Templates · Authentication
WhatsApp OTP templates: authentication messages for logins and sign-ups
Authentication templates for one-time passwords on WhatsApp: what WhatsApp fixes, what you choose, the button types, and the utility messages that go with them.
By Broadchat teamPublished 6 min read
Before you submit these templates
- You cannot write your own text for an authentication template. WhatsApp supplies the body ("{{1}} is your verification code"), the optional security line and the expiry footer, translated into the template's language. Templates that try to add marketing or extra text are not authentication templates.
- Authentication templates cannot contain URLs, media or extra buttons; the only button is the OTP button (copy code, one-tap or zero-tap).
- For one-tap and zero-tap, add your Android app's package name and its 11-character signing-key hash. A wrong hash means the autofill silently falls back to copy code.
- Use the code only once and for a short time. Set Code expiry so the footer tells the user how long the code is valid, and match it to your backend's real expiry.
- Set a Message validity period so a code that cannot be delivered quickly is dropped instead of arriving after it has expired.
- Password reset links and "was this you?" alerts are not one-time codes. Send them as utility templates, without asking for the code back in chat.
How WhatsApp OTP templates differ from other templates
WhatsApp OTP templates use Meta's authentication category, and they work differently from every other template on this site: you do not write the message. WhatsApp supplies the text "{{1}} is your verification code", an optional line "For your security, do not share this code" and an optional footer "This code expires in N minutes", and translates them into the template's language. What you choose is the button type, whether the security line and expiry footer appear, and how long WhatsApp should keep trying to deliver the message.
That is why the examples below look almost identical. Their differences are in settings, and those settings decide how the code reaches the user. Use these templates if you send login, sign-up or transaction codes from a website or app. They are not for alerts, links or anything with a URL; see the account alert templates for those.
Choosing the OTP button
| Button | What the user does | Where it works | Extra setup |
|---|---|---|---|
| Copy code | Taps to copy, pastes into your screen | Every device | None |
| One-tap autofill | Taps Autofill; your Android app opens with the code filled in | Android app users | Package name and signing-key hash; app handshake |
| Zero-tap | Nothing; WhatsApp passes the code to your Android app | Android app users | As one-tap, plus accepting the zero-tap terms |
One-tap and zero-tap fall back to a copy-code button wherever they cannot work, so one template covers all users.
Creating an authentication template in Broadchat
- Open CRM → WhatsApp Templates and click Create Template. Choose the channel, a name such as
login_otp_copy, the Authentication category and the language. - Choose the OTP button: Copy Code, One-tap autofill or Zero-tap. For the last two, add each Android app's Package name and Signature hash (up to five apps), and for zero-tap tick the terms checkbox.
- Switch Add security recommendation on, set Code expiry (1 to 90 minutes) and, if you want, a Message validity period (30 to 900 seconds).
- Submit. Meta's review can take up to 24 hours.
- Send codes from your backend through Broadchat's developer API, passing the code as the only variable.
Cost and delivery notes
Authentication messages are charged per delivered message at Meta's authentication rate for the recipient's country, and in some markets, including India, a higher authentication-international rate applies when the business is in another country. Rates are on WhatsApp API pricing. Keep SMS or email as a fallback for users who are not on WhatsApp or whose message is not delivered within your validity period.
The rules for other categories are in the WhatsApp message templates guide, and the term itself is explained on the message template glossary page.
Sources
- Authentication templates — Meta for Developers, checked 12 October 2026
- Template components — Meta for Developers, checked 12 October 2026
- Pricing on the WhatsApp Business Platform — Meta for Developers, checked 12 October 2026
Broadchat team · Product and partner success team
The people who build and support Broadchat, the white-label WhatsApp Business API platform. We write from what we see while onboarding partners and their clients on the official WhatsApp Cloud API, and we check every article against Meta's current documentation.
Last updated:
9 otp and authentication templates
Copy the wording, then submit it from CRM → WhatsApp Templates with the sample values shown. Meta reviews every template; approval is never guaranteed.
*{{1}}* is your verification code. For your security, do not share this code.
This code expires in 10 minutes.
- Copy code
Login code with copy button
Authenticationlogin_otp_copyLanguage: en
Use it when: The default for website and app logins: the user taps Copy code and pastes it into your login screen.
Variables Variable Meaning Sample {{1}} One-time code generated by your backend 482913 - WhatsApp shows the code in bold. The body, security line and footer are generated by WhatsApp; you only switch them on or off.
*{{1}}* is your verification code. For your security, do not share this code.
This code expires in 5 minutes.
- Copy code
Sign-up verification, 5-minute expiry
Authenticationsignup_otp_copy_5minLanguage: en
Use it when: When a new user verifies their mobile number during sign-up and you want a shorter validity than for logins.
Variables Variable Meaning Sample {{1}} One-time code 730154 - Pair a 5-minute code expiry with a message validity of about 5 minutes too, so a delayed message is not delivered after the code has expired.
*{{1}}* is your verification code. For your security, do not share this code.
This code expires in 10 minutes.
- Autofill
One-tap autofill for an Android app
Authenticationapp_otp_one_tapLanguage: en
Use it when: When users log in to your Android app: tapping Autofill opens the app and fills the code. On iPhone and WhatsApp Web the same template shows a copy-code button instead.
Variables Variable Meaning Sample {{1}} One-time code 905127 - Your app must initiate a handshake with WhatsApp before you send the code, as described in Meta's one-tap guide; without it the button falls back to copy code.
*{{1}}* is your verification code. For your security, do not share this code.
- Copy code
Zero-tap code delivery
Authenticationapp_otp_zero_tapLanguage: en
Use it when: For Android apps where the code should reach the app without the user doing anything; WhatsApp passes it to your app and the user sees it in chat as a fallback.
Variables Variable Meaning Sample {{1}} One-time code 661840 - Zero-tap requires accepting WhatsApp's zero-tap terms when you create the template. Use it only where users expect automatic filling, such as re-login on a device they already use.
*{{1}}* is your verification code. For your security, do not share this code.
- Copy code
Transaction approval code
Authenticationpayment_otp_no_footerLanguage: en
Use it when: When a logged-in user confirms a sensitive action such as changing a payout bank account or approving a high-value order in your app.
Variables Variable Meaning Sample {{1}} One-time code 218476 - WhatsApp's text does not say what the code is for. Show the action and amount on your own screen next to the code field, not in the template.
*{{1}}* is your verification code.
- Copy code
Minimal code message
Authenticationotp_basic_no_security_lineLanguage: en
Use it when: Only when another part of your flow already warns users not to share codes. In most cases keep the security recommendation switched on.
Variables Variable Meaning Sample {{1}} One-time code 557302 Hi {{1}}, your mobile number has been verified for your Ledgerbook account. You will now receive login codes and account alerts on this WhatsApp number. If you did not do this, reply HELP.
Number verified confirmation
Utilitymobile_number_verifiedLanguage: en
Use it when: Once, after the first successful verification, to confirm that future codes will arrive on WhatsApp.
Variables Variable Meaning Sample {{1}} User first name Kavya - This is a utility template, not authentication: it confirms an account change and contains no code.
Hi {{1}}, we received a request to reset the password for your Ledgerbook account. The link below works once and expires in 30 minutes. If you did not ask for this, you can ignore this message.
- Reset password
Password reset link
Utilitypassword_reset_linkLanguage: en
Use it when: When a user asks for a password reset and you send a link rather than a code.
Variables Variable Meaning Sample {{1}} User first name Arjun - Authentication templates cannot carry URLs, so a reset link has to be a utility template. Meta makes the final category decision.
Hi {{1}}, sign-in to your Ledgerbook account was paused for {{2}} after several wrong verification codes. If this was you, wait and try again. If not, reply HELP and our team will secure your account.
- HELP
Too many wrong codes
Utilityotp_attempts_lockedLanguage: en
Use it when: When your backend locks login attempts after repeated wrong codes, which can signal someone trying to take over the account.
Variables Variable Meaning Sample {{1}} User first name Rohan {{2}} Lock duration 15 minutes - Never ask the user to send the code they received back in chat.
Frequently asked questions
Can I write my own text in a WhatsApp OTP template?
No. Authentication templates use text set by WhatsApp: the code line, an optional security recommendation and an optional expiry footer, translated into the template language. You choose the button type and these options, not the wording.
Can I add a link or my logo to an authentication template?
No. Authentication templates cannot contain URLs or media, and the only button is the OTP button. Send password reset links or account notices as separate utility templates.
What is the difference between one-tap and zero-tap?
With one-tap, the user taps Autofill and your Android app opens with the code filled in. With zero-tap, WhatsApp passes the code to your app without a tap. Both need your app's package name and signing-key hash, and both fall back to copy code where they cannot work.
Should WhatsApp replace SMS OTP completely?
Usually not. Keep SMS or email as a fallback for users who do not have WhatsApp or whose message is not delivered in time. Many businesses send the WhatsApp code first and offer SMS after a short wait.