You should probably define "OTP" somewhere on the page. Maybe just spell it out "One Time Password (OTP)" the first time you use it.