A combination of good, accurate clocks (remember that a $10 digital Casio drifts less than a second per day) and some functionality on the server side to detect and correct for drift. When the key window is 30 seconds, the key won't drift more than 10 keys per year, which should be easy to correct for without compromising security (and if in doubt, it's easy to "ask" for a second code - just fail the attempt, the user will try again).