WhatsApp OTP: How It Works, What It Costs, and How to Build It
Secure more logins, prevent fraud, and cut costs using WhatsApp for OTP delivery
Nam Hing Chau
Content & SEO Manager
Summary
WhatsApp OTP sends a one-time verification code through a WhatsApp authentication template instead of an SMS. Meta charges for each delivered authentication message at a rate set by the recipient's country, and Android users can fill in the code with one tap. Prelude Verify sends WhatsApp OTPs from your own branded number and moves to SMS or another channel when WhatsApp can't deliver.
WhatsApp reaches more than 3 billion people every month, according to Meta. In markets where it is the default messaging app, that makes it a natural channel for verification codes, with different rules, costs and security trade-offs than SMS.
This guide is a technical reference for developers and product teams building WhatsApp OTP into a product. It covers how the flow works under the hood, what you need to set it up, what it costs, what compliance requires, how to secure it, and how to configure fallback routing.
If you're still evaluating whether WhatsApp OTP is the right channel for your product, start with how and why to send WhatsApp OTPs first. If you're comparing vendors, see our guide to the best WhatsApp OTP provider. For a broader look at OTP channel selection, see our best OTP providers guide.
WhatsApp OTP vs SMS OTP: A Direct Comparison
WhatsApp OTP | SMS OTP | |
|---|---|---|
Delivery infrastructure | Internet data (Wi-Fi or mobile) | Cellular carrier network |
Carrier filtering risk | None (Meta's own messaging limits and template rules apply instead) | High in some markets |
Encryption | Encrypted with the Signal protocol between the user and the Cloud API, which Meta operates for the business | No |
Delivery dependency | The user's data connection | Carrier routing; can fail entirely |
Cost | Per delivered message, priced by the recipient's country; volume tiers lower the rate | Per message segment, priced by destination country and carrier |
Template requirement | Required: a Meta authentication template with fixed text | No Meta-style approval; some countries require sender or template registration with carriers |
User opt-in required | Yes | Depends on the country: US and Canadian carriers require an opt-in screen before approving your sender |
Code autofill | One-tap button on Android; keyboard suggestion on iOS 26+; copy code button on earlier iOS | SMS Retriever on Android; one-time code AutoFill on iOS; WebOTP on the web |
Works without cellular signal | Yes (Wi-Fi only) | No |
SIM swap vulnerability | Lower, not zero: a hijacked number can register WhatsApp on a new device unless the user has turned on two-step verification | Yes |
Best markets | India, Brazil, Indonesia, LATAM, Western Europe | Global fallback, North America, markets with low WhatsApp penetration |
With Prelude Verify | Sent from your branded WhatsApp number, with automatic fallback when WhatsApp can't deliver | Routed across 30+ providers, with fraud scoring before any code is sent |
How WhatsApp OTP Works
The verification flow is structurally close to SMS OTP, with three key differences: WhatsApp only reaches numbers registered on WhatsApp, all messages must use pre-approved templates, and explicit user opt-in is required.
Step 1: Phone number entry: The user enters their phone number. If the number isn't on WhatsApp, Meta returns an "Unable to deliver message" error (code 131026), so your fallback logic has to react to that delivery failure.The verification flow is structurally close to SMS OTP, with three key differences: WhatsApp only reaches numbers registered on WhatsApp, all messages must use pre-approved templates, and explicit user opt-in is required.
Step 2: OTP generation: Your backend generates a 6-digit code and stores it temporarily with an expiration timestamp. 5 to 10 minutes is the standard expiry window; shorter for sensitive financial actions.
Step 3: Template message send: You send the OTP using a Meta authentication template via the WhatsApp Cloud API. Unlike other templates, its body text is fixed by Meta: "<code> is your verification code." You can add an optional security disclaimer and an optional expiration warning, and you choose a button type: copy code, one-tap autofill or zero-tap.
Step 4: User receives and enters the code: The message arrives in the user's WhatsApp chat once their phone is online. On Android, a one-tap autofill button fills the code into your app, and zero-tap fills it with no tap at all. On iOS 26 and later, the code appears as a keyboard suggestion; earlier iOS versions use the copy code button.
Step 5: Validation Your backend checks the code against the stored value, confirms it has not expired, and verifies that the attempt count is within the permitted limit. If the check passes, the session is created.
How Much Does WhatsApp OTP Cost?
Meta has charged per message since July 1, 2025, and only for messages that are delivered. The rate depends on two things: the message category (OTPs use the authentication category) and the country calling code of the recipient's phone number.
Three details change the real cost:
Volume tiers. Authentication and utility rates drop as monthly volume grows. Tiers are set per market and reset each month.
Authentication-international rates. In some markets, Meta charges a higher authentication rate to businesses based in another country. They apply in India, Indonesia, Egypt, Malaysia, Nigeria, Pakistan, Saudi Arabia, South Africa and the UAE, with nine more markets added from October 1, 2026: Bangladesh, Iraq, Kazakhstan, Kuwait, Morocco, Nepal, Oman, Sri Lanka and Ukraine. A business only pays them once it sends more than 750,000 messages outside customer service windows to unique WhatsApp users in those countries, across all its accounts, in a moving 30-day period, and Meta gives 30 days' notice.
Fallback attempts. When WhatsApp can't deliver, the SMS or other channel that takes over is billed at its own rate.
Prelude Verify charges per verification and passes WhatsApp message costs through at zero markup. If you connect a WhatsApp Business Account with no payment method attached, Meta bills Prelude and your WhatsApp messages appear on your Prelude balance like any other channel. To compare provider fees, see our guide to the best WhatsApp OTP providers.
Technical Requirements
To send WhatsApp OTPs, you need:
A verified Meta Business Account
A WhatsApp Business phone number registered with Meta
At least one approved authentication template
Access to the WhatsApp Cloud API (directly via Meta, or through a provider like Prelude)
A secure backend to handle code generation, storage, expiry, and validation
Meta must approve each template before you can use it. Once approved, the template can be used indefinitely without re-approval unless you change the content.
Using a provider like Prelude simplifies this significantly. Prelude is a Meta Business Solution Provider (BSP), which means WhatsApp is a native channel rather than a third-party integration.
The Verify API manages the full verification lifecycle from initiating the verification and sending the message to performing retries, checking code validity, and returning the result with automatic channel selection and fallback routing across 30+ providers. Clients connect their own WhatsApp Business Account to Prelude via Meta's Embedded Signup flow, so messages are delivered from a branded WhatsApp number. Prelude creates the WhatsApp verification templates on your account automatically.
For a step-by-step setup with Prelude, see how to send WhatsApp OTPs.
WhatsApp OTP Compliance Requirements
WhatsApp has stricter compliance requirements than SMS for OTP delivery. These are not optional, and non-compliance risks account suspension.
Explicit user consent: You must obtain opt-in before messaging people on WhatsApp, including OTPs. Meta requires the opt-in to state clearly that the person agrees to receive messages from your business, and to name your business. You can collect it any way you choose, such as on your website, by SMS, through an IVR flow or on paper, and it can be general rather than specific to WhatsApp. It must also comply with local law.
Approved templates only: All outbound messages must use pre-approved templates. Free-form messages are not permitted outside of live customer support windows. Every OTP must use an approved authentication template.
Messaging limits: Meta caps how many unique users a business can message outside a customer service window in a moving 24-hour period. New business portfolios start at 250 users, then scale to 2,000, 10,000, 100,000 and unlimited, and the limit is shared by every number in the portfolio. You should understand them before launching at scale.
Template content rules: Authentication templates enforce these for you: the body is Meta's fixed text, with an optional security disclaimer and expiration warning. You can't add promotional content.
Rate limiting and security controls
WhatsApp's platform requirements and OTP security best practices align closely. Both require the same controls.
Code expiry: Expire codes after 5 to 10 minutes. For financial transactions or account recovery, 2 to 3 minutes is more appropriate. Turn on the template's expiration warning so users understand why a code stops working.
Attempt limits: Cap failed entry attempts at 3 to 5 per code. Invalidate the code immediately when the limit is reached. Do not allow unlimited guesses against a live code.
Resend rate limiting: Enforce a minimum interval between resend requests (30 to 60 seconds is standard). Cap total OTPs sent per user per hour (5 is a reasonable limit). This prevents abuse and reduces exposure to WhatsApp's messaging limits.
Number validation before sending: Validate the format and line type of the number, and screen it for fraud signals, before you send. Meta doesn't charge for undelivered WhatsApp messages, but a wasted attempt still delays the user, and the SMS fallback that follows is billed.
Prelude Verify scores every request for fraud and blocks suspicious ones before any code is sent, on WhatsApp or any other channel. For a comprehensive treatment of OTP security controls across all channels, see our OTP best practices guide.
When to Use WhatsApp OTP
WhatsApp OTP is not a universal SMS replacement. The right deployment model depends on your user geography and use case.
Use WhatsApp OTP when | Use SMS OTP when |
Users are in India, Brazil, Indonesia, LATAM, or Western Europe | Users are in North America or markets with low WhatsApp penetration |
SMS delivery is below 90% in a specific market | WhatsApp opt-in has not been collected from existing users |
International SMS costs are a meaningful line item at your volume | Users are in areas with limited data connectivity but reliable cellular |
You want codes encrypted in transit with the Signal protocol | Regulatory requirements mandate SMS for your use case |
WhatsApp is the user's primary communication channel | Your user base skews toward contexts where SMS is the default (B2B, enterprise) |
Use WhatsApp as the primary channel when: Your users are predominantly in markets with high WhatsApp penetration: India, Brazil, Indonesia, Mexico, most of Western Europe. If your SMS delivery rate in a specific country falls below 90%, WhatsApp should be your primary channel in that market.
Use WhatsApp as a fallback channel when: Your primary channel is SMS and you want automatic recovery when delivery fails. A well-configured fallback reduces failed verifications without requiring you to manage WhatsApp as a primary integration. Prelude handles this automatically: when an attempt fails to deliver, Verify retries on the next best route, which can be WhatsApp, another SMS provider or another channel.
Keep SMS as primary when: Your users are in markets with strong SMS infrastructure and lower WhatsApp penetration, or where WhatsApp opt-in collection adds friction to your onboarding flow. B2B products with enterprise users often fall into this category.
Do not use WhatsApp OTP when: Your users have not opted in. Sending WhatsApp OTPs without explicit consent is a compliance violation that risks account suspension. Check whether the consent you already hold covers messages from your business: Meta accepts a general opt-in, as long as it names your business and says the person agrees to receive messages from it.
Fallback Architecture
No single channel achieves 100% delivery in every market. A resilient OTP flow uses automatic fallback to recover failed verifications without requiring user action.
Prelude Verify doesn't follow a fixed sequence. For each attempt, it ranks every available route (a provider and channel pair) by cost and conversion, and when an attempt fails or the user asks for a new code, it moves to the next best route it hasn't tried. WhatsApp and every other non-SMS channel are used at most once per verification; SMS can be retried on different providers.
In a WhatsApp-first market, set preferred_channel to whatsapp: Prelude tries WhatsApp first and moves on to the next best route if it can't deliver. In an SMS-first market, leave it unset and WhatsApp becomes one of the routes Verify can fall back to.
The fallback decision is made at the routing layer, not in your application code. Prelude's Verify API handles channel selection and fallback logic automatically based on destination country, delivery signal, and your configured channel preferences. There is no additional code required on your side to handle the fallback; it is built into the routing layer.
For more on multi-channel fallback architecture, see our SMS delivery rate guide.
What's Next?
Prelude's Verify API manages the full verification lifecycle across WhatsApp, SMS, RCS, Telegram, Viber, Zalo and Silent Network Authentication with automatic channel selection, fallback routing across 30+ providers, fraud detection, and delivery analytics built in. See how it works or get started for free.
For further reading:
Why and how to send WhatsApp OTPs if you're still evaluating whether WhatsApp OTP is right for your product
FAQs
Can I automate OTP over WhatsApp?
Yes, and you should. The whole point of using the WhatsApp Business API is to send and verify OTPs programmatically, at scale. That said, "automated" doesn’t mean "unlimited" or "unregulated". You'll still need to follow WhatsApp’s template and opt-in policies.
What if a user doesn’t have WhatsApp?
The WhatsApp message fails to deliver, so your flow needs a fallback to SMS or another channel. Prelude Verify does this automatically by retrying on the next best route.
Can I send OTPs without a pre-approved template?
No. WhatsApp does not permit free-form outbound messages for non-support use cases. All OTP messages must use an approved authentication template.
Can I use the same OTP message for all users?
Yes. In fact you have to: authentication templates use Meta's fixed text, "<code> is your verification code," and only the code changes from user to user.
Is WhatsApp OTP cheaper than SMS?
It depends on the country. Meta prices authentication messages per delivered message by the recipient's country, so compare Meta's authentication rate with your SMS rate market by market. Check the authentication-international rate too if your users are in markets like India or Indonesia and your business is based elsewhere.
How do I handle users who don't opt in to WhatsApp messages?
Use SMS as the default channel and offer WhatsApp as an option during onboarding. Users who opt in can be routed to WhatsApp OTP; users who don't are served via SMS. Never send a WhatsApp OTP to a user who has not explicitly consented.
What is a WhatsApp authentication template?
It's the Meta template category for one-time codes. The body text is fixed ("<code> is your verification code"), you can add a security disclaimer and an expiration warning, and you pick a copy code, one-tap autofill or zero-tap button.
Is WhatsApp OTP more secure than SMS OTP?
It removes some SMS risks: codes travel encrypted with the Signal protocol. It doesn't remove phishing, and a hijacked phone number can still be used to register WhatsApp on a new device unless the user has two-step verification on.
WhatsApp reaches more than 3 billion people every month, according to Meta. In markets where it is the default messaging app, that makes it a natural channel for verification codes, with different rules, costs and security trade-offs than SMS.
This guide is a technical reference for developers and product teams building WhatsApp OTP into a product. It covers how the flow works under the hood, what you need to set it up, what it costs, what compliance requires, how to secure it, and how to configure fallback routing.
If you're still evaluating whether WhatsApp OTP is the right channel for your product, start with how and why to send WhatsApp OTPs first. If you're comparing vendors, see our guide to the best WhatsApp OTP provider. For a broader look at OTP channel selection, see our best OTP providers guide.
WhatsApp OTP vs SMS OTP: A Direct Comparison
WhatsApp OTP | SMS OTP | |
|---|---|---|
Delivery infrastructure | Internet data (Wi-Fi or mobile) | Cellular carrier network |
Carrier filtering risk | None (Meta's own messaging limits and template rules apply instead) | High in some markets |
Encryption | Encrypted with the Signal protocol between the user and the Cloud API, which Meta operates for the business | No |
Delivery dependency | The user's data connection | Carrier routing; can fail entirely |
Cost | Per delivered message, priced by the recipient's country; volume tiers lower the rate | Per message segment, priced by destination country and carrier |
Template requirement | Required: a Meta authentication template with fixed text | No Meta-style approval; some countries require sender or template registration with carriers |
User opt-in required | Yes | Depends on the country: US and Canadian carriers require an opt-in screen before approving your sender |
Code autofill | One-tap button on Android; keyboard suggestion on iOS 26+; copy code button on earlier iOS | SMS Retriever on Android; one-time code AutoFill on iOS; WebOTP on the web |
Works without cellular signal | Yes (Wi-Fi only) | No |
SIM swap vulnerability | Lower, not zero: a hijacked number can register WhatsApp on a new device unless the user has turned on two-step verification | Yes |
Best markets | India, Brazil, Indonesia, LATAM, Western Europe | Global fallback, North America, markets with low WhatsApp penetration |
With Prelude Verify | Sent from your branded WhatsApp number, with automatic fallback when WhatsApp can't deliver | Routed across 30+ providers, with fraud scoring before any code is sent |
How WhatsApp OTP Works
The verification flow is structurally close to SMS OTP, with three key differences: WhatsApp only reaches numbers registered on WhatsApp, all messages must use pre-approved templates, and explicit user opt-in is required.
Step 1: Phone number entry: The user enters their phone number. If the number isn't on WhatsApp, Meta returns an "Unable to deliver message" error (code 131026), so your fallback logic has to react to that delivery failure.The verification flow is structurally close to SMS OTP, with three key differences: WhatsApp only reaches numbers registered on WhatsApp, all messages must use pre-approved templates, and explicit user opt-in is required.
Step 2: OTP generation: Your backend generates a 6-digit code and stores it temporarily with an expiration timestamp. 5 to 10 minutes is the standard expiry window; shorter for sensitive financial actions.
Step 3: Template message send: You send the OTP using a Meta authentication template via the WhatsApp Cloud API. Unlike other templates, its body text is fixed by Meta: "<code> is your verification code." You can add an optional security disclaimer and an optional expiration warning, and you choose a button type: copy code, one-tap autofill or zero-tap.
Step 4: User receives and enters the code: The message arrives in the user's WhatsApp chat once their phone is online. On Android, a one-tap autofill button fills the code into your app, and zero-tap fills it with no tap at all. On iOS 26 and later, the code appears as a keyboard suggestion; earlier iOS versions use the copy code button.
Step 5: Validation Your backend checks the code against the stored value, confirms it has not expired, and verifies that the attempt count is within the permitted limit. If the check passes, the session is created.
How Much Does WhatsApp OTP Cost?
Meta has charged per message since July 1, 2025, and only for messages that are delivered. The rate depends on two things: the message category (OTPs use the authentication category) and the country calling code of the recipient's phone number.
Three details change the real cost:
Volume tiers. Authentication and utility rates drop as monthly volume grows. Tiers are set per market and reset each month.
Authentication-international rates. In some markets, Meta charges a higher authentication rate to businesses based in another country. They apply in India, Indonesia, Egypt, Malaysia, Nigeria, Pakistan, Saudi Arabia, South Africa and the UAE, with nine more markets added from October 1, 2026: Bangladesh, Iraq, Kazakhstan, Kuwait, Morocco, Nepal, Oman, Sri Lanka and Ukraine. A business only pays them once it sends more than 750,000 messages outside customer service windows to unique WhatsApp users in those countries, across all its accounts, in a moving 30-day period, and Meta gives 30 days' notice.
Fallback attempts. When WhatsApp can't deliver, the SMS or other channel that takes over is billed at its own rate.
Prelude Verify charges per verification and passes WhatsApp message costs through at zero markup. If you connect a WhatsApp Business Account with no payment method attached, Meta bills Prelude and your WhatsApp messages appear on your Prelude balance like any other channel. To compare provider fees, see our guide to the best WhatsApp OTP providers.
Technical Requirements
To send WhatsApp OTPs, you need:
A verified Meta Business Account
A WhatsApp Business phone number registered with Meta
At least one approved authentication template
Access to the WhatsApp Cloud API (directly via Meta, or through a provider like Prelude)
A secure backend to handle code generation, storage, expiry, and validation
Meta must approve each template before you can use it. Once approved, the template can be used indefinitely without re-approval unless you change the content.
Using a provider like Prelude simplifies this significantly. Prelude is a Meta Business Solution Provider (BSP), which means WhatsApp is a native channel rather than a third-party integration.
The Verify API manages the full verification lifecycle from initiating the verification and sending the message to performing retries, checking code validity, and returning the result with automatic channel selection and fallback routing across 30+ providers. Clients connect their own WhatsApp Business Account to Prelude via Meta's Embedded Signup flow, so messages are delivered from a branded WhatsApp number. Prelude creates the WhatsApp verification templates on your account automatically.
For a step-by-step setup with Prelude, see how to send WhatsApp OTPs.
WhatsApp OTP Compliance Requirements
WhatsApp has stricter compliance requirements than SMS for OTP delivery. These are not optional, and non-compliance risks account suspension.
Explicit user consent: You must obtain opt-in before messaging people on WhatsApp, including OTPs. Meta requires the opt-in to state clearly that the person agrees to receive messages from your business, and to name your business. You can collect it any way you choose, such as on your website, by SMS, through an IVR flow or on paper, and it can be general rather than specific to WhatsApp. It must also comply with local law.
Approved templates only: All outbound messages must use pre-approved templates. Free-form messages are not permitted outside of live customer support windows. Every OTP must use an approved authentication template.
Messaging limits: Meta caps how many unique users a business can message outside a customer service window in a moving 24-hour period. New business portfolios start at 250 users, then scale to 2,000, 10,000, 100,000 and unlimited, and the limit is shared by every number in the portfolio. You should understand them before launching at scale.
Template content rules: Authentication templates enforce these for you: the body is Meta's fixed text, with an optional security disclaimer and expiration warning. You can't add promotional content.
Rate limiting and security controls
WhatsApp's platform requirements and OTP security best practices align closely. Both require the same controls.
Code expiry: Expire codes after 5 to 10 minutes. For financial transactions or account recovery, 2 to 3 minutes is more appropriate. Turn on the template's expiration warning so users understand why a code stops working.
Attempt limits: Cap failed entry attempts at 3 to 5 per code. Invalidate the code immediately when the limit is reached. Do not allow unlimited guesses against a live code.
Resend rate limiting: Enforce a minimum interval between resend requests (30 to 60 seconds is standard). Cap total OTPs sent per user per hour (5 is a reasonable limit). This prevents abuse and reduces exposure to WhatsApp's messaging limits.
Number validation before sending: Validate the format and line type of the number, and screen it for fraud signals, before you send. Meta doesn't charge for undelivered WhatsApp messages, but a wasted attempt still delays the user, and the SMS fallback that follows is billed.
Prelude Verify scores every request for fraud and blocks suspicious ones before any code is sent, on WhatsApp or any other channel. For a comprehensive treatment of OTP security controls across all channels, see our OTP best practices guide.
When to Use WhatsApp OTP
WhatsApp OTP is not a universal SMS replacement. The right deployment model depends on your user geography and use case.
Use WhatsApp OTP when | Use SMS OTP when |
Users are in India, Brazil, Indonesia, LATAM, or Western Europe | Users are in North America or markets with low WhatsApp penetration |
SMS delivery is below 90% in a specific market | WhatsApp opt-in has not been collected from existing users |
International SMS costs are a meaningful line item at your volume | Users are in areas with limited data connectivity but reliable cellular |
You want codes encrypted in transit with the Signal protocol | Regulatory requirements mandate SMS for your use case |
WhatsApp is the user's primary communication channel | Your user base skews toward contexts where SMS is the default (B2B, enterprise) |
Use WhatsApp as the primary channel when: Your users are predominantly in markets with high WhatsApp penetration: India, Brazil, Indonesia, Mexico, most of Western Europe. If your SMS delivery rate in a specific country falls below 90%, WhatsApp should be your primary channel in that market.
Use WhatsApp as a fallback channel when: Your primary channel is SMS and you want automatic recovery when delivery fails. A well-configured fallback reduces failed verifications without requiring you to manage WhatsApp as a primary integration. Prelude handles this automatically: when an attempt fails to deliver, Verify retries on the next best route, which can be WhatsApp, another SMS provider or another channel.
Keep SMS as primary when: Your users are in markets with strong SMS infrastructure and lower WhatsApp penetration, or where WhatsApp opt-in collection adds friction to your onboarding flow. B2B products with enterprise users often fall into this category.
Do not use WhatsApp OTP when: Your users have not opted in. Sending WhatsApp OTPs without explicit consent is a compliance violation that risks account suspension. Check whether the consent you already hold covers messages from your business: Meta accepts a general opt-in, as long as it names your business and says the person agrees to receive messages from it.
Fallback Architecture
No single channel achieves 100% delivery in every market. A resilient OTP flow uses automatic fallback to recover failed verifications without requiring user action.
Prelude Verify doesn't follow a fixed sequence. For each attempt, it ranks every available route (a provider and channel pair) by cost and conversion, and when an attempt fails or the user asks for a new code, it moves to the next best route it hasn't tried. WhatsApp and every other non-SMS channel are used at most once per verification; SMS can be retried on different providers.
In a WhatsApp-first market, set preferred_channel to whatsapp: Prelude tries WhatsApp first and moves on to the next best route if it can't deliver. In an SMS-first market, leave it unset and WhatsApp becomes one of the routes Verify can fall back to.
The fallback decision is made at the routing layer, not in your application code. Prelude's Verify API handles channel selection and fallback logic automatically based on destination country, delivery signal, and your configured channel preferences. There is no additional code required on your side to handle the fallback; it is built into the routing layer.
For more on multi-channel fallback architecture, see our SMS delivery rate guide.
What's Next?
Prelude's Verify API manages the full verification lifecycle across WhatsApp, SMS, RCS, Telegram, Viber, Zalo and Silent Network Authentication with automatic channel selection, fallback routing across 30+ providers, fraud detection, and delivery analytics built in. See how it works or get started for free.
For further reading:
Why and how to send WhatsApp OTPs if you're still evaluating whether WhatsApp OTP is right for your product
FAQs
Can I automate OTP over WhatsApp?
Yes, and you should. The whole point of using the WhatsApp Business API is to send and verify OTPs programmatically, at scale. That said, "automated" doesn’t mean "unlimited" or "unregulated". You'll still need to follow WhatsApp’s template and opt-in policies.
What if a user doesn’t have WhatsApp?
The WhatsApp message fails to deliver, so your flow needs a fallback to SMS or another channel. Prelude Verify does this automatically by retrying on the next best route.
Can I send OTPs without a pre-approved template?
No. WhatsApp does not permit free-form outbound messages for non-support use cases. All OTP messages must use an approved authentication template.
Can I use the same OTP message for all users?
Yes. In fact you have to: authentication templates use Meta's fixed text, "<code> is your verification code," and only the code changes from user to user.
Is WhatsApp OTP cheaper than SMS?
It depends on the country. Meta prices authentication messages per delivered message by the recipient's country, so compare Meta's authentication rate with your SMS rate market by market. Check the authentication-international rate too if your users are in markets like India or Indonesia and your business is based elsewhere.
How do I handle users who don't opt in to WhatsApp messages?
Use SMS as the default channel and offer WhatsApp as an option during onboarding. Users who opt in can be routed to WhatsApp OTP; users who don't are served via SMS. Never send a WhatsApp OTP to a user who has not explicitly consented.
What is a WhatsApp authentication template?
It's the Meta template category for one-time codes. The body text is fixed ("<code> is your verification code"), you can add a security disclaimer and an expiration warning, and you pick a copy code, one-tap autofill or zero-tap button.
Is WhatsApp OTP more secure than SMS OTP?
It removes some SMS risks: codes travel encrypted with the Signal protocol. It doesn't remove phishing, and a hijacked phone number can still be used to register WhatsApp on a new device unless the user has two-step verification on.
Start optimizing your auth flow
Send verification text-messages anywhere in the world with the best price, the best deliverability and no spam.
