What the OTP service does
One-time passcodes are the workhorse of account security: sign-up confirmation, login verification, password reset, confirming a high-value transaction, verifying a phone number before delivery. Almost every product needs them, and almost every product sends them over SMS by default.
The wavadesk OTP module sends those codes over WhatsApp instead. You call an endpoint with a phone number, we deliver a passcode message, and you verify the code the customer types back through a second call. Delivery, expiry and attempt limits are handled for you.
One request creates a code, stores it hashed and delivers it to the customer's WhatsApp.
A second request checks the code the customer entered, with attempt limits and expiry enforced.
Codes expire on a window you set. Expired codes fail closed rather than lingering.
Sent, delivered and verified counts, so you can see funnel drop-off rather than guess at it.
Why WhatsApp beats SMS for verification
This is not a preference argument. There are four concrete operational differences.
Delivery you can actually confirm
SMS gives you a submission receipt from an aggregator, not proof a human saw it. WhatsApp gives delivery and read status, so when a customer says the code never arrived you can check rather than speculate.
Cost per verification
SMS is priced per message per country, and international verification costs add up quickly. WhatsApp conversations on wavadesk are unlimited on every plan, so the marginal cost of an additional verification is zero.
It arrives where the conversation already is
If your customer already messages you on WhatsApp, the code appears in a thread they recognise, from a sender they have talked to before. That materially reduces the phishing suspicion that unknown SMS shortcodes create.
No shortcode or sender-ID approvals
SMS sender registration varies by country and can take weeks. Your WhatsApp number is already connected and already yours.
| SMS | WhatsApp via wavadesk | |
|---|---|---|
| Cost per message | Per message, per country | Included — unlimited conversations |
| Delivery confirmation | Submission receipt only | Delivered and read status |
| Sender recognition | Unknown shortcode | Your existing business number |
| Setup | Sender ID / shortcode approval | Already connected by QR |
| Rich content | 160 characters, plain | Formatting and branding available |
A small share of customers will not have WhatsApp. Most teams send over WhatsApp first and fall back to SMS on non-delivery — the module reports non-delivery so you can trigger that.
How it works in practice
Two endpoints, and no state for you to keep. The code itself is generated, hashed and stored on our side; you never hold it.
Your backend calls the send endpoint with the customer's phone number and an optional purpose label such as login or signup.
The message arrives from your connected business number, in the language you specify.
In your app, site or checkout — wherever the verification is happening.
Call the verify endpoint with the number and the code. You get a pass or fail, with the reason on failure: wrong, expired, or too many attempts.
The send call does not hand back the passcode. Verification happens through the verify endpoint, so a leak in your logs cannot expose live codes.
Full request and response shapes are in API and integrations.
Security controls
An OTP system is a security control, so its own defaults matter. These are enforced rather than optional.
- Codes stored hashed, never in plain text, and never returned by the send endpoint
- Configurable expiry window, defaulting to a short lifetime
- Attempt limits per code, after which the code is burned and a new one must be requested
- Rate limiting per phone number, so an attacker cannot use your endpoint to spam a victim
- Rate limiting per API key, to contain a leaked credential
- Single-use codes — a verified code cannot be replayed
- Full audit record of every send and verify attempt with timestamps
Abuse you should think about
The main risk with any OTP endpoint is not code guessing, it is being used as a free messaging cannon against someone else's phone. Per-number rate limits are the defence, and they are on by default. If you expose a public sign-up form, keep a captcha or equivalent in front of the send call as well.
Delivery and conversion reporting
Verification is a funnel, and funnels leak. The reporting surface shows sends, deliveries and successful verifications so you can see where.
The gap between delivered and verified is the number worth watching. A wide gap usually means one of three things: your code entry screen is confusing, your expiry window is too short for real users, or you are verifying at a point in the journey where people abandon anyway.
Where teams use it
Confirming a phone number at account creation, and step-up verification at login.
A code to a verified number, without relying on email deliverability.
Verifying the number before a reservation is held, which cuts fake bookings.
Confirming the recipient's number before dispatch, reducing failed deliveries.
The OTP module is included on the Scale plan and available as an add-on to others. See pricing.
Frequently asked questions
Is sending OTPs over WhatsApp secure?
The transport is end-to-end encrypted, codes are stored hashed and never returned by the send endpoint, and every code is single-use with a short expiry and an attempt limit. Rate limits per number and per API key are on by default.
What if a customer does not use WhatsApp?
The module reports non-delivery, so your backend can fall back to SMS or email. Most teams send over WhatsApp first and keep an SMS fallback for coverage.
How much does each OTP cost?
Nothing per message. WhatsApp conversations are unlimited on every plan, so additional verifications do not add cost. The OTP module itself is included on Scale and available as an add-on to other plans.
How long is a code valid for?
You configure the expiry window, and codes fail closed once it passes. A short window is the safer default; widen it only if you see legitimate users timing out.
Can I see whether the code was delivered?
Yes. WhatsApp provides delivery and read status, and the reporting surface shows sent, delivered and verified counts so you can find drop-off in the verification funnel.
Do I need a separate WhatsApp number for OTPs?
No. Codes are sent from the same connected business number your customers already message, which is part of why they are trusted more than an unknown shortcode.