wrapped mfa_token=token_given_from_last_curl_command and otp=otp in quotation markes , then it worked,