Step-up OTP for sensitive actions via WhatsApp API

Sends a fresh one-time code via WhatsApp authentication template when the user confirms a sensitive account action.

Use case overview

Sends a fresh one-time code via WhatsApp authentication template when the user confirms a sensitive account action. Copy-code button helps paste the code in your confirmation dialog.

Template example

{{1}} is your verification code. For your security, do not share this code with anyone.

Copy code

{{1}}
one-time step-up verification code (digits)
“Copy code”
button — fixed in the Meta template

WhatsApp Business API for account action otp

When to use it

Reach for this scenario when a signed-in user starts a sensitive account change — email update, payout settings, API key rotation — and you need a fresh one-time code before the change commits. It fits developers shipping portals, small teams with high-risk settings, and agencies that need step-up verification plus an audit trail for security reviews.

Stronger step-up before sensitive changes

The backend generates a one-time code when the user starts a protected change and sends it in one body variable through an authentication template, bound to the pending action until validation completes.

Faster code entry on mobile

The copy-code button carries the same OTP as the message body, so the user pastes the digits into your confirmation dialog instead of retyping them from chat.

Verification without an open chat

Authentication-category templates deliver the OTP even when no support session is open, so step-up works on cold start without needing an active conversation first.

Audit-ready OTP delivery

Each send puts the code in body and copy-code button per authentication template rules, so security reviews can log OTP delivery alongside high-risk setting changes.

Workflow

Trigger
User starts a protected account change.
event · triggered
Build & send
Backend generates a step-up code and sends the authentication template.
POST /sendTemplate
Customer acts
User copies the code and confirms the action.
user action
Delivered
Backend validates and applies the change.
delivered

Technical implementation

Prerequisites

1MSG API Key · How to get API Key
WhatsApp Business account · How to Connect WABA
WhatsApp Template · How to Approve WABA Template
Customer opt-in · How to Manage Customers Consent

Code examples

#!/usr/bin/env bash
set -euo pipefail

# === Configuration (replace "___" placeholders) ===

API_BASE_URL="https://api.1msg.io"        # production 1MSG API base URL
CHANNEL_ID="___"                           # channel ID from 1MSG dashboard
API_TOKEN="___"                            # channel JWT token (Bearer)

TEMPLATE_NAME="___"                        # approved template name
TEMPLATE_NAMESPACE="___"                   # template namespace (required — send fails without it)
TEMPLATE_LANGUAGE="___"                    # template language code, e.g. "en"



# === Test data ===
TEST_PHONE="___"                 # client phone in international format
TEST_CODE="___"         # {{1}} otp code

PHONE_NORM="$(printf '%s' "$TEST_PHONE" | tr -cd '0-9')"

for pair in "CHANNEL_ID=$CHANNEL_ID" "API_TOKEN=$API_TOKEN" \
            "TEMPLATE_NAME=$TEMPLATE_NAME" "TEMPLATE_NAMESPACE=$TEMPLATE_NAMESPACE" \
            "TEMPLATE_LANGUAGE=$TEMPLATE_LANGUAGE" "TEST_PHONE=$TEST_PHONE" \
            "TEST_CODE=$TEST_CODE"; do
    val="${pair#*=}"
    if [ -z "$val" ] || [ "$val" = "___" ]; then
        echo "Missing configuration value: ${pair%%=*}" >&2
        exit 1
    fi
done

if [ -z "$PHONE_NORM" ]; then
    echo "Error: phone number has no digits after normalization" >&2
    exit 1
fi

URL="${API_BASE_URL%/}/${CHANNEL_ID}/sendTemplate"

# params carries body and button blocks.

# {{1}} otp code → ${TEST_CODE}
read -r -d '' PAYLOAD <<JSON || true
{
  "phone": "${PHONE_NORM}",
  "template": "${TEMPLATE_NAME}",
  "namespace": "${TEMPLATE_NAMESPACE}",
  "language": { "policy": "deterministic", "code": "${TEMPLATE_LANGUAGE}" },
  "params": [
    {
      "type": "body",
      "parameters": [
        { "type": "text", "text": "${TEST_CODE}" }
      ]
    },
    {
      "type": "button",
      "sub_type": "url",
      "index": "0",
      "parameters": [ { "type": "text", "text": "${TEST_CODE}" } ]
    }

  ]
}
JSON

RESPONSE="$(curl -s -w '\n%{http_code}' -X POST "$URL" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -d "$PAYLOAD")"

HTTP_CODE="$(printf '%s' "$RESPONSE" | tail -n1)"
BODY="$(printf '%s' "$RESPONSE" | sed '$d')"

case "$BODY" in
    *'"sent":true'*) ok=1 ;;
    *) ok=0 ;;
esac

if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ] && [ "$ok" -eq 1 ]; then
    echo "Message sent to client."
    echo "API response: $BODY"
else
    echo "Send failed. HTTP status: $HTTP_CODE" >&2
    echo "$BODY" >&2
    exit 1
fi

Response and delivery status

HTTP 2xx and JSON "sent": true mean 1MSG accepted the message for sending — not that it already reached the customer's phone. Save the id field (looks like wamid.…) to correlate delivery callbacks.

200 OKResponse

{
  "sent": true,
  "message": "Sent to [email protected]",
  "description": "Message has been sent to the provider",
  "id": "wamid.HBgLMzgwNjM5..."
}

sent
Accepted for sending — not yet on the customer's phone
id
Store it; delivery callbacks and hookInfo are keyed on this

Delivery statuses and webhooks →

Common errors

Status	API response	Cause	Fix
200	Message was not sent: template is not defined	namespace, template or language is missing from the request body.	Send all three. Take namespace and the exact template name from GET /templates; language is an object: {"policy": "deterministic", "code": "en"}.
200	template name (…) does not exist in <language>	The template is approved in a different language than the one requested.	Use the exact language code the template was approved in (for example es_MX is not the same as es). Check it in GET /templates.
200	Message was not sent: provide chatId, phone, bsuid, or username	No recipient the channel could resolve.	Pass exactly one recipient: phone (country code plus number, digits only), chatId (for example [email protected]) or bsuid.