APM with OTP to identify 'trusted client'

Some of the 3rd party services do this sort of thing.

Duo for example has a "remember my browser", and typically these can be integrated cleanly using either supplied code or as radius server (although I think Duo uses an additional machine which is not elegant).

Having just been down a similar route and thinking a third party service might have been quicker, simpler and easier to maintain. Although sometimes it is desirable not to rely on third party services.