you can’t sign in, reset your password, or receive verification codes, you can request account recovery to regain access to your account. Account recovery might take a few days or longer, depending on the specific account information you can provide to verify your identity. “After you request account recovery, you'll get an email with a confirmation of your request and the date and time of when you can expect to regain access.” … When the wait period is over, Apple sends you a text or automated phone call with instructions to regain access to your account. Follow the instructions to immediately regain access to your Apple ID.”
