There are different reasons and ways a two factor authentication code can be triggered.
Sometimes it’s a new IP and the system hasn’t seen before and due to the unrecognized login, it’ll throw a soft check to your login and make sure you’re supposed to be in the account.
Another reason could be Domain Protection. This is an add on to the domain registration that adds a layer of protection. So any changes to the domain require a code for approval. This can impact changes to the routing or management of the domain registration.
Rarely (but I’ve seen it) the system will recognize a “high value” domain based on various evaluation metrics. Certain domains recognized to match certain criteria will get an automated verification protocol.
How can I add my web dev to the account.
Generally there’s just one user on the account. This is the person that must send in the ID if things need to be reset by corporate.
If you need multiple people to log into the account and don’t want any issues with the verification protocols, then you should proactively add 2SV to the account and list all relevant numbers. This way everyone who needs to access the account can have their phone included with the 2FA list.