WhatsApp OTP verification API for signups, logins and payments
Send one-time passwords through Dexatel’s WhatsApp OTP verification API. If WhatsApp can’t reach a customer, a backup channel does, and you only pay for the messages that arrive.
Why businesses choose Dexatel for WhatsApp OTP verification
Three things decide whether WhatsApp OTP works in production: the code arrives, you only pay for the ones that do, and Meta approves your template.
What you get with Dexatel's WhatsApp OTP
Track whether a verification message was sent, delivered or failed. Put that beside your own validation results and you can tell a code that never arrived from one the customer never typed. Every verification send reports its result to a signed webhook, or you can pull the status from the API.
Let Dexatel generate the verification code, or pass your own if you already issue codes elsewhere. Pick a length between four and eight digits, and set how long it stays valid, from 30 seconds to 15 minutes.
Messages carry your business name and logo, sent from your own registered WhatsApp sender. Customers can open the profile and see which business sent the code before they type anything.
POST to send a code, GET to check the one your user entered. Authenticate with your API key, handle the result in the signup or login flow you already have, and start from the examples in our integration guide.
No sandbox. You send real codes to real numbers through the same endpoints you'll use in production, so you can check delivery and validation before launch.
Set up WhatsApp OTP with Dexatel
Before you start have these ready:
How to get started
How businesses use WhatsApp OTP
All four are the same two API calls. What changes is when you fire them.
Verify new accounts and cut spam
A new user signs up and you need to know the number is real. Send a code before the account goes live, and again before they can post. Marketplaces, classifieds, ride-hailing and iGaming apps use it at registration. A code shows the number is theirs, not who they are.
Protect logins and recovery
Send a code after the password at login, or to the registered number when someone is locked out. Fintech apps, neobanks, SaaS platforms and travel sites use it. Two-factor adds a code to the password, passwordless replaces it, and the two are worth keeping separate.
Verify deposits and withdrawals
Money is about to leave the account, so ask for a code first. iGaming operators use it on withdrawals, payment and remittance services on transfers, retailers at checkout. The code confirms the person, not the amount, so your own limits still do the rest.
Verify sensitive account changes
Someone changes an email, a phone number or payout details. Send a code to the contact you already have on file, before the change saves. Banks, telecoms and marketplaces use it. Changes to a SIM need more than a code, because that is what SIM swap goes after.
WhatsApp OTP vs SMS OTP
Both work. Here is what separates them.
| Feature | WhatsApp OTP | SMS OTP |
|---|---|---|
Delivery feedback | Delivery status, occasionally read | Delivery receipt only |
Message format | Approved template from your business profile, with your name and logo | Plain text from a sender ID, short code or long number |
App required | Yes, an active WhatsApp account on that number | No, works on most phones |
Internet connection | Needs Wi-Fi or mobile data | No data needed, but needs SMS service |
Regional strength | Worth testing in Latin America, MENA, South Asia and Southeast Asia | Every country, every network, including customers without WhatsApp |
Code entry | Copy-code button, the only button type authentication templates allow | Manual entry, or device OTP autofill |
Setup | A registered sender and an approved authentication template | Sender registration, and template approval in some markets |
Fallback | Falls back to SMS, Viber, Telegram or Email through the Verify API | Can sit behind WhatsApp, or lead with WhatsApp behind it |
What blocks delivery | No internet, no WhatsApp account, a customer who blocked your business | Coverage, roaming, carrier filtering, routing |
Pricing | Per delivered message, varies by destination | Per message segment, varies by destination |
Connect Dexatel's WhatsApp OTP API to your application
Build your WhatsApp OTP integration with two REST calls, fallback set in the same request, and signed webhooks. Send a code from your application, validate the one your user typed, and see what happened to both.
A successful request returns a message ID. It confirms the request was created, not that the message arrived or that the customer verified.
The receipts
Don't take our word for it
WhatsApp OTP pricing
You pay for delivered messages. Nothing is charged for a message we don't deliver, and a delivered code is billable even if the customer never types it in.
| What you pay for | How it's charged |
|---|---|
WhatsApp OTP | Per delivered message |
SMS fallback | At the SMS rate, only if it fires |
Monthly sender fee | $28 per active WhatsApp sender |
Rates vary by destination country and your monthly volume. Template creation and submission cost nothing.
Frequently asked questions
Do my users need WhatsApp installed?
Yes. A WhatsApp OTP only reaches someone with an active WhatsApp account on that number. That is what fallback is for: put SMS, Viber, Telegram or Email behind WhatsApp and everyone else still gets verified.
What happens if the code isn't delivered?
Dexatel moves to the next channel in the order you set. You are not charged for the WhatsApp message that failed, and the fallback message is billed at its own channel's rate. Each attempt is a separate message with its own ID.
How long is a WhatsApp OTP code valid?
You choose, from 30 seconds to 15 minutes. Set it on your authentication template with otp_expiration_seconds. If you do not set it, codes last 15 minutes.
Do I need my own WhatsApp sender?
Yes. Meta requires businesses to send authentication messages from their own registered sender rather than a shared one. Registration is part of setup.
How is WhatsApp OTP priced?
You pay per delivered message, at a rate that depends on the destination country and your monthly volume, plus $28 a month for each active WhatsApp sender. Undelivered messages cost nothing. Estimate your cost
Can I use the WhatsApp Business app and the API on the same number?
No. The number cannot be linked to any WhatsApp account, including a personal one, the Business app, or another provider. You either deregister it first or use a different number, and chat history does not transfer.If you’re deciding between the two, see how the WhatsApp Business app and the API compare.
Can the same code be checked more than once?
Yes. Checking a code does not consume it, and there is no limit on how many times a wrong code can be submitted. Add attempt limits in your own application if your flow needs them.
What are your rate limits?
20 requests per second per account, not per API key. Over that, requests return HTTP 429. There is no per-number limit and no burst allowance. Larger accounts can have the limit raised, so ask your account manager.
Who is responsible for charges caused by toll fraud?
You are. We do not run a protection programme and we do not issue credits after an attack. What we do give you is a country blacklist that works across every channel including fallback, and SMS Limits for SMS specifically. Both are worth setting up before you go live.
Where is verification data stored and processed?
In the EU, on AWS. We are GDPR compliant and ISO/IEC 27001:2022 certified, and verification data is deleted within six months of the service ending, under the data processing agreement in our terms of service. Enterprise customers can discuss regional hosting.
Can verification codes appear in our server logs?
Yes, if your systems record full request URLs. The check request carries the code as a query parameter, so redact query strings from application, proxy and monitoring logs, and keep API keys out of them entirely.
How do I get a verified badge on my WhatsApp profile?
Registering a sender does not get you one. Meta decides eligibility and approval separately, so we can help you through the process but cannot guarantee the outcome.
Should I use the same WhatsApp sender for OTP and marketing?
A separate authentication sender keeps account-access messages away from promotional ones. Run your campaigns and support chats from another sender through the WhatsApp Business API. It matters because a customer who blocks your sender after too many promotions also stops receiving your codes.
Which metrics should I track?
Completed verifications first, not opens. Then delivery time, resend rate, how often fallback fires, and what a completed verification costs you. Compare by country and by channel, because the answer changes market to market.
How do I move from SMS OTP to WhatsApp?
You reorder rather than switch. Put WhatsApp first in your fallback chain and leave SMS behind it, so customers with WhatsApp get it there and everyone else gets exactly what they got before.
