The code printed / saved when this clinic was set up (or last generated in Settings > Security).
At least 8 characters, with a letter and a number.
Lost the recovery code too? Contact your software vendor for a server-side reset.