OTP Verification via WhatsApp
Generate a one-time code in your app, send it with a WhatsApp authentication template — with a copy-code or one-tap autofill button — through POST /api/v1/messages, and verify it yourself. Messages are end-to-end encrypted.
✦ 14-day free trial · Your own WhatsApp Business number · Meta bills messages directly
Why WhatsApp OTPs Over SMS?
WhatsApp OTPs reach users in an app they already have open, with end-to-end encryption, a copy-code button so nobody retypes the code, and one-tap autofill on supported Android apps. They also help in markets where SMS filtering delays or blocks one-time codes.
- Copy-code button — users never retype the code
- End-to-end encryption by default
- One-tap auto-fill on Android
WhatsApp OTP vs. Traditional SMS OTP vs. Authenticator Apps
Compare deliverability, verification speeds, security standards, and cost profiles.
| Metric | WhatsApp OTP | Traditional SMS OTP | Authenticator Apps (TOTP) |
|---|---|---|---|
| Encryption | ✓ (End-to-end) | ✗ (Plain text) | ✓ (Generated on device) |
| Setup Friction | None (Uses active app) | None (SMS native inbox) | High (Requires app download) |
| One-Tap Auto-fill | ✓ (Supported on Android) | ✓ (Device native permission) | ✗ (Manual code copying) |
| Needs Internet Access | Yes (mobile data or Wi-Fi) | No (cellular network) | No (works offline) |
Send a WhatsApp OTP with an authentication template
curl -X POST https://waba-api.startmessaging.com/api/v1/messages \
-H "Authorization: Bearer sm_live_your_api_key" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: login-7781" \
-d '{
"to": "+919812345678",
"type": "template",
"template": {
"name": "login_code",
"language": "en_US",
"parameters": [
{
"text": "482913"
}
],
"buttonParameters": [
{
"index": 0,
"subType": "url",
"text": "482913"
}
]
},
"clientReference": "login-7781"
}'const res = await fetch('https://waba-api.startmessaging.com/api/v1/messages', {
method: 'POST',
headers: {
'Authorization': 'Bearer ' + process.env.SM_API_KEY,
'Content-Type': 'application/json',
'Idempotency-Key': 'login-7781',
},
body: JSON.stringify({
"to": "+919812345678",
"type": "template",
"template": {
"name": "login_code",
"language": "en_US",
"parameters": [
{
"text": "482913"
}
],
"buttonParameters": [
{
"index": 0,
"subType": "url",
"text": "482913"
}
]
},
"clientReference": "login-7781"
}),
});
const { data } = await res.json();
console.log(data.id, data.status);import os, requests
res = requests.post(
'https://waba-api.startmessaging.com/api/v1/messages',
headers={
'Authorization': f"Bearer {os.environ['SM_API_KEY']}",
'Idempotency-Key': 'login-7781',
},
json={
"to": "+919812345678",
"type": "template",
"template": {
"name": "login_code",
"language": "en_US",
"parameters": [
{
"text": "482913"
}
],
"buttonParameters": [
{
"index": 0,
"subType": "url",
"text": "482913"
}
]
},
"clientReference": "login-7781"
},
)
data = res.json()['data']
print(data['id'], data['status'])<?php
$body = <<<'JSON'
{
"to": "+919812345678",
"type": "template",
"template": {
"name": "login_code",
"language": "en_US",
"parameters": [
{
"text": "482913"
}
],
"buttonParameters": [
{
"index": 0,
"subType": "url",
"text": "482913"
}
]
},
"clientReference": "login-7781"
}
JSON;
$ch = curl_init('https://waba-api.startmessaging.com/api/v1/messages');
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'Authorization: Bearer ' . getenv('SM_API_KEY'),
'Content-Type: application/json',
'Idempotency-Key: login-7781',
],
CURLOPT_POSTFIELDS => $body,
]);
$data = json_decode(curl_exec($ch), true)['data'];
echo $data['id'] . ' ' . $data['status'];WhatsApp Authentication — FAQ
What's the difference between WhatsApp OTP and SMS OTP?
WhatsApp OTPs are delivered through the WhatsApp app instead of SMS. Key differences: WhatsApp messages are end-to-end encrypted (SMS is not), authentication templates add a copy-code or one-tap autofill button, and delivery does not depend on carrier SMS filtering. SMS OTPs still reach users who do not have WhatsApp or are offline, so many apps offer both. With StartMessaging you send the WhatsApp code yourself via POST /api/v1/messages; any SMS option runs separately.
Does WhatsApp support one-tap auto-fill?
Yes! On Android devices, WhatsApp authentication messages support a one-tap auto-fill button. When users receive the OTP, they can tap a single button to automatically copy and paste the code into your app — no manual entry needed.
Are WhatsApp OTPs compliant with country-specific guidelines?
Yes. WhatsApp authentication templates are sent over Meta's WhatsApp Business Platform, so India's TRAI DLT registration, which applies to SMS, is not needed for them. You still need the user's consent and a Meta-approved authentication template, and you should follow your own security and data-protection rules.
What is the expiration time for WhatsApp OTPs?
You decide. Your app generates the code and checks it, so the validity period is your own rule (5–10 minutes is common). When you create the authentication template you can also add an expiry notice, so the message tells users how long the code is valid.
Can I customize the WhatsApp OTP message template?
Within Meta’s fixed format. You create an authentication template in the template builder: Meta writes the message text itself, and you choose the language, the Copy code button, Meta’s security warning (“For your security, do not share this code.”) and an optional line saying when the code expires. The template then goes to Meta for approval.
What does a WhatsApp OTP cost?
StartMessaging adds nothing per message. Meta charges every delivered authentication template at its authentication rate, billed directly to your own WhatsApp Business Account, and in some countries Meta charges a higher international authentication rate. Each message’s pricing field shows the category Meta used: authentication or authentication-international.
Can my plan’s monthly API message allowance block OTPs?
Not on a paid Developer plan: it never stops authentication templates, even past its monthly allowance. Developer Free and the free trial stop every API send at their allowance of 100 and 1,000 messages a month, with 402 PLAN_MESSAGE_LIMIT_REACHED. Team and Business have no monthly API message limit under fair use.
Secure Your Users with WhatsApp OTPs
14-day free trial. Connect your own WhatsApp Business number in minutes.