When using SMS with the domain bound format (https://developer.apple.com/news/?id=z0i801mg) the autofill gets correctly suggested in Safari, but it doesn't in a WKWebView (on iOS).
You can easily try this yourself by navigating to "https://icloud.com" and logging in with "didn't receive code" -> "send message to ...". In Safari you will get the SMS and it will suggest you to insert the code from messages. In a WKWebView you get the SMS and nothing happens.
The format Apple is using is: "Your Apple ID code is: 123456 Do not share it with anyone. @icloud.com #123456 %apple.com"
If you now ask someone to send you an sms with the following content it will correctly suggest the autofill: "Your Apple ID code is: 123456 Do not share it with anyone."
Another weird difference is that with the Safari autofill it triggeres a paste in the html input, but in WKWebView it forcefully sets the value of the html input.
Why are those implementations so different? Is there any way of getting domain bound SMS otp working with WKWebView?