Send one-time passwords on WhatsApp using Meta's authenticat ion templates, with SMS as a fallback.
More Indian users check WhatsApp before their SMS inbox, so many apps now send login and payment OTPs on WhatsApp first. Meta allows this only through a dedicated template category built for verification codes.
This page explains how WhatsApp authentication templates work, what each OTP costs, how to integrate the API, and why you still need SMS behind it. If you only need SMS OTPs today, see our OTP SMS service.
Meta sorts every WhatsApp template into a category: marketing, utility or authentication. OTPs must use the authentication category. Unlike other templates, its wording is set by Meta, not written by you.
| Part | What it contains | Can you change it? |
|---|---|---|
| Body text | "<code> is your verification code." | No, the wording is fixed by Meta |
| Security recommendation | A short note telling the user not to share the code | Optional: on or off |
| Expiry warning | States that the code expires in a set number of minutes | Optional: 1 to 90 minutes |
| Button | Copy code, or one-tap autofill on Android | You choose the button type |
Because the text is fixed, authentication templates are approved quickly and can't be used to slip in promotional content. If you submit an OTP under the marketing or utility category instead, it is likely to be rejected. See our template rejection guide.
Template structure from Meta's authentication templates documentation, checked 19 October 2026.
The user taps a button to copy the code, then pastes it into your app or website. Works on every device, and is the only option for websites and older iPhones.
On Android, the button opens your app and fills in the code. On iOS 26 and later, the keyboard offers the code as a suggestion without extra integration.
Android only. Your app receives the code in the background and the user never leaves the screen. Needs the most app-side work.
Most teams start with copy code, because it works everywhere, and add one-tap for their Android app once the basic flow is live.
A WhatsApp OTP has two costs: Meta's per-message charge for each authentication message, and your provider's platform fee.
| WhatsApp OTP | SMS OTP | |
|---|---|---|
| Per message | About ₹0.115 (Meta's authentication rate for India) | ₹0.40 at 5,000 SMS down to ₹0.12 from 1 lakh SMS |
| Platform fee | ₹7,999 for 3 months (MetaReach WhatsApp Business API plan) | None; slab rate only |
| Reaches | Users with WhatsApp on that number | Any mobile number |
| Example: 30,000 OTPs a month for 3 months | 90,000 × ₹0.115 = ₹10,350 + ₹7,999 = ₹18,349 | 90,000 at ₹0.20 = ₹18,000 |
Meta's India authentication rate as reported by multiple WhatsApp providers in October 2026. SMS rates from our pricing page; see also OTP SMS pricing.
This is the general shape of a copy-code authentication message in Meta's Cloud API. The code appears in both the body and the button. Endpoint and authentication details for your account are shared at onboarding.
{
"messaging_product": "whatsapp",
"to": "91XXXXXXXXXX",
"type": "template",
"template": {
"name": "login_otp",
"language": { "code": "en" },
"components": [
{ "type": "body",
"parameters": [ { "type": "text", "text": "482913" } ] },
{ "type": "button", "sub_type": "url", "index": "0",
"parameters": [ { "type": "text", "text": "482913" } ] }
]
}
}WhatsApp can only reach numbers that have WhatsApp installed and connected to the internet. Some users will be offline, on a different number, or not on WhatsApp at all. Without a fallback, they can't log in.
The usual pattern is simple: send on WhatsApp first, wait 20 to 30 seconds for a delivery status, then send the same code by SMS if it hasn't arrived. For the last step, some teams add a voice OTP call. Our SMS and voice OTP fallback guide covers the timing in detail, and SMS OTPs in India need DLT-approved templates; see the OTP SMS DLT guide.
It is the WhatsApp Business API used to send one-time passwords. Your server generates the code and sends it in a WhatsApp authentication template, which shows the code with a copy-code or one-tap button.
It is Meta's template category for verification codes. The body text is fixed as "<code> is your verification code", with an optional security note, an optional expiry time of 1 to 90 minutes, and a copy-code or one-tap autofill button.
Meta charges about ₹0.115 per authentication message in India, as reported by WhatsApp providers in October 2026, excluding GST. Your provider's platform fee is added on top; MetaReach's WhatsApp Business API plan is ₹7,999 for 3 months plus GST.
Per message, often yes: about ₹0.115 on WhatsApp against ₹0.12 to ₹0.40 for SMS depending on volume. But WhatsApp also has a platform fee and only reaches users on WhatsApp, so most businesses use WhatsApp first with SMS as a fallback.
Meta's one-tap autofill button is for Android. On iOS 26 and later, the keyboard can suggest the code from the notification without extra integration. Older iPhones and websites use the copy-code button.
DLT registration applies to SMS in India, not to WhatsApp messages. If you use SMS as a fallback, which most businesses do, the SMS OTP template must be DLT-approved.
Tell us your monthly OTP volume, your app platforms and your current SMS setup. We'll map out a WhatsApp-first flow with SMS fallback and send a written quote.
WhatsApp is a trademark of Meta Platforms, Inc. MetaReach Marketing is not affiliated with or endorsed by Meta. Template rules and rates are based on Meta's documentation and provider reports checked on 19 October 2026 and may change.
From startups to enterprises — brands that grow with MetaReach
