How to Build a WhatsApp OTP System for Logins and Password Resets

If you run an app, an e-commerce store, or a portal in Pakistan or India, you already know that SMS OTPs are broken. Local telecom operators constantly hike their rates. In India, the DLT registration process is a bureaucratic maze where templates get blocked for minor spacing errors. In Pakistan, international gateways like Firebase or Twilio charge in US Dollars, making every single login attempt cost you up to 15 or 20 PKR. On top of that, delivery rates are terrible. Users wait minutes for a code that never arrives, get frustrated, and close your app.

Moving your authentication to WhatsApp solves the delivery issue and, in many cases, slashes your monthly bill. But you cannot just send a random text message with a code. Meta has specific rules, technical requirements, and pricing structures for authentication messages. Here is how to set up a WhatsApp OTP system that actually works, what it costs, and how to avoid getting your API account suspended.

The Real Cost: SMS OTP vs. WhatsApp OTP

Let's look at the actual math. If you use an international SMS gateway to send an OTP to a Pakistani user, you pay around $0.05 to $0.08 per message. With current exchange rates, that is roughly 14 to 22 PKR per OTP. If you use local SMS routes, it is cheaper (around 1.5 to 2.5 PKR), but delivery rates drop to 70% or lower because of carrier spam filters, network congestion, and DND (Do Not Disturb) registries.

For India, local SMS costs around 0.12 to 0.18 INR, but the setup requires DLT registration, entity IDs, and constant template maintenance. If you use international providers without DLT, your messages simply do not deliver.

WhatsApp charges for messages based on "conversations." An authentication conversation starts when you deliver an OTP and lasts for 24 hours. During this window, you can send multiple codes to the same user if they click "Resend" without paying extra. Meta charges a flat rate per conversation category based on the user's country code.

Here is a practical comparison of the costs and performance metrics you will actually see in production:

WhatsApp is not just cheaper than international SMS; it is also faster. A delivery time of under three seconds means your users do not abandon their carts or registration screens.

How the Technical Flow Works

You cannot send a standard text template for OTPs anymore. Meta requires you to use their official "Authentication Templates." These templates are locked down. You cannot add marketing text, links, or custom media. They only contain the code, a standard message, and optional buttons.

The user flow looks like this:

1. The user enters their phone number on your login page.
2. Your backend generates a secure 6-digit PIN.
3. Your backend sends an API request to the WhatsApp Cloud API using an approved Authentication template.
4. The user receives a clean message with a prominent "Copy Code" button or a "One-Tap Autofill" button (on Android).
5. The user inputs the code, and your database verifies it.

First, you need a dedicated phone number. Do not use your personal WhatsApp number or a number you use for daily business calls. Read about Which Phone Number Should You Choose for the WhatsApp API? to understand the differences between virtual, landline, and mobile numbers.

Once your number is connected to the Meta Business Cloud API, you must create an Authentication Template. Here is what the raw JSON payload looks like when you send the OTP via the API:

{
  "messaging_product": "whatsapp",
  "recipient_type": "individual",
  "to": "923001234567",
  "type": "template",
  "template": {
    "name": "auth_otp_template",
    "language": {
      "code": "en_US"
    },
    "components": [
      {
        "type": "body",
        "parameters": [
          {
            "type": "text",
            "text": "582910"
          }
        ]
      },
      {
        "type": "button",
        "sub_type": "url",
        "index": "0",
        "parameters": [
          {
            "type": "text",
            "text": "582910"
          }
        ]
      }
    ]
  }
}

This payload tells Meta to populate the template with the OTP "582910" and attach it to the "Copy Code" button. To track if the user actually received the message, you need to configure webhooks. You can learn more about managing these signals in Tracking WhatsApp API Message Statuses: Webhooks, Error Codes, and Costs.

The Pitfalls and Bad Ideas

Do not try to save money by using a "Marketing" or "Utility" template for your OTPs. Some developers think they can write a custom template like: "Hey! Your verification code is {{1}}. Thanks for shopping with us!" to bypass the strict formatting of Authentication templates. Meta's automated scanners will flag this. If you get caught sending authentication codes inside marketing templates, Meta will reject the template or suspend your phone number.

Another bad idea is relying solely on WhatsApp. What if the user does not have WhatsApp installed? What if they are in an area with zero mobile data but decent cellular reception?

Your login page must have a fallback mechanism. The best practice is:

• Show a "Send OTP via WhatsApp" button as the primary option.
• Start a 30-second timer.
• If the user does not receive the code or clicks "Send via SMS," trigger your fallback SMS gateway.

This hybrid approach keeps your delivery rates close to 99% while keeping your costs low. Also, keep an eye on your quality rating. If users flag your OTPs as spam (which happens if your app spam-sends codes to the wrong numbers), your number can get suspended. Read Stop Getting Banned: How to Run a WhatsApp API Without Losing Your Number to keep your sender score clean.

The Setup Complexity

To use the official API, you must go through Meta's developer portal, set up a business portfolio, verify your business documents (like your SECP registration in Pakistan or GST/PAN in India), and set up a credit card for billing.

If you want to bypass this complex setup, WA Link provides a simplified platform that handles the API infrastructure for you, letting you connect your number and start sending messages without wrestling with Meta's developer console. However, remember that WA Link does not bypass Meta's core policy rules; you still need to follow their template guidelines to avoid getting flagged.

Real Questions from the Field

Why was my OTP template rejected by Meta?

Meta rejects authentication templates if you add any text that is not strictly related to authentication. You cannot include emojis, promotional offers, website links (other than the official app link for one-tap autofill), or custom greetings. Stick to the default Meta layout for authentication templates.

Can I use the same API for password resets?

Yes. The API does not care if the OTP is for logging in, registering, or resetting a password. To the API, it is just a string of numbers. You can use the exact same template for all verification flows.

What is the delivery timeout for WhatsApp OTP?

In our experience, if a WhatsApp OTP is not delivered within 10 seconds, it is usually because the user's phone is offline or has no internet connection. We recommend setting your frontend resend timer to 30 seconds before allowing the user to request an SMS fallback.

Do I get charged if the message is not delivered?

Meta charges for delivered messages. If the recipient’s phone is switched off or has no internet connection, the message remains in a "sent" status. If it is not delivered within Meta's retry window (usually 30 days, though OTPs expire in your system much faster), you do not get charged for that conversation.

Can I use a local virtual number?

We do not recommend virtual numbers for OTP services in Pakistan or India. Local telecom regulators often block virtual numbers, or Meta flags them during verification. Use a clean, physical SIM card number or a direct virtual mobile number (VMN) from a verified tier-1 carrier.

Your Next Step

Your next step is to create a test template in your Meta developer console or sign up for a sandbox account to test the latency of WhatsApp OTPs against your current SMS provider.