Support recovery code verify token or HMAC verify token