WhatsApp OTP: how authentication templates work, India costs, and when SMS is still needed

Jignesh Vasavada runs a diagnostics lab with four collection centres in Rajkot. Patients log in to his Android app with a one-time password to download their reports, about 9,000 logins a month. Every week the front desk hears the same line from someone standing at the counter: “OTP nahi aaya.” His developer suggested sending the code on WhatsApp, through what people search for as the WhatsApp authentication API and what Meta’s documentation calls authentication templates.

It’s a good idea with conditions attached. The message is cheap and can drop the code into the app without the patient typing anything. It also reaches only people who use WhatsApp on that number, the wording isn’t yours to write, and the useful parts need a developer.

What is a WhatsApp authentication template?

It’s the one kind of WhatsApp message that Meta allows to carry a one-time password. There is no separate product called the authentication API: it’s the ordinary Cloud API send call, using a template whose category is authentication.

Meta’s categorisation page is blunt about it: “Only authentication templates can be used to send a one-time passcode for identity verification. Marketing and utility templates cannot be used for this purpose.” A code tucked into a utility template to dodge the format will be caught sooner or later; our piece on how Meta decides a message’s category covers what happens then.

The WhatsApp OTP template: what you can and can’t change

Almost nothing in it is yours. Meta sets the body text and offers two optional lines and a button. A finished message looks like this:

482913 is your verification code. For your security, do not share this code.
This code expires in 10 minutes.
[Copy code]

Part	Fixed or optional	What you control
Body: the code followed by “is your verification code.”	Fixed	Nothing. Meta supplies the wording in each template language
Security line: “For your security, do not share this code.”	Optional	On or off
Expiry footer: “This code expires in 10 minutes.”	Optional	The number of minutes, from 1 to 90
Button	One of copy code, one-tap autofill, or zero-tap	The button label, up to 25 characters
The code itself	Yours	Up to 15 characters

URLs, media and emojis aren’t supported anywhere in the template. Your brand name doesn’t appear in the body either. Meta’s page suggests that businesses sending codes request Official Business Account status, so that people are less likely to dismiss or ignore the message.

Two protections come built in. Authentication messages are delivered only to the customer’s main phone; on linked devices such as WhatsApp Web, the message is masked with a prompt to look at the phone. And WhatsApp disables forwarding of authentication messages, which Meta says is there to combat phishing.

For ready examples of the three layouts, see numbers 28 to 30 in our template examples.

Copy code, one-tap and zero-tap: which button to choose

Copy code needs no app work and works everywhere. One-tap and zero-tap save the customer effort, but only on Android and only after your developer has changed the app.

Button	Works on	What the customer does	What your developer builds
Copy code	Any phone	Taps the button, switches to your app, pastes	Nothing in the app
One-tap autofill	Android only	Taps the button; WhatsApp opens your app and hands it the code	The app’s package name and signing key hash in the template, and a “handshake” from the app before each send
Zero-tap	Android only	Nothing; the code appears in your app	Everything one-tap needs, plus a receiver in the app, and acceptance of Meta’s zero-tap terms

The handshake is the part people miss. Before your server sends the message, your app has to tell WhatsApp on the same phone that a code is coming. WhatsApp then runs an eligibility check when the message arrives: was the handshake made in the last 10 minutes (or within the template’s expiry time), does the package name match, does the signing key hash match. If any check fails, the customer sees a copy code button instead. Zero-tap degrades the same way, first to one-tap and then to copy code, which is why Meta requires a zero-tap template to include both of the other buttons.

So the worst case on Android is a copy code message. That’s a decent worst case.

On iPhones there is no one-tap or zero-tap. Since 15 June 2026, on iOS 26 and later, the keyboard suggests the code from the notification with no work on your side; on earlier iOS versions the customer uses the copy code button. Meta lists the limits: numeric codes of 3 to 8 digits only, and it doesn’t trigger when WhatsApp is open on screen. You can switch it off for a template in WhatsApp Manager, which Meta suggests for high-security flows.

One date for anyone with an older integration: Meta’s pages carry a warning that the PendingIntent method of starting the handshake is deprecated on 15 October 2026, and point developers to its OTP Android SDK.

On zero-tap, Meta’s own best-practice list starts with this: “Do not make WhatsApp your default password/code delivery method.” The customer should choose it.

What does a WhatsApp OTP cost in India?

Meta charges ₹0.115 for each authentication template delivered to an Indian number, before GST, on its INR rate card effective 1 October 2026 (as listed on 9 October 2026). You pay for delivered messages, and your provider’s fees, if you use one, are on top.

For Jignesh, 9,000 codes at ₹0.115 comes to ₹1,035 a month before GST. The rate card gives the list rate for the first 7,50,000 authentication messages a month to Indian numbers, with lower tier rates above that. A lab in Rajkot will not trouble the tiers.

The rate card has a second authentication line for India, and it causes confusion:

Rate	Per delivered message	Who pays it
Authentication	₹0.115	A business based in India, and any business not yet eligible for the international rate
Authentication-international	₹2.4971	A business based outside India that Meta has deemed eligible, from its start time onwards

Meta’s page on these rates sets three conditions, and all must hold. The business is eligible, which happens once it sends more than 750K messages outside customer service windows in a moving 30-day period to people in the countries that have such a rate. The business is based in a different country from the recipient. And the message is delivered on or after the start time, which Meta sets 30 days after eligibility and announces by email. Meta’s own example table shows a business whose primary business location is India paying the ordinary authentication rate for Indian recipients in every case.

One catch for larger companies: once past the start time, if Meta hasn’t verified your primary business location, authentication messages are billed at the international rate until it does. A company with a foreign parent should check the Primary Business Location field in Business Manager before volumes get there.

We aren’t quoting an SMS price next to this. SMS rates depend on your provider and the operators behind it, as our WhatsApp, SMS and email comparison explains, so compare ₹0.115 with the figure on your own SMS invoice. The full WhatsApp rate table is in the pricing guide.

Where delivery goes wrong

A WhatsApp code fails for different reasons than an SMS does, and most of them are on Meta’s best-practices page.

The number isn’t on WhatsApp, or it’s the wrong number. Meta notes that people accidentally choose WhatsApp when they aren’t registered, and that many keep one number for SMS and another for WhatsApp. Its advice is to check on Android whether WhatsApp is installed before showing the option, and to let the customer confirm their WhatsApp number.

The message has a short life. If WhatsApp can’t deliver, it retries for a period called time-to-live, which for authentication templates defaults to 10 minutes and can be set anywhere from 30 seconds to 15 minutes. Meta recommends a value no longer than your code’s expiry, and says that if you haven’t had a delivered webhook by then you should assume the message was dropped. That missing webhook is your trigger to send the code another way.

New accounts hit a ceiling. A new business portfolio can deliver to 250 different people in a rolling 24 hours outside open chats, and Meta’s definition of the limit makes no exception for authentication templates. Jignesh’s 9,000 logins a month is about 300 a day. He needs the limit at 2,000 before launch; the route is in our messaging limits guide.

Numbers get recycled. Meta warns that WhatsApp doesn’t enforce ownership of a phone number after registration, so the previous owner of a recycled number may still hold the WhatsApp account. For account recovery, where the code may be the only check, it advises an extra challenge on top of the WhatsApp code.

Opt-in still applies to OTPs

Yes, you need it. Meta’s business messaging policy requires opt-in before any message, and the page on authenticating users says a common way to collect it is to offer a choice of channels on the login screen. A button that says “Send code on WhatsApp” under the phone number field does the job, provided the screen names your business. The wider consent picture is in our opt-in and DPDP guide.

Meta also asks that each business send codes from its own WhatsApp Business account and its own number. Sharing one account across separate businesses is against its policy.

When SMS is still needed

For every customer who isn’t on WhatsApp, and every time the WhatsApp message doesn’t arrive in time. An OTP has to reach any phone: a keypad handset, a smartphone with data switched off, a parent’s number used for a child’s test report.

SMS has its own gate. Commercial SMS in India runs under TRAI’s rules, which means DLT registration with a telecom operator, a registered header and a registered content template before anything is sent. OTPs are the standard example of the transactional category. If your app sends SMS codes today, that registration already exists, so keep it.

A sensible order for a login screen:

1. Ask for the mobile number and offer both “SMS” and “WhatsApp”. Don’t preselect WhatsApp.
2. If the customer picks WhatsApp, send the authentication template with a time-to-live matching the code’s expiry.
3. If no delivered status comes back within that time, show “Send by SMS instead” or send it automatically.
4. Remember the customer’s choice for next time.

What we’d do in Jignesh’s place

Start with a copy code template, because it needs no change to the app and works on every phone. Put the security line and a 10-minute expiry on it. Get the portfolio verified so the limit is 2,000 before the first patient sees the option. Keep the SMS route exactly as it is.

Run both for a month and count two things: how many WhatsApp codes showed as delivered inside the expiry time, and how many patients then completed the login. If those numbers beat SMS for the patients who chose WhatsApp, have the developer add one-tap autofill next. If the terms here are unfamiliar, the WhatsApp Business glossary defines them, and the API guide covers getting a number connected in the first place.