diff --git a/osm_nbi/nbi.py b/osm_nbi/nbi.py
index 1b03ea5..1c8b035 100644
--- a/osm_nbi/nbi.py
+++ b/osm_nbi/nbi.py
@@ -1236,12 +1236,20 @@
             outdata = token_info = self.authenticator.new_token(
                 token_info, indata, cherrypy.request.remote
             )
+            if outdata.get("email") or outdata.get("otp") == "invalid":
+                return self._format_out(outdata, token_info)
             cherrypy.session["Authorization"] = outdata["_id"]  # pylint: disable=E1101
             self._set_location_header("admin", "v1", "tokens", outdata["_id"])
             # for logging
             self._format_login(token_info)
+            if outdata.get("otp") == "valid":
+                outdata = {
+                    "id": outdata["id"],
+                    "message": "valid_otp",
+                    "user_id": outdata["user_id"],
+                }
             # password expiry check
-            if self.authenticator.check_password_expiry(outdata):
+            elif self.authenticator.check_password_expiry(outdata):
                 outdata = {
                     "id": outdata["id"],
                     "message": "change_password",
@@ -2407,6 +2415,22 @@
         elif k == "OSMNBI_ACCOUNT_EXPIRE_DAYS":
             account_expire_days = int(v)
             engine_config["authentication"]["account_expire_days"] = account_expire_days
+        elif k == "OSMNBI_SMTP_SERVER":
+            engine_config["authentication"]["smtp_server"] = v
+            engine_config["authentication"]["all"] = environ
+        elif k == "OSMNBI_SMTP_PORT":
+            port = int(v)
+            engine_config["authentication"]["smtp_port"] = port
+        elif k == "OSMNBI_SENDER_EMAIL":
+            engine_config["authentication"]["sender_email"] = v
+        elif k == "OSMNBI_EMAIL_PASSWORD":
+            engine_config["authentication"]["sender_password"] = v
+        elif k == "OSMNBI_OTP_RETRY_COUNT":
+            otp_retry_count = int(v)
+            engine_config["authentication"]["retry_count"] = otp_retry_count
+        elif k == "OSMNBI_OTP_EXPIRY_TIME":
+            otp_expiry_time = int(v)
+            engine_config["authentication"]["otp_expiry_time"] = otp_expiry_time
         if not k.startswith("OSMNBI_"):
             continue
         k1, _, k2 = k[7:].lower().partition("_")