F5 APM One time Password as SMS using clickatell

The expression should work, provided that session.user.otp.mobile contains the correct string to begin with. Could you verify what session.user.otp.mobile and session.logon.last.username contains after this has been evaluated?

Another thing that I have a question about is that the HTTP Auth configuration that you showed us contains a session variable that begins with session.otp.assigned, I might dare to assume that it is session.otp.assigned.val which is the variable used by the built in OTP features that was included in the Visual Policy Editor some versions after Jason Rahm and Per Boe wrote that solution that you linked to in the first post. You should either use only the solution as written by Jason/Per, or use the built in features. If you mix those two solutions you might have some weird results unless you know what to change.