How to Send OTP via WhatsApp API (Cheaper Than SMS)
WhatsApp delivers OTPs where users actually look — and at a flat software cost instead of per-SMS fees. Here is the API call and the practices that make OTP flows reliable.
Why teams move OTP from SMS to WhatsApp
- Cost: SMS bills per message; a flat-plan WhatsApp API has no per-OTP fee
- Deliverability: Malaysians read WhatsApp far more reliably than SMS inboxes filled with spam
- Rich formatting: bold the code, add your brand name, include a validity note
The API call
An OTP send is one POST — generate the code in your backend, then:
curl -X POST https://app365.my/api/external/send-message \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"device_token": "your-device-token",
"recipient": "60123456789",
"message": "Your App365 verification code is *483920*. It expires in 5 minutes. Do not share this code."
}'Best practices for a reliable OTP flow
- Expire codes in 3–5 minutes and invalidate previous codes when a new one is issued
- Rate-limit requests per number to stop abuse (and lock after several failed attempts)
- Never include links in an OTP message — just the code, brand and validity
- Log the API response; on failure, fall back to SMS or a resend button
- Use a dedicated, warmed-up number for OTPs — do not mix with marketing blasts
Latency and scale
The call returns as soon as the message is queued on your connected number, and delivery is near-instant for online recipients. For login flows, keep one device dedicated to transactional traffic so marketing campaigns never queue ahead of a verification code.
FAQ
Is WhatsApp OTP cheaper than SMS?
Usually, yes. SMS charges per message; App365 charges a flat plan per connected number (from RM1,200/year), so OTP volume does not increase your bill.
What if the user is not on WhatsApp?
The send will not deliver, so build a fallback: if the API response fails or the user does not receive it, offer SMS or email as a second channel.
Can I send OTPs from my existing backend?
Yes — it is one REST call from any language. Generate and validate the code in your own system; WhatsApp is just the delivery channel.
Ready to put this into action?
App365 handles the blasting, warmup, auto-replies and opt-outs for you — built for Malaysian businesses.