Coinbase just updated the permissions part of their API: https://www.coinbase.com/docs/api/permissions

"OAuth2 authentication requires additional two factor authentication when debiting funds with send scope. When 2FA is required the API will respond with a 402 status code and an error. To successfully complete the request, you must send the user's 2FA token in the CB-2FA-Token header together with the current access token. Keep in mind that 2FA tokens expire fast so you need to re-try the request after user supplies their token. Two factor authentication affects only users who have 2FA enabled."