In more detail
Codes combine language and optional region (en, en-GB, es-MX), and x-default marks the fallback for visitors who match none of them. Language codes come from ISO 639-1 and region codes from ISO 3166-1, so British English is en-GB, not en-UK, and uk on its own means Ukrainian. Annotations can be <link rel="alternate"> tags in the page head, HTTP Link headers or entries in the XML Sitemap. They must be reciprocal: every version lists all versions, including itself.
Why it matters
Missing return links or invalid codes make search engines ignore the annotations, and searchers land on a version in the wrong language. Each URL in a set should also be its own canonical; pointing translations' canonicals at the English page tells search engines to drop them.
Example
The same block goes in the head of all three versions:
<link rel="alternate" hreflang="en" href="https://example.com/">
<link rel="alternate" hreflang="es" href="https://example.com/es/">
<link rel="alternate" hreflang="fr" href="https://example.com/fr/">
<link rel="alternate" hreflang="x-default" href="https://example.com/">
Common confusion
hreflang links equivalent translations; a canonical URL picks one of several identical pages. Translations are not duplicates of each other.