WhatsApp OTP API: Send and Verify OTP Codes on WhatsApp | WALoops
WALoops
code REST API for developers

WhatsApp OTP API

Send one-time passwords to your users on WhatsApp with two API calls: one to send the code, one to verify it. Start free with 100 OTPs a month from our WhatsApp number, with no Meta account and no DLT registration.

  • check_circle 100 free OTPs every month
  • check_circle No credit card
  • check_circle Any language that can make an HTTP call
POST /api/otp/send.php
curl -X POST https://app.waloops.com/api/otp/send.php \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"phone":"919876543210"}'

// 200 OK
{ "success": true, "expires_in": 300 }
483920 is your verification code. For your security, do not share this code. This code expires in 5 minutes.

Why send OTPs on WhatsApp instead of SMS

In India and many other countries, WhatsApp is the app people already have open. The WhatsApp OTP vs SMS OTP comparison covers it in detail.

verified_user

No DLT registration

Indian SMS needs DLT entity, header and template registration before your first message. WhatsApp OTPs use a template Meta approves, and on our shared number that's already done.

mark_chat_read

Fewer lost codes

SMS codes get delayed or filtered by operators. WhatsApp messages arrive over the internet in seconds, so fewer users give up waiting for the code.

lock

Branded and trusted

Codes arrive in a chat from a verified business, with the security warning built into the message, so users know it's really you.

How the WhatsApp OTP API works

Two endpoints, JSON in and out, authenticated with your API key in the X-API-Key header. Phone numbers include the country code, digits only.

Step 1

POST /api/otp/send.php

phoneRequired. With country code, e.g. 919876543210
purposeOptional label for your logs, e.g. login, signup, checkout

Returns {"success": true, "expires_in": 300}. A 6-digit code is sent on WhatsApp and is valid for 5 minutes.

Step 2

POST /api/otp/verify.php

phoneRequired. The same number you sent the code to
codeRequired. What the user typed

Returns {"verified": true}, or {"verified": false, "error": "Incorrect code"}. A code can be used once.

# 1. Send a code
curl -X POST https://app.waloops.com/api/otp/send.php \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone": "919876543210", "purpose": "login"}'

# 2. Verify what the user typed
curl -X POST https://app.waloops.com/api/otp/verify.php \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone": "919876543210", "code": "483920"}'

Limits and errors

RuleValueResponse when hit
Code length6 digits–
Code lifetime5 minutes"This code has expired"
Wrong attempts per code5"Too many incorrect attempts. Request a new code."
Resend to the same numberOnce every 30 secondsHTTP 429
Monthly quotaDepends on planHTTP 429 with the plan limit
Missing or invalid phone–HTTP 400

WhatsApp OTP API pricing

The same API key works for the API and our WordPress plugin. No per-message charges from WALoops on any of these plans.

Free

$0/month
100 OTPs / month

Sent from the WALoops WhatsApp number. No Meta setup.

Get a free API key

Introduction

$5/month
1,000 OTPs / month

Use our shared number, or connect your own WhatsApp Business number.

Start Introduction

Starter

$9.99/month
Unlimited OTPs

Sent from your own connected WhatsApp Business number, with your brand name.

Start Starter

On your own number, Meta bills authentication messages to your WhatsApp Business account at its own rate. See the WhatsApp pricing guide.

Prefer not to write code?

Frequently asked questions

What is a WhatsApp OTP API? expand_more
An API that sends a one-time password to a user's WhatsApp instead of by SMS. Your app calls it with a phone number, the user receives a code in WhatsApp, and your app calls it again to check the code they typed.
Is the WhatsApp OTP API free? expand_more
The Free plan includes 100 WhatsApp OTPs every month with no credit card, sent from the WALoops WhatsApp number. Paid plans start at $5/month for 1,000 OTPs.
Do I need a Meta or WhatsApp Business account? expand_more
Not on the Free and Introduction plans: codes go out from our verified WhatsApp number. To send from your own number and brand name, connect a WhatsApp Business number on Introduction or Starter.
Do WhatsApp OTPs need DLT registration in India? expand_more
No. DLT registration applies to SMS. WhatsApp messages use templates approved by Meta instead.
How long is a code valid? expand_more
Five minutes. Each code can be used once and allows five wrong attempts before the user has to request a new one.
What if the user doesn't have WhatsApp? expand_more
The code can't be delivered to a number that isn't on WhatsApp. Offer another sign-in method, such as email or password, alongside WhatsApp OTP.
Which languages and frameworks are supported? expand_more
Any that can make an HTTPS POST request with JSON: PHP, Node.js, Python, Java, Go, Ruby, mobile apps and no-code tools. For WordPress there's a ready-made plugin.
Join 500+ D2C Brands on WAloops

Send your first WhatsApp OTP in five minutes

Free API key, 100 OTPs a month, no credit card.

✓ No credit card required   ✓ 7-day free trial   ✓ Cancel anytime