Yes, RFC 6238 requires this too. Quoting from https://tools.ietf.org/html/rfc6238#section-5.2 https://tools.ietf.org/html/rfc6238#section-5.2: > Note that a pr

Yes, RFC 6238 requires this too. Quoting from https://tools.ietf.org/html/rfc6238#section-5.2 https://tools.ietf.org/html/rfc6238#section-5.2: > Note that a prover may send the same OTP inside a given time-step window multiple times to a verifier. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.