You also need to get the PIN that the specific user is using in addition to the access code from the token. You can use it without a PIN but that is reducing it to a single factor auth solution.