The Custom URL scheme currently supports RFC2289 based challenges and responses.
The custom URL scheme is only available in OTP Pro, an In-App purchase.
The [One Time Password authentication system] uses a secret pass-phrase to generate a sequence of one-time (single use) passwords. With this system the user's secret pass-phrase never need to cross the network at any time such as during authentication or during pass-phrase change. Thus, it is not vulnerable to replay attacks. Added security is provided by the property that no secret information need be stored on any system, including the server being protected.