Login OTP WhatsApp template

A login OTP template sends a one-time password on WhatsApp for sign-in or transaction approval. It uses Meta’s Authentication category, which has a fixed body: you choose the options, not the words. Here’s what each option does and how to set it up.

Category AuthenticationSend On each login or transactionVersions 2
Use this template See all 2 versions
Y
Your lenderBusiness account
Today
482913 is your verification code. For your security, do not share this code.This code expires in 10 minutes.10:00Copy code

Copy-ready templates

Two versions: copy code, and one-tap autofill

Meta writes the message text for authentication templates. What you choose is the button type, the security line and the expiry note.

1

Copy-code button

Works on every phone. The customer taps to copy the code and pastes it.

Category
Authentication
Language
English (en)
Header
None
Footer
This code expires in 10 minutes.
Buttons
Copy code: “Copy code”
{{1}} is your verification code. For your security, do not share this code.

This is Meta’s fixed wording. You only switch the security line and expiry footer on or off.

{{1}} is your verification code. For your security, do not share this code.This code expires in 10 minutes.10:00Copy code
2

One-tap autofill (Android)

For your Android app. The code fills in by itself, with copy-code as the fallback.

Category
Authentication
Language
English (en)
Header
None
Footer
This code expires in 5 minutes.
Buttons
One-tap autofill: “Autofill”
{{1}} is your verification code. For your security, do not share this code.

One-tap needs your Android app’s package name and signing key hash when you create the template.

{{1}} is your verification code. For your security, do not share this code.This code expires in 5 minutes.10:00Autofill

Variables

What each variable means

VariableWhat goes in itSample valueUsually comes from
{{1}}The one-time password482913Your authentication service
Generate and check codes in your own authentication service. WhatsApp only delivers them; it doesn’t verify them.

Meta category

Why it’s Authentication, and what that changes

Meta has a separate category for one-time passwords. Authentication templates have a preset body, no links, no media and no emojis, and they’re priced separately from Utility and Marketing.

Because the wording is fixed, approval is quick. The work is in the setup: the button type, the expiry time and, for one-tap, your app’s details.

What gets rejectedTrying to send OTPs as Utility templates with your own wording, or adding links or offers. Meta requires the Authentication category for one-time codes.

Timing

When to send it

  1. 1
    Login or transaction startsSend the OTP.Within seconds
  2. 2
    Code expires5 to 10 minutes, matching your footer.
  3. 3
    Resend requestedAllow a resend after 30 to 60 seconds, with a limit per session.

Offer SMS as a fallback. If a customer doesn’t use WhatsApp on that number, your login flow should switch channels without making them start again.

Approval

Why login OTP templates get rejected

Variable at the start

Authentication templates are the one exception: Meta’s own format starts with the code, so this is allowed here.

Your own wording

Custom OTP text in a Utility template is rejected or re-categorised. Use the Authentication category.

Links, emojis or media

Not allowed in authentication templates.

Wrong app details for one-tap

A wrong package name or signature hash makes one-tap fail silently, falling back to copy-code.

Send it from SAMWAD

Three ways to put this template to work

No codeCampaign upload

Never. OTPs are sent one at a time, in real time.

No codeJourney or Zapier

Not suited: OTPs need your authentication service to generate and check codes.

DevelopersAPI from your system

Your authentication service calls SAMWAD with the code on each login or transaction.

# On each login or transaction approval
POST https://www.app.samwad.tech/api/wpbox/sendtemplatemessage
{
  "token": "YOUR_API_KEY",
  "phone": "919800000210",
  "template_name": "login_otp",
  "template_language": "en",
  "components": [{ "type": "body",
    "parameters": [
      { "type": "text", "text": "482913" }
    ] }]
}

Full request format, button parameters and webhooks: developer documentation.

Keep OTP chats out of your support queue. If customers reply to an OTP, an automatic message can point them to your help options.

Security notes for OTPs

  • Never ask for the OTP back. Your agents and YARA should never ask a customer to share a code in the chat.
  • Expiry and limits. Expire codes in 5 to 10 minutes and limit resends per session.
  • Fallback. Keep SMS as a fallback for customers who don’t use WhatsApp on that number.
The sample wording on this page is a starting point, not legal advice. Have your compliance team review it before you submit.Sources: Meta: authentication templates · Meta: template categorization

FAQ

Login OTP template FAQs

Want help setting this up for your loans? We’ll walk through it with you on a call.

Book a demo
Can banks send OTPs on WhatsApp?

Yes, using Meta’s Authentication templates. Many lenders send OTPs on WhatsApp with SMS as a fallback.

Can we change the OTP message text?

No. Meta presets the body. You choose the button type, the security line and the expiry footer.

What is one-tap autofill?

An Android option that fills the code into your app without copying. It needs your app’s package name and signature hash.

Is an OTP a Utility template?

No. One-time passwords must use the Authentication category, which is priced separately.

Use it with these templates

All financial services templates →
UtilityKYC pending reminder templateGet KYC finished through your own portal, never by collecting IDs in the chat.See the template →UtilityLoan application received templateConfirm the application the moment it’s submitted, with a reference and next step.See the template →UtilityEMI payment received templateConfirm every EMI payment with the amount and the next due date.See the template →
WhatsApp for financial services →The WhatsApp guide for lenders and insurers (free PDF) →WhatsApp EMI reminders: a guide for lenders →WhatsApp for NBFCs: templates, consent and KYC →AI agents for customer queries →

Use this template

Send this template to your borrowers this week.

Start a free trial, submit the template with SAGE checking it against Meta’s rules, and send it to your opted-in customers.

Use this template

For larger teams

Lending at scale?

Several numbers, your loan system connected through the API, YARA answering borrower questions, and on-prem or VPC AI for regulated teams.

Book a live demo