Hi @vikas.dagar
You can use either Auth Code, or Auth Code + PKCE
Neither one uses OTP verification. They do use a “code” to exchange for the tokens, but this code is handled entirely by the protocol, it is invisible to the user.
I still recommend switching to OIDC or SAML.
John