Authentication (OTP) templates

Learn how to build and send secure One-Time Password (OTP) messages with copy-code buttons.

WhatsApp supports a dedicated Authentication template category specifically designed for One-Time Passwords (OTPs) and verification codes.

To improve conversion rates and user experience, you can include a Copy Code button, which allows users to copy the code to their device clipboard with a single tap.

Meta guidelines for OTP templates

Meta enforces strict formatting and security policies on authentication templates:

No media allowed: You cannot add images, video files, or document attachments.
No external links: The template cannot contain URL buttons or custom phone numbers.
Copy Code buttons: Must be configured as a button of type copy_code with the dynamic OTP parameter bound to it.

Dynamic parameters mapping

When sending an OTP template with a Copy Code button, you must provide parameters for both the message body and the button.

Suppose your template is configured as:

Body: "{{1}} is your verification code. For security, do not share this code."
Button: Copy Code

Your API request must provide:

A body parameter: the code (e.g., 582910).
A button parameter: the code itself to be copied by the button (e.g., 582910).

Send code example

Use the following request pattern to dispatch an OTP code:

curl -X POST "https://api.wazapin.com/v1/messages" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "channel_id": "wzp_abc123",
    "to": "6281234567890",
    "type": "template",
    "content": {
      "name": "otp_verification",
      "language": {
        "code": "en_US"
      },
      "components": [
        {
          "type": "body",
          "parameters": [
            {
              "type": "text",
              "text": "582910"
            }
          ]
        },
        {
          "type": "button",
          "sub_type": "copy_code",
          "index": 0,
          "parameters": [
            {
              "type": "text",
              "text": "582910"
            }
          ]
        }
      ]
    }
  }'

import { WazapinClient } from "@wazapin/sdk";

const wazapin = new WazapinClient({ apiKey: process.env.WAZAPIN_API_KEY! });

await wazapin.messages.send({
  channel_id: "wzp_abc123",
  to: "6281234567890",
  type: "template",
  content: {
    name: "otp_verification",
    language: { code: "en_US" },
    components: [
      {
        type: "body",
        parameters: [{ type: "text", text: "582910" }]
      },
      {
        type: "button",
        sub_type: "copy_code",
        index: 0,
        parameters: [{ type: "text", text: "582910" }]
      }
    ]
  }
});

import requests

requests.post(
    "https://api.wazapin.com/v1/messages",
    headers={"X-Api-Key": "YOUR_API_KEY", "Content-Type": "application/json"},
    json={
        "channel_id": "wzp_abc123",
        "to": "6281234567890",
        "type": "template",
        "content": {
            "name": "otp_verification",
            "language": {"code": "en_US"},
            "components": [
                {
                    "type": "body",
                    "parameters": [{"type": "text", "text": "582910"}]
                },
                {
                    "type": "button",
                    "sub_type": "copy_code",
                    "index": 0,
                    "parameters": [{"type": "text", "text": "582910"}]
                }
            ]
        }
    },
    timeout=30
).raise_for_status()

package main

import (
	"bytes"
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	body := []byte(`{
  "channel_id": "wzp_abc123",
  "to": "6281234567890",
  "type": "template",
  "content": {
    "name": "otp_verification",
    "language": {
      "code": "en_US"
    },
    "components": [
      {
        "type": "body",
        "parameters": [
          {
            "type": "text",
            "text": "582910"
          }
        ]
      },
      {
        "type": "button",
        "sub_type": "copy_code",
        "index": 0,
        "parameters": [
          {
            "type": "text",
            "text": "582910"
          }
        ]
      }
    ]
  }
}`)

	req, err := http.NewRequest(http.MethodPost, "https://api.wazapin.com/v1/messages", bytes.NewReader(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-Api-Key", os.Getenv("WAZAPIN_API_KEY"))
	req.Header.Set("Content-Type", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	// 201 = message accepted; delivery status via webhooks / GET /v1/messages/{id}
	out, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(out))
}

<?php

$payload = '{
  "channel_id": "wzp_abc123",
  "to": "6281234567890",
  "type": "template",
  "content": {
    "name": "otp_verification",
    "language": {
      "code": "en_US"
    },
    "components": [
      {
        "type": "body",
        "parameters": [
          {
            "type": "text",
            "text": "582910"
          }
        ]
      },
      {
        "type": "button",
        "sub_type": "copy_code",
        "index": 0,
        "parameters": [
          {
            "type": "text",
            "text": "582910"
          }
        ]
      }
    ]
  }
}';

$ch = curl_init("https://api.wazapin.com/v1/messages");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Content-Type: application/json",
    "X-Api-Key: " . getenv("WAZAPIN_API_KEY"),
]);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// 201 = message accepted; delivery status via webhooks / GET /v1/messages/{id}
echo $httpCode . "\n" . $response . "\n";

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class SendMessage {
    public static void main(String[] args) throws Exception {
        String body = """
                {"channel_id": "wzp_abc123", "to": "6281234567890", "type": "template", "content": {"name": "otp_verification", "language": {"code": "en_US"}, "components": [{"type": "body", "parameters": [{"type": "text", "text": "582910"}]}, {"type": "button", "sub_type": "copy_code", "index": 0, "parameters": [{"type": "text", "text": "582910"}]}]}}
                """;

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://api.wazapin.com/v1/messages"))
                .header("X-Api-Key", System.getenv("WAZAPIN_API_KEY"))
                .header("Content-Type", "application/json")
                .POST(HttpRequest.BodyPublishers.ofString(body))
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());

        // 201 = message accepted; delivery status via webhooks / GET /v1/messages/{id}
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

require "net/http"
require "uri"

uri = URI("https://api.wazapin.com/v1/messages")
request = Net::HTTP::Post.new(uri)
request["Content-Type"] = "application/json"
request["X-Api-Key"] = ENV["WAZAPIN_API_KEY"]
request.body = '{"channel_id": "wzp_abc123", "to": "6281234567890", "type": "template", "content": {"name": "otp_verification", "language": {"code": "en_US"}, "components": [{"type": "body", "parameters": [{"type": "text", "text": "582910"}]}, {"type": "button", "sub_type": "copy_code", "index": 0, "parameters": [{"type": "text", "text": "582910"}]}]}}'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

# 201 = message accepted; delivery status via webhooks / GET /v1/messages/{id}
puts response.code
puts response.body

using System.Net.Http;
using System.Text;

var body = "{\"channel_id\": \"wzp_abc123\", \"to\": \"6281234567890\", \"type\": \"template\", \"content\": {\"name\": \"otp_verification\", \"language\": {\"code\": \"en_US\"}, \"components\": [{\"type\": \"body\", \"parameters\": [{\"type\": \"text\", \"text\": \"582910\"}]}, {\"type\": \"button\", \"sub_type\": \"copy_code\", \"index\": 0, \"parameters\": [{\"type\": \"text\", \"text\": \"582910\"}]}]}}";

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-Api-Key", Environment.GetEnvironmentVariable("WAZAPIN_API_KEY"));

var response = await client.PostAsync(
    "https://api.wazapin.com/v1/messages",
    new StringContent(body, Encoding.UTF8, "application/json"));

// 201 = message accepted; delivery status via webhooks / GET /v1/messages/{id}
Console.WriteLine((int)response.StatusCode);
Console.WriteLine(await response.Content.ReadAsStringAsync());

Troubleshooting

Button does not copy the code

Make sure the index matches the zero-based index of the Copy Code button in your template configuration (usually 0 if it is the only button). Ensure the sub_type is set exactly to "copy_code".

Template validation errors

If Meta rejects the template during creation, confirm you did not include links, media, or any text suggesting promotional offers in the template body or buttons.