How to Send OTP Via WhatsApp: A Complete Guide

To send an OTP on WhatsApp, set up an approved WhatsApp Business sender and authentication template, then use a messaging API to send a one-time code to the customer’s WhatsApp number.

With Dexatel Verify, the process has five steps: register a sender, get a template approved, send the code through the API, add a fallback channel and check the code the customer enters. This guide covers each step, the setup rules, pricing and common delivery problems. For the channel itself, see WhatsApp OTP.

What You Need Before You Start

• A business account with the right access. You need access to Meta’s business tools and the details required for WhatsApp Business Platform onboarding. Meta may ask you to complete business verification before your sender is approved.
• An eligible WhatsApp sender number. The number must not be linked to any WhatsApp account, including a personal account, the WhatsApp Business app or another WhatsApp Business service. If the number is in the WhatsApp Business app today, deregister it first or use a new number. Chat history does not move over.
• A messaging provider account. WhatsApp authentication templates are sent through the WhatsApp Business Platform API.
• A code-entry screen in your app. Your signup or login flow needs a place where users enter the OTP and logic that decides whether it is valid.

How to Send OTP on WhatsApp in 5 Steps

Step 1: Register Your WhatsApp Sender

Sign up for a Dexatel account with your business email. In the dashboard, click Add Channel, then Add next to WhatsApp. Open the WhatsApp channel, choose Get Access, click Start Now and submit your business details for the Meta application.

Allow time for Meta’s review. Business verification can take several business days. You can access your Dexatel account during review, but the sender cannot send messages until Meta approves it.

Step 2: Create an Authentication Template

WhatsApp only lets you send codes through templates in the Authentication category. In the dashboard, open WhatsApp Templates, click Create Template, enter a name, pick the Authentication category and your approved sender, then click Save and Send for Approval.

Meta reviews the template before you can use it. Review times vary. You can create the language versions you need. Templates are self-service in any language, at no extra cost. If a template is rejected, the dashboard shows Meta’s reason. Correct the template and submit it again.

Here is what an approved authentication message looks like to the user:

847291 is your verification code. For your security, do not share this code.
This code expires in 10 minutes.
[Copy code]

Meta controls the wording of the message body. You can turn the security line and expiry footer on or off and choose the language, but you cannot freely rewrite the text.

Step 3: Send the Code With One API Request

Send the OTP through the Dexatel verification API at POST /v1/verifications. If you pass code_length, Dexatel generates the code. If your own system generates the code, pass it in code instead. Use only one of these fields. A request with both is rejected with an error.

bash

curl -X POST https://api.dexatel.com/v1/verifications \
  -H "X-Dexatel-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "data": {
      "channel": "WHATSAPP",
      "sender": "MyBusiness",
      "phone": "14155552671",
      "template": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "code_length": 6
    }
  }'

A few details matter here:

• channel is uppercase: WHATSAPP.
• phone is digits only, starting with the country code.
• template is the ID of your approved template.
• code_length and code accept 4 to 8 digits.
• How long the code stays valid is set on the template with otp_expiration_seconds, from 30 seconds to 15 minutes. The default is 15 minutes. The expire_date in the API response does not control this.

Dexatel allows 20 requests per second for each account, not each API key. Requests over the limit return HTTP 429. There is no per-number limit, and the API does not send rate-limit headers. If you expect traffic spikes, ask your account manager or Dexatel support about a higher limit.

Step 4: Add a Fallback Channel

A WhatsApp OTP may not reach a customer. The user may not have WhatsApp, or the delivery attempt may fail. You can add a fallback so the verification tries another channel when the WhatsApp send fails.

The fallback is set in each API request. There is no fallback setting in the dashboard. To use a fallback for users who don’t have WhatsApp, include it on every verification request, because your system cannot know in advance which numbers lack WhatsApp.

Add a fallback object to the same request. You can list up to five channels in priority order.

json

{
  "data": {
    "channel": "WHATSAPP",
    "sender": "MyBusiness",
    "phone": "14155552671",
    "template": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "code_length": 6,
    "fallback": {
      "priorities": [
        {
          "channel": "SMS",
          "sender": "MyBusiness",
          "template": "b2c3d4e5-f6a7-8901-bcde-f12345678901"
        }
      ],
      "cancellation_threshold_sec": 120
    }
  }
}

The fallback works as follows:

• The next channel is tried only when the current one fails. Failures include an internal error on Dexatel’s side, a message that cannot reach the provider and a provider that fails to send.
• The chain stops when a channel reports a successful delivery, or when the time limit runs out. You set the limit with cancellation_threshold_sec, from 120 to 300 seconds. The default is 120 seconds.
• You cannot cancel a chain after it starts.
• Each attempt is a new message with its own ID. A verification does not keep one ID across attempts.
• You set the channel order in each request.
  

The available fallback channels include SMS, Viber, Telegram, email and RCS. The cheapest or most suitable order depends on the recipient’s country and your rates. SMS is not always the most expensive option. For the SMS side of the fallback, see SMS OTP.

Step 5: Verify the Code

When the user enters the code, send it to the verification endpoint to check it against the phone number:

bash

curl "https://api.dexatel.com/v1/verifications?code=847291&phone=14155552671" \
  -H "X-Dexatel-Key: YOUR_API_KEY"

A correct, unexpired code returns the verification record with the status ACTIVATED. A wrong or expired code returns 200 OK with an empty data list, not an error. Check for an empty list in your code and show the user a clear message.

Checking a code does not use it up. The same code can be checked more than once until it expires. Dexatel does not limit wrong attempts, so set your own limit, for example three to five attempts, then require a new code.

Two checks belong in your own application:

• Limit wrong attempts. Dexatel does not cap them, so you need to set the limit.
• Show the expiry. Display a countdown that matches the code’s validity so the user knows when to request a new one.

If you prefer, Dexatel can check the code for you. Turn on this feature in the dashboard and send Dexatel the code and phone number. Dexatel then changes the status from DROPPED to ACTIVATED. If your system generates and checks the code itself, you don’t need this.

Authentication Template Rules

WhatsApp authentication templates have a fixed message format set by Meta. You can send one-time codes without writing a different custom message for each customer.

Dexatel does not support one-tap autofill, so the copy-code button is the only option.

How Much WhatsApp OTP Costs

WhatsApp OTP pricing depends on the recipient’s country, your message volume and the provider you use. Since July 1, 2025, Meta has charged authentication messages per delivered message rather than per conversation. Some countries have a higher international authentication rate, and the WhatsApp pricing page shows the rate for each country.

Dexatel’s published prices include its margin on top of Meta’s cost. Prices exclude VAT, and customers pay any applicable government taxes on top.

With Dexatel:

• $28 per month for each active WhatsApp sender (€25 on the EUR price list). The fee applies every month the sender is active, whether or not you send messages that month. Each sender needs its own Facebook Business account.
• A per-message charge for each WhatsApp authentication message, at a rate that depends on the destination. See the WhatsApp pricing page for the current rate in each country.
• SMS fallback has a separate charge when it is used. SMS is billed per submitted message, and each message is paid once.

If you use WhatsApp only as a fallback, the monthly sender fee still applies while the sender is active. Plan for it even if the fallback rarely runs.

WhatsApp OTP vs SMS OTP

WhatsApp and SMS both deliver one-time codes, but they reach customers differently. WhatsApp requires an internet connection and an active WhatsApp account. SMS uses the mobile network. A fallback setup can use both.

Start with the channel that works best for your users and market. WhatsApp may be a strong first choice where customers use it often. SMS can be a useful first channel or a fallback elsewhere. You set the order in each API request.

See SMS OTP for the alternative channel.

Best Practices for WhatsApp OTP

A secure WhatsApp OTP flow should make verification easy for real users while limiting repeated or unwanted requests.

• Keep codes short-lived. Match the expiry to your customer journey. A shorter code leaves less time for misuse.
• Limit code-entry attempts in your app. Dexatel does not cap wrong guesses.
• Limit how often users can request codes. Dexatel has no per-number limit, so add limits per phone number or session to reduce abuse and unexpected costs.
• Set your own fraud protection. Under the standard agreement, the customer pays for fraudulent verification traffic, and Dexatel does not offer credits or refunds for it. Use the country blacklist in the dashboard to block destinations you do not serve. The blacklist also applies to fallback messages. SMS limits apply only to SMS, so they cover WhatsApp OTP only when SMS is in the fallback chain.
• Check numbers before sending if you need to.Dexatel Lookup is a separate paid service. A verification request does not run a lookup automatically. Lookup cannot guarantee that WhatsApp will receive a message.
• Review delivery webhooks. If you set up a delivery webhook, Dexatel sends delivery reports for OTP messages to it. Statuses include DELIVERED, READ (WhatsApp and Viber only), FAILED, REJECTED and EXPIRED. You will usually receive DELIVERED, not READ. Dexatel retries a failed webhook call three times if your server doesn’t respond within 20 seconds.
• Measure completed verifications. Compare codes sent with codes verified. If fewer customers finish, check both delivery and the sign-in experience. The dashboard has filters for completion rates and countries.

Common Problems and How to Fix Them

The authentication template was rejected. Read Meta’s rejection reason in your dashboard, correct the template and submit it again. Dexatel support can help at no extra cost.

The sender number cannot be registered. The number may already be linked to a WhatsApp account, including the WhatsApp Business app. Deregister it from the app or use a new number. The same number cannot be used in the app and the API at the same time.

The sender exists but cannot send. Only an approved sender can send messages. Check its Meta approval status. A sender that is pending or in any other state can appear in your sender list but cannot send.

Users are not receiving the code. Check the message status and confirm the phone number is correct. Make sure your request includes a fallback, since the fallback is only tried when it is in the request.

The API returns HTTP 429. You have reached the 20-requests-per-second account limit. Queue requests, reduce repeated sends or ask Dexatel about a higher limit.

The user enters a code but verification fails. Check whether the code has expired and whether the phone number matches. An empty result from the check means the code is wrong or expired.

FAQ

What is a WhatsApp OTP?

A WhatsApp OTP is a one-time code sent to a user’s WhatsApp account to confirm they own a phone number. Apps use it for signup, login, password resets and payment approvals. Read more in What is OTP.

Can I send OTP from the WhatsApp Business app?

No. Sending an authentication template requires the WhatsApp Business Platform API. The same number cannot be used in the WhatsApp Business app and the API at the same time. If the number is in the app, deregister it or use a new number.

Is WhatsApp OTP free?

No. Each active sender has a monthly fee, and each delivered authentication message has a per-message charge that depends on the country.

How long does WhatsApp template approval take?

Review times vary. Business verification can take several business days.

Can I change the text of a WhatsApp OTP message?

Only a little. Meta sets the body text. You can turn the security line and expiry footer on or off and choose the language.

What happens if the user does not have WhatsApp?

If the WhatsApp send fails and your request includes a fallback, the next channel, such as SMS, is tried. Include the fallback on every verification request, since you can’t know in advance which numbers lack WhatsApp.

How long is a WhatsApp OTP valid?

You set it on the template with otp_expiration_seconds, from 30 seconds to 15 minutes. The default is 15 minutes.

Start Sending WhatsApp OTP

To start sending WhatsApp OTPs, register an approved sender, create an authentication template and connect the verification API. Add a fallback to every request and set your own limits on code attempts to make sign-in more reliable.

Explore the WhatsApp OTP API, follow the WhatsApp verification guide, or create a Dexatel account.