Provision a phone number, email address, or secret once for the workspace under 2FA / OTP in the dashboard. When a run hits a challenge, the automation requests the current code from the platform and enters it, the same way it fills any other field.
Secrets are provisioned once and referenced by ID. The values never appear in the automation, the samples, or the replays.