It's not magic, it's a time-synchronized OTP.