WhatsApp OTP lets you send login and verification codes to customers on WhatsApp instead of (or alongside) SMS, using a special Meta template category called authentication. The message has fixed wording set by Meta, a copy-code or one-tap autofill button, and an optional expiry line, and you trigger it from your backend through an API. This guide explains how authentication templates work, how WhatsApp OTP compares with SMS OTP, and how to implement it with a sensible SMS fallback.
How WhatsApp OTP works
Every business-initiated WhatsApp message has to use a pre-approved template. For one-time passwords, Meta provides the authentication category, which is built only for verification codes. Here is what Meta's documentation says about these templates, as of November 2026:
- The body text is fixed. You don't write it yourself. It reads "<code> is your verification code."
- Optional security line: "For your security, do not share this code."
- Optional expiry line: "This code expires in <N> minutes", where you choose a value from 1 to 90 minutes.
- No URLs, media or emojis are allowed in the template.
- The code can be up to 15 characters.
Because the wording is standard, authentication templates are fast to create and simple to get approved. Meta updates these rules from time to time, so check the authentication templates documentation before you build.
Copy-code, one-tap and zero-tap buttons
Authentication templates come with one of three delivery styles:
| Button type | What the user does | Where it works | Best for |
|---|---|---|---|
| Copy code | Taps the button, code copies to clipboard, pastes it in your app or website | All devices | Websites, and the default fallback |
| One-tap autofill | Taps the button and your Android app opens with the code filled in; on iOS 26 and later, the code is offered as a keyboard suggestion | Android app (with integration), iOS 26+ | Mobile app logins |
| Zero-tap | Nothing: your app receives the code automatically | Android only | Apps that want a fully seamless login |
One-tap and zero-tap require extra setup in your Android app, including your app's package name and signing key hash, so Meta knows which app is allowed to receive the code. If the device isn't eligible, the message falls back to a copy-code button. If you only have a website, copy code is all you need.
WhatsApp OTP vs SMS OTP
Most Indian businesses don't pick one or the other. They use WhatsApp OTP as the primary channel for users who have WhatsApp, and keep SMS as the backup.
| Factor | WhatsApp OTP | SMS OTP |
|---|---|---|
| Reach | Only users with WhatsApp on that number | Any mobile number |
| India regulations | Meta's template rules | DLT registration of sender ID and templates (TRAI) |
| Branding | Shows your business name and profile | Shows a sender ID header |
| Delivery status | Sent, delivered and read via webhooks | Delivery reports from the operator |
| User experience | Copy-code or one-tap autofill button | Android SMS autofill, manual typing |
| Pricing | Per delivered authentication message, set by Meta | Per SMS, set by your provider |
| Works without internet | No | Yes |
WhatsApp OTP's big advantages are the business name shown to the user and the read status, which tells you whether the person actually opened the code. SMS still wins on reach and offline delivery. For a broader comparison, see WhatsApp vs SMS marketing.
What WhatsApp OTP costs
Since 1 July 2025, Meta charges per delivered template message, and authentication is its own pricing category. For Indian recipients, authentication rates are usually well below marketing rates, and India has volume tiers for utility and authentication messages, so the per-message rate can drop as your monthly volume grows. Meta has changed Indian rates several times since 2025 and can change them again, so check Meta's current pricing or your AiSender wallet before planning a budget. Our WhatsApp Business API pricing in India guide explains how categories and rates work.
On AiSender you pay from a prepaid wallet with no monthly fee, get GST invoices, and failed messages are refunded to your wallet.
Designing a delivery fallback
An OTP that doesn't arrive means a lost login or a lost order. Plan for failure from day one:
- Check who is likely on WhatsApp. Most Indian smartphone users are, but some numbers (landlines, feature phones, new SIMs) won't be.
- Send the WhatsApp OTP first and start a timer.
- Listen to webhooks. If you get a "failed" status, or no "delivered" status within your chosen wait time (many teams use 15 to 30 seconds), trigger SMS.
- Reuse the same code in the SMS so the user isn't confused by two different codes.
- Give the user a choice. A "Didn't get it? Send via SMS" link on the OTP screen handles edge cases.
- Rate-limit requests per number and per IP to stop OTP abuse, which can quietly run up your bill.
Implementing WhatsApp OTP: step by step
1. Connect your number
Your OTP number should be a dedicated business number on the WhatsApp Business Platform. With AiSender, you connect it in about 10 minutes using Continue with Facebook. See how to get WhatsApp Business API for what you need ready.
2. Create the authentication template
Choose the authentication category, pick the button type (copy code for websites, one-tap or zero-tap for Android apps), switch on the security recommendation, and set an expiry that matches your backend's code validity. If your code expires in 5 minutes on the server, say 5 minutes in the template.
3. Generate and store the code on your server
Generate a random numeric code (4 to 8 digits is typical), store a hash of it with the phone number and expiry time, and never log it in plain text.
4. Send the message through the API
Call AiSender's REST API (POST /api/v1/messages) with the recipient number, your authentication template name and the code as a variable. The exact request fields are in your AiSender API documentation. Under the hood, Meta's Cloud API expects the code in both the body and the button parameter, which looks like this:
{
"messaging_product": "whatsapp",
"to": "919812345678",
"type": "template",
"template": {
"name": "login_otp",
"language": { "code": "en" },
"components": [
{ "type": "body", "parameters": [ { "type": "text", "text": "482913" } ] },
{ "type": "button", "sub_type": "url", "index": "0",
"parameters": [ { "type": "text", "text": "482913" } ] }
]
}
}5. Handle status webhooks
Set up an AiSender webhook to receive message status updates. Use "delivered" to stop your fallback timer and "failed" to trigger SMS immediately. Store statuses so you can track WhatsApp delivery rates over time.
6. Verify and expire
When the user submits the code, compare it with the stored hash, check the expiry, allow only a few attempts, then delete it.
For other transactional flows, such as order and shipping updates, our WhatsApp API integration guide covers webhooks in more detail.
Security tips for OTP flows
- Never put the OTP in a marketing or utility template
- Don't let your support team ask customers to read out their OTP
- Watch for sudden spikes in OTP requests, which can signal fraud
FAQ
Can I write my own text for a WhatsApp OTP message?
No. Authentication templates use fixed wording from Meta. You can only choose the button type, whether to add the security recommendation, and the expiry time.
Does WhatsApp OTP work for website logins?
Yes. Use a copy-code button. The user taps it on their phone and pastes the code on your website. One-tap and zero-tap are for mobile apps.
Should I stop using SMS OTP?
Most businesses keep SMS as a fallback for users without WhatsApp or without internet. Use WhatsApp first and switch to SMS when delivery fails or times out.
Can I add a link or logo to the OTP message?
No. URLs, media and emojis aren't supported in authentication templates.
If you want WhatsApp OTPs with simple REST API calls, webhooks and a prepaid wallet, get started with AiSender.
Try AiSender for your business
WhatsApp Business API, team inbox and AI chatbot. No monthly fee.