WhatsApp OTP: send and verify codes with the Verify API

The Verify API sends a one-time code (OTP) to a person's WhatsApp and checks the code they type. PayPerWA generates the code, sends it with your approved Authentication template, keeps only a keyed hash of it and never returns the code to you.

Price

Per OTP sent, two separate fees: Meta's authentication fee for the recipient's country, billed by Meta to the payment method on your WhatsApp Business Account (₹0.115 for an Indian number), plus PayPerWA's ₹0.20 ($0.004 on USD wallets) from your prepaid wallet. Verifying a code is free. No subscription. If WhatsApp refuses a send, PayPerWA's fee goes back to your wallet.

Before you start

1. Connect a number, add a payment method in Meta and recharge your wallet.
2. Create a template in Dashboard → Templates → New → Authentication and wait for Meta to approve it. WhatsApp allows one-time codes only in Authentication templates, and your Meta business must be verified first: PayPerWA stops the submission if Meta reports it as not verified or still pending.
3. Create an API key in Settings → API with the messages:send permission. Call the API from your server, never from browser code.

Send a code

POST https://payperwa.com/api/v1/otp/send
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{ "to": "919876543210" }

Optional: code_length 4–8 (default 6), expiry_minutes 1–30 (default 10), template_name, language, channelId. The answer has a verification_id, expires_at and the cost.

Check a code

POST https://payperwa.com/api/v1/otp/verify

{ "to": "919876543210", "code": "482913" }

Send the code with to or with verification_id. A well-formed request gets 200 with status: approved, incorrect (with attempts_remaining), max_attempts, expired or not_found. The one exception is OTP_UNAVAILABLE (503, see below).

Limits per number

• A new code after 30 seconds, at most 5 codes an hour.
• Each code works once; 5 wrong attempts cancel it.
• After 15 wrong codes in 24 hours, no new code is sent until older ones leave that window.
• Limits are checked before anything is charged. A 429 carries retry_after_seconds.

Common errors

• OTP_TEMPLATE_REQUIRED or OTP_TEMPLATE_NOT_AUTHENTICATION (400): no approved Authentication template, or the named template is Marketing or Utility.
• OTP_COOLDOWN, OTP_TOO_MANY_SENDS, OTP_TOO_MANY_FAILED_CHECKS (429): one of the limits above.
• INSUFFICIENT_WALLET_BALANCE (402): recharge the wallet.
• OTP_UNAVAILABLE (503, on send or verify): verification is briefly unavailable; nothing was sent or charged, try again.

Opt-outs

Through the API, a Marketing or Utility template to a number that opted out is refused with 403 CONTACT_OPTED_OUT before anything is charged. OTPs still go to that number: the block does not cover Authentication templates, because the person asked for the code.

No DLT registration is needed (that is an SMS rule). Codes come with a copy-code button (no one-tap or zero-tap autofill), and there is no SMS fallback: the person needs WhatsApp on that number. Full reference: API documentation. Overview: WhatsApp OTP API.