WhatsApp OTP API — Send OTP via WhatsApp

Why WhatsApp OTP beats SMS OTP in India

Use cases for WhatsApp OTP

How to implement WhatsApp OTP (5-minute setup)

1. Sign up at web.zaptilo.ai and generate an API token.
2. Submit an Authentication-category template (e.g. login_otp) — typically approved within an hour.
3. Generate a 6-digit OTP server-side, store with expiry (e.g. Redis with 10-minute TTL).
4. POST to Zaptilo's /api/send/template endpoint with the recipient's number and OTP value.
5. Verify the user-submitted OTP against your stored value.

cURL

curl -X POST https://web.zaptilo.ai/api/send/template \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "phone": "919876543210",
    "template": {
      "name": "login_otp",
      "language": { "code": "en" },
      "components": [{
        "type": "body",
        "parameters": [{ "type": "text", "text": "482910" }]
      }]
    }
  }'

PHP / Laravel

// PHP / Laravel — using zaptilo/whatsapp Composer package
use Zaptilo\WhatsApp\Zaptilo;

$otp = random_int(100000, 999999);
Cache::put("otp_{$user->phone}", $otp, now()->addMinutes(10));

$client = new Zaptilo(env('ZAPTILO_API_TOKEN'));
$client->sendTemplate(
    phone: '91' . $user->phone,
    templateName: 'login_otp',
    language: 'en',
    bodyValues: [(string) $otp]
);

Node.js

// Node.js — using zaptilo-whatsapp npm package
const { Zaptilo } = require('zaptilo-whatsapp');

const otp = Math.floor(100000 + Math.random() * 900000);
await redis.set(`otp:${phone}`, otp, 'EX', 600);

const wa = new Zaptilo({ token: process.env.ZAPTILO_API_TOKEN });
await wa.sendTemplate(
  `91${phone}`,
  'login_otp',
  'en',
  [String(otp)]
);

Python

# Python — using zaptilo-whatsapp PyPI package
import random, redis
from zaptilo_whatsapp import Zaptilo

otp = random.randint(100000, 999999)
redis_client.set(f"otp:{phone}", otp, ex=600)

client = Zaptilo(token=os.environ['ZAPTILO_API_TOKEN'])
client.send_template(
    phone=f"91{phone}",
    template_name="login_otp",
    language="en",
    body_values=[str(otp)]
)

Full integration guides: Laravel · Node.js · Python · Spring Boot · .NET

OTP best practices

• Use a 6-digit numeric OTP. 4-digit is too easy; 8+ adds friction.
• Set short expiry (5-10 minutes). Reduces phishing window.
• Rate-limit OTP requests per phone number — max 3-5 per hour. Prevents abuse.
• Add SMS fallback for the rare user without WhatsApp. Try WhatsApp first, fall back after 30s.
• Use Meta's "Copy Code" button in the template — better UX than typing.
• Include a security note in the template body ("Don't share this code with anyone").
• Log failed verifications to your fraud detection — repeated wrong OTPs is a red flag.

Read next

Frequently asked questions