Skip to content

A glossary story9 chapters · 6 min read

Copy Code Authentication

The OTP button on a WhatsApp authentication template that copies the code for the user to paste; it works on every phone and backs up autofill.

Also called: Copy code button · COPY_CODE OTP button · Copy code template · OTP copy button

Reviewed

Follow along

Climb the OTP ladder, then fall back

6 / 6
  1. Tier 1: Copy code (current)Tap, then paste
  2. Tier 2: One-tap autofill (not reached)1 tap
  3. Tier 3: Zero-tap (not reached)No tap
Move 6 of 6Drops a tier

Tier 1 · Copy code

Tap, then paste

Why: No handshake, or one older than 10 minutes: one-tap is not possible either, so the copy-code button appears.

COPY_CODE: works on every primary phone with no app setup. It is also the fallback for the other two types.

Each rung removes a step for the user and adds work for your app. Follow one template through different phones to see why every path ends on copy code when conditions fail.

Move 6 of 6: drops to tier 1, Copy code (Tap, then paste). No handshake, or one older than 10 minutes: one-tap is not possible either, so the copy-code button appears.

Chapter 1 · The scenario

Example: Web checkout for a Jaipur handicrafts store

A Jaipur handicrafts store verifies the phone number at web checkout. Because the customer is on a laptop browser, autofill into an app is not an option, so the store's template uses copy code with a 5-minute footer and a 5-minute time-to-live. The customer opens WhatsApp on their phone, taps "Copy code", and types the six digits into the checkout page — the store's UI says "Check WhatsApp on your phone" because linked desktop sessions show a prompt instead of the code. If no delivered status arrives within 20 seconds, the page offers an SMS code.

— Web checkout for a Jaipur handicrafts store

Chapter 2 · What is copy code authentication?

Copy code authentication is the simplest of the three ways an authentication template can deliver a one-time passcode on WhatsApp. The template is created with a button of type: OTP and otp_type: COPY_CODE. When the message arrives, the user sees Meta's preset text ("482913 is your verification code.") and a button labelled "Copy code" by default. Tapping it puts the code on the device's clipboard; the user switches to your app or website and pastes it.

Its value is that it asks nothing of your app. One-tap autofill and zero-tap only work on Android, need your app's package name and signing-key hash registered in supported_apps, and need a handshake from the app shortly before each send. Copy code has no such conditions, so it works on every primary phone, Android or iOS, for apps and for websites alike. That is also why it is the floor of the system: whenever one-tap or zero-tap conditions are not met, WhatsApp shows the copy-code button instead.

Two 2026 details are worth knowing. Since 15 June 2026, on iOS 26 and later, copy-code messages also trigger a keyboard suggestion, so iPhone users can fill the code from the notification in one tap with no integration work. And on the Cloud API, authentication messages sent to linked devices such as WhatsApp desktop are masked with a prompt to view them on the primary phone, so "works everywhere" means every phone that holds the WhatsApp account, not every screen. Copy code also differs from the copy-code button on a coupon template: that one is a marketing feature for promo codes, while this one carries verification codes at the authentication rate.

Key takeaways

  • Copy code authentication is the OTP button type that copies the code to the clipboard so the user can paste it into your app or website.
  • It needs no app integration, so it works on every primary phone, Android or iOS, and in web sign-up flows.
  • One-tap autofill and zero-tap fall back to the copy-code button whenever their Android conditions are not met.
  • Send the identical code twice: as the body parameter and as the button parameter with sub_type: url and index: 0.
  • Since 15 June 2026, iOS 26 and later also suggest the code on the keyboard, with no extra integration work.

Chapter 3 · How it unfolds

How does copy code authentication work?

  1. Create the template with COPY_CODE

    Submit an AUTHENTICATION template whose BUTTONS component has one OTP button with otp_type: COPY_CODE. The optional text sets the label, up to 25 characters; leave it out to get the localised default.

  2. Generate and store the code

    Create a random code of up to 15 characters (6 digits is typical), store only a hash with its expiry time, and match the expiry to code_expiration_minutes if you show the footer.

  3. Send the code twice in one payload

    Pass the OTP as the body parameter and again as the parameter of the button component, which uses sub_type: url and index: 0 because WhatsApp stores the OTP button as a URL-type button.

  4. Let the user copy and paste

    The tap copies the code to the clipboard. On iOS 26 and later the keyboard can also suggest it. Make your input field accept a pasted code, including surrounding spaces.

  5. Verify and expire

    Compare the entered code with the stored hash, allow a small number of attempts, and invalidate the code once used or expired.

Chapter 4 · The facts

Copy code authentication: key facts and limits

otp_typeCOPY_CODE
Button labelOptional text, up to 25 characters
Code lengthUp to 15 characters
Works onEvery primary phone, Android and iOS
App setup neededNone: no handshake or signature hash
iOS 26 and laterKeyboard suggestion since 15 June 2026

Chapter 5 · Why it matters

Why does copy code authentication matter?

Most login and payment flows have to work for every user, not just Android users with your app installed. Copy code is the delivery method you can rely on for web sign-ups, iPhone users and anyone whose handshake has timed out, and it is the path every autofill integration silently falls back to. Getting it right — short expiry, clear button label, a paste-friendly input field — decides whether the fallback feels smooth or broken.

Chapter 6 · In code

Copy code authentication in code

import crypto from "node:crypto";
 
export async function sendLoginCode(to) {
  const otp = crypto.randomInt(0, 1_000_000).toString().padStart(6, "0");
  // Store only a hash, with the same 5-minute validity as the template footer.
  await otpStore.set(to, {
    hash: crypto.createHash("sha256").update(otp).digest("hex"),
    expiresAt: Date.now() + 5 * 60_000,
    attempts: 0,
  });
 
  const res = await fetch(
    `https://graph.facebook.com/v26.0/${process.env.PHONE_NUMBER_ID}/messages`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.ACCESS_TOKEN}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        messaging_product: "whatsapp",
        to,
        type: "template",
        template: {
          name: "login_otp_copy",
          language: { code: "en_US" },
          components: [
            { type: "body", parameters: [{ type: "text", text: otp }] },
            {
              type: "button",
              sub_type: "url", // the OTP button is stored as a URL button
              index: "0",
              parameters: [{ type: "text", text: otp }],
            },
          ],
        },
      }),
    },
  );
  return res.json(); // { messages: [{ id: "wamid..." }] }
}

The code goes in twice: once for the body text and once for the copy-code button.

Chapter 7 · Where it goes wrong

Common mistakes with copy code authentication

  • Sending the code only once

    Leaving out the button parameter, or sending a different value there, makes the send fail or copies the wrong code. Put the identical OTP in the body parameter and in the button parameter.

  • Blocking paste in the input field

    Split-digit inputs that reject a pasted six-digit string defeat the point of the button. Accept a full paste into the first box and trim spaces.

  • Telling desktop users to check WhatsApp Web

    Authentication messages on linked devices are masked and point users to the primary phone. Word your UI as "Check WhatsApp on your phone".

  • Long-lived codes

    A code that stays valid for 30 minutes and a message that can still be delivered after that both widen the window for misuse. Keep validity short and set message_send_ttl_seconds to match.

Chapter 8 · Copy Code Authentication FAQs

Copy Code Authentication FAQs

Does copy code work on iPhone?+
Yes. One-tap and zero-tap are Android-only, but copy code works on every primary phone. Since 15 June 2026, iOS 26 and later also offer a keyboard suggestion for copy-code messages.
Can I change the "Copy code" label?+
Yes, with the optional `text` field when you create the template, up to 25 characters. Without it, WhatsApp uses a default label localised to the template's language.
Is a copy-code OTP the same as a coupon code button?+
No. Both copy text to the clipboard, but the OTP button belongs to an authentication template with fixed wording and the authentication rate. The coupon button sits on a marketing template, carries a promo code and is billed as marketing.
Why does WhatsApp desktop show a prompt instead of the code?+
Authentication messages are shown only on the primary phone. On the Cloud API, linked devices such as WhatsApp desktop or web display a masked message asking the user to open it on their phone, so word your sign-in screen as "Check WhatsApp on your phone".

Chapter 9 · What good teams do

Best practices for copy code authentication

  • Keep codes to 6 digits: easy to read, easy to paste and well under the 15-character cap.
  • Use a clear button label in the user's language, or leave it blank for the localised default.
  • Start with copy code, ship it, then add one-tap for Android app users once the basics are measured.
  • Log which delivery path users actually hit so you know how often autofill falls back.

See InfiQ pricing

From definition to your first message

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms