Quick Answer
A WhatsApp OTP is a one-time password sent to a user's WhatsApp number instead of, or alongside, an SMS. Businesses send it through the WhatsApp Business Platform as an authentication template: Meta fixes the wording, the code sits in a parameter, and the message can carry a copy-code or one-tap autofill button. No DLT registration is needed for WhatsApp itself, but users must have WhatsApp, so most Indian apps keep SMS OTP as a fallback.
How does a WhatsApp OTP work?
Meta handles one-time passwords through a dedicated template category called Authentication. Its format is deliberately strict so that users can trust every code they receive.
Your server generates the code, then calls the WhatsApp OTP API with the user's number, the approved authentication template and the code as a parameter. WhatsApp shows a preset message such as “482913 is your verification code.”, with an optional security line (“For your security, do not share this code.”) and an optional expiry line. Links, media and emojis are not allowed in authentication templates, and the code itself can be up to 15 characters.
The user taps the button, the code reaches your app or website, and your server checks it. Delivery and read status come back to you as webhooks, so you can trigger an SMS or voice retry if the message is not delivered within your time limit.
| Button type | What the user does | Where it works |
|---|
| Copy code | Taps once to copy the code, then pastes it into your app or website. | All devices, including web and iPhone users |
| One-tap autofill | Taps the button and your Android app fills the code automatically. | Android apps that complete Meta's app handshake; falls back to copy code otherwise |
| Zero-tap | Nothing: the code is passed to your Android app in the background. | Android apps that implement zero-tap and accept Meta's terms for it |
Template rules and button behaviour are defined by Meta and can change. Your template is reviewed by Meta before you can send it.
WhatsApp OTP vs SMS OTP in India
The two channels complement each other. Use the comparison below to decide which one is primary for your users and which one is the fallback.
| Factor | WhatsApp OTP | SMS OTP |
|---|
| Registration | Meta business verification and an approved authentication template | TRAI DLT: entity, header and OTP template under the transactional category |
| Reach | Only users who have WhatsApp and a data connection | Every mobile number, including DND, with no data needed |
| Sender identity | Your business display name and profile | Your 6-character header with a -T suffix |
| Autofill | Copy-code, one-tap and zero-tap buttons | Android SMS auto-read with an app hash |
| Billing | Meta charges per delivered authentication message | Charged per SMS; SMSGatewayHub bills only delivered SMS |
Most teams send on WhatsApp first and fall back to OTP SMS service provider routes, or the other way round for users without WhatsApp. Compare channel costs on WhatsApp pricing and OTP SMS pricing.
Why SMSGatewayHub
Why send WhatsApp OTP with SMSGatewayHub?
One account for WhatsApp, SMS, RCS and voice means a failed code never becomes a failed sign-up.
Official WhatsApp Business Platform
SMSGatewayHub is a Meta Tech Provider on the official platform, not an unofficial tool that risks number bans. Read more on the WhatsApp Business API.
Automatic fallback
If WhatsApp cannot deliver, resend the code by SMS, voice OTP or RCS from the same account and wallet.
Transparent Meta billing
Every authentication message is shown per message by Meta category in your Pay As You Go wallet.
Developer-friendly API
REST endpoints, webhooks for delivery and read status, and code samples in the developer API docs.
Certified security
ISO 27001, ISO 9001:2015, SOC 2 and VAPT tested. See the Trust Center.
Onboarding help
Our team guides you through Meta business verification, template submission and the switch from SMS-only OTP.
WhatsApp OTP use cases by industry
Wherever a user proves who they are, a WhatsApp code can sit next to SMS.
Banks, NBFCs & fintech
App login, device binding and loan e-sign verification, with SMS kept as the regulated fallback. Messaging for banks & NBFCs
How to start sending WhatsApp OTP
Create your account
Register free and connect a business number that is not active on another WhatsApp account.
Verify your business
Complete Meta business verification in Business Manager with your legal business documents.
Create the template
Submit an authentication template and choose copy-code or one-tap. One-tap needs your Android package name and app signing hash.
Integrate the API
Generate the code on your server, send it as the template parameter and verify the user's input server-side.
Add fallback
Register a DLT OTP template for SMS and switch automatically when WhatsApp is not delivered in time.
Compliance and security checklist
Meta's policies govern the WhatsApp leg; TRAI's DLT rules govern the SMS fallback. Get both right before launch.
- Let users choose WhatsApp for their code, for example a “Send code on WhatsApp” option, so the message is expected.
- Use authentication templates only for codes; never add offers, or Meta will reject or recategorise the template.
- Keep codes short-lived and state the expiry in the template.
- Generate and check codes on your server and never return the code in an API response to the app.
- Limit resend attempts per number to stop OTP abuse and unnecessary charges.
- Keep your SMS fallback DLT-compliant: transactional header and a registered template. See DLT registration.
Need missed call or voice verification as well? See missed call OTP, or build one verification flow across channels with our OTP API.
Frequently Asked Questions
What is a WhatsApp OTP?
A WhatsApp OTP is a one-time password delivered to a user's WhatsApp number to verify a login, sign-up, payment or password reset. Businesses send it through the WhatsApp Business Platform using a Meta authentication template with a copy-code or one-tap button.
Do I need DLT registration to send WhatsApp OTP in India?
No. WhatsApp messages are not scrubbed through TRAI DLT; they follow Meta's business verification and template approval. If you use SMS as a fallback, the SMS leg still needs a DLT entity, a transactional header and a registered OTP template.
Can I write my own text for a WhatsApp OTP template?
No. Meta uses fixed wording for authentication templates: the code line, an optional do-not-share security line and an optional expiry line. Links, media and emojis are not allowed, and the code can be up to 15 characters.
What is the difference between copy-code and one-tap buttons?
A copy-code button copies the code so the user can paste it, and works on every device. A one-tap autofill button passes the code straight into your Android app after a handshake; if the handshake is not possible, WhatsApp shows a copy-code button instead.
What happens if the user does not have WhatsApp?
The message cannot be delivered, so you should fall back to another channel. With SMSGatewayHub you can resend the code by SMS, voice OTP or RCS from the same account.
How much does a WhatsApp OTP cost?
Meta charges per delivered authentication message, and the rate depends on the recipient's country. Current India rates and SMSGatewayHub plans are listed on the WhatsApp pricing page, or contact sales on 1800 102 1822.
Add WhatsApp OTP to your login flow
Create a free account, verify your business with Meta and keep SMS as a fallback, all from one SMSGatewayHub wallet.