An OTP code is a one-time password. A customer uses it to confirm a login, a sign-up or a payment. In WhatsApp, you can send such a code in two ways. The first is the official WhatsApp Business API (WABA) with a special template. The second is a gateway that sends the code as a regular message. The official way is more reliable, but not every company can use it. Below, we explain how both ways work, how much they cost and how to protect customer accounts from fraudsters.
Table of Contents
What OTP in WhatsApp is and why you need it
OTP (one-time password) is a code made of digits or letters and digits. It works only once and only for a set period of time. It confirms that the owner of the phone number is the one taking the action. For example, a customer enters their number on a website, gets a code in WhatsApp and types it into the form.
OTP is most often used in these cases:
- logging in to a personal account, or the second login step after a password;
- signing up and verifying a phone number;
- restoring access to an account;
- confirming a payment or linking a card;
- changing a phone number, email or delivery address.
Compared with SMS, WhatsApp has three advantages. The customer sees the company name, not an unknown number. The customer can copy the code with one button. You do not need to register a sender name. In SMS, the company name replaces the number only if you register it with mobile operators. In many countries, this registration costs extra. WhatsApp is not cheaper everywhere, so compare the price of a WhatsApp message with your SMS rate.
How OTP works in the official WhatsApp Business API
In WABA, codes are sent only with a template of the authentication category. Meta states this directly: if your app sends codes in WhatsApp, it must use this type of template. You cannot send a code with a marketing or utility template.
You can take a template from the Meta library or create your own. Library templates are already approved. You can send them right away, but you cannot change their text. If you create your own template, you write the text with the code yourself. But Meta must approve it before you can send it.
A library template consists of:
- the ready-made Meta phrase «<code> is your verification code.» in the language you chose when you created the template;
- optionally, the code validity period, from 1 to 90 minutes;
- a button for the code: copy, autofill or no button (the table below shows which one to choose).
A custom template consists of:
- your text with a variable for the code. For example, «Your verification code is {{1}}», where {{1}} is the variable that will hold the code;
- optionally, the warning «Do not share this code with anyone». Meta adds it automatically if you set addSecurityRecommendation: true when you create the template;
- a button for the code: copy, autofill or no button (the table below shows which one to choose).
You cannot add links, images or emoji to the template. The code itself can be up to 15 characters long. The requirements are listed in Meta’s documentation on authentication templates.
You choose the button type when you create the template: code autofill (One-tap), code copy (Copy code) or a template without a button (Zero-tap).
| Button | Where it works | What you need to do |
| Copy code | iOS and Android | No changes needed |
| One-tap autofill | Android only | Adapt your integration to exchange data with WhatsApp |
| Zero-tap (no button) | Android only | Adapt your integration and accept Meta’s terms |
On iPhones with iOS 26 and later, the system itself offers to fill in the code from the notification. You do not need to change anything.
Four more things to consider in advance:
- The code arrives only on the phone. In WhatsApp Web and on a computer, the message is hidden. WhatsApp asks the customer to open it on their main device.
- You need the customer’s phone number. A customer can write to a company with a hidden phone number and show only their username. In that case, the company sees a BSUID instead of the number. A BSUID is a unique ID that Meta assigns to each user–business pair. You cannot send authentication templates to a BSUID: Meta returns error 131062. So always ask the customer for their phone number before you send an authentication template.
- The message has a limited lifetime. If WhatsApp does not deliver the code within 10 minutes, the message is deleted. You can change this period to any value from 30 seconds to 15 minutes. Do not set it longer than the code validity period. Otherwise, the customer may get a code that no longer works.
- The «I didn’t request a code» button. Meta is gradually adding it to templates. If a customer taps it, someone may have tried to log in to their account.
Who can send OTP through WABA
Access to authentication templates is limited. According to GREEN-API documentation on authentication templates, a company must meet two conditions:
- Pass verification through Meta or its official partner.
- Have a limit of at least 2,000 messages per day. This is the second limit level (Tier 2). With it, the company can start conversations with 2,000 different customers within 24 hours. A verified company with an approved account name usually gets this limit right away.
If the company does not meet these conditions, Meta rejects the template with an insufficient permissions error. So a company without verification cannot use the official way. It can still use the GREEN-API WhatsApp API gateway and SMS.
How much does OTP in WhatsApp cost
The payment model depends on how you send codes. In WABA, you pay for each delivered authentication message. The price depends on the customer’s country.
| Customer’s country | Price per message |
| India | $0.0019 |
| Israel | $0.0072 |
| Pakistan | $0.0203 |
| Indonesia | $0.0338 |
| South Africa | $0.0128 |
Prices are based on GREEN-API WABA rates. Data is actual as of November 2026. You can check prices for other countries in the WABA price calculator.
In 18 countries, including India and Kazakhstan, Meta applies a higher rate called authentication-international. It applies only to companies that send more than 750,000 messages within 30 days to customers in these countries. For example, take a company from India that meets these conditions. It pays the higher rate for codes sent to customers in Kazakhstan. For codes sent to customers in India, it pays the regular rate. Meta gives 30 days’ notice before it switches a company to the higher rate. The full list of countries is in Meta’s documentation on the international rate.
The GREEN-API WhatsApp API gateway uses a different payment model. You pay a fixed fee per number, with no limits on chats or messages.
How to choose a way to send OTP
The gateway is called a «gray» solution, and the official WABA is called a «white» one. For OTP, this difference matters most of all: if the number is blocked, customers cannot log in to their accounts.
| Criterion | WABA («white») | Gateway («gray») |
| Access | Verification and a limit of 2,000+ messages per day | Any number, linked with a QR code |
| How the code looks | Meta template with a «Copy code» button | Regular message; you can add a copy button |
| Payment | Fee for each delivered message | Fixed fee |
| Blocking risk | Low if you follow Meta’s rules | If the number is blocked or restricted, you cannot send messages |
GREEN-API offers both solutions: the official WhatsApp Business API (WABA) and the WhatsApp API gateway. For example, an online service can start with the gateway while it goes through Meta verification. It can then switch to WABA once it gets access to authentication templates. In any case, keep SMS as a backup channel.
How to send OTP through WABA
- Connect WABA and verify your company.
- Use a ready-made authentication template or create your own with a «Copy code» button and a validity period, for example, 5 minutes. In GREEN-API, you create templates with the CreateTemplate
- Wait for Meta to approve the template if you created it yourself. You can send a library template right away.
- Send the code with the SendTemplate method. The code goes into the template variable. The text and the button are already set in the template.
- Track the delivery status. If the «delivered» status does not arrive within a minute, offer to send the code to the customer by SMS.
How to send OTP through the gateway
Through the gateway, the code goes out as a regular message. To make it convenient for the customer, add a copy button. In GREEN-API, this is the SendInteractiveButtons method.
Here is a Python example. The script creates a code, saves it with its expiry time, sends it to the customer and checks it when the customer enters it.
import hashlib
import hmac
import os
import secrets
import time
import requests
API_URL = os.environ["API_URL"]
ID_INSTANCE = os.environ["ID_INSTANCE"]
API_TOKEN = os.environ["API_TOKEN_INSTANCE"]
codes = {} # in production, store codes in a database or Redis
def code_hash(code: str) -> str:
return hashlib.sha256(code.encode()).hexdigest()
def send_otp(phone: str) -> None:
code = f"{secrets.randbelow(10**6):06d}"
codes[phone] = {"hash": code_hash(code), "expires": time.time() + 300, "attempts": 0}
url = f"{API_URL}/waInstance{ID_INSTANCE}/sendInteractiveButtons/{API_TOKEN}"
body = {
"chatId": f"{phone}@c.us",
"body": f"Your verification code: {code}. Do not share it with anyone.",
"footer": "The code is valid 5 minutes",
"buttons": [{"buttonId": "1", "buttonText": "Copy code", "copyCode": code}],
}
requests.post(url, json=body, timeout=10).raise_for_status()
def check_otp(phone: str, code: str) -> bool:
entry = codes.get(phone)
if not entry or time.time() > entry["expires"] or entry["attempts"] >= 5:
return False
entry["attempts"] += 1
if hmac.compare_digest(entry["hash"], code_hash(code)):
del codes[phone] # the code is single use
return True
return False
This setup needs the Business plan: on the free Developer plan, you can write to only three chats. Keep in mind that the gateway works with a regular number. If the number is blocked, codes stop arriving. So do not send codes through the gateway without a backup channel, such as SMS.
Security rules for OTP
OTP reliability depends not only on the channel. It also depends on how you handle codes on your side.
- Check the number before sending. Make sure the customer has WhatsApp, and tell them where the code will arrive.
- Limit the validity period. For example, 5 minutes. After that, the code must not work, even if it is entered correctly.
- Limit attempts. For example, allow no more than 5 entry attempts and no more than one resend per minute.
- Make the code single-use. Delete it after a successful entry.
- Store a hash of the code, not the code itself. Then a database leak will not reveal valid codes.
- Keep a backup channel. If the code is not delivered, offer SMS.
- Do not add advertising. A code message must contain only the code and the warning.
FAQ
Is it safe to send OTP via WhatsApp?
Yes, if you follow the rules on your side. In WABA, the code is shown only on the customer’s main phone. The «I didn’t request a code» button helps you notice an attempt to hack an account. But your server, not WhatsApp, enforces the validity period, the attempt limit and the single use of the code.
Can I send a code with a regular template?
No. Meta requires you to send verification codes only with an authentication template. A code in a marketing or utility template breaks the rules. Meta may reject such a template or change its category.
How long should an OTP code be valid?
In a WABA template, you can set the validity period from 1 to 90 minutes. In practice, 5–10 minutes is enough to open WhatsApp and enter the code. Set the lifetime of the message itself to be no longer than the code validity period.
What if the OTP code does not arrive?
Check that the number is in international format and that the customer has WhatsApp. Look at the delivery status. If the message is not delivered within a minute, offer to send the code by SMS. Allow resends in WhatsApp no more than once per minute.