One-time passcodes are the strictest template category on WhatsApp and the least forgiving to write, because almost every instinct people have about improving them causes a rejection. Authentication templates take no links, no emoji, no marketing and no additional sentences. What follows is what an approved OTP message actually looks like, the rules behind that shape, and the honest comparison with SMS — which is usually why a business is considering the move.
The shortest form that works. Meta supplies the security warning and the copy-code button — you supply the code variable.
Name the amount and the merchant so the customer can tell a genuine request from a fraudulent one. That is the whole security value.
Say what the code will change. A reset code that does not name the action is what phishing looks like.
Short and bare: "{{1}} is your verification code." Meta adds the security warning and the one-tap copy button itself, so the business supplies only the code variable and at most a brief line naming the service and the expiry. Anything more — a greeting, a link, an emoji — causes a rejection.
Through the WhatsApp Business Platform with an approved Authentication template, triggered by your application at the moment the user requests a code. It cannot be done from the free WhatsApp Business app, which has no programmatic sending. You will normally reach the platform through a provider rather than integrating with Meta directly.
Almost always because something was added. Authentication templates permit no URLs, no emoji, no marketing and no extra sentences, and Meta supplies the security disclaimer and copy-code button — writing your own version of either is a rejection. The other common cause is submitting under the wrong category.
In several markets, including India, yes at volume — authentication conversations are priced separately and per-country, and the gap against transactional SMS can be significant. It is not universal, though: check the rate for the countries you actually send to before switching, because in some markets SMS remains cheaper.
The transport is encrypted end to end, and the copy-code button reduces the transcription errors that cause failed logins. The risk profile is the same as SMS in one important respect: it authenticates possession of a number, not a person. Treat it as one factor, and keep the message specific about what the code authorises so users can spot a fraudulent request.
They will not receive it, so keep an SMS fallback. The usual pattern is to attempt WhatsApp first, then fall back to SMS after a few seconds without delivery — that captures the cost saving where it applies without locking anyone out of their account.
Written by Reputoo Editorial Team. Ready-to-use WhatsApp messages, written to pass Meta’s template review and read like a person wrote them.
1,000+ businesses onboarded · Member of NVIDIA Inception · Official WhatsApp Business API, no per-message markup.
