Wikipedia explains:
Before the order can be processed by the military, the President must be positively identified using a special code issued on a plastic card, nicknamed the “biscuit”. The United States has a two-man rule in place, and while only the President can order the release of nuclear weapons, the order must be confirmed by the Secretary of Defense. Once all the codes have been verified, the military would issue attack orders to the proper units. These orders are given and then re-verified for authenticity.