WhatsApp OTP with authentication templates
Send OTPs on WhatsApp with authentication templates: copy-code buttons, about ₹0.115 per OTP in India and no SMS DLT registration. Setup and best practices.
By Engage team, Shwastik Tech SolutionsUpdated 4 min read
Why send OTPs on WhatsApp
- Delivery you can see: sent, delivered and read statuses arrive by webhook.
- One tap: a copy-code button (or autofill on Android) instead of retyping digits.
- Trust: the code comes from your business profile with your name and logo, not an unknown sender ID.
- No DLT paperwork: WhatsApp templates are approved by Meta, not registered on India’s SMS DLT platforms.
How authentication templates work
Authentication templates are deliberately restricted so they can’t be abused:
- The body is Meta’s fixed text—“{{1}} is your verification code.”—with optional lines for a security warning (“For your security, do not share this code.”) and an expiry (“This code expires in 10 minutes.”).
- One button: copy code, or one-tap/zero-tap autofill for Android apps that integrate with WhatsApp.
- No links, media or emoji, and codes of up to 15 characters.
What it costs
Meta charges per delivered authentication message. On the current India rate card that’s about ₹0.115; high monthly volumes can unlock lower rates. If your business is registered outside India and sends OTPs to Indian numbers, the authentication-international rate (about ₹2.50) applies. More in our India pricing guide.
WhatsApp vs SMS for OTPs
| SMS (India) | ||
|---|---|---|
| Registration | Meta template approval | DLT entity, header and template registration |
| Delivery status | Sent, delivered, read | Delivery report from the operator |
| User experience | Copy-code / autofill button, branded sender | Text from a header ID |
| Reach | Users with WhatsApp | Any mobile number |
The common pattern is WhatsApp first, then SMS if the WhatsApp message isn’t delivered within a few seconds.
Sending an OTP with the API
With Engage, create an approved authentication template, then send it with one call to POST /v1/messages, passing the code as the template variable. Use an Idempotency-Key so retries never send two codes, and listen for the message.status webhook to trigger your SMS fallback. The messages reference has copy-paste examples.
Best practices
- Generate and check codes on your server; never trust the client.
- Expire codes quickly (5–10 minutes) and allow a limited number of attempts.
- Rate-limit OTP requests per phone number and per IP to stop SMS/WhatsApp pumping fraud.
- Don’t send marketing in authentication templates—they’ll be rejected.
Frequently asked questions
How much does a WhatsApp OTP cost in India?
About ₹0.115 per delivered authentication message on Meta’s India rate card, before GST. OTPs sent to Indian numbers by businesses outside India use the higher authentication-international rate.
Do I need DLT registration for WhatsApp OTPs?
No. DLT registration is a TRAI requirement for SMS in India. WhatsApp OTPs go through Meta’s WhatsApp Business Platform, where templates are approved by Meta instead.
Can I add a link to a WhatsApp authentication template?
No. Authentication templates use Meta’s fixed wording and can’t contain URLs, media or emoji. They support a copy-code or one-tap autofill button.