See Get a verification code and sign in with two-factor authentication https://support.apple.com/en-us/HT204974 Below is an excerpt, but read the whole document. See the bold italics below.
Whenever you sign in with your Apple ID on a new device or browser, you'll confirm your identity with your password plus a six-digit verification code. There are a few ways you can get a verification code. You can use the code displayed on your trusted device, get a text or phone call, or generate a code from your trusted device [see the additional information in the article].
A trusted device is an iPhone, iPad, or iPod Touch with iOS 9 and later or a Mac with OS X El Capitan and later that you've already signed into using two-factor authentication.
If you can’t sign in, reset your password, or receive verification codes, you can request account recovery to regain access to your account. This link takes you to:
Recover your Apple ID when you can’t reset your password https://support.apple.com/en-us/HT204921which you may need to use.
“Account recovery might take a few days or longer, depending on the specific account information you can provide to verify your identity. After you request account recovery, you'll get an email with a confirmation of your request and the date and time of when you can expect to regain access. … When the wait period is over, Apple sends you a text or automated phone call with instructions to regain access to your account.” Read the whole document carefully.
