Use case
Send login and verification codes with WhatsApp OTP authentication templates
Everything needed to send one-time passcodes on WhatsApp: what Meta's authentication template allows, how to send it from your backend through Broadchat, and how to stop OTP abuse.
By Broadchat teamPublished 6 min read
How the flow works
The user asks for a code
On your app or website the user enters their WhatsApp number and taps Send code. Your backend checks rate limits for that number, device and IP before doing anything else.
Your backend generates and stores the code
Your server creates a random 6-digit code, stores only a hash of it with an expiry time such as 10 minutes, and never logs the plain code.
The authentication template is sent
Your backend calls the Broadchat channel API with the channel access token, sending your approved authentication template with the code as its parameter and the same code for the copy-code or one-tap button.
The user enters or autofills the code
The user taps Copy code and pastes it, or, on Android with one-tap autofill set up, the code fills in automatically. Your backend compares it with the stored hash and checks the expiry.
Delivery fails, the user chooses another route
If the WhatsApp send fails or no code is entered within your timeout, offer the user a retry after a cooldown or another channel such as SMS or email. Which fallback you offer is your own product decision.
Business: 482913 is your verification code. For your security, do not share this code. This code expires in 10 minutes. [Copy code]
Customer: I didn't ask for this
Business: Thanks for telling us. No action is needed: the code expires on its own and your account stays safe as long as you do not share it. If you keep getting codes you did not request, reply HELP and our team will check your account.
Customer: HELP
Business: I have passed this to our security team. Someone will reply here shortly. We will never ask you for a code, PIN or password in this chat.
Customer: Ok thanks
How WhatsApp OTP authentication works
WhatsApp OTP authentication means sending a one-time passcode for login, sign-up or a sensitive action through Meta's authentication template category instead of SMS. Your backend generates the code, sends it in an approved authentication message template, and the user copies it, or has it filled in automatically on Android. WhatsApp shows the message from your verified business name, which helps users trust it.
This page is for developers and product teams who already have a login or checkout flow. If you only need a handful of codes a day, any working channel will do; WhatsApp earns its place when you send codes at scale to users who live on WhatsApp.
What Meta allows in an authentication template
Authentication templates are deliberately rigid, which is why they are approved quickly and treated as a separate category:
- Fixed body: the text is Meta's preset, for example 482913 is your verification code. You can add the security disclaimer For your security, do not share this code and an expiry line such as This code expires in 10 minutes.
- One button for the code: a Copy code button, or one-tap autofill (Android, needs your app's package name and signature hash), which falls back to copy code when autofill is not possible.
- No URLs, media or emojis in the body, and no promotional content of any kind.
- Category: authentication. Meta also has an authentication-international category that applies to some recipients outside the business's country, including in India, and is priced higher. Check how your user base splits by country on the WhatsApp API pricing explainer.
Templates to set up
| Template name | Category | Sample |
|---|---|---|
login_otp | Authentication | {{1}} is your verification code. For your security, do not share this code. Expires in 10 minutes. Copy code button. (482913) |
signup_otp_onetap | Authentication | Same preset body with a one-tap autofill button for your Android app; falls back to copy code. (731045) |
payment_confirm_otp | Authentication | Preset body with security disclaimer, expiry 5 minutes, used before a high-value change. (209876) |
new_device_login_alert | Utility | Hi {{1}}, your account was signed in on a new device ({{2}}) at {{3}}. Not you? Reply HELP. (Arjun; Chrome on Windows; 14 Oct, 9:42 pm) |
The last one is not an OTP: a login alert is a utility message about the user's own account. Keep it separate from the code template.
Build it in Broadchat
- Connect your number under Channels → All Channels and add balance to that channel's messaging wallet.
- Create the authentication templates under CRM → WhatsApp Templates, choosing the authentication type and the copy-code or one-tap button. Review can take up to 24 hours.
- From the channel, copy the channel access token. Your backend sends the template to the Graph-compatible proxy at
/api/meta/{version}/{phone-number-id}/messages, using the same request body as Meta's Cloud API, with the code as the body parameter and the button parameter. Sends are billed to the channel wallet. - Subscribe to the channel's webhooks to receive sent, delivered and failed statuses, and surface failures to your login screen within seconds.
- Add a small Chatbots → Chatbots flow with a Match Keyword trigger on HELP that sends the safety reply and uses Assign to Agent for your security team.
Abuse protection and failure modes
- OTP pumping: attackers trigger thousands of codes to inflate your bill. Rate-limit per number, per device and per IP; add a captcha after two requests; block number ranges you do not serve.
- Low wallet balance: sends fail when the channel wallet runs dry. Set a balance alert and top up before peak hours.
- Number not on WhatsApp: the send fails. Detect the failure from the webhook and offer SMS or email at once rather than making the user wait.
- Codes in logs: never store or log plain codes, and never ask for a code, PIN or password inside a WhatsApp chat.
Illustrative ROI
Illustrative only: an app verifies 20,000 logins a month. If 1,000 of those users currently abandon because an SMS code arrives late or not at all, and WhatsApp delivery lets 300 of them finish sign-in, that is 300 more active users a month. Put your own value on an active user, then subtract Meta's authentication charges (higher for authentication-international recipients) and your platform subscription. Run WhatsApp and SMS side by side for a month before switching fully.
Background on the platform is in what the WhatsApp Business API is. Agencies building login flows for client apps can run them under their own brand through the partner program.
Broadchat modules used
- Authentication message templates
- Channel access token and Graph-compatible API
- Per-channel messaging wallet
- Channel webhooks for delivery status
- Channels quality and limit view
Industries: Fintech and NBFCs, Ecommerce, Insurance, SaaS and apps, Healthcare portals
What to measure
- Verification completion: codes entered correctly as a share of codes sent.
- Time from send to successful verification, split by copy-code and one-tap autofill.
- Failed sends by error code, to separate wrong numbers and non-WhatsApp users from wallet or limit problems.
- Code requests per number per hour, to spot abuse and tune rate limits.
- Share of users who fall back to SMS or email, and why.
Sources
- Message templates overview — Meta for Developers, checked 12 October 2026
- Pricing on the WhatsApp Business Platform — Meta for Developers, checked 12 October 2026
- Template components — Meta for Developers, checked 12 October 2026
Broadchat team · Product and partner success team
The people who build and support Broadchat, the white-label WhatsApp Business API platform. We write from what we see while onboarding partners and their clients on the official WhatsApp Cloud API, and we check every article against Meta's current documentation.
Last updated:
Frequently asked questions
Can I put a link or my logo in a WhatsApp OTP message?
No. Authentication templates do not allow URLs, media or emojis. The body is Meta's preset text with the code, an optional security disclaimer and an optional expiry line, plus a copy-code or one-tap button.
What is authentication-international?
It is a separate pricing category Meta applies to authentication messages sent to users in certain countries by businesses outside them, including India. It costs more than domestic authentication, so check your user mix before choosing WhatsApp for international logins.
Do I need a chatbot to send OTPs?
No. OTPs are sent from your backend through the channel API. A chatbot is only useful for handling replies such as I didn't ask for this or HELP.
Should I drop SMS completely?
That is your decision. Many teams keep SMS or email as a fallback for users who are not on WhatsApp or whose send fails. Measure completion on both channels for a few weeks first.
How long should a WhatsApp OTP be valid?
Short: 5 to 10 minutes suits most logins, less for payment confirmations. Show the expiry in the template, enforce it on your server, and invalidate the code after one successful use or a few wrong attempts.