diff --git a/openapi/otp/README.md b/openapi/otp/README.md
index 571be47e..d37b8b66 100644
--- a/openapi/otp/README.md
+++ b/openapi/otp/README.md
@@ -58,22 +58,10 @@ Deletes the code. Silent if the code does not exist.
 
 | Method | Path | Auth | Description |
 |---|---|---|---|
-| `POST` | `/otp/create` | Bearer token (team context) | Create an OTP code |
+| ~~`POST`~~ | ~~`/otp/create`~~ | ~~Bearer token~~ | **Disabled** — use `otp.Create` process instead |
 | `POST` | `/otp/login` | Public | Verify code, set session cookies |
 
-### POST /otp/create
-
-Requires a valid access token with team context. The `team_id` is forced from the caller's identity. Validates that the target user/member belongs to the same team.
-
-**Request:**
-```json
-{"member_id": "M1", "redirect": "/agents/keeper/entry/xxx"}
-```
-
-**Response:**
-```json
-{"code": "abc123def456"}
-```
+> **Note:** The `/otp/create` HTTP endpoint is intentionally disabled. Exposing it would allow any team member to generate OTP codes for other members, effectively logging in as them without credentials. OTP codes must be created server-side via the `otp.Create` process only.
 
 ### POST /otp/login
 
diff --git a/openapi/otp/handler.go b/openapi/otp/handler.go
index 9d88b603..61822b8b 100644
--- a/openapi/otp/handler.go
+++ b/openapi/otp/handler.go
@@ -33,9 +33,11 @@ type OTPLoginRequest struct {
 }
 
 // Attach registers OTP HTTP routes on the given router group.
-// The create endpoint requires authentication; login is public.
+// NOTE: /otp/create is disabled — OTP codes should only be created via
+// server-side Process (otp.Create) to prevent team members from generating
+// codes for other members and logging in as them.
 func Attach(group *gin.RouterGroup, auth types.OAuth) {
-	group.POST("/create", auth.Guard, GinOTPCreate)
+	// group.POST("/create", auth.Guard, GinOTPCreate)
 	group.POST("/login", GinOTPLogin)
 }