WhatsApp OTP API: verify phone numbers over WhatsApp

How WhatsApp OTP works with WAppOTP

1. Create a free account and a project.
2. Open WhatsApp → Linked Devices on your phone and scan the QR code shown in the dashboard. Your number is now connected.
3. Create an API key. Use a secret server key, or an origin-restricted publishable key for OTP from the browser.
4. Call POST /v1/otp/send with the user's phone number in E.164 format. WAppOTP generates a code and sends it on WhatsApp.
5. Call POST /v1/otp/verify with the verificationId and the code the user entered. You get valid: true or false.

Two API calls

SDKs are available for Node.js, PHP and Python, and there is a WordPress/WooCommerce plugin and a Shopify integration guide. Every endpoint is described in the OpenAPI specification.

# 1. Send a code to the user's WhatsApp
curl -X POST https://api.wappotp.com/v1/otp/send \
  -H "Authorization: Bearer $WAPPOTP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to":"+639171234567"}'
# → {"verificationId":"…","status":"pending","expiresIn":300}

# 2. Check the code the user typed
curl -X POST https://api.wappotp.com/v1/otp/verify \
  -H "Authorization: Bearer $WAPPOTP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"verificationId":"…","code":"482913"}'
# → {"valid":true,"status":"verified"}

Security built in

• Codes are stored only as keyed hashes and expire after a few minutes.
• A limited number of attempts per code, plus rate limits per phone number and per IP address.
• Secret API keys are shown once and stored hashed; keys can be scoped (for example OTP only).
• Idempotency keys make retries safe, so a network retry never sends a second code.
• Signed webhooks (otp.verified and more) so your backend can trust the event.

Delivery you can rely on

• Link several WhatsApp numbers to one project and spread traffic across them.
• If WhatsApp can't deliver within about 45 seconds, the code can fall back to SMS (Philippine numbers) or email automatically.
• Connection alerts tell you when a linked phone goes offline, and messages queue and retry instead of being lost.

When to choose the official WhatsApp Business API instead

WAppOTP uses an unofficial WhatsApp Web connection and is not affiliated with WhatsApp or Meta. If you need Meta's support contract, very high sending volume from a single verified sender, or guaranteed template delivery, the official WhatsApp Business Platform is the better fit. WAppOTP is built for teams that want to go live today with a number they already own.

Frequently asked questions

Related