OTP Authentication

WhatsApp Authentication templates provide a secure, high-delivery-rate channel for sending one-time passwords (OTP) and verification codes. This guide covers creating, submitting, and sending OTP messages.

Overview

Authentication templates are purpose-built for verification codes:

High delivery rates - WhatsApp messages have 98%+ open rates
Instant delivery - Codes arrive in seconds
User-friendly - Copy button or auto-fill on Android
Cost-effective - Lowest messaging rates of all template categories
Secure - End-to-end encrypted delivery

Prerequisites

Before creating OTP templates, ensure you have:

Meta Business Verification

Your Meta Business account must be verified

WhatsApp Connected

A sender with WhatsApp Business Account configured

Payment Method

Valid payment method configured in Meta Business Manager

API Key

A Zavu API key for your project

Step 1: Create OTP Template

Via Dashboard

Navigate to Senders in your dashboard
Select the sender with WhatsApp connected
Go to the Templates tab
Click Create Template
Configure the template:
- Name: Use a descriptive name like otp_verification
- Channel: Select WhatsApp only
- Category: Select AUTHENTICATION
- Language: Choose your language (e.g., en)
Configure the OTP button:
- Button Type: Choose Copy Code or One-Tap (Android only)
Optional settings:
- Enable Security Recommendation to add “Do not share this code”
- Set Code Expiration (1-90 minutes)
Click Create

Via API

import Zavudev from '@zavudev/sdk';

const zavu = new Zavudev({
  apiKey: process.env["ZAVUDEV_API_KEY"],
});

const template = await zavu.templates.create({
  name: 'otp_verification',
  language: 'en',
  body: '{{1}} is your verification code.',
  category: 'AUTHENTICATION',
  buttons: [{
    type: 'otp',
    text: 'Copy code',
    otpType: 'COPY_CODE'
  }],
  addSecurityRecommendation: true,
  codeExpirationMinutes: 10
});

console.log('Template ID:', template.id);
console.log('Status:', template.status); // "draft"

import os
from zavudev import Zavudev

zavu = Zavudev(
    api_key=os.environ.get("ZAVUDEV_API_KEY"),
)

template = zavu.templates.create(
    name="otp_verification",
    language="en",
    body="{{1}} is your verification code.",
    category="AUTHENTICATION",
    buttons=[{
        "type": "otp",
        "text": "Copy code",
        "otp_type": "COPY_CODE"
    }],
    add_security_recommendation=True,
    code_expiration_minutes=10
)

print("Template ID:", template.id)
print("Status:", template.status)  # "draft"

template = client.templates.create(
  name: "otp_verification",
  language: "en",
  body: "{{1}} is your verification code.",
  category: "AUTHENTICATION",
  buttons: [{
    type: "otp",
    text: "Copy code",
    otp_type: "COPY_CODE"
  }],
  add_security_recommendation: true,
  code_expiration_minutes: 10
)

puts "Template ID: #{template.id}"
puts "Status: #{template.status}" # "draft"

template, err := client.Templates.New(context.TODO(), zavudev.TemplateCreateParams{
    Name:     zavudev.String("otp_verification"),
    Language: zavudev.String("en"),
    Body:     zavudev.String("{{1}} is your verification code."),
    WhatsappCategory: zavudev.String("AUTHENTICATION"),
    Buttons: []zavudev.TemplateButtonParams{
        {
            Type:    zavudev.String("otp"),
            Text:    zavudev.String("Copy code"),
            OTPType: zavudev.String("COPY_CODE"),
        },
    },
    AddSecurityRecommendation: zavudev.Bool(true),
    CodeExpirationMinutes:     zavudev.Int(10),
})

fmt.Println("Template ID:", template.ID)
fmt.Println("Status:", template.Status) // "draft"

$template = $client->templates->create([
    'name' => 'otp_verification',
    'language' => 'en',
    'body' => '{{1}} is your verification code.',
    'category' => 'AUTHENTICATION',
    'buttons' => [[
        'type' => 'otp',
        'text' => 'Copy code',
        'otpType' => 'COPY_CODE',
    ]],
    'addSecurityRecommendation' => true,
    'codeExpirationMinutes' => 10,
]);

echo 'Template ID: ' . $template->id . "\n";
echo 'Status: ' . $template->status . "\n"; // "draft"

curl -X POST https://api.zavu.dev/v1/templates \
  -H "Authorization: Bearer $ZAVUDEV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "otp_verification",
    "language": "en",
    "body": "{{1}} is your verification code.",
    "category": "AUTHENTICATION",
    "buttons": [{
      "type": "otp",
      "text": "Copy code",
      "otpType": "COPY_CODE"
    }],
    "addSecurityRecommendation": true,
    "codeExpirationMinutes": 10
  }'

Meta auto-generates the message body for authentication templates. The format is always: {{1}} is your verification code. followed by optional security text and expiration.

Step 2: Submit for Meta Approval

Authentication templates typically receive fast approval (within hours).

Via Dashboard

Go to Senders > Select sender > Templates tab
Find your template with “Draft” status
Click the … menu and select Submit for Approval

Via API

await zavu.templates.submit({
  templateId: template.id,
  senderId: 'sender_abc123'
});

// Check status
const updated = await zavu.templates.retrieve({
  templateId: template.id
});
console.log('Status:', updated.status); // "pending" -> "approved"

zavu.templates.submit(
    template_id=template.id,
    sender_id="sender_abc123"
)

# Check status
updated = zavu.templates.retrieve(template_id=template.id)
print("Status:", updated.status)  # "pending" -> "approved"

client.templates.submit(
  template_id: template.id,
  sender_id: "sender_abc123"
)

# Check status
updated = client.templates.retrieve(template_id: template.id)
puts "Status: #{updated.status}" # "pending" -> "approved"

_, err = client.Templates.Submit(context.TODO(), template.ID, zavudev.TemplateSubmitParams{
    SenderID: zavudev.String("sender_abc123"),
})

// Check status
updated, err := client.Templates.Get(context.TODO(), template.ID)
fmt.Println("Status:", updated.Status) // "pending" -> "approved"

$client->templates->submit($template->id, [
    'senderId' => 'sender_abc123',
]);

// Check status
$updated = $client->templates->retrieve($template->id);
echo 'Status: ' . $updated->status . "\n"; // "pending" -> "approved"

curl -X POST https://api.zavu.dev/v1/templates/tmpl_abc123/submit \
  -H "Authorization: Bearer $ZAVUDEV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "senderId": "sender_abc123"
  }'

Expected Approval Time

Template Type	Typical Approval Time
AUTHENTICATION	1-4 hours
UTILITY	24-48 hours
MARKETING	24-72 hours

Authentication templates are prioritized by Meta and usually approved within hours. If approval takes longer, ensure your Meta Business is fully verified.

Step 3: Send OTP Messages

Once approved, send verification codes to users:

import Zavudev from '@zavudev/sdk';

const zavu = new Zavudev({
  apiKey: process.env["ZAVUDEV_API_KEY"],
});

// Generate your OTP code
const otpCode = '123456';

const message = await zavu.messages.send({
  to: '+14155551234',
  messageType: 'template',
  content: {
    templateId: 'tmpl_abc123',
    templateVariables: {
      '1': otpCode  // The OTP code
    }
  }
});

console.log('Message ID:', message.id);
console.log('Status:', message.status);

import os
from zavudev import Zavudev

zavu = Zavudev(
    api_key=os.environ.get("ZAVUDEV_API_KEY"),
)

# Generate your OTP code
otp_code = "123456"

message = zavu.messages.send(
    to="+14155551234",
    message_type="template",
    content={
        "template_id": "tmpl_abc123",
        "template_variables": {
            "1": otp_code  # The OTP code
        }
    }
)

print("Message ID:", message.id)
print("Status:", message.status)

# Generate your OTP code
otp_code = "123456"

message = client.messages.send_(
  to: "+14155551234",
  message_type: "template",
  content: {
    template_id: "tmpl_abc123",
    template_variables: {
      "1" => otp_code  # The OTP code
    }
  }
)

puts "Message ID: #{message.id}"
puts "Status: #{message.status}"

// Generate your OTP code
otpCode := "123456"

message, err := client.Messages.Send(context.TODO(), zavudev.MessageSendParams{
    To:          zavudev.String("+14155551234"),
    MessageType: zavudev.String("template"),
    Content: &zavudev.MessageContentParams{
        TemplateID: zavudev.String("tmpl_abc123"),
        TemplateVariables: map[string]string{
            "1": otpCode, // The OTP code
        },
    },
})

fmt.Println("Message ID:", message.ID)
fmt.Println("Status:", message.Status)

// Generate your OTP code
$otpCode = '123456';

$message = $client->messages->send([
    'to' => '+14155551234',
    'messageType' => 'template',
    'content' => [
        'templateId' => 'tmpl_abc123',
        'templateVariables' => [
            '1' => $otpCode, // The OTP code
        ],
    ],
]);

echo 'Message ID: ' . $message->id . "\n";
echo 'Status: ' . $message->status . "\n";

curl -X POST https://api.zavu.dev/v1/messages \
  -H "Authorization: Bearer $ZAVUDEV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "+14155551234",
    "messageType": "template",
    "content": {
      "templateId": "tmpl_abc123",
      "templateVariables": {
        "1": "123456"
      }
    }
  }'

What the User Sees

The user receives a message like:

123456 is your verification code.

For your security, do not share this code.

This code expires in 10 minutes.

[Copy code]

OTP Button Types

COPY_CODE (Recommended)

The Copy Code button allows users to tap and copy the code to their clipboard.

buttons: [{
  type: 'otp',
  text: 'Copy code',
  otpType: 'COPY_CODE'
}]

Benefits:

Works on all platforms (iOS, Android, Web)
Simple user experience
No additional configuration required

ONE_TAP (Android Only)

The One-Tap button enables automatic code filling in your Android app.

buttons: [{
  type: 'otp',
  text: 'Copy code',
  otpType: 'ONE_TAP',
  packageName: 'com.yourcompany.app',
  signatureHash: 'K8a+W1234...'
}]

Requirements:

Android app only
Must provide packageName (Android package name)
Must provide signatureHash (Android app signature hash)

How to get your signature hash:

In your Android app, use the SMS Retriever API helper:

AppSignatureHelper helper = new AppSignatureHelper(context);
ArrayList<String> signatures = helper.getAppSignatures();
// Use the first signature
String signatureHash = signatures.get(0);

The hash is an 11-character string like K8a+W1234ab

One-Tap auto-fill only works on Android. iOS users will see a standard copy button. Always ensure your flow works without auto-fill as a fallback.

Template Options

Security Recommendation

Add a security disclaimer to your OTP message:

addSecurityRecommendation: true

This adds: “For your security, do not share this code.”

Code Expiration

Display when the code expires:

codeExpirationMinutes: 10  // 1-90 minutes

This adds: “This code expires in 10 minutes.”

Best Practices

Use Short Expiration

Set expiration to 5-10 minutes for security. Shorter is better.

Enable Security Warning

Always enable addSecurityRecommendation to protect users from phishing.

Generate Secure Codes

Use cryptographically secure random number generators for OTP codes.

Rate Limit Requests

Limit OTP requests per user to prevent abuse (e.g., 5 per hour).

OTP Code Guidelines

Use 6-digit numeric codes for balance of security and usability
Generate codes using secure random functions
Store codes with expiration timestamps
Invalidate codes after successful verification
Limit verification attempts (e.g., 3 tries per code)

// Example: Generate secure OTP
import crypto from 'crypto';

function generateOTP(): string {
  return crypto.randomInt(100000, 999999).toString();
}

Common Issues

Issue	Solution
Template rejected	Ensure category is AUTHENTICATION and content is purely verification-related
Code not displaying	Check that variable `{{1}}` is provided in `templateVariables`
One-Tap not working	Verify `packageName` and `signatureHash` are correct for your Android app
Slow delivery	Check recipient’s WhatsApp status and your sender’s quality rating
Button not showing	Ensure the template has `buttons` configured with OTP type

Webhook Events

Track OTP delivery status via webhooks:

{
  "id": "evt_1702000000000_abc123",
  "type": "message.delivered",
  "timestamp": 1702000000000,
  "data": {
    "messageId": "msg_xyz789",
    "to": "+14155551234",
    "channel": "whatsapp",
    "status": "delivered"
  }
}

Configure webhooks to receive:

message.sent - OTP accepted by WhatsApp
message.delivered - OTP delivered to device
message.failed - Delivery failed

See Webhooks Guide for setup instructions.

Next Steps

Template Approval

Learn more about the approval process and common rejection reasons

Configure Webhooks

Set up webhooks to track delivery status

Smart Routing

Use smart routing to automatically fall back to SMS if WhatsApp fails

Rate Limiting

Understand API rate limits for high-volume OTP sending

​Overview

​Prerequisites

Meta Business Verification

WhatsApp Connected

Payment Method

API Key

​Step 1: Create OTP Template

​Via Dashboard

​Via API

​Step 2: Submit for Meta Approval

​Via Dashboard

​Via API

​Expected Approval Time

​Step 3: Send OTP Messages

​What the User Sees

​OTP Button Types

​COPY_CODE (Recommended)

​ONE_TAP (Android Only)

​Template Options

​Security Recommendation

​Code Expiration

​Best Practices

Use Short Expiration

Enable Security Warning

Generate Secure Codes

Rate Limit Requests

​OTP Code Guidelines

​Common Issues

​Webhook Events

​Next Steps

Template Approval

Configure Webhooks

Smart Routing

Rate Limiting

Overview

Prerequisites

Step 1: Create OTP Template

Via Dashboard

Via API

Step 2: Submit for Meta Approval

Via Dashboard

Via API

Expected Approval Time

Step 3: Send OTP Messages

What the User Sees

OTP Button Types

COPY_CODE (Recommended)

ONE_TAP (Android Only)

Template Options

Security Recommendation

Code Expiration

Best Practices

OTP Code Guidelines

Common Issues

Webhook Events

Next Steps