WhatsApp OTP: What It Is, How It Works, and How to Use It Securely

What Is WhatsApp OTP?

A WhatsApp OTP (One-Time Password) is a secure verification code sent to a user via WhatsApp instead of a traditional SMS text message. It is widely used for app logins, account registrations, and financial transactions because it offers end-to-end encryption, faster global delivery, and lower operational costs than SMS.

Because the code is unique and valid for only one session or transaction, it prevents attackers from reusing intercepted credentials and reduces the risks associated with static passwords such as interception, reuse, and phishing. Unlike SMS, WhatsApp OTP messages are delivered over internet based infrastructure through the WhatsApp Business Platform, allowing users to receive a verification code in WhatsApp just like any other chat.

This significantly improves account security, as Microsoft data shows that more than 99.9% of compromised accounts did not use multi factor authentication, meaning OTP would have prevented most of those breaches.

How WhatsApp OTP works:

• Trigger: A user requests a login or sign-up on your website or mobile app.
• Generation: Your backend server generates a random numeric code (typically 4 to 6 digits) with a short expiration time of 5 to 10 minutes.
• Dispatch: The code is sent automatically using an approved pre-defined authentication template via the WhatsApp Business Platform.
• Verification: The user copies or auto-fills the code back into your application, which your server validates

This is part of a series of articles about OTP.

How WhatsApp OTP Works

WhatsApp OTP authentication typically follows four stages: a verification event triggers the request, the business generates a temporary code, the code is dispatched through an approved WhatsApp authentication template, and the business verifies the code when the user submits it. WhatsApp acts as the delivery channel, while the business remains responsible for the authentication logic behind the OTP.

Trigger

The process begins when an event requires the user’s identity or phone number to be verified. Common triggers include:

• Creating a new account
• Logging in
• Resetting a password
• Confirming a transaction
• Changing sensitive account information
• Responding to a higher-risk login or action

When the user chooses WhatsApp as the verification channel, the application sends a request to its authentication backend to begin the OTP process.

Meta requires businesses that send one-time passwords or verification codes through WhatsApp to use an authentication template rather than a standard free-form message.

Generation

After the authentication request is triggered, the business’s backend generates the OTP. The code should be unique to the authentication attempt and valid only for a limited period.

The business, rather than WhatsApp, is responsible for generating and validating the OTP. Meta’s authentication templates provide the structure used to deliver the verification code and can display an optional expiration notice. Meta allows the displayed expiration period in an authentication template to be configured from 1 to 90 minutes.

In practice, the backend should associate the generated OTP with the relevant user or verification session and enforce controls such as expiration, retry limits, and single use.

Dispatch

The business then sends the OTP through the WhatsApp Cloud API using an approved authentication template. Meta’s Messages API uses the /{Phone-Number-ID}/messages endpoint to send messages to a WhatsApp user and requires an access token for authentication.

Depending on the authentication template selected, the recipient can receive the code through different user experiences:

• Copy code: The user taps a button to copy the OTP and pastes it into the application.
• One-tap autofill: On supported Android implementations, tapping the button opens the business’s app and passes the OTP to it.
• Zero-tap: Supported Android integrations can receive the authentication code without requiring the user to tap an OTP button.
• iOS keyboard suggestions: On iOS 26 and later, supported authentication messages can provide native OTP autofill through keyboard suggestions.

WhatsApp can also report what happened to the message after dispatch. Meta’s status webhooks distinguish between states including sent, delivered, read, and failed, giving businesses visibility into whether the OTP actually reached the user’s device.

Verification

Once the user copies, enters, or autofills the OTP, the code is submitted to the business’s backend for validation.

The authentication system should check whether:

• The submitted code matches the generated OTP
• The code belongs to the correct user or authentication session
• The OTP is still within its validity period
• The code has not already been used
• The maximum number of verification attempts has not been exceeded

If those checks succeed, the application completes the requested authentication action. If the code is incorrect, expired, or already used, access should be rejected and the user may be given the option to request a new OTP.

It is important to distinguish WhatsApp message delivery from OTP verification. WhatsApp delivers the authentication message and can report delivery status, but the business’s own authentication system ultimately determines whether the code is valid and whether the user should be granted access. Meta describes the Cloud API’s core functionality as sending messages and receiving webhooks, while authentication templates provide the WhatsApp-specific OTP delivery experience.

Types of WhatsApp Authentication Templates

Copy Code Templates

Copy code templates display the OTP inside the WhatsApp message together with a button that copies the code to the user’s clipboard. The user then returns to the app or website and pastes the code into the verification field. This reduces typing errors and makes the process faster than entering the code manually.

This template type is the simplest WhatsApp authentication option because it does not require deep integration with a mobile app. It can be used for web logins, account registration, password recovery, or transaction confirmation. The user still has to switch between WhatsApp and the service requesting verification, so it involves more steps than autofill-based methods.

Copy code templates are also useful as a fallback when automatic authentication is not supported on a device or operating system. They provide a consistent verification method while still benefiting from WhatsApp delivery status and message routing.

One-Tap Autofill Templates

One-tap autofill templates add a button that can send the OTP directly from WhatsApp to a business’s Android app. Instead of copying the code and pasting it manually, the user taps the button and the app receives the OTP. This reduces friction and lowers the chance of errors during authentication.

The feature requires additional Android configuration. The business must associate the authentication template with its app and provide information such as the package name and app signing details. WhatsApp uses these details to ensure that the OTP is passed only to the intended application.

If one-tap autofill cannot be used on a particular device, the authentication message can fall back to a copy code flow. This makes it possible to provide a faster experience where supported without leaving other users unable to complete verification.

Zero-Tap Templates and iOS Keyboard Suggestions

Zero-tap templates reduce user interaction further by allowing a configured Android app to receive the OTP automatically from WhatsApp. The user does not need to copy the code or tap an autofill button. Once the authentication message arrives, the app can retrieve the code through the supported mechanism and use it to continue the verification process.

Because zero-tap authentication automatically transfers sensitive information between WhatsApp and the receiving app, it requires specific Android integration and app verification. Businesses should also keep server-side controls such as short expiration periods, limited retry attempts, and single-use OTP validation in place.

iOS does not use the same zero-tap mechanism. Instead, the operating system can recognize verification codes in incoming messages and display the OTP as a keyboard suggestion above the input field. The user taps the suggestion to enter the code without manually switching between apps or typing it.

The result is a similar reduction in friction, but the interaction model is different. Android can support direct app-level OTP transfer, while iOS generally keeps the user involved by requiring a tap before the code is inserted.

WhatsApp OTP vs. Other OTP Methods

Each OTP channel offers distinct advantages and trade-offs.

WhatsApp OTP vs. SMS OTP

SMS OTP may fail due to carrier delays, filtering, or roaming issues, whereas WhatsApp bypasses many telecom limitations.

For a full breakdown of how SMS-based verification works, see our guide to SMS OTP delivery and use cases.

WhatsApp OTP vs. Email OTP

Email OTPs are slower and easier to miss.

WhatsApp OTP vs. Authenticator Apps

Authenticator apps offer maximum security but introduce friction.

Benefits of Using WhatsApp OTP

As authentication becomes more critical to both security and user experience, WhatsApp OTP provides a scalable option that supports higher completion rates and smoother verification flows across global audiences.

• Higher delivery reliability: Messages are delivered over internet infrastructure instead of traditional carrier routes, reducing issues such as SMS filtering, routing failures, and telecom congestion, especially for international users
• Faster user experience: OTP messages are typically delivered within seconds, enabling near real time authentication and reducing login friction and abandonment during registration or checkout
• Better visibility: Delivery confirmations and read receipts provide clear insight into whether messages were delivered and viewed, helping teams monitor performance and troubleshoot issues
• Improved user trust: Branded messages, verified business profiles, and conversation history increase legitimacy, reduce confusion, and improve verification completion rates
• Potential cost savings: Lower reliance on international SMS delivery can reduce authentication costs, particularly for high volume and globally distributed user bases

Challenges of Using WhatsApp OTP

WhatsApp OTP does introduce operational and technical considerations that organizations must plan for carefully. Delivery depends on internet connectivity and an active WhatsApp account, which can create gaps if fallback channels are not in place. In addition, template approval requirements and user expectations around instant delivery mean that delays or failures can quickly surface as support issues.

• • Requires Internet Access – Users must have an active internet connection to receive WhatsApp OTP messages. Connectivity gaps, roaming restrictions, or poor signal quality can delay delivery. This makes fallback mechanisms essential for uninterrupted authentication.

• WhatsApp Account Dependency – The recipient’s number must be linked to an active WhatsApp account. If the number is not registered, OTP delivery will fail entirely. Businesses must detect this scenario and reroute verification through SMS, voice, or email.

• Template Approval Needed – WhatsApp requires OTP messages to use pre-approved templates. While this protects users from spam, it introduces operational planning requirements. Businesses must design, submit, and manage templates before launching campaigns.

User Expectations – Users expect WhatsApp messages to arrive instantly. Even minor delays can trigger concerns like “WhatsApp OTP not coming” or “WhatsApp OTP not received.” Without proactive communication and fallback flows, this can increase support tickets and user frustration.

How Much Does WhatsApp OTP Cost?

WhatsApp OTP pricing follows the WhatsApp Business Platform’s authentication message rates. Since July 1, 2025, Meta has used per-message pricing for template messages: a business is charged when an authentication template is successfully delivered, rather than paying a fixed fee for opening a conversation.

There is no single global price for a WhatsApp OTP. The amount Meta charges depends primarily on the country or pricing region associated with the recipient’s WhatsApp phone number and the applicable authentication rate for that market. Meta publishes separate rate cards and periodically updates both rates and regional classifications.

Authentication pricing can also become more economical at scale. Meta supports volume-based pricing tiers for authentication and utility messages, meaning qualifying businesses can move into lower rate tiers as their monthly message volume increases in a particular market and category. Meta tracks these tiers at the WhatsApp Business Account level and applies the relevant tier for the billing period.

WhatsApp OTP Not Received: Common Reasons

If a WhatsApp OTP is not received, the problem can occur at several points in the delivery process. Meta distinguishes between a message being sent, delivered, read, or failed, so businesses should use WhatsApp message-status webhooks to determine where the verification message stopped rather than assuming every missing OTP has the same cause.

The User Is Offline

A WhatsApp message can be accepted for sending without immediately reaching the recipient’s device. Meta states that messages may remain undelivered when a WhatsApp user does not come online during the period in which WhatsApp holds messages for offline users.

For OTP flows, this is particularly important because verification codes usually have short expiration periods. A code that arrives after it has expired is effectively unusable even if message delivery eventually succeeds.

What to do: Allow users to request a new code and provide an alternative authentication channel, such as SMS, when WhatsApp delivery does not complete within the expected verification window.

The User Is Checking a Linked Device

Authentication messages have additional protections that ordinary WhatsApp messages do not. Meta’s linked device security means authentication codes are delivered in usable form only to the user’s primary WhatsApp device. On linked devices, such as WhatsApp Web or another linked device, the authentication message can instead be masked and instruct the user to view it on the primary device.

As a result, a user may believe the WhatsApp OTP has not arrived when they are checking a linked device rather than the phone designated as their primary WhatsApp device.

What to do: Tell the user to check WhatsApp on their primary phone before requesting another OTP.

The Phone Number Is Incorrect

Authentication templates are sent to a specific WhatsApp user phone number. Meta recommends confirming the user’s WhatsApp phone number before sending a one-time password or verification code.

Formatting mistakes, incorrect country codes, outdated numbers, or simple typing errors can therefore cause the OTP to be directed incorrectly or prevent successful delivery.

What to do: Display the destination number, at least partially masked, before sending the OTP and allow the user to correct it.

How to Set Up WhatsApp OTP

Setting up WhatsApp OTP requires connecting your application to the WhatsApp Business Platform, creating an approved authentication template, and integrating OTP generation and validation into your backend.

1. Set Up the WhatsApp Business Platform

Start by creating or connecting a WhatsApp Business Account (WABA) through Meta’s developer dashboard. Your app must be connected to a WhatsApp Business Account before it can use the Cloud API to send verification messages. Meta’s setup flow also provides the WhatsApp Business Account ID and phone number ID needed for API requests.

You will also need an access token to authenticate API requests. Meta allows temporary tokens during initial testing, while production integrations should use the appropriate long-lived credentials and permissions for the application.

2. Add and Register a Business Phone Number

Connect the phone number that will send your WhatsApp OTP messages. Meta’s registration process includes adding the number to the WhatsApp Business Account, receiving a verification code, verifying the number, and registering it for API use.

This is the business sending number; it is separate from the recipient phone number that users provide during authentication.

3. Create an Authentication Template

WhatsApp requires businesses sending OTPs or verification codes to use an authentication template. Authentication templates have standardized content and can include:

• The verification code
• An optional security disclaimer
• An optional expiration warning
• A copy-code button
• A one-tap autofill button
• Zero-tap authentication where supported

Meta limits customization of authentication templates so that they remain clearly recognizable as verification messages.

Templates can be created through WhatsApp Manager or programmatically through the Message Templates API.

4. Choose the OTP User Experience

Select the authentication method that fits your application.

A copy code template lets users tap a button to copy the OTP to their clipboard and then paste it into your application.

For Android apps, one-tap autofill can open the intended application and pass the verification code to it after the user taps the authentication button. Meta recommends one-tap autofill where supported because it allows the user to complete authentication without manually switching apps and entering the code.

Meta also supports zero-tap authentication for compatible Android implementations. On iOS 26 and later, authentication templates can trigger native OTP keyboard suggestions, allowing users to insert the code with a tap without requiring the same Android-specific integration.

5. Generate the OTP on Your Backend

When a user initiates an authentication event, such as registration, login, or password recovery, your backend should generate a unique OTP and associate it with that user or verification session.

The backend should also control security rules such as:

• OTP expiration
• Single-use validation
• Maximum verification attempts
• Resend limits
• Session association

WhatsApp provides the delivery channel, but your application remains responsible for generating the code and deciding whether a submitted OTP is valid.

6. Send the Authentication Template

Once the template is approved, send it through the WhatsApp Cloud API using Meta’s /messages endpoint. The request identifies the recipient, authentication template, language, and verification code parameters that should appear in the message. Meta’s Cloud API authenticates these requests using a bearer access token.

When using a copy-code authentication template, for example, the OTP supplied in the API request is displayed in the message and associated with the copy button.

7. Validate the Code

After the user enters or autofills the OTP, send it back to your backend for verification.

The server should confirm that:

• The submitted OTP matches the generated code
• The OTP has not expired
• The OTP has not already been used
• The allowed number of attempts has not been exceeded

If validation succeeds, mark the verification session as complete and invalidate the OTP so it cannot be reused.

8. Configure Delivery Status Webhooks

Meta recommends setting up a webhook endpoint to receive WhatsApp events and message-status updates. Webhooks can report statuses such as message delivery and reading, allowing your authentication system to track whether an OTP reached the user.

This information is particularly useful for identifying delivery failures and deciding when to offer another verification channel.

9. Test the Complete Authentication Flow

Before moving to production, test the process from end to end:

1. Trigger an authentication request.
2. Generate the OTP.
3. Send the approved WhatsApp authentication template.
4. Confirm that the message arrives.
5. Test copy, autofill, or zero-tap behavior where applicable.
6. Submit the OTP.
7. Confirm successful and unsuccessful validation.
8. Test expired codes, repeated attempts, and resend scenarios.

Meta provides a WhatsApp OTP sample application for Android demonstrating OTP sending and receiving, template creation, one-tap autofill, and copy-code integration.

For production deployments, businesses can integrate directly with the WhatsApp Cloud API or use a CPaaS provider that handles parts of the WhatsApp API integration, routing, monitoring, and fallback infrastructure.

Best Practices for Implementing WhatsApp OTP

Security and usability must work together. An OTP flow that is secure but frustrating will drive abandonment, while a frictionless but weak flow increases fraud exposure. The goal is to balance protection, speed, and reliability.

Organizations evaluating their options can explore our guide to OTP services for a breakdown of leading providers and delivery methods.

1. Use Short-Lived OTPs with Strict Expiration

OTP validity should be short enough to limit the time an intercepted code can be abused, while still giving legitimate users enough time to complete verification. A validity window of roughly 30–90 seconds is appropriate for many high-risk flows, but the exact value should reflect delivery latency, user behavior, and transaction sensitivity. Once the window expires, the code must be rejected even if it is otherwise correct.

Expiration should be enforced server-side rather than relying only on the time shown in the WhatsApp message. Each OTP should also be tied to a specific user, session, and authentication event so it cannot be reused elsewhere. When a new OTP is issued, the previous code should be invalidated to reduce replay risk.

Key actions:

• Enforce OTP expiration on the backend.
• Use shorter validity windows for higher-risk actions.
• Bind each OTP to a specific user and session.
• Invalidate previous codes when a new OTP is issued.
• Reject expired or already-used codes immediately.

2. Enforce Attempt Limits and Progressive Lockouts

OTP verification endpoints should limit how many times a user or attacker can submit a code. Without attempt controls, even a short numeric OTP can be brute-forced through repeated guesses. The backend should track failed attempts per verification session and stop accepting submissions after a defined threshold.

Progressive controls can reduce abuse without locking out legitimate users too aggressively. For example, the system can introduce short delays after several failed attempts, then temporarily block verification after repeated failures. Attempt limits should also apply to resend requests so attackers cannot continuously generate fresh codes or overwhelm the delivery channel.

Key actions:

• Limit the number of OTP verification attempts.
• Add progressive delays after repeated failures.
• Temporarily lock verification after the threshold is exceeded.
• Rate limit OTP resend requests.
• Track attempts by user, session, device, and IP where appropriate.

3. Combine WhatsApp OTP with Secondary Risk Signals

WhatsApp OTP should be treated as one part of the authentication decision rather than the only security control. A valid code confirms that the user can access the WhatsApp account associated with the phone number, but it does not prove that the request itself is legitimate. Attackers may still obtain valid OTPs through phishing, malware, session theft, or social engineering.

Risk-based authentication can strengthen the flow by evaluating device fingerprinting, IP reputation, location changes, login velocity, account history, and behavioral anomalies alongside the OTP result. A low-risk login may proceed after successful OTP verification, while a suspicious request can require additional verification, be delayed, or be blocked. This reduces the chance that a stolen or socially engineered OTP is enough to take over an account.

Key actions:

• Evaluate device and browser characteristics.
• Check IP reputation and geographic anomalies.
• Compare the request with normal user behavior.
• Escalate suspicious sessions to stronger verification.
• Block high-risk requests even when the OTP is correct.

4. Provide Seamless Fallback to Alternative Channels

WhatsApp delivery can fail because the user is offline, the phone number is not registered with WhatsApp, connectivity is poor, or a platform or routing issue interrupts delivery. Authentication flows should therefore include fallback channels so users are not locked out when the primary OTP method is unavailable.

Fallback should be controlled rather than offered indiscriminately. The system can wait for delivery status or a short timeout before presenting another option, then route verification through SMS, email, or voice according to the user’s registered contact methods and risk profile. Security controls such as attempt limits, resend limits, and session binding should remain consistent across all channels so switching delivery methods does not weaken the authentication flow.

Key actions:

• Monitor WhatsApp delivery status before triggering fallback.
• Offer SMS, email, or voice as alternative channels.
• Keep the same session and risk controls across channels.
• Prevent unlimited switching between delivery methods.
• Make fallback options clear when delivery is delayed or fails.

5. Log, Audit, and Monitor Verification Attempts

Every OTP request and verification attempt should generate security telemetry that can be used for fraud detection, troubleshooting, and audit purposes. Useful events include OTP generation, dispatch status, delivery failure, successful verification, failed submissions, resend requests, lockouts, fallback use, and unusual changes in device or location.

Monitoring these events over time can reveal abuse patterns that are difficult to detect from individual requests. Repeated OTP requests across many accounts, high failure rates from one IP range, or sudden increases in fallback usage may indicate automated attacks or delivery problems. Logs should include enough context for investigation while avoiding storage of plaintext OTP values.

Key actions:

• Log OTP requests, delivery outcomes, and verification results.
• Track repeated failures and resend activity.
• Alert on unusual request volumes or behavioral patterns.
• Correlate OTP events with device, IP, and account context.
• Never store plaintext OTPs in logs.

Why WhatsApp OTP Belongs in Your Authentication Strategy

WhatsApp OTP is no longer an emerging experiment or niche channel. It has become a mainstream authentication method for businesses prioritizing reliability, speed, and user trust. As messaging ecosystems evolve, verification strategies must adapt to meet both security demands and customer experience expectations.

Successful adoption depends on:

• Smart orchestration
• Strong security controls
• Thoughtful fallback strategies

When implemented correctly, WhatsApp OTP verification strengthens account protection, reduces fraud risk, and delivers a smoother, more confidence-building user journey.