Sending OTPs on WhatsApp in India: authentication template rules, buttons and cost
To send OTPs on WhatsApp you must use an approved authentication template: fixed text with your code, an optional security note and expiry line, and a copy-code or one-tap autofill button. In India Meta charges INR 0.115 per delivered authentication message for businesses based in India. Codes go only to the user's primary phone, and URLs, media and emojis are not allowed.
Prices as on 22 October 2026. Figures were checked against the provider's official pages on that date. Providers change prices and rules without notice, so confirm on the official page before you budget. Convo360 adds no markup: you pay the provider directly with your own account. Convo360 is not affiliated with Meta or WhatsApp. This summarises Meta's published documentation on the date shown; Meta's own pages prevail.
- Only authentication templates may carry one-time passcodes; a marketing or utility template that should be authentication is rejected.
- The text is fixed by Meta; you choose the security disclaimer, an expiry line of 1 to 90 minutes and the button type.
- Meta's India rate is INR 0.115 per delivered authentication message for India-based businesses, with volume discounts only at very high volumes.
- Authentication messages are delivered only to the user's primary WhatsApp device, not to linked devices.
- Copy-code, one-tap and zero-tap templates need the user's phone number, not a username-based ID.
Why OTPs need an authentication template
Meta's rule is simple: if you send one-time passwords or verification codes over WhatsApp, you must use an authentication template. Its category guidelines say only authentication templates may carry one-time passcodes. Meta also checks for misuse: a marketing or utility template that should have been authentication is marked rejected, with no option to request a review.
This matters for Indian apps, fintech-adjacent services, e-commerce stores and coaching portals that send login or order-confirmation codes. Sending the code inside a general utility message is the most common mistake, and it fails Meta's review.
Authentication templates are also separate from marketing for limits. The per-user marketing cap that triggers error 131049 applies to marketing templates, so your OTPs are not held back because a customer has received many offers.
What an authentication template looks like
According to Meta's authentication template documentation, the template is built from fixed parts:
| Part | What you control |
|---|---|
| Preset text | Fixed by Meta: the code followed by is your verification code |
| Security disclaimer | Optional: For your security, do not share this code |
| Expiry warning | Optional: This code expires in a set number of minutes, from 1 to 90 |
| Button | Copy code, one-tap autofill, or none for zero-tap |
You cannot add URLs, media or emojis to the content or parameters, and parameters are limited to 15 characters. Meta offers the preset text in many languages, so a Hindi or Tamil version reads naturally for your users.
Copy code, one-tap and zero-tap: which to choose
- Copy code. The user taps the button, the code is copied, and they paste it into your app or website. Works everywhere, needs no app changes. The safest default for most Indian SMBs, especially if login happens on a website.
- One-tap autofill (Android). Tapping the button opens your Android app and hands it the code. Meta calls this the preferred option, but it needs changes in your app's code.
- Zero-tap (Android only). The WhatsApp client passes the code straight to your app without the user tapping anything.
- iPhone users. On iOS 26 and later, keyboard suggestions offer the code for autofill from the notification, with no integration needed. Earlier iOS versions should get a copy-code template.
Two more behaviours to know. With linked device security, authentication messages are delivered only to the user's primary WhatsApp phone; linked devices such as WhatsApp Web show a prompt to check the phone. And the default time-to-live for an authentication message is 10 minutes, adjustable from 30 seconds to 15 minutes, so a stale code is not delivered after it has expired.
What WhatsApp OTPs cost in India
Meta charges per delivered message. On its INR rate card, checked on 22 October 2026, an authentication message to an Indian number costs INR 0.115, the same as a utility message. Volume tiers bring the rate down, but on Meta's tier card they start only above 7,50,000 authentication messages a month, so most SMBs pay the list rate.
A separate authentication-international rate, listed for India at INR 2.4971, applies only to businesses based outside India that send a very large number of authentication messages to Indian users. A business whose primary location is India pays the normal authentication rate for Indian users.
Compare that with SMS OTPs, which in India need DLT registration and are priced by your SMS provider; see DLT registration explained. Many businesses use WhatsApp first and SMS as a fallback for users not on WhatsApp.
A quick sum helps with budgeting. A Nagpur coaching portal sending 20,000 login codes a month would pay Meta about INR 2,300 at the list rate, before any tax, and only for codes actually delivered.
Good practice for WhatsApp OTP flows
- Confirm the number first. Meta recommends confirming the user's WhatsApp number before sending the code.
- Say where the code is going. If you offer SMS and WhatsApp, tell the user the code will arrive on WhatsApp.
- Confirm capture. When your app receives the code, show that it has been accepted.
- Use phone numbers, not usernames. Meta's username documentation says business-scoped user IDs cannot be used for copy-code, one-tap or zero-tap templates.
- Never ask for codes in chat. Your support bot should never request a customer's OTP, password or card number. Fraudsters rely on exactly that.
Sending OTPs with Convo360
On Convo360 you create the template in WhatsApp Studio: choose the Authentication category, pick the button type, set the expiry and submit it to Meta. The builder checks your draft against Meta's template rules before you submit.
To send codes from your own system you have two routes:
- REST API (included on Business, or a ₹999/month add-on on Starter and Pro): your app calls Convo360 with the number and the code. See using the REST API.
- Inbound webhook trigger: your system posts to a flow, and the flow's Send Template block sends the authentication template. If your system tells the flow the user prefers SMS, a Condition block can route them to a Send SMS block instead.
Convo360's AI agents are set never to ask customers for OTPs or passwords. Meta bills you directly for each delivered message, with no markup from Convo360.
Example conversation
Send WhatsApp OTPs and alerts from your own number
Start free in minutes — no code, no credit card. Bring your own AI keys and pay no per-message markup.
Frequently asked questions
How much does a WhatsApp OTP cost in India?
For a business based in India, Meta charges INR 0.115 per delivered authentication message to an Indian number, per its rate card checked on 22 October 2026. Volume discounts start only above 7,50,000 authentication messages a month. Rates can change quarterly.
Can I send an OTP in a utility template?
No. Meta's rules say only authentication templates may carry one-time passcodes. A marketing or utility template that should be authentication is rejected, and no review is possible, so create a proper authentication template instead.
Why is my WhatsApp OTP not showing on WhatsApp Web?
Authentication templates use linked device security. Meta delivers them only to the user's primary WhatsApp device, and linked devices such as WhatsApp Web or desktop show a prompt asking the user to check their phone.
What is the difference between copy code and one-tap autofill?
Copy code lets the user copy the code with a button and paste it anywhere, with no app changes. One-tap autofill, on Android, opens your app and passes the code in directly, but requires changes to your app's code.
Can WhatsApp OTP messages include a link?
No. Meta does not allow URLs, media or emojis in authentication template content or parameters. The text is a fixed preset with your code, an optional security disclaimer, an optional expiry line and an OTP button.
Official sources
- Meta: Authentication templates
- Meta: Template categorization and category guidelines
- Meta: Pricing on the WhatsApp Business Platform (INR rate card and volume tiers)
- Meta: Authentication-international rates
- Meta: Template time-to-live
Related reading
Available across India — see WhatsApp & AI calling automation by state and city.