post
https://api.valmarpayments.com/auth/sso/verify-otp
Answers the EMAIL_OTP Cognito challenge (public - the session plus emailed code are the credential). On success returns real Cognito tokens; on an incorrect code returns a new session for retry.