RFC6287 a.k.a. OCRA details how a server can generate a challenge to another client, and the client is expected to answer the challenge based on a shared private key.
I am not sure this belongs in otpauth, but the mechanism is quite similar, and the spec has been published by the OATH wg.
