The decision is technically solely up to the President. Of course, he does not personally perform the launch; there are other people in the chain of command following his orders.
The International Commission on Nuclear Non-proliferation and Disarmament (ICNND) studied the process in depth. (They were searching for possible cyber-attack vulnerabilities.)
The most portable way the president has to command nuclear strikes is the "nuclear football".
is a specially outfitted briefcase which can be used by the President to authorize a
nuclear strike when away from fixed command centres. The President is
accompanied by an aide carrying the nuclear football at all times...
The attack options provided in the football include single ICBM launches and large scale predetermined scenarios as part of the Single Integrated Operational Plan. Before
initiating a launch the President must be positively identified using a special code on a
plastic card, sometimes referred to as ‘the gold codes’ or ‘the biscuit’. The order must
also be approved by a second member of the government as per the two-man rule
This two-man rule is officially described in Air Force Instruction 91-104. Basically, two people have to validate any nuclear order. Again, from the ICNND,
The US uses the two-man rule to achieve a higher level of security in nuclear affairs.
Under this rule two authorized personnel must be present and in agreement during
critical stages of nuclear command and control. The President must jointly issue a
launch order with the Secretary of Defense; Minuteman missile operators must agree
that the launch order is valid; and on a submarine, both the commanding officer and
executive officer must agree that the order to launch is valid.
However, the two-man rule from AFI 91-104 is only meant to confirm the command is valid; it's not meant to decide whether or not a command should be issued. Ultimately, that decision rests solely upon the President of the United States (or his successor). The Secretary of Defense (or his successor) simply affirms that the command was indeed issued, and done so by the appropriate person.
For succession purposes, the codes are actually distributed to at least the President and Vice President, though the VP's commands would only be listened to if the President were unreachable.
Why Clinton's Losing the Nuclear Biscuit Was Really, Really Bad
A nuclear launch order can only be commanded by the President, or his successor in case of death or removal from office.
In effect, without Clinton's "biscuit," as the personal identifier is called, the President would not have been able to initiate a launch order or confirm a launch order executed by someone else...
So what happens if the President doesn't have his identifier?
The commander in chief of NORAD resorts to the next person the NCA list, the Vice President.
This shouldn't be very surprising; the military has always worked with a chain of command, with a single person ultimately responsible at each level. There's no democracy, no voting.
Naturally, it possible someone could question the order, but the further from the President, the less information they would have.
It might seem like an insane process, but remember that in a real nuclear event, every second would count as the US and its enemy try to remove as much of each other's nuclear capacity as possible.
So, terrifying...but that's nukes.
EDIT 1: To use an analogy from the comments to explain the role of the SecDef:
it's like a judge performing a marriage. They don't decide who marries whom when; they simply confirm that the decision is indeed being made by the appropriate parties
The Security of Defense (technically) doesn't second guess the wisdom of the decision. And even if he did, it would be potentially useless check as the President appoints and dismisses the Secretary of Defense (and changes the order of succession at will).
This answer describes the official process. As with any protocol that involves a human, it's conceivable that it could be broken, but that speculative and currently without precedent. I believe the question assumes adherence to policy, otherwise the answer is false from outset.
EDIT 2: A recent (Dec 2018) opinion article from The Washington Post agrees with this assessment.
The secretary of defense has no legal position in the nuclear chain of command, and any attempts by a secretary of defense to prevent the president from exercising the authority to use nuclear weapons would be undemocratic and illegal. With or without Mattis, the president has unchecked and complete authority to launch nuclear weapons based on his sole discretion.
EDIT 3: Expert Franklin Miller has said the same: that the President has essentially unilateral power to launch nukes.
The only authoritative way to change that is to change his status as President: removal by Congress, or the VP and a majority of the Cabinet declaring him disabled/unfit (25th Amendment).