One time codes on WhatsApp: what is allowed, and what breaks

WhatsApp can deliver one time codes through an authentication category template, and it is often cheaper and faster than SMS. It should never be your only channel: a code that requires data, a working WhatsApp install and the same number will lock out real users on their worst day.

What an authentication template may contain

Meta restricts these more than any other category, and the restrictions are the point: an authentication message that could carry arbitrary text is a phishing vector. In practice the body is the code and a short expiry, with a copy code button, and no custom marketing, no links of your own, and no additional variables beyond the code.

Category: Authentication

<code> is your verification code. For your security, do
not share this code.

Expiry: 10 minutes
Button:  Copy code

The failure modes, in the order you will meet them

No WhatsApp, or no data

The person's phone has the number but not the app, or has the app and no bundle. Nothing is delivered and nothing errors in a way that tells you why. Offer the fallback after a short wait rather than making them ask - and make the fallback button visible from the first screen, not hidden behind "didn't get it?".

A different number on WhatsApp

Plenty of people use WhatsApp on a number that is not their primary line. Verify the number you will actually send to, and say which one you are using: "we sent a code to your WhatsApp on …4821".

The code arrives after the timeout

Delivery is usually seconds and occasionally not. A 60 second expiry produces support tickets; five to ten minutes is a better trade between usability and risk, and rate limiting the attempts matters more than shortening the window.

The number is blocked or unreachable

You cannot tell blocked from offline - see what message statuses mean. Treat a missing delivered status after a few seconds as a prompt to offer the alternative, not as an error to show.

Practical rules

1. Always have a second channel, and switch to it fast. SMS or email; the point is that it does not share a failure mode with the first.
2. Rate limit by number and by account. OTP endpoints are abused to make you pay for messages to strangers - every send costs you money and costs the recipient patience.
3. Never log the code. It ends up in an aggregator, and now your logging vendor can log in as your users.
4. Do not reuse a code across channels. One code, one delivery attempt, one expiry.
5. Expire on use. A code that still works after the user has logged in is a code worth stealing.

Cost, honestly

Authentication conversations are billed per conversation on the Cloud API, at rates that vary by country and change. In markets with expensive A2P SMS, WhatsApp is usually cheaper; in markets with cheap SMS it may not be. Work it out for your own countries with your own volumes rather than trusting a comparison table - including this one.