Authentication Message Templates

If your mobile application offers users the option to receive one-time passwords or verification codes via WhatsApp, you must use an authentication template.

The authentication template with an OTP button consists of the following:

• Preset authentication message template fixed text:

  • <VERIFICATION_CODE> is your verification code.

  • Security disclaimer (optional): For your safety, do not share this code.

  • Expiry warning (optional): This code will expire in <NUM_MINUTES> minutes.

  • Button: Copy code or one-tap autofill button.

  • Message validity: If the message is not delivered within the validity period, you will not be charged, and your customer will not see the message.

The code length cannot exceed 15 characters. URLs, media, and emojis are not supported. Due to the authentication template with an OTP button consisting only of preset text and buttons, the risk of it being paused is greatly reduced.

Copy Code Authentication Templates

The copy code authentication template allows you to send a one-time password or code along with a copy code button to your users.

When a WhatsApp user clicks the copy code button, the WhatsApp client copies the password or code to the device's clipboard. The user can then switch to your app and paste the password or code into your app.

See Copy Code Authentication Templates for how to use them.

One-Tap Autofill Authentication Templates

The authentication template includes a one-tap autofill button.

When a WhatsApp user clicks the autofill button, the WhatsApp client triggers an activity that opens your application and provides it with the password or code.

See One-Tap Autofill Authentication Templates for how to use them.

Zero-Tap Authentication Templates

The zero-tap authentication template allows your users to receive a one-time password or code via WhatsApp without leaving your application.

When a user in your app requests a password or code and you provide that password or code using a zero-tap authentication template, the WhatsApp client broadcasts the included password or code, which your app can then capture using a broadcast receiver.

See Zero-Tap Authentication Templates for how to use them.

Best Practices

• Confirm the number before sending a one-time password or code to the user's WhatsApp phone number.

• Clearly explain to users that the password or code will be sent to their WhatsApp phone number, especially when you offer multiple ways for users to receive passwords or codes. See Getting Opt-In for more tips.

• When the user pastes the password or code into your app, or your app receives the password or code through the one-tap autofill button flow, clearly indicate to the user that your app has captured the password or code.