How do I set up WhatsApp OTP instead of SMS?

Step 1: Build the authentication template

OTPs must go out on an authentication-category template — you cannot send a code as free-form text or a marketing template, and Meta will reject attempts to do so. In the InfiQ template builder you pick the Authentication category, add the verification-code variable as the body parameter, and attach a button. You get two button styles: a copy-code button, which drops the OTP onto the user's clipboard so they paste it back into your app, and a one-tap autofill button, which passes the code straight into your Android app via a package name and signing-hash handshake. Authentication templates use Meta's fixed, pre-approved wording (the code plus an optional security disclaimer and expiry line), which is exactly why they clear review fast — you're choosing from a controlled format rather than writing custom copy that can trip a rejection.

• Category: Authentication (required for OTP — never Utility or Marketing)
• Body variable: the {{code}} parameter your backend fills at send time
• Button: 'Copy code' for any device, or 'One-tap autofill' for native Android
• Optional: code-expiry line (e.g. 'expires in 10 minutes') and security warning

Step 2: Route OTPs through WhatsApp, keep SMS as fallback

In your login and signup service, replace the SMS gateway call with a WhatsApp send at the moment a user requests a code. The InfiQ API returns a message ID you store against the OTP session; webhooks then push delivery status back to you in real time. The key design choice is the fallback: if WhatsApp returns a failed status — the recipient has no WhatsApp account, the number is a landline, or delivery times out after a few seconds — your service automatically fires the same code over SMS instead. Most teams set a short delivery timeout (roughly 15–30 seconds) so a genuine WhatsApp user gets the fast path while a non-WhatsApp user still receives their code without noticing the difference. This 'WhatsApp-first, SMS-fallback' pattern is what lets you shift the majority of volume off SMS while never leaving a real user unable to log in.

What WhatsApp OTP costs in India

Since 1 July 2025 WhatsApp bills per delivered message by category, so every authentication OTP that reaches a handset is charged at the authentication rate — not per conversation, and the 24-hour service window doesn't apply to template sends like OTPs. That per-message model makes verification cost predictable: you multiply expected successful deliveries by the authentication rate, and your SMS fallback only bills on the smaller slice that couldn't be reached on WhatsApp. For most Indian businesses the authentication rate lands below the combined SMS gateway plus DLT cost, and the savings compound at signup-heavy scale. InfiQ applies its own transparent ₹ platform pricing on Meta's live authentication rate (ex-GST) with no per-OTP surprises, and the calculator lets you model your real monthly verification spend before you switch.

• Billed per delivered authentication message
• SMS fallback only costs on the deliveries WhatsApp couldn't complete
• Transparent ₹ pricing, ex-GST — model it in the InfiQ calculator first

Reliability, security, and account ownership

A verification flow can't afford flakiness, so a few operational details matter. Keep your OTP template's failure rate low by only sending codes to opted-in numbers you actually collected — mass, unsolicited OTP sends trigger quality flags. Set a sensible code lifetime and rate-limit requests per number to blunt OTP-flooding abuse. Because InfiQ onboards you through Meta's Embedded Signup, the WhatsApp Business Account and its BSUID (Business-Scoped User ID, the identifier under WhatsApp's 2026 usernames change) stay owned by you — your sender number, templates, and message history are yours, and you can move providers without losing your verified identity. That ownership is what protects a critical login channel from vendor lock-in.