Yes you have to generate a unique code and give it they by private.
i dont tasted but would be posible this code has experitation date on on DB and when user wants to login, first validate the exp. date , if expiration date its tru would show a modal screen whit instructions.
in ma case i have a modal to verify if code entered is the same saved in Users DB Field Called PIN, if not the same links to Error Screen whit an Error Message anda Back to Login Screen, if the Pin Enterd its the same user can login good as long as username and Password are correct. its like a double validation.
Hope Help this regards.