Short answer
To send OTP codes on WhatsApp, a business must use an approved authentication template. Meta fixes the text as "<code> is your verification code", with an optional security disclaimer and expiry warning, plus a one-tap autofill button, a copy-code button, or zero-tap. Authentication messages go only to the user's primary WhatsApp device.
Choose a delivery style
| Style | How it works | Needs app changes |
|---|---|---|
| Copy code | User taps a button to copy the code, then pastes it | No |
| One-tap autofill | Button opens your Android app and passes the code | Yes, Android |
| Zero-tap | Your Android app receives the code with no tap | Yes, Android |
| Keyboard suggestions | On iOS 26 and later, iOS offers the code from the notification | No |
Steps to send a WhatsApp OTP
- Create an authentication template with the security disclaimer, expiry minutes and the button type you need.
- Wait for Meta to approve the template.
- Generate the code in your backend and store a hash with an expiry.
- Send the template with the code as the body variable and, for copy code, as the button variable.
- Track delivery through webhooks and fall back to SMS if the message is not delivered.
Pricing and limits
Since 1 July 2025, Meta charges per delivered message by category and recipient market, and authentication is its own category. Some markets have an authentication-international rate. Check Meta's pricing page for current rates.
Users without WhatsApp cannot receive the code, so keep SMS or voice as fallback. OmniChannels.ai, through BroadNet as an official Meta Business Solution Provider, supports one-tap, zero-tap and copy-code authentication templates.