Skip to content
The InfiQ GlossaryFeature

Templates

Zero-Tap Authentication

An Android-only WhatsApp authentication template type that hands the one-time passcode straight to your app, with no tap, copy or typing by the user.

Also called: Zero-tap OTP · ZERO_TAP OTP button · WhatsApp zero-tap · Automatic OTP delivery to app

InfiQ Glossaryreviewed Expert

What is zero-tap authentication?

Zero-tap authentication is the most automatic of the three button types for a WhatsApp authentication template. With copy code authentication the user copies the code into your app; with one-tap autofill they tap a button to send it there. With zero-tap, the WhatsApp app on the phone hands the one-time passcode to your Android app through a broadcast the moment the message arrives, so the login field fills itself. The WhatsApp message still lands in the chat, showing Meta's fixed text such as "123456 is your verification code".

It is also the most constrained option. It works only for Android apps, only after your app has performed a handshake with WhatsApp or WhatsApp Business on the same phone, and only when the template lists your app's package_name and 11-character signature_hash in supported_apps (up to five pairs). The template is created with otp_type zero_tap, and Meta will not create it unless zero_tap_terms_accepted is true. Setting that flag accepts that zero-tap use falls under the WhatsApp Business Terms of Service and that it is your responsibility to make sure customers expect the code to be filled in for them.

When the message reaches the phone, WhatsApp runs an eligibility check: a handshake started no more than 10 minutes earlier (or within the template's code_expiration_minutes), a package name and signing-key hash that match the installed app, and a zero-tap broadcast receiver declared by your app (Meta's checklist also expects the one-tap autofill activity). If any check fails, the message falls back to a one-tap autofill button when your one-tap activity exists, otherwise to a copy-code button; every non-Android device gets copy code. Zero-tap still sends a real OTP over WhatsApp, which makes it different from silent network authentication, where the mobile operator confirms the SIM and no code is sent at all.

Key takeaways

  • Zero-tap authentication delivers a WhatsApp one-time passcode straight into your Android app, with no tap, copy or typing by the user.
  • It needs an app handshake, a matching package name and 11-character signature hash, and zero_tap_terms_accepted set to true.
  • If an eligibility check fails, WhatsApp shows a one-tap autofill button instead, or a copy-code button; iPhones always get copy code.
  • It is billed as an ordinary authentication message, and your server must still verify the code, its expiry and the number of attempts.

Figure 1

Read the three pieces a zero-tap sign-in needs

5 / 5
{
"name": "signin_code",
"category": "AUTHENTICATION",
"message_send_ttl_seconds": 300,
"components": [
{ "type": "body", "add_security_recommendation": true },
{ "type": "footer", "code_expiration_minutes": 5 },
{ "type": "buttons", "buttons": [{
"type": "otp",
"otp_type": "zero_tap",
"zero_tap_terms_accepted": true,
"text": "Copy code",
"autofill_text": "Autofill",
"supported_apps": [
{ "package_name": "in.example.grocer",
"signature_hash": "K8a/AINcGX7" }
]
}] }
]
}

Step 5 of 5 · lines 4–7

Keep the delivery TTL (300 s) no longer than the code's validity (5 minutes), which also bounds the handshake window.

Jump to
Step through the template, the app's handshake and its broadcast receiver. Each highlight explains a field or call that WhatsApp's zero-tap eligibility check depends on.

Template, step 5 of 5, lines 4–7: Keep the delivery TTL (300 s) no longer than the code's validity (5 minutes), which also bounds the handshake window.

Why it matters

Why does zero-tap authentication matter?

Each step between "Send code" and "Signed in" costs users: switching apps, finding the message, copying six digits and coming back is where people stall, mistype or give up. Zero-tap removes every one of those steps for Android users — which in India is most of an app's audience — while keeping the WhatsApp message as a visible record. The trade-off is engineering effort and responsibility: an Android SDK, a receiver, a handshake timed to the request, signing hashes for every build, and terms that make you answerable for users not being surprised. Because it falls back to one-tap and then copy code by itself, the downside of a failed check is only the experience you already had.

How does zero-tap authentication work?

  1. Create a zero-tap template

    Post an AUTHENTICATION template to /{WABA_ID}/message_templates with a buttons component holding one otp button: otp_type: zero_tap, zero_tap_terms_accepted: true, optional text and autofill_text labels (25 characters each) and supported_apps with each build's package_name and signature_hash.

  2. Build the Android side

    Add Meta's OTP Android SDK, declare an exported BroadcastReceiver for the com.whatsapp.otp.OTP_RETRIEVED action, and add a one-tap activity for the same action so a failed zero-tap check can still offer autofill.

  3. Handshake when the user asks for a code

    In the same tap that requests the code, call WhatsAppOtpHandler.sendOtpIntentToWhatsApp(context). It sends com.whatsapp.otp.OTP_REQUESTED to WhatsApp and WhatsApp Business and returns a handshake ID (a UUID) that the app stores.

  4. Send the authentication template

    Your server calls POST /{PHONE_NUMBER_ID}/messages with the code as the body parameter and again in a button component (sub_type: url, index: 0). The code must appear twice; after creation the zero-tap button reads back as type url.

  5. WhatsApp checks eligibility and broadcasts the code

    If the handshake is recent and the package name and signature hash match, WhatsApp broadcasts OTP_RETRIEVED with the code and the request_id. The SDK's processOtpCode() rejects a missing, malformed or mismatched handshake ID.

  6. Verify on the server and tell the user

    The app submits the code, your server checks it, its expiry and the attempt count as for any OTP, and the app confirms that the code was received from WhatsApp.

Zero-tap authentication in code

curl -X POST "https://graph.facebook.com/v26.0/{WABA_ID}/message_templates" \
  -H "Authorization: Bearer {ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "signin_code",
    "language": "en_US",
    "category": "AUTHENTICATION",
    "message_send_ttl_seconds": 300,
    "components": [
      { "type": "body", "add_security_recommendation": true },
      { "type": "footer", "code_expiration_minutes": 5 },
      { "type": "buttons", "buttons": [{
        "type": "otp",
        "otp_type": "zero_tap",
        "text": "Copy code",
        "autofill_text": "Autofill",
        "zero_tap_terms_accepted": true,
        "supported_apps": [
          { "package_name": "in.example.grocer", "signature_hash": "K8a/AINcGX7" },
          { "package_name": "in.example.grocer.debug", "signature_hash": "Qm3x9LzP0aB" }
        ]
      }] }
    ]
  }'

Illustrative package names and hashes. Without zero_tap_terms_accepted: true the template is not created.

Common mistakes with zero-tap authentication

  • Surprising users with auto-filled codes

    The zero-tap terms make you responsible for customers expecting the code to be filled in for them. Let users choose WhatsApp rather than making it the silent default, say on screen that the code will arrive automatically, and confirm when it has.

  • Sending the template before the handshake

    If the server sends first, or the user waits longer than the handshake window, the check fails and zero-tap quietly becomes one-tap or copy code. Start the handshake in the same action that requests the code.

  • Registering only the release build

    Debug, staging and white-label builds are signed with other keys or use other package names, so they fail the signature check. Add each build as its own supported_apps pair, up to five.

  • Trusting any broadcast that carries a code

    The receiver is exported, so check that request_id matches the handshake ID you stored before using code — or let the SDK's processOtpCode() do it — and clear the stored ID once it has been used.

  • Treating zero-tap as the verification

    Zero-tap only moves the digits. Your server must still check the code, enforce its expiry, limit attempts and rate-limit requests, exactly as for SMS or copy code.

Example: A grocery app's sign-in in Hyderabad

A Hyderabad grocery-delivery app offers "Get code on WhatsApp" next to SMS on its sign-in screen, with a line explaining that the code will be filled in automatically. On Android the tap starts the handshake and asks the server for a code; about three seconds later the field fills, the app submits it and shows "Code received from WhatsApp". QA builds kept falling back to one-tap until the team registered the debug package and its signing hash as a second supported_apps entry. iPhone users receive the same template with a copy-code button, and a customer whose WhatsApp runs on a different phone also gets copy code, because no handshake could reach it.

— A grocery app's sign-in in Hyderabad

Best practices for zero-tap authentication

  • Declare the one-tap activity as well as the zero-tap receiver, so a failed check degrades to one tap rather than to copying.
  • Keep the template time-to-live (message_send_ttl_seconds) at or below the code's validity so a stale code is never delivered.
  • Log whether each sign-in completed by zero-tap, one-tap or manual entry to see where users fall back.
  • Move any remaining PendingIntent-based handshake code to Meta's OTP Android SDK, the path Meta now documents.
  • Keep an SMS OTP or voice fallback for users without WhatsApp on the same phone.

Zero-Tap Authentication FAQs

Does zero-tap authentication work on iPhone?
No. Zero-tap is Android-only, and iPhone users receive the same template with a copy-code button. Since 15 June 2026, iOS 26 and later also offers the code as a keyboard suggestion, without any integration.
What happens when a zero-tap check fails?
The message still arrives, with a fallback button. WhatsApp shows a one-tap autofill button if your app declares the one-tap activity, and a copy-code button otherwise.
Is zero-tap authentication the same as silent network authentication?
No. Zero-tap delivers a one-time passcode over WhatsApp and hands it to your app; silent network authentication asks the mobile operator to confirm the SIM, so no code is sent at all.
Does zero-tap cost more than a copy-code OTP?
No. It is an authentication template, charged per delivered message at the authentication rate (₹0.14 in India on InfiQ's card, ex-GST). A higher authentication-international rate applies to codes a business registered abroad sends to Indian users.
What does zero_tap_terms_accepted mean?
It confirms that you accept Meta's zero-tap terms, and Meta will not create the template without it. You agree that zero-tap use falls under the WhatsApp Business Terms of Service and that customers must expect the code to be filled in for them.

See InfiQ pricing

* Per-message rates for India, ex-GST: marketing, utility and authentication effective 1 July 2026; service messages ₹0.145 since 1 October 2026 (they were ₹0 until 30 September 2026). Volume commitments earn discounts — final rate is confirmed on your account; applicable GST extra. Rates for other countries differ (see the international rate table on /pricing).

Try it on the official WhatsApp Business API

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms