@Override
    public List<Credential> fromRequest(final HttpServletRequest request, final MultiValueMap<String, String> requestBody) {
        if (requestBody == null || requestBody.isEmpty()) {
            LOGGER.debug("Skipping [{}] because the requestBody is null or empty", getClass().getSimpleName());
            return new ArrayList<>();
        }
        val otp = requestBody.getFirst(PARAMETER_NAME_YUBIKEY_OTP);
        LOGGER.debug("YubiKey token in the request body: [{}]", otp);
        if (StringUtils.isBlank(otp)) {
            return new ArrayList<>();
        }
        return CollectionUtils.wrap(prepareCredential(request, new YubiKeyCredential(otp)));
    }
OTP token found in the request body.
support/cas-server-support-yubikey-core-mfa/src/main/java/org/apereo/cas/adaptors/yubikey/YubiKeyRestHttpRequestCredentialFactory.java