Yes, users can only use one-time tokens three consecutive times to log into the Secure Website. One-time tokens are only to be used in cases of emergencies, when immediate access to the RDS Secure Website is necessary but you are not able to use Google Authenticator. One-time tokens cannot be a primary, recurring method of accessing the RDS Secure Website. After three uses, users must use Google Authenticator to log in, at which time their one-time token use is reset back to zero.
Refer to Multi-Factor Authentication for additional information.