How to authenticate xcodes non-interactively? (without hitting 2FA prompt)

I've created an "app-specific password" for an account that has developer access to the App Center, set XCODES_USERNAME to the email address and XCODES_PASSWORD to the app-specific password, but I get either of these messages from xcodes install ...:

Two-factor authentication is enabled for this account.
Enter the 6 digit code sent to +xx xxxx xxx xxx: Invalid HTTP response (400) for https://idmsa.apple.com/appleauth/auth/verify/phone/securitycode.
Invalid HTTP response (400) for https://idmsa.apple.com/appleauth/auth/verify/phone/securitycode.

or

Apple ID: Missing username or a password. Please try again.

I also tried to create a new Apple account that didn't have 2FA on, but it turns out these days you can't create an Apple account without a phone number, and they automatically enroll and force 2FA on all new accounts, so you can never turn it off.

Is there any way to get this working non-interactively out of the box? Or do I have to go down the path of something like Plivo and a whole virtual phone number solution just so I can programmatically grab the 2FA SMS messages that Apple is sending?

Start with the authentication path used by xcodes install and the XCODES_USERNAME and XCODES_PASSWORD environment variables; inspect how Apple’s 2FA response is handled. The issue names no files or tests. Done would require a confirmed non-interactive authentication approach and a clear way to verify it.