One Time Password (OTP) is a short code used to verify a user’s identity when they log in to an application. OTP protects users’ personal data, and to keep that data secure, each code is only valid for a few minutes. As an application service provider, you also share responsibility for keeping the OTP codes you send confidential.
OTP codes are usually sent via SMS. However, SMS has several security weaknesses, including messages that can be intercepted. That’s why it’s worth switching to WhatsApp OTP, sent through the WhatsApp Business API. WhatsApp encrypts messages on their way to the user, making them much harder to intercept than SMS. The WhatsApp Business API also offers fast delivery and room for longer messages.
Get the WhatsApp Business API by partnering with Qiscus, an official WhatsApp Business partner in Indonesia. Qiscus provides WhatsApp Business API services in one dashboard called Qiscus Omnichannel Chat. If you want to send WhatsApp OTP codes to your customers, follow the tutorial below.
Things to Know
Prepare the following before you send OTP codes via the WhatsApp Business API:
- WhatsApp Business API access. To enable it, contact Qiscus.
- An active Qiscus Omnichannel Chat account. Want to see how it works first? Book a demo with our team.
- WhatsApp integrated with Qiscus Omnichannel Chat. Follow the integration guide to connect your account.
- An OTP message template. See the product documentation to create one.
- Your server region. Your account is hosted in either Indonesia or Malaysia, and every API request must go to that region’s server URL. See the next section.
Choose the Right Server URL (Data Center Region)
Your Qiscus account lives in one data center region, and every API request in this tutorial must be sent to that region’s server URL.
| Region | Server URL |
| Indonesia (ID) | https://omnichannel.qiscus.com |
| Malaysia (MY) | https://omnichannel-my.qiscus.com |
The examples in this tutorial use the Indonesia server URL. If your account is in Malaysia, replace omnichannel.qiscus.com with omnichannel-my.qiscus.com. The paths, headers, request bodies, and responses stay the same.
Not sure which region you’re on? Check your dashboard’s address bar: omnichannel-my.qiscus.com means Malaysia, and omnichannel.qiscus.com means Indonesia. You can also ask your Account Manager or Qiscus support. To host your data in Malaysia, select Malaysia as your region when you register.
How to Send WhatsApp OTP via Qiscus Omnichannel Chat
Once your Qiscus Omnichannel Chat setup is complete, follow these steps.
1. Authentication
Before you send a WhatsApp OTP, get your AdminToken with the following API.
[POST] https://omnichannel.qiscus.com/api/v1/authMalaysia accounts: https://omnichannel-my.qiscus.com/api/v1/auth
Sample request body
{
"email": "YOUR_EMAIL",
"password": "YOUR_PASSWORD"
}Example request
curl --location --request POST 'https://omnichannel.qiscus.com/api/v1/auth' \
--form 'email=YOUR_EMAIL' \
--form 'password=YOUR_PASSWORD'Example response
{
"data": {
"user": {
"id": 2,
"name": "Qismo",
"email": "qiscus_xxxx_YOUR_EMAIL",
"authentication_token": "QEXevusxxxxxxxxxx1lsl8",
...
},
"long_lived_token": "CztxxxxxxxxxxxxxxxjtS",
"user_configs": {
"notifagentjoining": null,
"is_notifagentjoining_enabled": true,
"notifmessagecoming": null,
"is_notifmessagecoming_enabled": false
}
}
}The response contains your AdminToken. Use it in the Authorization header in the next steps.
2. Choosing the Template
Qiscus Omnichannel Chat provides several ready-to-use OTP templates. See the template details in our documentation. To create a new template, open the Outbound Message menu on the Qiscus Omnichannel Chat dashboard. The same page lists the templates you’ve already created.
OTP templates use WhatsApp’s Authentication category. Since 29 May 2023, Meta applies these rules to new authentication templates:
- No links, media, or emojis.
- Each parameter is at most 15 characters.
- The template must include a Copy Code button, so users can copy the OTP and paste it into your app.
If an authentication template you created in the dashboard is rejected, edit it in Facebook Business Manager.
3. Using the API
After you get the AdminToken and pick a template, send the OTP through the API. This tutorial uses the sample template otp_confirmation_text. To find the channel_id, template_name, namespace, and other details, click View on the selected template.
Send a WhatsApp OTP with this API:
[POST] https://omnichannel.qiscus.com/api/v3/admin/broadcast/clientMalaysia accounts: https://omnichannel-my.qiscus.com/api/v3/admin/broadcast/client
Header
| Key | Value |
| Authorization | {{AdminToken}} |
Body
| Key | Type | Description |
| channel_id | Optional | Channel identifier. If empty, the first WhatsApp channel is used |
| template_name | Required | Name of the selected template |
| namespace | Required | Namespace of the selected template |
| language | String, required | Language of the selected template |
| variables[] | Array of strings, required | The OTP code you want to send |
| phone_number | String, required | The phone number you want to send the OTP to |
| button_params | Required if the template has buttons | Fill this in only if the message template has buttons |
Example request
curl --location --request POST 'https://omnichannel.qiscus.com/api/v3/admin/broadcast/client' \
--header 'Authorization: YOUR_ADMIN_TOKEN' \
--form 'channel_id=7xx' \
--form 'template_name=otp_confirmation_text' \
--form 'namespace=51dcd9a4_xxxx_xxxx_xxxx_xxxxxxbb5' \
--form 'language=id' \
--form 'variables[]=5678' \
--form 'phone_number=+628xxxxxxx321' \
--form 'button_params='Example response
{
"data": {
"broadcast_job_id": 12345,
"broadcast_logs": [
{
"id": 12371070,
"message_id": "gBGHxxxSGUDxsVcB",
"notes": null,
"phone_number": "+628xxxxxxx321",
"sent_at": "2026-10-13T03:47:14Z",
"status": "sent",
"variables": "[\"5678\"]"
}
],
"language": "id",
"name": "otp_confirmation_text",
"namespace": "51dcd9a4_xxxx_xxxx_xxxx_xxxxxxbb5"
},
"status": 200
}The result
Here’s how the message looks in the customer’s WhatsApp.
4. Checking If the Message Was Sent
You can check whether an OTP message reached the customer in two ways.
- Via the Qiscus dashboard
Open the Outbound Message menu, then select WhatsApp Broadcasts to see your broadcast history. Click a broadcast to open its detail page, where the Broadcast Log section shows full details for each recipient.
A message can have one of four delivery statuses:
- Sent: the message has been sent.
- Delivered: the message reached the customer but hasn’t been read yet.
- Read: the customer opened and read the message.
- Failed: the message couldn’t be delivered.
You can see each message’s status in the Broadcast Log section of the broadcast detail page.
- Via webhook
You can also receive message statuses through a webhook. To do this, set your webhook URL with this API:
[POST] https://omnichannel.qiscus.com/whatsapp/{{APP-ID}}/{{channel-id}}/settingsMalaysia accounts: https://omnichannel-my.qiscus.com/whatsapp/{{APP-ID}}/{{channel-id}}/settings
Header
| Key | Value |
| Qiscus-App-Id | {{APP-ID}} |
| Qiscus-Secret-Key | {{Secret Key}} |
| Content-Type | application/json |
Find your App ID and Secret Key in the Qiscus Omnichannel Chat dashboard: open the Settings menu, then click App Information.
Body
{
"webhooks": {
"url": "https://YOUR_DOMAIN_URL.com/receive_webhooks"
}
}Example request
curl -X POST \
https://omnichannel.qiscus.com/whatsapp/YOUR_APP_ID/YOUR_CHANNEL_ID/settings \
-H 'Qiscus-App-Id: YOUR_APP_ID' \
-H 'Qiscus-Secret-Key: YOUR_SECRET_KEY' \
-H 'Content-Type: application/json' \
-d '{
"webhooks": {
"url": "https://YOUR_DOMAIN_URL.com/receive_webhooks"
}
}'Example response
{
"business_id": "xxxxxxxxxxxxxxx",
"status": 200,
"webhooks": {
"url": "https://YOUR_DOMAIN_URL.com/receive_webhooks"
}
}Read more about webhook settings in the WhatsApp Business API documentation.
5. If the WhatsApp OTP Is Not Sent
An OTP message may fail to reach your customer because:
- The customer’s phone number is wrong.
- The phone number isn’t registered on WhatsApp.
- The template is an older authentication template that contains links, media, or emojis (see Step 2).
- The API request was sent to the wrong region’s server URL.
If the OTP message isn’t delivered, you can:
- Try sending the message again.
- Send the OTP through another channel connected to Qiscus Omnichannel Chat, such as SMS or email.
How to Hide WhatsApp OTP Codes in Your Inbox
OTP codes are confidential and protect your customers’ personal data. To keep them confidential, you can hide the OTP variable in the Qiscus Omnichannel Chat inbox, so only the customer can read it. Use the same API as in Step 3 and add hide_variables to the body.
[POST] https://omnichannel.qiscus.com/api/v3/admin/broadcast/clientMalaysia accounts: https://omnichannel-my.qiscus.com/api/v3/admin/broadcast/client
Header: the same as in Step 3.
Body: all the parameters from Step 3, plus:
| Key | Type | Description |
| hide_variables | true | Hides the OTP code in the Qiscus Omnichannel Chat inbox |
Example request
curl --location --request POST 'https://omnichannel.qiscus.com/api/v3/admin/broadcast/client' \
--header 'Authorization: YOUR_ADMIN_TOKEN' \
--form 'channel_id=7xx' \
--form 'template_name=otp_confirmation_text' \
--form 'namespace=51dcd9a4_xxxx_xxxx_xxxx_xxxxxxbb5' \
--form 'language=id' \
--form 'variables[]=5678' \
--form 'phone_number=+628xxxxxxx321' \
--form 'button_params=' \
--form 'hide_variables=true'You can get the AdminToken, channel_id, template_name, namespace, and other values the same way as in Step 3. The response uses the same format as the Step 3 example.
The result
Here’s how hide_variables changes the message in the Qiscus Omnichannel Chat inbox.
Your WhatsApp Business API is now ready to send WhatsApp OTP codes to customers. Make sure to test the delivery before you go live.
Contact Qiscus for WhatsApp Business API Implementation
Qiscus Omnichannel Chat brings all your business conversations into one dashboard. It also includes solutions such as Chatbot and WhatsApp Chatbot to help you get more out of every customer conversation. Want to see it in action? Book a demo with our team.
Frequently Asked Questions
Can I send OTP via the WhatsApp Business API?
Yes. Once you have WhatsApp Business API access through an official partner such as Qiscus, you can send OTP codes with an approved authentication template and the broadcast API in Qiscus Omnichannel Chat.
Is WhatsApp OTP more secure than SMS OTP?
WhatsApp encrypts messages on their way to the user, so OTP codes are much harder to intercept than SMS, which can be intercepted in transit. WhatsApp also offers fast delivery and room for longer messages.
What are the rules for WhatsApp authentication templates?
Since 29 May 2023, Meta requires new authentication templates to have no links, media, or emojis, keep each parameter to 15 characters or fewer, and include a Copy Code button.
Why is my WhatsApp OTP not being delivered?
Common causes are a wrong phone number, a number that isn’t registered on WhatsApp, an older template that contains links, media, or emojis, or an API request sent to the wrong region’s server URL. You can resend the message or send the OTP through another channel, such as SMS or email.
How do I hide OTP codes in the Qiscus Omnichannel Chat inbox?
Add hide_variables=true to the body of the broadcast API request. The OTP code is then hidden in the inbox, so only the customer can read it.
