New device login OTP via WhatsApp API

The scenario sends the user a WhatsApp authentication template with a one-time verification code when a login attempt is flagged as coming from a new device.

Try the demo View code example

Use case overview

The scenario sends the user a WhatsApp authentication template with a one-time verification code when a login attempt is flagged as coming from a new device. The copy-code button lets them paste the code into your login confirmation screen.

Template example

{{1}} is your verification code. For your security, do not share this code with anyone.

Copy code

{{1}}
one-time new-device login verification code (digits)
“Copy code”
button — fixed in the Meta template

WhatsApp Business API for new device login otp

When to use it

Reach for this scenario when a user signs in from a new device or browser and you must confirm it is really them before opening a session, but there is no open WhatsApp chat yet — a free-text message is not allowed on cold start. It fits IAM and web or mobile apps that detect unrecognized endpoints, account-security teams blocking unauthorized logins, and integrators wiring device-fingerprint or risk-engine events through the 1MSG API.

Stop unauthorized new-device access

One body variable carries the freshly generated OTP in an authentication template, so the user must confirm the login on WhatsApp before your backend opens a session from an unrecognized device or browser.

Faster code entry on the login screen

The copy-code button carries the same digits as the single body variable, so the user taps Copy code and pastes into your confirmation form instead of retyping from another channel.

Compliant cold-start delivery

Only an approved authentication template can open the conversation; your backend sends the code in both body and button parameters when the new-device login event fires.

Clear audit trail for retries

Delivery status is logged when the template goes out, so security teams can retry or alert on failures while the backend validates the code the user submits.

Workflow

Trigger
User signs in from a new device or browser and your system flags the attempt.
event · triggered
Capture event
Your backend generates a one-time verification code and resolves the user's WhatsApp number.
phone: "+…"
Build & send
A template message is built with the code in the body and the same value in the copy-code button parameter.
POST /sendTemplate
Delivered
The user receives the WhatsApp message and copies or reads the code.
delivered
Status tracked
Your backend validates the submitted code and allows or blocks the new-device session; delivery errors are handled per platform rules.
status: "read"

Technical implementation

Prerequisites

1MSG API Key · How to get API Key
WhatsApp Business account · How to Connect WABA
WhatsApp Template · How to Approve WABA Template
Customer opt-in · How to Manage Customers Consent

Code examples

#!/usr/bin/env bash
set -euo pipefail

# === Configuration (replace "___" placeholders) ===

API_BASE_URL="https://api.1msg.io"        # production 1MSG API base URL
CHANNEL_ID="___"                           # channel ID from 1MSG dashboard
API_TOKEN="___"                            # channel JWT token (Bearer)

TEMPLATE_NAME="___"                        # approved template name
TEMPLATE_NAMESPACE="___"                   # template namespace (required — send fails without it)
TEMPLATE_LANGUAGE="___"                    # template language code, e.g. "en"



# === Test data ===
TEST_PHONE="___"                 # client phone in international format
TEST_CODE="___"         # {{1}} otp code

PHONE_NORM="$(printf '%s' "$TEST_PHONE" | tr -cd '0-9')"

for pair in "CHANNEL_ID=$CHANNEL_ID" "API_TOKEN=$API_TOKEN" \
            "TEMPLATE_NAME=$TEMPLATE_NAME" "TEMPLATE_NAMESPACE=$TEMPLATE_NAMESPACE" \
            "TEMPLATE_LANGUAGE=$TEMPLATE_LANGUAGE" "TEST_PHONE=$TEST_PHONE" \
            "TEST_CODE=$TEST_CODE"; do
    val="${pair#*=}"
    if [ -z "$val" ] || [ "$val" = "___" ]; then
        echo "Missing configuration value: ${pair%%=*}" >&2
        exit 1
    fi
done

if [ -z "$PHONE_NORM" ]; then
    echo "Error: phone number has no digits after normalization" >&2
    exit 1
fi

URL="${API_BASE_URL%/}/${CHANNEL_ID}/sendTemplate"

# params carries body and button blocks.

# {{1}} otp code → ${TEST_CODE}
read -r -d '' PAYLOAD <<JSON || true
{
  "phone": "${PHONE_NORM}",
  "template": "${TEMPLATE_NAME}",
  "namespace": "${TEMPLATE_NAMESPACE}",
  "language": { "policy": "deterministic", "code": "${TEMPLATE_LANGUAGE}" },
  "params": [
    {
      "type": "body",
      "parameters": [
        { "type": "text", "text": "${TEST_CODE}" }
      ]
    },
    {
      "type": "button",
      "sub_type": "url",
      "index": "0",
      "parameters": [ { "type": "text", "text": "${TEST_CODE}" } ]
    }

  ]
}
JSON

RESPONSE="$(curl -s -w '\n%{http_code}' -X POST "$URL" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -d "$PAYLOAD")"

HTTP_CODE="$(printf '%s' "$RESPONSE" | tail -n1)"
BODY="$(printf '%s' "$RESPONSE" | sed '$d')"

case "$BODY" in
    *'"sent":true'*) ok=1 ;;
    *) ok=0 ;;
esac

if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ] && [ "$ok" -eq 1 ]; then
    echo "Message sent to client."
    echo "API response: $BODY"
else
    echo "Send failed. HTTP status: $HTTP_CODE" >&2
    echo "$BODY" >&2
    exit 1
fi

Response and delivery status

HTTP 2xx and JSON "sent": true mean 1MSG accepted the message for sending — not that it already reached the customer's phone. Save the id field (looks like wamid.…) to correlate delivery callbacks.

200 OKResponse

{
  "sent": true,
  "message": "Sent to [email protected]",
  "description": "Message has been sent to the provider",
  "id": "wamid.HBgLMzgwNjM5..."
}

sent
Accepted for sending — not yet on the customer's phone
id
Store it; delivery callbacks and hookInfo are keyed on this

Delivery statuses and webhooks →

Common errors

Status	API response	Cause	Fix
200	Message was not sent: template is not defined	namespace, template or language is missing from the request body.	Send all three. Take namespace and the exact template name from GET /templates; language is an object: {"policy": "deterministic", "code": "en"}.
200	template name (…) does not exist in <language>	The template is approved in a different language than the one requested.	Use the exact language code the template was approved in (for example es_MX is not the same as es). Check it in GET /templates.
200	Message was not sent: provide chatId, phone, bsuid, or username	No recipient the channel could resolve.	Pass exactly one recipient: phone (country code plus number, digits only), chatId (for example [email protected]) or bsuid.