How to Send OTP via WhatsApp API: A Step-by-Step Developer Guide · WABPO Developer Documentation
How to Send OTP via WhatsApp API: A Step-by-Step Developer Guide
Implement a secure WhatsApp OTP verification flow in your application using the official WABPO API and step-by-step developer guides.
How to Send OTP via WhatsApp API: A Step-by-Step Developer Guide
Sending one-time passwords through WhatsApp gives users a fast and familiar way to verify their phone number, sign in, reset a password, or confirm an important action.
This guide explains how to send OTP messages through the official WhatsApp API using WABPO.
WABPO handles WhatsApp message delivery and reporting. Your application remains responsible for generating, storing, expiring, and verifying each OTP.
What You Need
Before starting, make sure you have:
A WABPO account
A Meta account connected to WABPO
An approved WhatsApp authentication template
A WABPO public API key
Your project ID, template ID, and campaign ID
A secure backend or serverless function
Never expose your WABPO API key in frontend, browser, or mobile application code.
Step 1: Create a WABPO Account
Create your account at WABPO and sign in to the dashboard.
After signing in, create or select the project that will send WhatsApp OTP messages.
Step 2: Connect Your Meta Account
Connect your WhatsApp number and Meta business account to the selected WABPO project.
reused: 1 means the idempotency key had already been used, so WABPO returned the existing message instead of sending a duplicate.
Check the OTP Message Status
Check a message using its WABPO message ID:
GET https://api.wabpo.com/api/v1/public/messages/:messageId?projectId=PROJECT_ID
You can also check it using your external reference:
GET https://api.wabpo.com/api/v1/public/messages?projectId=PROJECT_ID&externalReference=login-challenge-8f19d2
Possible message statuses include:
queued
sent
delivered
read
failed
excluded
Remember that delivered or read does not mean the OTP was successfully verified. Verification happens inside your application.
View Combined OTP Analytics
Use the campaign report endpoint:
GET https://api.wabpo.com/api/v1/public/campaigns/:campaignId/report?projectId=PROJECT_ID&range=month&page=1&limit=25
The report includes:
Total messages
Sent messages
Delivered messages
Read messages
Failed messages
Replies
Recipient-level statuses
Failure reasons
Timestamps
Using one dedicated OTP campaign keeps these results grouped together.
Common Errors
Missing Authentication Code
Send one of these variables:
{
"verification_code": "482731"
}
{
"otp": "482731"
}
{
"code": "482731"
}
Template Not Approved
Wait until Meta approves the authentication template and make sure you are using its WABPO template ID.
Invalid Phone Number
Use international E.164 format:
+923001234567
Missing API Scope
Make sure the API key has the messages:send scope.
Project Access Denied
Check that the API key is allowed to access the supplied projectId.
Duplicate Request
If you reuse an idempotency key, WABPO returns the previously created message instead of sending another one.
Meta or Billing Failure
Check:
The project’s Meta connection
Meta payment status
WABPO wallet or subscription
The message’s failureReason
OTP Security Checklist
Before using WhatsApp OTP in production:
Generate OTPs only on your backend.
Use a cryptographically secure random generator.
Store a hash instead of the plain OTP where practical.
Expire codes after a short period, usually 5–10 minutes.
Limit OTP resend attempts.
Limit incorrect verification attempts.
Rate-limit by account, phone number, and IP address.
Use a unique idempotency key for each OTP challenge.
Never log OTP values or API keys.
Mark each OTP as used after successful verification.
Do not accept an OTP more than once.
Do not treat WhatsApp delivery as successful verification.
Final Workflow
The complete process is:
Create a WABPO account.
Connect your Meta account and WhatsApp number.
Create an authentication template.
Wait for Meta approval.
Generate a WABPO API key.
Create or use a dedicated integration campaign.
Generate the OTP securely in your backend.
Call the WABPO template-message API.
Ask the user to enter the received code.
Verify that code inside your own application.
Use the WABPO message and campaign APIs to monitor delivery performance.
This approach gives your users a simple WhatsApp verification experience while keeping OTP security and verification under your application’s control.
