How to programmatically hide a window from screen capture/screen sharing on Ubuntu (X11/Wayland) for a desktop OTP app?

I've got very little useful knowledge to offer here, but I want to point out that the older X11 approaches to screen capture (i.e. before PipeWire and portals) are practically indistinguishable from similar approaches to remote desktop connections, say, x0vncserver, which (if they weren't a whole dedicated display server) were mostly screen-scraping-based – not compositor-based – and so it was mostly up to the program doing the capture to exclude rectangles. (X11 technically has window exclusion as part of XSECURITY but that's hardly ever used... You'd probably want such "private" windows to still show up in VNC, for example.)

(Personally I'd use the UI design seen on smartphone apps, where the OTP is not actually revealed to screen unless interacted with. Think of actual password managers like KeePass – all of them let you copy a stored password without actually displaying it.

Wouldn't bother with clipboard clearing, though. An OTP is supposed to become "consumed" and the 2nd use rejected by the server – hence the 'O' in 'OTP' – so there's no point in clearing it from clipboard.)

It is difficult to exclude windows from screen capture. Nothing stops a screen-sharing app to read the framebuffer directly and just ignore windows altogether. My system doesn't have xdg-desktop-portal installed at all, but screen sharing apps work just fine.

I would think about building the OTP app such that accidentally sharing the token doesn't compromise security (for example, binding the token to a specific device or transaction). Whether it is possible depends on what exactly your app does.