An authenticator is needed. An authenticator can be a fixed passcode, no token needed. But know that fixed passcodes are inherently insecure as the numbers do not change often enough to be regarded as two-factor, even with the strongest fixed passcode policy, it is not strong enough. Fixed passcodes are best for testing and isolating other problems, but not that good to leave in place without extra consideration on what user account has it, and where that user account is allowed to log in successfully.
