WhatsApp Verification Code: How to Send via Official API Securely Without Losing Registration

The format: what is allowed and what is not

An authentication template consists of:

• Standard text with the code. A phrase predefined by Meta, translated into the template’s language, informing that this is the verification code. The code is inserted as a variable.
• Optional security notice. A phrase advising the customer not to share the code.
• Optional validity notice. Information that the code expires after a certain number of minutes.
• Button. Copy code, or automatic filling in supported scenarios.

And what is excluded:

• Links and URLs in the message body.
• Image, video, or document in the header.
• Emojis and promotional text.
• Any content other than the code—welcome messages, offers, product usage instructions.

Trying to circumvent this format by using the utility category to send a code with custom text usually fails: Meta reviews template categories and may reclassify or reject them.

The three types of buttons

Copy code

The simplest button and the one that works on any device. The customer taps, the code goes to the clipboard, and they paste it into the app or website. It’s the default choice for verification on websites, computers, or iPhone apps.

One-tap fill

Available for Android apps. When tapping the button, WhatsApp delivers the code directly to the company’s app, which fills it in automatically. Requires technical configuration in the app—package identification and signature—and if the device doesn’t meet requirements, the message falls back to the copy button.

No-tap fill

Also on Android, the code is delivered to the app without any customer action. It’s the smoothest experience and requires the most care: Meta requires the company to accept specific usage conditions, and the app must be prepared to receive the code securely.

The Three-Layer Code Method

Reliable verification depends on more than just the template. It requires three layers working together.

Layer 1 — Secure generation

• Random code generated on the server, never in the app or browser.
• Short validity, a few minutes, indicated in the message.
• One-time use: once validated, the code is no longer valid.
• Limit on wrong attempts before blocking and requiring a new code.

Layer 2 — Observable delivery

• Recording the status of each send: sent, delivered, failed—and the reason for failure.
• Waiting time before allowing resend, to prevent the customer from requesting five codes in a row.
• Alternative channel defined—usually SMS or email—when the number doesn’t have WhatsApp or delivery fails.

Layer 3 — Abuse protection

• Limits on requests per phone number, IP, and device within a time window.
• Blocking suspicious patterns: number sequences, many requests for different countries, unusual spikes.
• Daily cost monitoring, to detect attacks before the bill arrives.

The complete flow, step by step

• 1. The customer enters their mobile number during registration or login.
• 2. The system validates the number format and checks request limits.
• 3. The server generates the code, records it with validity, and sends the authentication template via the official API.
• 4. The screen shows: “We sent a code to your WhatsApp ending in 4821” and a resend countdown.
• 5. The message status is monitored. If it fails or isn’t delivered within a few seconds, the screen offers the alternative channel.
• 6. The customer pastes or has the code filled in; the server validates, marks it as used, and proceeds.
• 7. Wrong attempts above the limit block the code and request a new one.

Cost and calculation

Meta charges template messages by category, and authentication has its own price, varying by the destination number’s country. The official table changes periodically, so calculations should use current values. The comparison structure with SMS, in illustrative numbers:

• Volume: 50,000 codes per month.
• Cost per SMS with current provider: R$ 0.09 — R$ 4,500 per month.
• Verification completion rate by SMS: 88% — losing 6,000 verifications.
• Hypothetical cost per authentication message on WhatsApp: R$ 0.07 — R$ 3,500 per month.
• If the completion rate rises to 93% with WhatsApp and copy button, that’s 2,500 more verifications per month.

If 20% of completed verifications become paying customers with a ticket of R$ 60, the 2,500 extra verifications are worth about R$ 30,000 per month. In this scenario, message cost savings are the smallest gain: the main benefit is the registration that is no longer abandoned. Replace with your operation’s real numbers before deciding.

When WhatsApp is not the best option

• Audience with low WhatsApp presence, such as some international markets.
• Verification of the phone number itself in regulated scenarios requiring SMS or call.
• Very low volume, where API and template setup isn’t worthwhile.
• Operation without technical capacity to implement limits and monitoring. In this case, hiring a provider that already delivers these layers is safer than improvising.

In most Brazilian operations, the most robust architecture is WhatsApp as the main channel and SMS as the automatic alternative.

Authentication and number quality

Authentication messages come from the same number and business account used in other communications, which has consequences:

• Consider a dedicated number for codes when the company also runs marketing campaigns at volume. This way, a quality problem in campaigns doesn’t affect customer login.
• The account’s sending limit applies to everything. A large campaign on the same day as a registration peak can compete for the same capacity.
• Unsolicited code requests become complaints. When someone enters the wrong number, the owner of that number receives a code they didn’t request. Format validation and resend limits reduce this.

What to write on the screen, not in the message

Since the message is fixed, the experience is completed on the product screen:

• Before sending: “We will send a code to your WhatsApp.” The customer opens the app already expecting the message.
• After sending: the number’s last digits, the company name shown on WhatsApp, and the validity time.
• If it doesn’t arrive: “Didn’t receive it? Check if the number has WhatsApp or receive it by SMS.” — with the resend countdown visible.
• Security: “We never ask for this code by phone or message.” This phrase protects the customer from social engineering scams.

Metrics that show if verification is healthy

• Delivery rate: messages delivered over sent, by country and device type when possible.
• Time to delivery: codes arriving after thirty seconds already trigger resend requests.
• Completion rate: validated verifications over started. This metric links the channel to revenue.
• Resends per verification: a high average indicates delivery delay or confusing screen.
• Use of alternative channel: how many needed SMS or email, and why.
• Cost per completed verification, not per message sent.

Checklist before going live

• Approved authentication template, with security and validity notices.
• Button tested on Android and iPhone, on website and app.
• Code generated on the server, with short validity, one-time use, and attempt limits.
• Request limits per number, IP, and device configured.
• Delivery status recorded and automatic alternative channel working.
• Daily cost alert above normal.
• Screen texts reviewed, including the notice that the company never asks for the code.

Common mistakes in WhatsApp verification code

• Using utility or marketing templates to send code with custom text.
• Not limiting requests and discovering fraud via the bill.
• No alternative channel for those who don’t use WhatsApp.
• Validity too long or reusable code.
• Allowing immediate and unlimited resends.
• Mixing codes and campaigns on the same number without assessing quality risk.
• Not monitoring delivery status and treating all “I didn’t receive” as customer error.
• Configuring automatic filling without testing on real devices of the audience.

Where to start

Gather three numbers from your current operation: monthly code volume, cost per send, and verification completion rate. Create the authentication template with security notice, validity, and copy button, and implement the three layers—secure generation, observable delivery, and abuse protection—before releasing to the entire audience. Run with a portion of users, compare completion rate and cost with SMS, and only then expand, keeping SMS as the automatic alternative.