From your authenticator app, or one of your recovery codes.
Staff accounts only. Your tier is read from your account on every request, so a demotion takes effect immediately.