Generator/Troubleshooting
Two failures account for most lost access: a clock that drifted, and a phone that did not come back. Both are recoverable if you work in the right order.
The two look the same from the login screen — the code is refused — but the causes are opposite, and so are the fixes. If codes were working yesterday and every one is now rejected, suspect the clock. TOTP is a function of the shared key and the current time, so a device more than about thirty seconds out produces digits the service will not accept, from a key that is perfectly correct.
If instead you cannot produce a code at all, the problem is access to the key, not the arithmetic. That is a recovery-code problem, and the order you try things in matters: each wrong turn can cost you an option you still had.
You can test the first case in about ten seconds. Paste a setup key into the generator and compare it against the code your phone shows for the same account. Matching digits mean the key is fine and the clock is the suspect.
Both failures are cheap to insure against and expensive to fix afterwards. Keep the recovery codes a service issues at enrollment, offline and away from the account they protect. Keep the text setup key, not just the QR image, so a second authenticator can be enrolled without touching the account. And enroll more than one device, because one phone is a single point of failure for every account behind it.
If you are enrolling now, the setup guides name where each service hides the text key and which algorithm it issues.