WhatsApp OTP verification API for signups, logins and payments
Send one-time passwords through Dexatel’s WhatsApp OTP verification API. If WhatsApp can’t reach a customer, a backup channel does, and you only pay for the messages that arrive.
Why businesses choose Dexatel for WhatsApp OTP verification
Three things decide whether WhatsApp OTP works in production: the code arrives, you only pay for the ones that do, and Meta approves your template.
What you get with Dexatel's WhatsApp OTP
Track whether a verification message was sent, delivered or failed. Put that beside your own validation results and you can tell a code that never arrived from one the customer never typed. Every verification send reports its result to a signed webhook, or you can pull the status from the API.
Set up WhatsApp OTP with Dexatel
Before you start have these ready:
How to get started
How businesses use WhatsApp OTP
All four are the same two API calls. What changes is when you fire them.
WhatsApp OTP vs SMS OTP
Both work. Here is what separates them.
| Feature | WhatsApp OTP | SMS OTP |
|---|---|---|
Delivery feedback | Delivery status, occasionally read | Delivery receipt only |
Message format | Approved template from your business profile, with your name and logo | Plain text from a sender ID, short code or long number |
App required | Yes, an active WhatsApp account on that number | No, works on most phones |
Internet connection | Needs Wi-Fi or mobile data | No data needed, but needs SMS service |
Regional strength | Worth testing in Latin America, MENA, South Asia and Southeast Asia | Every country, every network, including customers without WhatsApp |
Code entry | Copy-code button, the only button type authentication templates allow | Manual entry, or device OTP autofill |
Setup | A registered sender and an approved authentication template | Sender registration, and template approval in some markets |
Fallback | Falls back to SMS, Viber, Telegram or Email through the Verify API | Can sit behind WhatsApp, or lead with WhatsApp behind it |
What blocks delivery | No internet, no WhatsApp account, a customer who blocked your business | Coverage, roaming, carrier filtering, routing |
Pricing | Per delivered message, varies by destination | Per message segment, varies by destination |
Connect Dexatel's WhatsApp OTP API to your application
Build your WhatsApp OTP integration with two REST calls, fallback set in the same request, and signed webhooks. Send a code from your application, validate the one your user typed, and see what happened to both.
A successful request returns a message ID. It confirms the request was created, not that the message arrived or that the customer verified.
The receipts
Don't take our word for it
WhatsApp OTP pricing
You pay for delivered messages. Nothing is charged for a message we don't deliver, and a delivered code is billable even if the customer never types it in.
| What you pay for | How it's charged |
|---|---|
WhatsApp OTP | Per delivered message |
SMS fallback | At the SMS rate, only if it fires |
Monthly sender fee | $28 per active WhatsApp sender |
Rates vary by destination country and your monthly volume. Template creation and submission cost nothing.
Frequently asked questions
Do my users need WhatsApp installed?
Yes. A WhatsApp OTP only reaches someone with an active WhatsApp account on that number. That is what fallback is for: put SMS, Viber, Telegram or Email behind WhatsApp and everyone else still gets verified.
What happens if the code isn't delivered?
Dexatel moves to the next channel in the order you set. You are not charged for the WhatsApp message that failed, and the fallback message is billed at its own channel's rate. Each attempt is a separate message with its own ID.
How long is a WhatsApp OTP code valid?
You choose, from 30 seconds to 15 minutes. Set it on your authentication template with otp_expiration_seconds. If you do not set it, codes last 15 minutes.
Do I need my own WhatsApp sender?
Yes. Meta requires businesses to send authentication messages from their own registered sender rather than a shared one. Registration is part of setup.
How is WhatsApp OTP priced?
You pay per delivered message, at a rate that depends on the destination country and your monthly volume, plus $28 a month for each active WhatsApp sender. Undelivered messages cost nothing. Estimate your cost
Can I use the WhatsApp Business app and the API on the same number?
No. The number cannot be linked to any WhatsApp account, including a personal one, the Business app, or another provider. You either deregister it first or use a different number, and chat history does not transfer.If you’re deciding between the two, see how the WhatsApp Business app and the API compare.
Can the same code be checked more than once?
Yes. Checking a code does not consume it, and there is no limit on how many times a wrong code can be submitted. Add attempt limits in your own application if your flow needs them.
What are your rate limits?
20 requests per second per account, not per API key. Over that, requests return HTTP 429. There is no per-number limit and no burst allowance. Larger accounts can have the limit raised, so ask your account manager.
Who is responsible for charges caused by toll fraud?
You are. We do not run a protection programme and we do not issue credits after an attack. What we do give you is a country blacklist that works across every channel including fallback, and SMS Limits for SMS specifically. Both are worth setting up before you go live.
Where is verification data stored and processed?
In the EU, on AWS. We are GDPR compliant and ISO/IEC 27001:2022 certified, and verification data is deleted within six months of the service ending, under the data processing agreement in our terms of service. Enterprise customers can discuss regional hosting.
Can verification codes appear in our server logs?
Yes, if your systems record full request URLs. The check request carries the code as a query parameter, so redact query strings from application, proxy and monitoring logs, and keep API keys out of them entirely.
How do I get a verified badge on my WhatsApp profile?
Registering a sender does not get you one. Meta decides eligibility and approval separately, so we can help you through the process but cannot guarantee the outcome.
Should I use the same WhatsApp sender for OTP and marketing?
A separate authentication sender keeps account-access messages away from promotional ones. Run your campaigns and support chats from another sender through the WhatsApp Business API. It matters because a customer who blocks your sender after too many promotions also stops receiving your codes.
Which metrics should I track?
Completed verifications first, not opens. Then delivery time, resend rate, how often fallback fires, and what a completed verification costs you. Compare by country and by channel, because the answer changes market to market.
How do I move from SMS OTP to WhatsApp?
You reorder rather than switch. Put WhatsApp first in your fallback chain and leave SMS behind it, so customers with WhatsApp get it there and everyone else gets exactly what they got before.
