Correction, this works if you are logged into the client portal - browser plays no role. I am able to reproduce, thank you 🙂
It seems this file was edited to point to ajax.php to decode the OTP using the secret. We need to move this to point to a publicly accessible ajax endpoint instead.
I think here is when it was changed: itflow-org/itflow3bd8842
