Use otp param at auth stage only.