It appears that the OTP is sent from "the response from triggering the one-time password".

I suspect it's a framework thing; they're probably directly serializing an object that's put in the database (ORM or other storage system) to what's returned via HTTP.