How do you send OTP on WhatsApp?
Send OTP on WhatsApp via Cloud API — authentication templates, copy-code buttons, latency benchmarks, security, fallback rules, and fintech deployment on Ominiflow. Use WhatsApp Cloud API with an approved authentication template, generate a one-time code on your server, and send via Graph API or Ominiflow.
Last updated: 6 July 2026
SMS OTPs fail. Codes arrive late, SIM-swap attacks happen, and support tickets pile up. WhatsApp OTP delivers login codes in 1–3 seconds over encrypted channels with verified business identity and optional copy-code buttons for one-tap verification.
This guide covers authentication templates, Cloud API setup, security controls, and production patterns for fintech, e-commerce, and SaaS teams deploying OTP on Ominiflow or direct Graph API.
Too long? Start here
- WhatsApp OTP requires WhatsApp Business API (Cloud API) — not the consumer app
- Use authentication template category with code + expiry variables
- Delivery typically 1–3 seconds when user has WhatsApp active
- Rate-limit requests; never log full OTP in plaintext
- India Meta authentication rates are lower tier than marketing — verify on rate card
- Ominiflow handles tokens, webhooks, and template management for faster go-live
What is WhatsApp OTP?
A one-time password sent through WhatsApp to verify logins, payments, or registrations. Unlike SMS, messages travel over WhatsApp's encrypted network and display your verified business name.
WhatsApp OTP vs SMS vs email
| Channel | Typical delivery | Security | Cost at scale |
|---|---|---|---|
| 1–3 seconds | E2E encryption; lower SIM-swap risk | ₹0.115 / 24h auth conversation in India; retries in-window free | |
| SMS | 5–30+ seconds | SIM-swap exposure | ₹0.12–₹0.20 per transactional SMS; every resend billed |
| Minutes | Phishing risk | Low but poor conversion |
Full India cost, delivery, and fallback math: WhatsApp vs SMS for OTP in India. Meta-published (not Ominiflow): Banco Inter made WhatsApp primary OTP vs SMS — +8 account verification, +10 password reset (May 2025).
Requirements
- Verified business in Meta Business Manager
- Dedicated phone number not on consumer WhatsApp
- Approved authentication template
- Backend to generate, store (hashed), and validate codes
Setup: WhatsApp Business API setup
How to send OTP (3 steps)
Step 1: Create authentication template
Example body: {1} is your verification code. For your security, do not share this code. Expires in {2} minutes.
No emojis, links, or media in authentication templates. Enable copy-code button in template settings.
Step 2: Connect Cloud API
Integrate via Graph API or Ominiflow BSP for token management and delivery webhooks. Architecture: integration guide.
Step 3: Automate delivery
- User requests OTP
- Backend generates 4–6 digit code (5–10 min TTL, store hashed)
- POST template message with code variables
- Validate submission; invalidate after success or expiry
Security best practices
- Rate-limit per phone and IP (e.g. 3 requests / 15 min)
- Never log full OTP in production logs
- Use authentication category only — not marketing templates
- SMS fallback only where regulation requires
- Monitor failed delivery webhooks
- Rotate API tokens via secrets manager
Troubleshooting
| Issue | Cause | Fix |
|---|---|---|
| Template rejected | Promotional language in auth template | Remove offers; use plain verification copy |
| Delivery slow | User offline on WhatsApp | Fallback channel or retry prompt |
| Error #132000 | Variable count mismatch | Match {1}/{2} to payload |
Send OTP with Ominiflow
Ominiflow provides Cloud API access, authentication template workflows, and delivery analytics for fintech and SaaS onboarding. Product page: WhatsApp OTP API.
FAQ
How fast is WhatsApp OTP delivery? expand_more
Usually 1–3 seconds when the user has WhatsApp active and your template is approved.
What template category is used? expand_more
Authentication templates with code and optional expiry variables.
Can I use my existing WhatsApp number? expand_more
Must migrate off consumer app before API use.
Is WhatsApp OTP more secure than SMS? expand_more
End-to-end encryption and verified business delivery reduce SIM-swap and spoofing risks vs SMS.
Do I need developers? expand_more
Backend code required to generate and validate codes. Ominiflow handles API infra and template ops.
What about RBI or compliance? expand_more
Consult legal for your sector. Many fintechs use WhatsApp OTP with documented fallback policies.
How much does WhatsApp OTP cost in India? expand_more
Meta authentication conversation rates — ₹0.115 per 24-hour window in India. Verify on Meta's rate card; Ominiflow passes at cost. Full comparison: WhatsApp vs SMS for OTP. Updated July 2026. WhatsApp OTP authentication guide for engineering and product teams.
