App Passwords Not Usable for REST API Requests

I’ve found that this plugin prevents the use of the REST API, even with an App Password as the checks don’t account for REST API requests. I found that at the very least you need to enhance the check_otp() function to include a check for defined('REST_REQUEST') this should allow REST API requests to use the App Password.