A sign-in form may offer to fill a code received through another channel. That convenience concerns entering the code; the service still has to decide whether the submitted value is valid for the current action.
The MDN autocomplete reference includes the one-time-code token for a field expecting a verification code. It is a semantic hint about the input’s purpose, not an authentication system by itself.
In a fictional account flow, the browser may help place a code into the correct box. The server must still check the code according to the service’s rules. A neatly filled field does not prove that the attempt succeeded.
As a user, read the service name and the action described in the message. Do not relay a code to someone who contacts you unexpectedly and asks for it. Enter it only in the legitimate process you intentionally started.
For interface testing, use the service’s approved test environment and sample codes. Check whether the field label remains understandable when autofill is unavailable and whether a rejected or expired code produces a clear next step.
Separate three observations in a bug report: the code was received, it appeared in the field, and the service accepted or rejected it. Keeping those stages distinct makes troubleshooting more useful than saying that “the code worked” when only the entry assistance had actually occurred.
Illustration selected from this site’s existing collection.