What Is WhatsApp OTP? Sending Verification Codes by WhatsApp Instead of SMS

Think of the six-digit code that lands on your phone when you sign up for a website. That is an OTP, a one-time password, usually just called a verification code. For years these codes have travelled by SMS. Yet most of your customers check WhatsApp far more often than their text messages. This article explains what a WhatsApp OTP is, how it works, where it beats SMS and where its limits are. We will be straightforward about it: this is not the right answer for every business or every situation.

What Is an OTP?

OTP stands for one-time password. The system generates a short random code, sends it to the user's phone number, the user types it into a form, and the system checks that the code is correct, still valid and used for the first time. Whoever receives it is shown to have real access to that phone number.

Typical uses include:

• Verifying a phone number on a registration form
• Passwordless login (phone number plus code)
• Password reset
• Confirming that the phone number on an e-commerce order is genuine, especially for cash on delivery
• Adding a second step to a sensitive action such as an address change or payment approval

How Does a WhatsApp OTP Work?

The logic is the same; only the channel that carries the code changes. The code is delivered as a WhatsApp message instead of an SMS. WapFlow OTP offers this as a REST API, and the flow looks like this:

1. In the WapFlow panel you link your own WhatsApp number with a QR code or a pairing code.
2. You create a live and a test API key in the panel.
3. Your site collects the user's phone number and calls /send from your server. The code reaches the user as a WhatsApp message from the number you linked.
4. The user enters the code, and your site checks it with a call to /verify.

Codes are generated with cryptographic randomness and are not stored in plain text. The length can be set from 4 to 8 digits and the validity from 60 to 900 seconds; by default a code has six digits and lasts five minutes. Each code allows at most five wrong attempts, and a verified code cannot be used again. The technical details are in the API documentation, and our PHP, Node.js and Python guide has code samples.

Advantages Over SMS

An app your customer already has open

Customers do not need to switch to a messaging app to read the code; many people keep WhatsApp open all day. That can shorten the time it takes to enter a code.

A familiar sender

The code comes from your own WhatsApp number. Instead of an anonymous short number, the customer sees a chat that carries your business identity. In the message template you can use the {app}, {code} and {minutes} variables to show your application name and the validity period.

A fixed monthly fee

WapFlow OTP has no per-message charge. You send as many codes as your plan's monthly quota allows. The plans are monthly: 249.99 TRY for 1 account and 5,000 codes, 449.99 TRY for 2 accounts and 15,000 codes, 649.99 TRY for 3 accounts and 30,000 codes, and 999.99 TRY for 5 accounts and 60,000 codes. Check the pricing page for current prices. If you already use a WapFlow cloud plan, a discount applies to the OTP plan; the rate is shown at checkout.

No Meta approval or template application

The official WhatsApp Business API involves business verification and message template approval. WapFlow OTP needs none of that because it works differently: it uses your own number as a linked device. Below we spell out what that means.

Limits You Should Know About

Presenting a method without its downsides would be unfair to you as a reader. Keep these in mind:

• It is not the official WhatsApp Business API. WapFlow OTP works through a linked device (QR) and is not affiliated with WhatsApp or Meta. We explain the difference in WhatsApp Business API or web automation?.
• There is no delivery guarantee. A message may fail to arrive because of WhatsApp, the number or the network. The user may not have WhatsApp at all.
• The ban risk is never zero. If WhatsApp restricts the number, codes stop too. Daily limits and account warm-up help lower that risk; see our post on reducing ban risk.
• Critical actions need a backup channel. For payment approval or account recovery, keep a second path such as SMS or e-mail.

Who Is It For?

It makes sense for businesses that already talk to customers on WhatsApp and have an order or appointment flow: small and mid-sized online shops, service businesses, local platforms. If you run WordPress or WooCommerce you can set it up without writing code using the plugin. If you operate a heavily regulated service, such as banking, you need to assess official channels and legal requirements separately.

Tips for a Good OTP Flow

• Verify the code on your server. Never leave the decision to the browser; always call /verify from your own server.
• Keep the API key secret. Do not use it in a browser, a mobile app or any public code.
• Add a cooldown to the resend button. If users keep clicking "the code did not arrive", your quota drains for nothing; keeping the button disabled for 60 seconds protects both your quota and your number.
• Keep error messages friendly. A clear line such as "Invalid code, 3 attempts left" guides the user to try again.
• Add bot protection. On public registration forms, a CAPTCHA or similar measure makes it harder for bad actors to burn your quota.

A Short Note on Privacy and Consent

A verification code is informational and relates to an action the user started themselves; it is not a marketing message. It is therefore usually treated as a transactional message that does not need commercial-message consent. Two rules still matter: never put advertising or a campaign inside the code message, and state in your privacy policy that you use the phone number only for verification. This section is not legal advice; ask your own adviser for your exact situation.

Before You Try It

In WapFlow OTP, a test key (starting with wfo_test_) sends no message and uses no quota; it returns the code in a test_code field instead. Try your integration with it first and switch only the key when you go live. When you are ready, look at the plans on the WapFlow OTP page.

Frequently Asked Questions

Does WhatsApp OTP fully replace SMS OTP?

Not in every case. If the user has no WhatsApp or the message does not arrive, you need a backup such as SMS or e-mail. Thinking of the two together is the healthiest approach.

Which number do the codes come from?

From your own WhatsApp number that you linked in the panel. If you link more than one number, sends are distributed in turn, and if one cannot send, the next is tried.

How should the phone number be written?

With the country code and digits only, for example 905321234567. Eleven-digit numbers starting with 0 are treated as Turkish and get 90 added in front. The API returns an error for an invalid number.

How many codes can I send to one number?

To prevent abuse, one number can receive 1 code per 60 seconds, 5 per hour and 10 per day.

Is it used together with the Windows app?

No. WapFlow OTP is a cloud API service and is sold separately. It is independent of the Windows app, and you can use either on its own.