I need help with the process/commands needed to implement the below functionality:

I'm modeling an OTP System, in which the user would request an OTP and the app will send him one. Later the user will use the OTP to use some functionality or something, and the OTP needs to be validated. Constraints:

• The OTP cannot be stored in the Clear.
• Need to use Thales payShield 9000, that I have available, sending HOST COMMANDS.

This is the process:

• App A request an OTP using a User Account
• App B Generates the OTP for that User Account and send it to App A
• App B Can't store the OTP in clear, so it must use the HSM to, in some way, store the OTP that can be validated later
• App A, later, sends the OTP to App B which validates it (using the HSM) and then procedes to send the approval to App A

My apologies if this doesn't make sense, and I don't have idea what I'm doing.