How does WhatsApp OTP work?
WhatsApp Authentication templates deliver login OTPs with higher read rates than SMS in India — strict Meta copy rules, ₹0.115/conversation (India auth), and a proven fallback pattern when delivery fails. Authentication templates deliver a one-time code via Cloud API. Your backend generates the code, sends via approved template, verifies server-side with TTL, and falls back to SMS on delivery failure.
Last updated: 24 June 2026
Quick answer: WhatsApp OTP verification uses Meta Authentication templates — a one-time code with expiry, no marketing copy, and optional copy-paste button support. In India, read rates often beat SMS because codes land inside an app users already check dozens of times daily. Meta Authentication pricing is ₹0.115 per 24-hour conversation in India (Ominiflow pass-through; verify on Meta's rate card). That is often cheaper than DLT SMS once you count resends — full math in WhatsApp vs SMS for OTP in India.
Authentication is not a shortcut around compliance. RBI and PCI expectations for OTP channels still apply: short TTL, rate limiting per phone and IP, audit logging, and no code reuse. The channel changes; the security bar does not. Banks, fintech apps, and marketplaces in India are increasingly adding WhatsApp as a primary or secondary OTP channel alongside SMS and email.
WhatsApp OTP vs SMS — when each wins
| Factor | SMS OTP | WhatsApp Authentication |
|---|---|---|
| Read rate | ~95% but DLT filtering and carrier delays vary | ~98% with in-app prominence and read receipts |
| Cost (India) | ₹0.12–0.20/SMS at volume | ₹0.115/conversation (Meta Authentication) |
| User friction | Switch apps, manual entry | One-tap copy button on supported devices |
| Fallback | Primary channel for most stacks | SMS fallback strongly recommended within 30s |
| Copy rules | Flexible under TRAI DLT | Strict Authentication format — no promos, limited variables |
| International | Reliable globally with local routes | Strong where WhatsApp penetration is high (India, Brazil, UAE) |
Run a 30-day A/B test on login flows before committing. Measure time-to-verify, resend rate, and support contacts — not just per-message cost. India comparison: WhatsApp vs SMS for OTP · Setup: send OTP on WhatsApp.
Authentication template rules
Meta enforces a narrow format for Authentication templates. Deviations trigger rejection or miscategorization — which can inflate your bill if a template lands in Marketing instead of Authentication.
- Allowed variables: OTP code, expiry time, optional security disclaimer
- Not allowed: Product promos, discount codes, cross-sell copy, URLs to marketing pages
- Buttons: Copy-code button (one-tap paste) where device supports it
- Language: Submit Hindi, English, or Hinglish variants separately — mixed-language copy often fails review
Production implementation pattern
- User enters phone on login, signup, or high-risk action (password reset, payout)
- Backend generates cryptographically secure code, stores hash with 5-minute TTL
- API call to Ominiflow with approved Authentication template + code variable
- User receives code with optional one-tap copy button
- Server verifies code, invalidates on success, increments failed-attempt counter
- If WhatsApp delivery webhook shows failure or no read in 30s, trigger SMS fallback automatically
- Log channel used, delivery status, and verification outcome for audit
Security and abuse prevention
| Control | Recommended setting |
|---|---|
| Code TTL | 5 minutes maximum |
| Resend cooldown | 60 seconds between sends per phone |
| Max attempts | 3–5 before lockout or CAPTCHA |
| Rate limit | Per IP + per phone + per account |
| Code format | 6 digits numeric; avoid predictable sequences |
These controls mirror what auditors expect from SMS OTP programs. WhatsApp does not exempt you from logging or incident response.
Related: Banking API India · KYC document flows · Template approval guide · Pricing · Platform comparisons
FAQ
Can I customize OTP message copy? expand_more
Authentication templates allow limited variables — code, expiry, and a short security line. No promotional text, brand slogans, or product mentions. Submit separate templates per language.
Is WhatsApp OTP PCI/RBI compliant? expand_more
The channel is compliant when code TTL, rate limiting, encryption in transit, and audit logging meet your security policy — same bar as SMS OTP. Document your fallback logic and retention policy for regulators.
What if the user does not have WhatsApp? expand_more
Always offer SMS or email fallback. Detect undelivered webhooks and route automatically — do not leave users stuck on a spinner.
