How to Use WhatsApp OTP for Login & Verification
Secure more logins, prevent fraud, and cut costs using WhatsApp for OTP delivery
Nam Hing Chau
Marketing Manager
Summary
WhatsApp OTP delivers verification codes through WhatsApp instead of SMS — offering higher delivery rates, a familiar interface, and lower costs in regions like India where SMS is expensive or unreliable. The article also walks through implementation and separates myth from reality on unlimited OTP bots and end-to-end encryption security claims.
WhatsApp OTP uses the WhatsApp Business API to deliver one-time passwords to users via WhatsApp instead of SMS. The verification goal is the same: confirm a phone number during login, signup, or a sensitive action but the delivery mechanism, compliance requirements, and security controls differ significantly from SMS.
This guide is a technical reference for developers and product teams building WhatsApp OTP into a product. It covers how the flow works under the hood, what you need to set it up, what compliance requires, how to secure it, and how to configure fallback routing.
If you're still evaluating whether WhatsApp OTP is the right channel for your product, start with how and why to send WhatsApp OTPs first. For a broader look at OTP channel selection, see our best OTP providers guide.
WhatsApp OTP vs SMS OTP: A Direct Comparison
WhatsApp OTP | SMS OTP | |
Delivery infrastructure | Internet data (Wi-Fi or mobile) | Cellular carrier network |
Carrier filtering risk | None | High in some markets |
End-to-end encryption | Yes | No |
Delivery speed | Under 2 seconds (typical) | 5-30 seconds; can fail entirely |
Cost | Category-based pricing, not destination-based; lower in international markets | Higher, especially for international destinations |
Template requirement | Required (Meta approval) | No |
User opt-in required | Yes | No (for transactional) |
Works without cellular signal | Yes (Wi-Fi only) | No |
SIM swap vulnerability | No | Yes |
Best markets | India, Brazil, Indonesia, LATAM, Western Europe | Global fallback, North America, markets with low WhatsApp penetration |
How WhatsApp OTP Works
The verification flow is structurally close to SMS OTP, with three key differences: WhatsApp requires number registration checks before sending, all messages must use pre-approved templates, and explicit user opt-in is required.
Step 1: Phone number entry The user enters their phone number. Your backend checks whether the number is reachable on WhatsApp via the API. If it is not registered, the API returns an undeliverable callback and your system falls back to SMS automatically.
Step 2: OTP generation Your backend generates a 6-digit code and stores it temporarily with an expiration timestamp. 5 to 10 minutes is the standard expiry window; shorter for sensitive financial actions.
Step 3: Template message send You send the OTP using a pre-approved WhatsApp message template via the WhatsApp Cloud API. The template is fixed in structure; the code is injected as a dynamic variable at send time. A standard OTP template looks like:
"Your verification code is {{1}}. It expires in 5 minutes. Do not share it with anyone."
Step 4: User receives and enters the code The message arrives in the user's WhatsApp chat within one to two seconds under normal conditions. The user copies the code into your app or taps a deep link if you've implemented one.
Step 5: Validation Your backend checks the code against the stored value, confirms it has not expired, and verifies that the attempt count is within the permitted limit. If the check passes, the session is created.
Technical Requirements
To send WhatsApp OTPs, you need:
A verified Meta Business Account
A WhatsApp Business phone number registered with Meta
At least one approved message template containing an OTP variable
Access to the WhatsApp Cloud API (directly via Meta, or through a provider like Prelude)
A secure backend to handle code generation, storage, expiry, and validation
The Meta template approval process typically takes 24 to 48 hours for the first submission. Templates for authentication use cases are generally approved faster than marketing templates. Once approved, the template can be used indefinitely without re-approval unless you change the content.
Using a provider like Prelude simplifies this significantly. Prelude is a Meta Business Solution Provider (BSP), which means WhatsApp is a native channel rather than a third-party integration.
The Verify API manages the full verification lifecycle from initiating the verification and sending the message to performing retries, checking code validity, and returning the result with automatic channel selection and fallback routing across 30+ providers. Clients connect their own WhatsApp Business Account to Prelude via Meta's Embedded Signup flow, so messages are delivered from a branded WhatsApp number. Prelude also supports two-way messaging over WhatsApp, allowing your application to receive and reply to inbound messages within the 24-hour conversation window.
WhatsApp OTP Compliance Requirements
WhatsApp has stricter compliance requirements than SMS for OTP delivery. These are not optional, and non-compliance risks account suspension.
Explicit user consent. You must obtain opt-in before sending any WhatsApp message, including transactional OTPs. The consent must be clear and specific: users must know they are agreeing to receive WhatsApp messages from your business. A pre-ticked checkbox during registration is insufficient. This must be a deliberate, affirmative action.
Approved templates only. All outbound messages must use pre-approved templates. Free-form messages are not permitted outside of live customer support windows. Every OTP template must be submitted to Meta and approved before use.
Rate limits. WhatsApp enforces per-number and per-account rate limits. Exceeding them risks throttling or temporary suspension. For most products, the practical limits are well above normal OTP volumes, but you should understand them before launching at scale.
Template content rules. OTP templates must be neutral, transactional, and free of promotional content. The message should contain the code, the expiry window, and a note not to share it. Nothing more.
Rate limiting and security controls
WhatsApp's platform requirements and OTP security best practices align closely. Both require the same controls.
Code expiry: Expire codes after 5 to 10 minutes. For financial transactions or account recovery, 2 to 3 minutes is more appropriate. Always include the expiry window in the message itself so users understand why a code stops working.
Attempt limits: Cap failed entry attempts at 3 to 5 per code. Invalidate the code immediately when the limit is reached. Do not allow unlimited guesses against a live code.
Resend rate limiting: Enforce a minimum interval between resend requests (30 to 60 seconds is standard). Cap total OTPs sent per user per hour (5 is a reasonable limit). This prevents abuse and reduces exposure to WhatsApp's per-account rate limits.
Number validation before sending: Check whether the number is reachable on WhatsApp before dispatching. This avoids undeliverable message costs and is a useful early fraud signal: VoIP numbers and bulk-registered numbers are disproportionately non-WhatsApp accounts.
For a comprehensive treatment of OTP security controls across all channels, see our OTP best practices guide.
When to Use WhatsApp OTP
WhatsApp OTP is not a universal SMS replacement. The right deployment model depends on your user geography and use case.
Use WhatsApp OTP when | Use SMS OTP when |
Users are in India, Brazil, Indonesia, LATAM, or Western Europe | Users are in North America or markets with low WhatsApp penetration |
SMS delivery is below 90% in a specific market | WhatsApp opt-in has not been collected from existing users |
International SMS costs are a meaningful line item at your volume | Users are in areas with limited data connectivity but reliable cellular |
You want end-to-end encryption by default | Regulatory requirements mandate SMS for your use case |
WhatsApp is the user's primary communication channel | Your user base skews toward contexts where SMS is the default (B2B, enterprise) |
Use WhatsApp as the primary channel when: Your users are predominantly in markets with high WhatsApp penetration: India, Brazil, Indonesia, Mexico, most of Western Europe. If your SMS delivery rate in a specific country falls below 90%, WhatsApp should be your primary channel in that market.
Use WhatsApp as a fallback channel when: Your primary channel is SMS and you want automatic recovery when delivery fails. A well-configured fallback reduces failed verifications without requiring you to manage WhatsApp as a primary integration. Prelude handles this routing automatically: if SMS delivery fails, the request routes to WhatsApp without any additional code on your side.
Keep SMS as primary when: Your users are in markets with strong SMS infrastructure and lower WhatsApp penetration, or where WhatsApp opt-in collection adds friction to your onboarding flow. B2B products with enterprise users often fall into this category.
Do not use WhatsApp OTP when: Your users have not opted in. Sending WhatsApp OTPs without explicit consent is a compliance violation that risks account suspension. If your existing user base has not been presented with a WhatsApp opt-in, you cannot retroactively send them WhatsApp messages.
Fallback Architecture
No single channel achieves 100% delivery in every market. A resilient OTP flow uses automatic fallback to recover failed verifications without requiring user action.
The standard Prelude routing sequence for WhatsApp-primary markets:
Attempt WhatsApp OTP: instant delivery for users with WhatsApp registered
If undeliverable, fall back to SMS: catches users without WhatsApp
If SMS fails, fall back to voice: catches users with unreliable SMS in that region
For markets where SMS is primary:
Attempt SMS OTP
If delivery fails or times out, fall back to WhatsApp
If WhatsApp undeliverable, fall back to voice
The fallback decision is made at the routing layer, not in your application code. Prelude's Verify API handles channel selection and fallback logic automatically based on destination country, delivery signal, and your configured channel preferences. There is no additional code required on your side to handle the fallback; it is built into the routing layer.
For more on multi-channel fallback architecture, see our SMS delivery rate guide.
What's Next?
Prelude's Verify API manages the full verification lifecycle across WhatsApp, SMS, RCS, and Silent Network Authentication with automatic channel selection, fallback routing across 30+ providers, fraud detection, and delivery analytics built in. Businesses typically see a 20-30% increase in conversion and 30-40% reduction in monthly costs. See how it works or get started for free.
For further reading:
Why and how to send WhatsApp OTPs if you're still evaluating whether WhatsApp OTP is right for your product
FAQs
Can I automate OTP over WhatsApp?
Yes, and you should. The whole point of using the WhatsApp Business API is to send and verify OTPs programmatically, at scale. That said, "automated" doesn’t mean "unlimited" or "unregulated". You'll still need to follow WhatsApp’s template and opt-in policies.
What if a user doesn’t have WhatsApp?
You should always check if the number is reachable on WhatsApp before trying to send an OTP. If it’s not, fallback to SMS or another channel. Good providers handle this logic automatically, so you don’t need to reinvent it.
Can I send OTPs without a pre-approved template?
No. WhatsApp does not permit free-form outbound messages for non-support use cases. All OTP messages must use an approved template. The approval process takes 24 to 48 hours for new templates.
Can I use the same OTP message for all users?
Yes, but only if it’s based on an approved template. WhatsApp doesn’t allow free-text messages outside of live customer support windows. So your OTP message must be generic in structure, with dynamic variables (e.g., {{1}}) filled in at send time.
Is WhatsApp OTP cheaper than SMS?
In many markets, yes. WhatsApp authentication pricing is based on message category rather than destination country, which removes the international carrier surcharges that make SMS expensive in high-cost markets like India, Brazil, France, and Germany. At high volumes in those markets, the cost difference can be significant.
How do I handle users who don't opt in to WhatsApp messages?
Use SMS as the default channel and offer WhatsApp as an option during onboarding. Users who opt in can be routed to WhatsApp OTP; users who don't are served via SMS. Never send a WhatsApp OTP to a user who has not explicitly consented.
How long does Meta template approval take?
24 to 48 hours for the first submission in most cases. Authentication use case templates are generally approved faster than marketing templates. Once approved, a template does not require re-approval unless you change its content.
WhatsApp OTP uses the WhatsApp Business API to deliver one-time passwords to users via WhatsApp instead of SMS. The verification goal is the same: confirm a phone number during login, signup, or a sensitive action but the delivery mechanism, compliance requirements, and security controls differ significantly from SMS.
This guide is a technical reference for developers and product teams building WhatsApp OTP into a product. It covers how the flow works under the hood, what you need to set it up, what compliance requires, how to secure it, and how to configure fallback routing.
If you're still evaluating whether WhatsApp OTP is the right channel for your product, start with how and why to send WhatsApp OTPs first. For a broader look at OTP channel selection, see our best OTP providers guide.
WhatsApp OTP vs SMS OTP: A Direct Comparison
WhatsApp OTP | SMS OTP | |
Delivery infrastructure | Internet data (Wi-Fi or mobile) | Cellular carrier network |
Carrier filtering risk | None | High in some markets |
End-to-end encryption | Yes | No |
Delivery speed | Under 2 seconds (typical) | 5-30 seconds; can fail entirely |
Cost | Category-based pricing, not destination-based; lower in international markets | Higher, especially for international destinations |
Template requirement | Required (Meta approval) | No |
User opt-in required | Yes | No (for transactional) |
Works without cellular signal | Yes (Wi-Fi only) | No |
SIM swap vulnerability | No | Yes |
Best markets | India, Brazil, Indonesia, LATAM, Western Europe | Global fallback, North America, markets with low WhatsApp penetration |
How WhatsApp OTP Works
The verification flow is structurally close to SMS OTP, with three key differences: WhatsApp requires number registration checks before sending, all messages must use pre-approved templates, and explicit user opt-in is required.
Step 1: Phone number entry The user enters their phone number. Your backend checks whether the number is reachable on WhatsApp via the API. If it is not registered, the API returns an undeliverable callback and your system falls back to SMS automatically.
Step 2: OTP generation Your backend generates a 6-digit code and stores it temporarily with an expiration timestamp. 5 to 10 minutes is the standard expiry window; shorter for sensitive financial actions.
Step 3: Template message send You send the OTP using a pre-approved WhatsApp message template via the WhatsApp Cloud API. The template is fixed in structure; the code is injected as a dynamic variable at send time. A standard OTP template looks like:
"Your verification code is {{1}}. It expires in 5 minutes. Do not share it with anyone."
Step 4: User receives and enters the code The message arrives in the user's WhatsApp chat within one to two seconds under normal conditions. The user copies the code into your app or taps a deep link if you've implemented one.
Step 5: Validation Your backend checks the code against the stored value, confirms it has not expired, and verifies that the attempt count is within the permitted limit. If the check passes, the session is created.
Technical Requirements
To send WhatsApp OTPs, you need:
A verified Meta Business Account
A WhatsApp Business phone number registered with Meta
At least one approved message template containing an OTP variable
Access to the WhatsApp Cloud API (directly via Meta, or through a provider like Prelude)
A secure backend to handle code generation, storage, expiry, and validation
The Meta template approval process typically takes 24 to 48 hours for the first submission. Templates for authentication use cases are generally approved faster than marketing templates. Once approved, the template can be used indefinitely without re-approval unless you change the content.
Using a provider like Prelude simplifies this significantly. Prelude is a Meta Business Solution Provider (BSP), which means WhatsApp is a native channel rather than a third-party integration.
The Verify API manages the full verification lifecycle from initiating the verification and sending the message to performing retries, checking code validity, and returning the result with automatic channel selection and fallback routing across 30+ providers. Clients connect their own WhatsApp Business Account to Prelude via Meta's Embedded Signup flow, so messages are delivered from a branded WhatsApp number. Prelude also supports two-way messaging over WhatsApp, allowing your application to receive and reply to inbound messages within the 24-hour conversation window.
WhatsApp OTP Compliance Requirements
WhatsApp has stricter compliance requirements than SMS for OTP delivery. These are not optional, and non-compliance risks account suspension.
Explicit user consent. You must obtain opt-in before sending any WhatsApp message, including transactional OTPs. The consent must be clear and specific: users must know they are agreeing to receive WhatsApp messages from your business. A pre-ticked checkbox during registration is insufficient. This must be a deliberate, affirmative action.
Approved templates only. All outbound messages must use pre-approved templates. Free-form messages are not permitted outside of live customer support windows. Every OTP template must be submitted to Meta and approved before use.
Rate limits. WhatsApp enforces per-number and per-account rate limits. Exceeding them risks throttling or temporary suspension. For most products, the practical limits are well above normal OTP volumes, but you should understand them before launching at scale.
Template content rules. OTP templates must be neutral, transactional, and free of promotional content. The message should contain the code, the expiry window, and a note not to share it. Nothing more.
Rate limiting and security controls
WhatsApp's platform requirements and OTP security best practices align closely. Both require the same controls.
Code expiry: Expire codes after 5 to 10 minutes. For financial transactions or account recovery, 2 to 3 minutes is more appropriate. Always include the expiry window in the message itself so users understand why a code stops working.
Attempt limits: Cap failed entry attempts at 3 to 5 per code. Invalidate the code immediately when the limit is reached. Do not allow unlimited guesses against a live code.
Resend rate limiting: Enforce a minimum interval between resend requests (30 to 60 seconds is standard). Cap total OTPs sent per user per hour (5 is a reasonable limit). This prevents abuse and reduces exposure to WhatsApp's per-account rate limits.
Number validation before sending: Check whether the number is reachable on WhatsApp before dispatching. This avoids undeliverable message costs and is a useful early fraud signal: VoIP numbers and bulk-registered numbers are disproportionately non-WhatsApp accounts.
For a comprehensive treatment of OTP security controls across all channels, see our OTP best practices guide.
When to Use WhatsApp OTP
WhatsApp OTP is not a universal SMS replacement. The right deployment model depends on your user geography and use case.
Use WhatsApp OTP when | Use SMS OTP when |
Users are in India, Brazil, Indonesia, LATAM, or Western Europe | Users are in North America or markets with low WhatsApp penetration |
SMS delivery is below 90% in a specific market | WhatsApp opt-in has not been collected from existing users |
International SMS costs are a meaningful line item at your volume | Users are in areas with limited data connectivity but reliable cellular |
You want end-to-end encryption by default | Regulatory requirements mandate SMS for your use case |
WhatsApp is the user's primary communication channel | Your user base skews toward contexts where SMS is the default (B2B, enterprise) |
Use WhatsApp as the primary channel when: Your users are predominantly in markets with high WhatsApp penetration: India, Brazil, Indonesia, Mexico, most of Western Europe. If your SMS delivery rate in a specific country falls below 90%, WhatsApp should be your primary channel in that market.
Use WhatsApp as a fallback channel when: Your primary channel is SMS and you want automatic recovery when delivery fails. A well-configured fallback reduces failed verifications without requiring you to manage WhatsApp as a primary integration. Prelude handles this routing automatically: if SMS delivery fails, the request routes to WhatsApp without any additional code on your side.
Keep SMS as primary when: Your users are in markets with strong SMS infrastructure and lower WhatsApp penetration, or where WhatsApp opt-in collection adds friction to your onboarding flow. B2B products with enterprise users often fall into this category.
Do not use WhatsApp OTP when: Your users have not opted in. Sending WhatsApp OTPs without explicit consent is a compliance violation that risks account suspension. If your existing user base has not been presented with a WhatsApp opt-in, you cannot retroactively send them WhatsApp messages.
Fallback Architecture
No single channel achieves 100% delivery in every market. A resilient OTP flow uses automatic fallback to recover failed verifications without requiring user action.
The standard Prelude routing sequence for WhatsApp-primary markets:
Attempt WhatsApp OTP: instant delivery for users with WhatsApp registered
If undeliverable, fall back to SMS: catches users without WhatsApp
If SMS fails, fall back to voice: catches users with unreliable SMS in that region
For markets where SMS is primary:
Attempt SMS OTP
If delivery fails or times out, fall back to WhatsApp
If WhatsApp undeliverable, fall back to voice
The fallback decision is made at the routing layer, not in your application code. Prelude's Verify API handles channel selection and fallback logic automatically based on destination country, delivery signal, and your configured channel preferences. There is no additional code required on your side to handle the fallback; it is built into the routing layer.
For more on multi-channel fallback architecture, see our SMS delivery rate guide.
What's Next?
Prelude's Verify API manages the full verification lifecycle across WhatsApp, SMS, RCS, and Silent Network Authentication with automatic channel selection, fallback routing across 30+ providers, fraud detection, and delivery analytics built in. Businesses typically see a 20-30% increase in conversion and 30-40% reduction in monthly costs. See how it works or get started for free.
For further reading:
Why and how to send WhatsApp OTPs if you're still evaluating whether WhatsApp OTP is right for your product
FAQs
Can I automate OTP over WhatsApp?
Yes, and you should. The whole point of using the WhatsApp Business API is to send and verify OTPs programmatically, at scale. That said, "automated" doesn’t mean "unlimited" or "unregulated". You'll still need to follow WhatsApp’s template and opt-in policies.
What if a user doesn’t have WhatsApp?
You should always check if the number is reachable on WhatsApp before trying to send an OTP. If it’s not, fallback to SMS or another channel. Good providers handle this logic automatically, so you don’t need to reinvent it.
Can I send OTPs without a pre-approved template?
No. WhatsApp does not permit free-form outbound messages for non-support use cases. All OTP messages must use an approved template. The approval process takes 24 to 48 hours for new templates.
Can I use the same OTP message for all users?
Yes, but only if it’s based on an approved template. WhatsApp doesn’t allow free-text messages outside of live customer support windows. So your OTP message must be generic in structure, with dynamic variables (e.g., {{1}}) filled in at send time.
Is WhatsApp OTP cheaper than SMS?
In many markets, yes. WhatsApp authentication pricing is based on message category rather than destination country, which removes the international carrier surcharges that make SMS expensive in high-cost markets like India, Brazil, France, and Germany. At high volumes in those markets, the cost difference can be significant.
How do I handle users who don't opt in to WhatsApp messages?
Use SMS as the default channel and offer WhatsApp as an option during onboarding. Users who opt in can be routed to WhatsApp OTP; users who don't are served via SMS. Never send a WhatsApp OTP to a user who has not explicitly consented.
How long does Meta template approval take?
24 to 48 hours for the first submission in most cases. Authentication use case templates are generally approved faster than marketing templates. Once approved, a template does not require re-approval unless you change its content.
Start optimizing your auth flow
Send verification text-messages anywhere in the world with the best price, the best deliverability and no spam.
