Use the code for the sign-in attempt and email address you are completing. An older message can contain a code that is no longer valid. Check that you did not switch accounts or restart the flow in another tab.
If the page reports expiration, request a new code when the control becomes available and complete that attempt. Do not keep guessing or paste the code into a support conversation. If a newly delivered code is rejected, report the request and arrival times, browser, and exact error without the code itself. Support needs those details to investigate delivery or validation, not your authentication secret.