Hey David – thanks for posting!
In order for our sandbox values to work as expected, you’ll want to use 000000 as your OTP code (rather than 123456). Our sandbox values are special-cased, so they work a bit differently than normal email/ phone factors.
Happy to help with anything else that comes up!