OTP check via API