It's 2FA, it's doesn't rely ONLY on the key for authentication and a token can be revoked easy if stolen.

The implementation and the technology has some challenges to be executed. Just like everyone tech projects, that doesn't have GooMicroZon people. Nothing special ^^