The token is 6 uppercase alphanumeric characters and expires 5 minutes after it is issued.
A new token can only be requested 2 minutes after the previous one.
Each user can request up to 6 tokens, or sign in 6 times with them, per day. Reaching the limit rejects the request and emails the user a notice. Counters reset on the next day.