WhatsApp OTP: verify phone numbers over WhatsApp

Prove that a user holds a phone number, for a sign-up or a sign-in without a password, over WhatsApp instead of SMS. Your user taps a link, WhatsApp opens with a code already written, and they press send. Your system is told which number sent it.

How it works

Your system asks for an OTP with one API request. It gets back a link, a QR code and a code.
Your user sends the code. On a phone they tap the link; on a computer they scan the QR code. The message is ready, so they only press send.
You are told the number. When the message reaches your number, a webhook brings the phone that sent it. That is what you sign them in with.

Your number then answers with a short confirmation, in English or Arabic.

Why the user sends the code

In most OTP flows the business sends a code to the user. Here the user writes first, and that changes three things.

It is the safest message there is for your number. Your number only replies. So there is no daily limit on new people, no night hours and no waiting.
The message itself proves the number. WhatsApp says who sent it, so the user has no code to copy back into your app.
There is no fee per code. A plan is priced by how many numbers you link.

When you already know the phone, give it in the request. The code is then accepted only from that phone, so a forwarded link signs nobody else in.

Rarely, WhatsApp hides the sender's number. The OTP still completes, but without a phone: never sign anyone in by it.

When you must send the code yourself

Your number can also send a code to a phone, the way an SMS OTP works, and your system checks what the user types.

Know its limit first. To someone who never wrote to your number, that code is a first message. It counts against the day's new people, and it is not sent at night. A late code is useless, so it is never kept waiting: if it cannot go within about two minutes, the OTP fails at once and says why. That is why we recommend the link: it always works.

Built to be safe

Codes are random, and we store only a keyed hash of each one.
A code expires after a time you choose, and too many wrong guesses fail it.
Limits per phone stop anyone from flooding a number with codes.
Try it in your panel makes a link you complete from your own phone.

Threadwire links your number as a device; it is not Meta's official API. WhatsApp API without Meta approval says what that means.

Start