If your mobile app offers users the option to receive one-time passwords or verification codes via the WhatsApp app or WhatsApp Business app, you must use an authentication template with a one-time password button (OTP) to deliver the password or code.

Authentication templates with OTP buttons consist of the following:

• The Body message is defined by META. That is, the body is fixed -> "<VERIFICATION_CODE> is your verification code."
• Next to the Body text message, it is defined a security recommendation message (Security disclaimer message) as a boolean (optional) by META: "For your security, do not share this code."
• From the Footer, you are able to add an Expiration warning message (optional): "This code expires in <NUM_MINUTES> minutes."
• It is mandatory to add an OTP button. Either a copy code button.
  Authentication templates must include either a copy code button. A copy code button copies the one-time password or code to the user's clipboard. The user can then manually switch to your app and paste the password or code into your app's interface.

📘

NOTE

URLs, media, and emojis are not supported. Because authentication templates with OTP buttons only consist of preset (fixed) text and buttons, their risk of being paused is significantly minimized.

Therefore, we recommend you (mandatory) create a new Authentication Template if you are still sending this category type (Authentication) without an OTP button.

Therefore, an authentication template with an OTP button consists of the following content:

• Fixed preset text:

  • <VERIFICATION_CODE> is your verification code.
  • Security disclaimer (optional): For your security, do not share this code.
  • Expiration warning (optional): This code expires in <NUM_MINUTES> minutes.

• Button: a copy code.

Let’s replicate the next example:

Creating Authentication Template

If you want to create the authentication template via Templates API, you need to provide the WhatsApp Business Account ID (WABA) or the unique identifier of the sender, and enter the following parameters to the request body:

🚧

WARNING

Enter only one of the required parameters (wabaId or senderId), not both.

HTTP Request: POST /whatsapp/templates

The following authentication template example includes a body, footer and OTP Button.

{
  "name": "dev_authentication_template",
  "category": "AUTHENTICATION",
  "templateLanguages": [
    {
      "language": "en",
      "components": [
        {
          "type": "BODY",
          "securityRecomendation": true
        },
        {
          "type": "FOOTER",
          "expirationMinutes": 15
        },
        {
          "type": "BUTTONS",
          "buttons": [
            {
              "type": "OTP",
              "otp_type": "COPY_CODE",
              "text": "Copy Code"
            }
          ]
        }
      ]
    }
  ]
}      

In your POST call, include the following parameters to create an authentication template:

Regardless of the types of objects you chose to customize the authentication template, the response body provides you with the WhatsApp Business Account ID (WABA) ("wabaId") and the template id ("id"), which will allow you to get information, delete from a specific template, list templates or send it.

Sending Authentication Template

Once the authentication template has been created via API and approved, the next step is sending the template to the end users through the Messages API.

HTTP Request: POST /whatsapp/messages

📘

NOTE

The one-time password or verification code to be delivered to the customer must appear twice in the payload.

{
    "from": "1000000001",
    "to": "+1000000002",
    "templateName": "dev_authentication_template",
    "placeholders": {
        "code": "982012"
    },
    "templateLanguage": "en_US",
    "templateButtons": {
        "type": "cta",
        "values": [
            {
                "index": 0,
                "value": "982012"
            }
        ]
    }
}   

Parameters present in the request body example when sending an Authentication Template are the following:

When you sent the Authentication Template, the response body contains the following data:

{
  "meta": {
    "timestamp": 170562,
    "transactionId": "ca811177-8e36-46e6-aec"
  },
  "data": {
    "id": "65a9cf4736e18",
    "body": null,
    "from": "1000000001",
    "to": "+1000000002",
    "date": "2024-01-19T01:24:23.510578992Z",
    "statusDate": "2024-01-19T01:24:23.510361335Z",
    "externalId": null,
    "owner": "[email protected]",
    "operator": "[email protected]",
    "status": "QUEUED",
    "providerId": null
  }
}

Parameters presented in the response body example when creating the Authentication Template are the following: