OTP is required only when logging in from a new or unapproved device.

Approved devices can log in again with email and password after the 8-hour session expires.