Ah okay. It looks like how the process works is that when you request an unlock code from Bootloader Unlocking Code for Fairphone 3 - Fairphone that gets stored in their server. After you hit the “Verify code” button, a GET request is sent to factory.fairphone.com/$IMEI/$SERIAL_NUM/$ENTERED_UNLOCK_CODE . The endpoint then checks whether $ENTERED_UNLOCK_CODE is equal to the code the server generated above. If there is no response the phone unlocks.
Interestingly enough factory.fairphone.com is not hosted along with the rest of the fairphone.com website. The IP address resolves as belonging to Quark VPN. Similarly the SSL cert is a “Let’s Encrypt” one rather than rather than the Sectigo cert used for fairphone.com. This is especially interesting as the Sectigo cert is valid for *.fairphone.com.