The OTP input looks like a row of slots, but underneath it is one native <input>. SMS autofill (autocomplete="one-time-code"), paste, password managers, forms and screen readers all see an ordinary text field.
Pasted codes are cleaned up, so “123-456” and “123 456” both work, and characters the pattern doesn’t allow are refused. On Android, webOtp fills the code from the SMS as it arrives.
Verification
(completed) fires when the last slot fills. Set aria-invalid on the input to reject a code: the slots turn red and shake.
Try 123456, or anything else.
Letters, groups and masking
pattern="alphanumeric" takes letters too, [groups] adds separators, and masked draws dots.