How to add WhatsApp OTP verification to your website

Step 1: Connect a WhatsApp number

1. Sign up for a free WAppOTP account and create a project.
2. In Connections, click to add a number and scan the QR code from WhatsApp → Linked Devices.
3. Use a dedicated number for production so personal chats stay separate.

Step 2: Create an API key

In Developers, create a secret server key and keep it in an environment variable such as WAPPOTP_KEY. Never put a secret key in browser code; for browser-only sites use an origin-restricted publishable key instead.

Step 3: Send the code

import { WhatsAppOtpClient } from "@whatsappotp/sdk";

const otp = new WhatsAppOtpClient({
  baseUrl: "https://api.wappotp.com",
  apiKey: process.env.WAPPOTP_KEY
});

// When the user submits their phone number:
const { verificationId } = await otp.sendOtp({ to: "+639171234567" });
// Store verificationId in the user's session.

Step 4: Verify the code

$otp = new WhatsAppOtp\Client('https://api.wappotp.com', getenv('WAPPOTP_KEY'));
$result = $otp->verifyOtp($_SESSION['verificationId'], $_POST['code']);

if ($result['valid']) {
    // Mark the phone number as verified.
}

Same flow in Python

import os
from whatsappotp import Client

otp = Client("https://api.wappotp.com", os.environ["WAPPOTP_KEY"])
sent = otp.send_otp("+639171234567")
result = otp.verify_otp(sent["verificationId"], code_from_user)
if result["valid"]:
    ...  # phone verified

Security checklist

• Always verify on the server; never trust a client-side "verified" flag.
• Send an Idempotency-Key header so retries don't send duplicate codes.
• Rely on WAppOTP's expiry, attempt limits and per-phone/per-IP rate limits, and add CAPTCHA on public sign-up forms.
• Subscribe to the otp.verified webhook if other services need to know.
• Enable fallback to SMS or email for users who don't receive WhatsApp.

Frequently asked questions

Related