WhatsApp OTP API: Send OTP on WhatsApp With SMS Fallback

A WhatsApp OTP API lets your website or app send a one-time password to a customer’s WhatsApp number using an approved Meta authentication template, then check the code the customer types. On Fast2SMS a WhatsApp OTP costs ₹0.25 per delivered message at the time of writing, with no setup fee, no monthly fee and no DLT registration, and failed messages are refunded automatically. With Smart OTP, the same API call can send the code on WhatsApp first and fall back to DLT SMS automatically if WhatsApp delivery fails, or the other way round.

What is a WhatsApp OTP API?

An OTP (one-time password) is a short code that proves a person really controls a mobile number. For years Indian businesses sent these codes only by SMS. Today most of your customers keep WhatsApp open all day, so sending the same code inside WhatsApp is often faster to notice, easier to copy and carries your verified business name instead of a six-letter sender ID.

A WhatsApp OTP API is the bridge between your software and WhatsApp. Your server makes an HTTPS request with the customer’s mobile number. The provider sends an authentication template message through the official WhatsApp Business API (Meta’s Cloud API), and your server later checks whether the code the customer typed is correct. Fast2SMS is an official WhatsApp Business API provider: numbers are onboarded through Meta’s embedded signup, and no unofficial WhatsApp Web automation is used.

How a WhatsApp OTP reaches your customer

1. The customer enters their mobile number on your login, signup or checkout page.
2. Your server calls the Fast2SMS OTP API with that number and your OTP ID.
3. Fast2SMS generates the code, sends it as a WhatsApp authentication template from your business number, and stores it with an expiry time.
4. The message arrives in WhatsApp with your verified business name and a Copy code button.
5. The customer pastes the code on your page, your server calls the verify API, and you get a simple true or false.

Because Fast2SMS generates, stores, expires and checks the code on its side, your database never holds an OTP. There is nothing to leak and no expiry cron job to maintain.

A note on “free WhatsApp OTP number” searches

Many people search for “WhatsApp OTP free number” or “WhatsApp OTP apk”. Those searches are about receiving codes on borrowed numbers, which is a different thing. This guide is for businesses that need to send verification codes to their own customers through the official WhatsApp Business API. What Fast2SMS gives free is the API access itself: there is no setup fee, no monthly fee and no per-number fee. You pay only for the OTP messages that are delivered.

Authentication templates and the copy-code button

Every business-initiated WhatsApp message must use a template that Meta has approved. Templates fall into categories, and the category decides both what you are allowed to write and what you pay. On Fast2SMS the India rates per message are, at the time of writing:

High-volume plans bring the per-message rate down to ₹0.11; share your monthly volume with the sales team through contact us for a custom rate. Full rates are on the WhatsApp pricing page.

What an authentication template looks like

Authentication templates are deliberately strict. Meta fixes most of the wording so that customers learn to recognise a genuine code. A typical message reads “701284 is your verification code. For your security, do not share this code.”, can carry an optional expiry line, and shows a Copy code button. The customer taps the button and pastes the code into your app without switching back and forth or typing digits by hand.

Rules that get authentication templates approved

• Security only. The template must carry an OTP or verification code and nothing else. No offers, no product promotion.
• No links. URLs are not allowed in authentication templates. If you need a link (for example a tracking page), that is a utility template.
• Say what the code is for in simple, direct words, and mention a validity period when it helps.
• Pick the right category. A common reason for rejection is filing an order update as authentication, or an OTP as utility. Fast2SMS explains the difference in utility vs authentication messages.

Meta’s authentication category also describes one-tap and zero-tap autofill for Android apps, which need extra work inside the mobile app itself. For most websites and apps in India, the copy-code button is what customers see and use. Fast2SMS also reviews your templates before you submit them to Meta, and template approval usually comes within 24 hours.

Sample authentication templates by situation

More examples are in what are WhatsApp authentication category messages.

WhatsApp OTP price vs SMS OTP

Fast2SMS has no separate OTP tariff. You pay the rate of the channel that actually carried the code:

• WhatsApp OTP: ₹0.25 per delivered authentication message, ₹0.11 on high-volume plans. Billing is on delivery basis, and failed WhatsApp messages are refunded to your wallet automatically within 48 hours.
• SMS OTP: your bulk SMS slab rate, from ₹0.25 down to ₹0.11 per SMS as your recharge grows. See bulk SMS pricing.
• No platform charges: no setup fee, no monthly fee, no per-number fee. You recharge a prepaid wallet from ₹100 (18% GST applies on the recharge, with a GST invoice), and new accounts get ₹50 free credit to send test OTPs.

Is WhatsApp OTP free?

The API access is free on Fast2SMS: connecting your WhatsApp Business number, the panel, the OTP endpoints, webhooks and reports cost nothing. The OTP messages themselves are paid per delivery, at the authentication rate above. Your wallet balance does not expire, so a slow month costs nothing.

What actually changes your OTP bill

Per-message price is only half the story. The other half is how many OTPs you pay for that never help a customer log in. The chart below compares three ways of sending 10,000 OTP requests, using entry-level rates and assuming 8% of numbers cannot receive the WhatsApp message (no WhatsApp account, phone offline, and so on). The 8% is an example for illustration, not a measured Fast2SMS figure.

The takeaway is honest and simple: at entry rates a WhatsApp OTP and an SMS OTP cost about the same on Fast2SMS. You choose WhatsApp for the experience (verified name, copy-code button, no DLT paperwork, refunds for failures) and you add SMS fallback so that no customer is left without a code. Since OTP volumes are high, even small per-message differences add up; that is why volume pricing exists for both channels.

For a deeper cost discussion, read OTP pricing in India: SMS vs WhatsApp.

Smart OTP: WhatsApp first, SMS fallback

Any single channel fails sometimes. A customer may not have WhatsApp on that number, a phone may be out of data, or an operator may reject an SMS. Smart OTP is the OTP engine inside Fast2SMS that handles this for you. You create an OTP template, choose a primary channel (SMS or WhatsApp) and optionally attach the other channel as fallback. The result is one OTP ID that your code uses for every send.

How the fallback decides

• Each OTP template has a primary channel and an optional fallback channel with its own approved template.
• If WhatsApp or the operator reports the first attempt as failed, Fast2SMS sends the same code on the fallback channel automatically, within about a minute, and only for attempts less than two minutes old.
• Your code does not change and makes no second request. The customer verifies the same OTP, whichever channel delivered it.
• You can change the channel or fallback in the panel at any time. Every website and app that uses that OTP ID follows instantly, with no deployment.
• Both attempts appear as separate lines in the OTP report and in your transaction history, and both reach your webhook.

Which order fits which OTP?

Pick the channel your users already have open, and let the other channel catch the misses.

Audience matters too. If many of your users are in areas with weak mobile data, SMS-first is safer. If your customers are smartphone users who chat with brands on WhatsApp, WhatsApp-first gives a smoother, branded experience. Read the full Smart OTP guide or see the OTP SMS product page.

Step-by-step setup on Fast2SMS

Before you start, keep three things ready, because Meta reviews them during WhatsApp onboarding and the process can get stuck without them:

• A genuine, established Facebook account (new accounts may be blocked by Meta).
• A working business website with your logo, business name, and terms and privacy pages.
• A phone number for WhatsApp: either a new number, or your existing WhatsApp Business app number.

1. Create your free account. Signup at fast2sms.com with your mobile number. ₹50 credit is added so you can send test OTPs straight away.
2. Connect WhatsApp with Facebook login. In the WhatsApp section, click “Login with Facebook”, continue on the “connect your account to Fast2SMS” window and fill in your business information. This is Meta’s embedded signup and it is free.
3. Choose your number. Pick “Start with a new WhatsApp phone number”, or “Connect your existing WhatsApp Business app” to keep using the app on your phone alongside the API (WhatsApp coexistence). Verify the number with the code Meta sends, select your business and time zone, and review.
4. Finish the signup. For an existing app number, scan the QR code from your phone and choose whether to share old chats. Then click Finish. This click is mandatory; without it you have to restart the embedded signup.
5. Get an authentication template approved. Create a template in the authentication category. Fast2SMS reviews it before submission, and Meta approval usually comes within 24 hours.
6. Create a Smart OTP template. Open Smart OTP, click Add OTP Template, choose WhatsApp as the channel and select your approved authentication template. Optionally open Configure Channel Fallback and attach an SMS template from your DLT-approved content. Copy the OTP ID.
7. Copy your API key. The API authorization key is in the Dev API section. It goes in the Authorization header of every request.
8. Test, then integrate. Use the Test OTP button on the template row to send a code to your own number and watch the status. Then call the send and verify endpoints from your code, as shown below.

A step-by-step walkthrough of the WhatsApp onboarding screens, with screenshots of every window, is in how to get free WhatsApp OTP API. If you plan to keep using the WhatsApp Business app on the same number, read what is WhatsApp coexistence first.

Send and verify: code samples

Two REST endpoints do the whole job. Fast2SMS generates the code, sends it on the channel set in your OTP ID, and checks it on verify. Authentication is your API key in the Authorization header. The full reference is at send OTP and verify OTP on docs.fast2sms.com.

1. Send the OTP

curl --request POST \
  --url https://www.fast2sms.com/dev/otp/send \
  --header 'Authorization: YOUR_API_KEY' \
  --header 'accept: application/json' \
  --header 'content-type: application/json' \
  --data '{
    "otp_id": "11111111",
    "mobile": "8888888888"
  }'

Success response:

{
  "return": true,
  "status_code": 200,
  "request_id": "lwdtp7cjyqxvfe9",
  "message": "OTP sent successfully"
}

Keep the request_id. It traces the OTP in reports and webhook events.

2. Verify what the customer typed

curl --request POST \
  --url https://www.fast2sms.com/dev/otp/verify \
  --header 'Authorization: YOUR_API_KEY' \
  --header 'accept: application/json' \
  --header 'content-type: application/json' \
  --data '{
    "mobile": "8888888888",
    "otp": "123456"
  }'

{
  "return": true,
  "status_code": 200,
  "message": "OTP verified successfully"
}

A wrong, expired or exhausted code returns "return": false, so one if-check gates your signup, login or COD confirmation.

The same flow in Node.js

// Node 18+ (built-in fetch). Keep the key in an environment variable.
const API_KEY = process.env.FAST2SMS_API_KEY;
const HEADERS = {
  'Authorization': API_KEY,
  'Content-Type': 'application/json',
  'Accept': 'application/json'
};

async function sendOtp(mobile) {
  const res = await fetch('https://www.fast2sms.com/dev/otp/send', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify({ otp_id: '11111111', mobile: mobile })
  });
  return res.json(); // keep data.request_id for tracing
}

async function verifyOtp(mobile, otp) {
  const res = await fetch('https://www.fast2sms.com/dev/otp/verify', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify({ mobile: mobile, otp: otp })
  });
  const data = await res.json();
  return data.return === true; // true = log the user in
}

The same flow in Python

import os
import requests

API_KEY = os.environ["FAST2SMS_API_KEY"]
HEADERS = {"Authorization": API_KEY, "Content-Type": "application/json", "Accept": "application/json"}

def send_otp(mobile):
    r = requests.post("https://www.fast2sms.com/dev/otp/send",
                      json={"otp_id": "11111111", "mobile": mobile},
                      headers=HEADERS, timeout=10)
    return r.json()

def verify_otp(mobile, otp):
    r = requests.post("https://www.fast2sms.com/dev/otp/verify",
                      json={"mobile": mobile, "otp": otp},
                      headers=HEADERS, timeout=10)
    return r.json().get("return") is True

The verify step in PHP

$ch = curl_init('https://www.fast2sms.com/dev/otp/verify');
curl_setopt_array($ch, array(
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => array(
        'Authorization: YOUR_API_KEY',
        'Content-Type: application/json',
        'Accept: application/json',
    ),
    CURLOPT_POSTFIELDS => json_encode(array(
        'mobile' => $customerMobile,
        'otp' => $enteredOtp,
    )),
));
$verify = json_decode(curl_exec($ch), true);
curl_close($ch);

if (!empty($verify['return'])) {
    // Verified: create the account, log in, or confirm the COD order
} else {
    // Wrong or expired OTP: show the error and offer resend
}

A complete PHP example with the send step is in the OTP SMS API guide.

Options you control

Check the exact parameter formats for these options, and the resend request, in the API documentation before going live.

Errors you should handle

• 400 Invalid OTP ID on send: the otp_id does not exist in your panel. Copy it from the OTP template list.
• 401 Invalid Authorization key: wrong or revoked API key.
• 400 Invalid OTP on verify: the customer typed the wrong code. Let them retry or resend.
• Maximum verification attempts reached: the attempt limit is used up and the code is dead. Ask for a fresh OTP.
• 404 OTP not found or already verified: each code verifies once.

Prefer to manage the code yourself?

You can also send an approved authentication template directly through the WhatsApp message API and generate and check codes in your own system. Every approved template gets a ready-made API URL in the panel (you can download them all as a sheet). A template send is a single GET request:

curl "https://www.fast2sms.com/dev/whatsapp?message_id=YOUR_TEMPLATE_ID&phone_number_id=YOUR_PHONE_NUMBER_ID&numbers=9999999999&variables_values=482913" \
  -H "Authorization: YOUR_API_KEY"

Here message_id is your approved template, phone_number_id is your WhatsApp Business number’s ID, numbers is the 10-digit Indian mobile number and variables_values carries the OTP. This route gives you no automatic SMS fallback and no verify endpoint, so most teams use Smart OTP instead. Details: WhatsApp message API.

Delivery reports and webhooks

You do not have to poll the API to learn whether an OTP arrived. Fast2SMS gives you two views:

• OTP report in the panel: sent, delivered, failed and pending per attempt, with the channel that carried it and the time it landed. A fallback shows as its own line next to the primary attempt. Filter by date, search a number and export to Excel.
• OTP webhooks: Fast2SMS calls a URL on your server with delivered or failed events, including the request ID, mobile number, channel, status, timestamps, failure reason and your own udf1 to udf3 values. You design the JSON body yourself using placeholders.

Useful webhook facts: webhooks fire for messages sent through the developer API (not dashboard sends); you can create up to 10 webhooks per channel; each request times out after 60 seconds and is retried up to 3 times, 60 seconds apart; logs are kept for 7 days with a one-time manual resend. Because retries exist, de-duplicate on request ID plus status and answer HTTP 200 quickly. The full payload list is in how webhooks work.

Security best practices

An OTP flow is only as safe as the code around it. These practices apply whichever channel you use:

1. Keep the API key on the server. Never put it in a mobile app, browser JavaScript or a public repository. Call Fast2SMS from your backend only.
2. Do not store OTPs. Let the verify endpoint check codes server-side. Your database should only ever know “verified” or “not verified”.
3. Use short expiry for sensitive actions. For password reset or payments, 5 minutes is plenty. Longer windows suit low-risk cases like delivery codes.
4. Limit wrong guesses. Set a low attempt limit in OTP Settings (for example 3 for password reset) so codes cannot be brute-forced.
5. Throttle resends. Use the resend wait in OTP Settings and add your own per-number and per-IP limits on the page that triggers OTPs. This stops abuse and protects your wallet from bots.
6. Verify webhook requests. Enable webhook signing in Dev API settings; every request then carries a webhook_secret_key header with a 40-character secret. Reject anything that does not match, and use HTTPS.
7. Never ask customers to share codes. Keep the security line in your template and train support staff never to request an OTP on calls or chats.
8. Pick the right channel for the risk. WhatsApp messages are end-to-end encrypted and go to the customer’s WhatsApp account; SMS gives a DLT-registered trail that regulated businesses often prefer. Smart OTP lets you use both.

On the platform side, Fast2SMS has run business messaging in India since 2011 with 99.9% uptime, and its data-security certificates are published on the certificates page.

WhatsApp OTP not received: causes and fixes

When a customer says “I did not get the code”, the reason is usually one of these:

Two habits remove most complaints: show a resend timer instead of letting users tap repeatedly, and let customers see and correct the number they typed. The OTP report then tells you exactly which attempt failed and which channel delivered.

Use cases: login, signup, COD, payments

Passwordless login

Customers reuse weak passwords and then forget them. OTP login removes the password: the phone becomes the key. A WhatsApp OTP with a copy-code button makes this a two-tap login, and support stops answering reset requests all day.

Signup verification

Verifying the mobile number at signup keeps fake and mistyped numbers out of your database, so order updates, delivery calls and marketing all reach real people later. It also makes coupon abuse expensive: a “first order discount” cannot be claimed ten times when every account needs a real, reachable number.

Cash-on-delivery confirmation

Indian ecommerce runs heavily on COD, and fake COD orders cost shipping both ways plus packaging and blocked stock. An OTP at checkout confirms a real, reachable customer before the parcel leaves. Fast2SMS plugins for WooCommerce OTP verification and Shopify OTP include COD confirmation.

Payments and transactions

For payment approval and high-value actions, use a short expiry and a low attempt limit. Many businesses keep SMS first here for the DLT trail and add WhatsApp as fallback so a customer out of coverage can still finish.

Delivery and doorstep handover

A delivery OTP lands in the same WhatsApp thread where the customer already gets order updates. They read it out to the delivery partner, and you have proof of handover.

Two-factor authentication on WordPress

The free Fast2SMS WordPress plugin adds WhatsApp two-factor authentication and WhatsApp OTP for WordPress login and registration, using the same OTP ID and the same fallback settings.

WhatsApp OTP vs SMS OTP vs Smart OTP

Fast2SMS Smart OTP vs a typical OTP provider

The comparison reflects publicly listed plans of common OTP and SMS providers in India; details vary by provider.

Why businesses pick Fast2SMS for OTP

• Official WhatsApp Business API with free embedded signup; keep your existing WhatsApp Business app number if you want.
• One API for WhatsApp and SMS OTP, with automatic fallback both ways and a verify endpoint, so you never build OTP storage yourself.
• Pay per message only: ₹0.25 per WhatsApp OTP, SMS from ₹0.11, no setup or monthly fee, recharge from ₹100, ₹50 free credit to test.
• Failed WhatsApp messages refunded automatically within 48 hours, and every attempt itemised in transaction history.
• Free DLT support for your SMS sender ID and OTP template, and template review before Meta submission.
• Free plugins for WordPress, WooCommerce and Shopify, plus webhooks and reports for custom apps. See all integrations.
• Real support: chat, phone (+91-6262778822), email ([email protected]) or a free meeting at fast2sms.com/meet.

The same account also runs WhatsApp Business API campaigns, bulk SMS, RCS messages and campaigns from one wallet. Developers can start with the API documentation, and everyone else can create a free account and send a test OTP in a few minutes.