Authenticate customers with WhatsApp OTPs

Provide customers with a simple way to validate their identity on a chat app they know and love.

Safeguard customer accounts with a trustworthy channel

Customers worldwide trust WhatsApp to send personal messages and documents and prefer to use WhatsApp to interact with businesses.

Offer your customers an easy but effective way to verify their identity and speed up the authentication process. With end-to-end encryption, secure delivery and global compliancy measures, we help you send one-time pins on WhatsApp that keep your customers satisfied.

Double up on security with WhatsApp OTP

Often, passwords aren’t enough to secure your customers’ accounts. Weak passwords and bad security habits make it easy for fraudsters to hack into private accounts. Unfortunately, your business is forced to deal with unhappy customers who can no longer trust your brand.

The WhatsApp Business API encrypts all messages, meaning only the customer can view the message. This makes WhatsApp a more reliable channel to send OTPs on and lowers the chance of hackers getting their hands on both a password and an OTP.

		OkHttpClient client = new OkHttpClient().newBuilder()
     .build();
 MediaType mediaType = MediaType.parse(“application/json”);
 RequestBody body = RequestBody.create(mediaType, “{\”from\”:\”441134960000\”,\”to\”:\”441134960001\”,\”messageId\”:\”a28dd97c-1ffb-4fcf-99f1-0b557ed381da\”,\”content\”:{\”text\”:\”Some text\”},\”callbackData\”:\”Callback data\”,\”notifyUrl\”:\”https://www.example.com/whatsapp\”}”);
 Request request = new Request.Builder()
     .url(“https://{baseUrl}/whatsapp/1/message/text”)
     .method(“POST”, body)
     .addHeader(“Authorization”, “{authorization}”)
     .addHeader(“Content-Type”, “application/json”)
     .addHeader(“Accept”, “application/json”)
     .build();
 Response response = client.newCall(request).execute();
							
											1
											2
											3
											4
											5
											6
											7
											8
											9
											10
											11
											12

		curl -L -g -X POST ‘https://{baseUrl}/whatsapp/1/message/text’ \
 -H ‘Authorization: {authorization}’ \
 -H ‘Content-Type: application/json’ \
 -H ‘Accept: application/json’ \
 –data-raw ‘{
   “from”: “441134960000”,
   “to”: “441134960001”,
   “messageId”: “a28dd97c-1ffb-4fcf-99f1-0b557ed381da”,
   “content”: {
     “text”: “Some text”
   },
   “callbackData”: “Callback data”,
   “notifyUrl”: “https://www.example.com/whatsapp”
 }’
							
											1
											2
											3
											4
											5
											6
											7
											8
											9
											10
											11
											12
											13
											14

		{
   “from”: “441134960000”,
   “to”: “441134960001”,
   “messageId”: “a28dd97c-1ffb-4fcf-99f1-0b557ed381da”,
   “content”: {
     “text”: “Some text”
   },
   “callbackData”: “Callback data”,
   “notifyUrl”: “https://www.example.com/whatsapp”
 }
							
											1
											2
											3
											4
											5
											6
											7
											8
											9
											10

		var client = new RestClient(“https://{baseUrl}/whatsapp/1/message/text”);
 client.Timeout = -1;
 var request = new RestRequest(Method.POST);
 request.AddHeader(“Authorization”, “{authorization}”);
 request.AddHeader(“Content-Type”, “application/json”);
 request.AddHeader(“Accept”, “application/json”);
 var body = @”{“”from””:””441134960000″”,””to””:””441134960001″”,””messageId””:””a28dd97c-1ffb-4fcf-99f1-0b557ed381da””,””content””:{“”text””:””Some text””},””callbackData””:””Callback data””,””notifyUrl””:””https://www.example.com/whatsapp””}”;
 request.AddParameter(“application/json”, body,  ParameterType.RequestBody);
 IRestResponse response = client.Execute(request);
 Console.WriteLine(response.Content);
							
											1
											2
											3
											4
											5
											6
											7
											8
											9
											10

		package main
 import (
     “fmt”
     “strings”
     “net/http”
     “io/ioutil”
 )
 func main() {
 <code>url := “https://%7BbaseUrl%7D/whatsapp/1/message/text” method := “POST” payload := strings.NewReader(`{“from”:”441134960000″,”to”:”441134960001″,”messageId”:”a28dd97c-1ffb-4fcf-99f1-0b557ed381da”,”content”:{“text”:”Some text”},”callbackData”:”Callback data”,”notifyUrl”:”https://www.example.com/whatsapp”}`) client := &http.Client { } req, err := http.NewRequest(method, url, payload) if err != nil {     fmt.Println(err)     return } req.Header.Add(“Authorization”, “{authorization}”) req.Header.Add(“Content-Type”, “application/json”) req.Header.Add(“Accept”, “application/json”) res, err := client.Do(req) if err != nil {     fmt.Println(err)     return } defer res.Body.Close() body, err := ioutil.ReadAll(res.Body) if err != nil {     fmt.Println(err)     return } fmt.Println(string(body))</code>
 }
							
											1
											2
											3
											4
											5
											6
											7
											8
											9
											10

		import http.client
 import json
 conn = http.client.HTTPSConnection(“{baseUrl}”)
 payload = json.dumps({
     “from”: “441134960000”,
     “to”: “441134960001”,
     “messageId”: “a28dd97c-1ffb-4fcf-99f1-0b557ed381da”,
     “content”: {
         “text”: “Some text”
     },
     “callbackData”: “Callback data”,
     “notifyUrl”: “https://www.example.com/whatsapp”
 })
 headers = {
     ‘Authorization’: ‘{authorization}’,
     ‘Content-Type’: ‘application/json’,
     ‘Accept’: ‘application/json’
 }
 conn.request(“POST”, “/whatsapp/1/message/text”, payload, headers)
 res = conn.getresponse()
 data = res.read()
 print(data.decode(“utf-8”))
							
											1
											2
											3
											4
											5
											6
											7
											8
											9
											10
											11
											12
											13
											14
											15
											16
											17
											18
											19
											20
											21
											22

		<?php
 $curl = curl_init();
 curl_setopt_array($curl, array(
     CURLOPT_URL => ‘https://%7BbaseUrl%7D/whatsapp/1/message/text’,
     CURLOPT_RETURNTRANSFER => true,
     CURLOPT_ENCODING => ”,
     CURLOPT_MAXREDIRS => 10,
     CURLOPT_TIMEOUT => 0,
     CURLOPT_FOLLOWLOCATION => true,
     CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
     CURLOPT_CUSTOMREQUEST => ‘POST’,
     CURLOPT_POSTFIELDS =>‘{“from”:”441134960000″,”to”:”441134960001″,”messageId”:”a28dd97c-1ffb-4fcf-99f1-0b557ed381da”,”content”:{“text”:”Some text”},”callbackData”:”Callback data”,”notifyUrl”:”https://www.example.com/whatsapp”}’,
     CURLOPT_HTTPHEADER => array(
         ‘Authorization: {authorization}’,
         ‘Content-Type: application/json’,
         ‘Accept: application/json’
     ),
 ));
 $response = curl_exec($curl);
 curl_close($curl);
 echo $response;
							
											1
											2
											3
											4
											5
											6
											7
											8
											9
											10
											11
											12
											13
											14
											15
											16
											17
											18
											19
											20
											21

		var settings = {
     “url”: “https://{baseUrl}/whatsapp/1/message/text”,
     “method”: “POST”,
     “timeout”: 0,
     “headers”: {
         “Authorization”: “{authorization}”,
         “Content-Type”: “application/json”,
         “Accept”: “application/json”
     },
     “data”: JSON.stringify({
         “from”: “441134960000”,
         “to”: “441134960001”,
         “messageId”: “a28dd97c-1ffb-4fcf-99f1-0b557ed381da”,
         “content”: {
             “text”: “Some text”
         },
         “callbackData”: “Callback data”,
         “notifyUrl”: “https://www.example.com/whatsapp”
     }),
 };
 $.ajax(settings).done(function (response) {
     console.log(response);
 });
							
											1
											2
											3
											4
											5
											6
											7
											8
											9
											10
											11
											12
											13
											14
											15
											16
											17
											18
											19
											20
											21
											22
											23

		var https = require(‘follow-redirects’).https;
 var fs = require(‘fs’);
 var options = {
     ‘method’: ‘POST’,
     ‘hostname’: ‘{baseUrl}’,
     ‘path’: ‘/whatsapp/1/message/text’,
     ‘headers’: {
         ‘Authorization’: ‘{authorization}’,
         ‘Content-Type’: ‘application/json’,
         ‘Accept’: ‘application/json’
     },
     ‘maxRedirects’: 20
 };
 var req = https.request(options, function (res) {
     var chunks = [];
 <code>res.on(“data”, function (chunk) {     chunks.push(chunk); }); res.on(“end”, function (chunk) {     var body = Buffer.concat(chunks);     console.log(body.toString()); }); res.on(“error”, function (error) {     console.error(error); });</code>
 });
 var postData = JSON.stringify({
     “from”: “441134960000”,
     “to”: “441134960001”,
     “messageId”: “a28dd97c-1ffb-4fcf-99f1-0b557ed381da”,
     “content”: {
         “text”: “Some text”
     },
     “callbackData”: “Callback data”,
     “notifyUrl”: “https://www.example.com/whatsapp”
 });
 req.write(postData);
 req.end();
							
											1
											2
											3
											4
											5
											6
											7
											8
											9
											10
											11
											12
											13
											14
											15
											16
											17
											18
											19
											20
											21
											22
											23
											24
											25
											26
											27
											28
											29

		require “uri”
 require “json”
 require “net/http”
 url = URI(“https://{baseUrl}/whatsapp/1/message/text”)
 https = Net::HTTP.new(url.host, url.port)
 https.use_ssl = true
 request = Net::HTTP::Post.new(url)
 request[“Authorization”] = “{authorization}”
 request[“Content-Type”] = “application/json”
 request[“Accept”] = “application/json”
 request.body = JSON.dump({
     “from”: “441134960000”,
     “to”: “441134960001”,
     “messageId”: “a28dd97c-1ffb-4fcf-99f1-0b557ed381da”,
     “content”: {
         “text”: “Some text”
     },
     “callbackData”: “Callback data”,
     “notifyUrl”: “https://www.example.com/whatsapp”
 })
 response = https.request(request)
 puts response.read_body
							
											1
											2
											3
											4
											5
											6
											7
											8
											9
											10
											11
											12
											13
											14
											15
											16
											17
											18
											19
											20
											21
											22

Integrate WhatsApp Business Platform API in an instant

Start unlocking opportunities to scale communications and grow engagement with a flexible API supported by developers.

Access detailed API documentation
Get 24/7 integration support
Create custom message templates

API

SDKs

Try for free

Expand your tech stack with multiple integration options

Easily implement the WhatsApp Business Platform into your existing tech stack and add on new integrations to build your B2C communication strategy.

Check integrations

Learn how to send an OTP on WhatsApp

Once you are set up, you can start sending triggered OTPs over WhatsApp API or through the Infobip platform. When a customer attempts to login to their account, it will trigger a message flow that provides the customers with a verification code over WhatsApp that they have to provide before getting access to their information.

Get set up and start sending OTP verification codes on WhatsApp

You will need:

An Infobip account
WhatsApp Business Platform Account
An approved message template
Customer opt-in

The WhatsApp OTP verification process

A customer logs into their account with a username and password
A new screen appears asking for an OTP that they should receive on WhatsApp
The customer will receive a notification from WhatsApp with their OTP
The customer inputs the OTP from the WhatsApp message and hits verify
The customer has successfully and securely logged in.

Discover the benefits of WhatsApp OTPs

Using WhatsApp as a verification channel for bank accounts and accessing other sensitive materials can bring great benefits to your business and your customers.

Better security

WhatsApp messages are encrypted every step of the way. Unlike other channels, WhatsApp ensures that only the end user can view the delivered message and helps reduce spam, fraud attacks and hackers from accessing accounts.

High visibility for OTPs

WhatsApp has over 2 billion users. By sending OTPs on WhatsApp, your business can assure that customers are getting their verification codes on a reliable channel that they check regularly. Your OTP verification codes won’t get lost in an inbox full of unread messages.

Higher brand trust

WhatsApp uses branded and verified profiles for businesses to send messages to their customers. This means that your end-users can rest assured they are interacting with your business every time. With a brand logo, name and verified check, your customers know the OTP they were sent over WhatsApp comes from a trusted source.

Better user experience

By sending OTPs via WhatsApp, you can offer your customers a convenient yet secure way to verify their identity. Since they are familiar with the chat app and use it regularly, they know they will receive the OTP message on time, trust the sender ,and rely on their favorite app to verify their identity.