[afzalive]

It needs to be end-to-end encrypted.

[OsrsNeedsf2P]

How do you do that if you only control one end?

[dgellow]

Asymmetric encryption? Both you (the human) and the agent publish public keys, the agent sign/encrypt the OTP request with you public key, you verify/decrypt using your private key, then do the same the other way to send the OTP (always encrypted though, given you’re sending a secret).

Something like that?

[nijave]

But that doesn't help for the agent receiving mail from arbitrary 3rd parties

[dgellow]

Oh sure I assumed they meant for the OTP