I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data). My user is already authenticated in my mobile app.
Now usually multiple websites implement OTP in a manner where I enter a code that is generated on a mobile device (SMS message, authenticator app or any native app).
I would like to reverse this flow, i.e. generate an OTP on a website and allow user to input it in a mobile app, where he is already authenticated.
On a 3rd party website there might be a new, child window opened that downloads OTP directly from my server via an API.
Question: are there any disadvantages to this flow?
PS I see the following advantage: in normal flow, a fake 3rd party website would "steal" my OTP. In my flow, even if they could see the OTP, the actual matching is performed only after code input in an authenticated environment. Before user inputs the OTP, it is not even associated with the user!