Why OTPs are drifting off SMS in India
SMS OTPs come with baggage: DLT registration, sender-ID and template registration with operators, per-message rates that vary by route, and, the part that actually hurts, silent failures. The SMS gateway says "submitted", the user says "code never came", and you have no way to know who's right. Every failed OTP is a signup or a payment that didn't happen.
WhatsApp authentication messages change the failure mode. Delivery is confirmed per message over a webhook, the transport is a data connection rather than an operator SMS route, and the message renders with a copy code button (and one-tap autofill on supported Android setups), so the user doesn't retype anything.
The honest limits: the recipient needs WhatsApp installed and a working data connection. That's most of India, but not all of it, which is why the sane architecture keeps SMS as a fallback, triggered automatically when the WhatsApp delivery webhook doesn't confirm within a few seconds.
How authentication templates work
Authentication is its own template category with a fixed format set by Meta, roughly "*{{code}} is your verification code*", with optional add-ons like a security disclaimer ("For your security, do not share this code") and an expiry line. You don't write free-form marketing copy, and that's a feature: fixed-format templates typically clear Meta's review fast, and there's nothing in them for a reviewer to reject.
At send time your backend makes one API call with the phone number and the code your system generated. Growcord passes it through the official Cloud API; the code is yours, the delivery and the buttons are handled for you. Codes work like any OTP: your side enforces expiry and attempt limits, WhatsApp is just the pipe, an end-to-end encrypted one.
What you get for authentication in Growcord
Fixed-format templates, fast approval
Authentication templates follow Meta's set structure, so review is usually quick and the login flow isn't hostage to copy edits.
Copy-code button
The code arrives with a tap-to-copy button, fewer mistyped codes, fewer 'resend OTP' loops in your funnel.
One POST per code
Send the template by name with the code as a variable, authenticated by an API key. Any language with an HTTPS client works.
Expiry text in the message
Add a 'code expires in 5 minutes' line to the template so the message matches the rules your backend enforces.
Per-message delivery receipts
Sent, delivered and failed events per OTP over webhooks, the delivery data an SMS route never gave you.
Clean SMS fallback pattern
No delivery event within your timeout? Fire the SMS route. The webhook tells you exactly which numbers need it.
Adding WhatsApp OTP to your login flow
Connect a number and create the template
Connect your WhatsApp number to Growcord, then create an authentication template, pick the copy-code button and expiry text in the dashboard and submit it to Meta.
Generate an API key
Create a scoped key for your auth service. Keys are revocable, so rotating one system's credentials never touches another's.
Send the code from your backend
Generate the OTP in your system as you do today, then POST it with the recipient's number and the template name. The user gets the code with a copy button in seconds.
Verify, and fall back when needed
Verify the code on your side as usual. Subscribe to delivery webhooks and trigger your SMS route for the numbers where WhatsApp doesn't confirm delivery.
What a WhatsApp OTP costs
Meta bills authentication messages in India at commonly around ₹0.12 per delivered message (rates move, check Meta's current rate card, and see the conversation pricing guide for how categories are billed).
DLT-era SMS OTPs typically land somewhere between ₹0.15 and ₹0.25 per message once registration and route costs are in, so at any real volume WhatsApp is usually the cheaper channel, with delivery receipts included rather than sold as an add-on.
One warning worth its own sentence: Meta charges a much higher international authentication rate when an OTP goes to a number registered outside your business's country. If your product has users abroad, price that path separately before you route all OTPs through WhatsApp.
On the platform side, API access is included from Growcord's Basic plan at ₹299/month (₹99/month billed yearly) with one API key; Startup at ₹799/month (₹399 yearly) gives you three keys and 1,000 included conversations.
Meta's fees pass through as credits at Meta's published rate, with zero markup on message costs. The pricing page has the full table and the 7-day money-back guarantee on subscriptions, and the developer API page covers the integration beyond OTPs.
Send a test OTP in the next half hour
Free tier includes 50 conversations a month, enough to wire the template, test the copy-code button on your own phone, and measure delivery.
Start free, no card neededWhy Growcord
What you get here that you don't get elsewhere
Frequently asked questions
Is WhatsApp OTP cheaper than SMS OTP in India?
Usually, yes. Meta's authentication rate in India is commonly around ₹0.12 per delivered message, while DLT-compliant SMS OTP routes typically cost ₹0.15–0.25 each. WhatsApp also confirms delivery per message, so you stop paying for codes that silently never arrived. Rates change, verify against Meta's current rate card before committing volume.
What happens if the user doesn't have WhatsApp?
The message fails and the delivery webhook tells you, usually within seconds. The standard pattern is a fallback: if no delivered event arrives within your timeout (say 5–10 seconds), your backend fires the same code over SMS. Users with WhatsApp get the better experience; everyone else still gets their code.
Do OTP templates need Meta approval?
Yes, like every template, but authentication templates follow a fixed format defined by Meta (essentially 'your code is {{code}}' plus optional expiry and security lines), so approval is typically fast, often within minutes. There's no free-form copy to reject, which makes this the least fragile template category.
Can I customise the OTP message text?
Only within Meta's fixed structure. You choose the language, whether to add a security disclaimer ('do not share this code') and an expiry warning, and which button type to use, copy-code, or one-tap autofill on supported Android devices. You can't add branding copy or offers; authentication templates are deliberately plain.
Is sending OTPs over WhatsApp secure?
The transport is end-to-end encrypted, which is stronger than the SMS network's protections. The usual OTP hygiene still applies on your side: short expiry, limited attempts, rate-limiting per number, and never reusing codes. WhatsApp replaces the delivery channel, not your verification logic.
Can I send OTPs to users outside India?
Yes, but check the price first. Meta applies a separate, significantly higher authentication-international rate when the destination country differs from your business account's country. For an India-registered business, domestic OTPs are cheap; the same code to a foreign number can cost many times more. Route by geography if you have global users.
Why businesses pick Growcord
Official WhatsApp Business API
Built on Meta's Cloud API, the sanctioned channel, not a modded app. No number-ban roulette.
Indian pricing, GST invoice
Plans from ₹99/month billed yearly. Paid in ₹ via Razorpay, with a proper GST invoice every time.
Free tier, no card needed
1 number and 50 conversations a month to prove it on real customers before paying anything.
Support from New Delhi, in IST
A real team on email and WhatsApp, Monday to Saturday 10:00–19:00 IST, not a ticket void.
Talk to us
Get set up on WhatsApp this week
Tell us what you sell and how many customers you message. We'll reply on WhatsApp with the plan that fits and, if you want it, walk you through the Meta approval step.
- No sales call unless you ask for one
- Answers from the team that builds it, in IST hours
- Free tier available. You can start before you decide
Keep reading
Related guides and comparisons
Last updated: 2026-08-07