Phone number verification code via WhatsApp API

Delivers a one-time code via WhatsApp authentication template when the user adds or changes a phone number.

Use case overview

Delivers a one-time code via WhatsApp authentication template when the user adds or changes a phone number. Copy-code button lets them paste the code in your profile form.

Template example

{{1}} is your verification code. For your security, do not share this code with anyone.

Copy code

{{1}}
one-time phone verification code (digits)
“Copy code”
button — fixed in the Meta template

WhatsApp Business API for phone number verification code

When to use it

Reach for this scenario when a user submits a new phone number and your app must prove they control it before the change goes live. It fits profile phone updates, linking WhatsApp as a contact channel, and compliance checks on cold start — for developer-built products, small teams, and agencies shipping the flow.

Cold-start delivery without an open session

Authentication-category templates are required for OTP outside a 24-hour window, so the code reaches the new number even when the user has never messaged you on WhatsApp.

Reliable sends on first attempt

The one-time code goes in both the body variable and the copy-code button params — body-only API calls return sent: false for authentication templates.

Less friction at code entry

The copy-code button puts the digits on the clipboard so the user can paste them into your profile form instead of memorizing the digits from the chat.

Verified number before it is saved

Your backend generates the OTP, sends the template to the international-format number, and only persists the new phone after the user submits a matching code.

Workflow

Customer acts
User enters a new phone number and requests verification.
user action
Build & send
Backend generates a code and sends the authentication template.
POST /sendTemplate
Copies the code
User copies the code from WhatsApp and submits it.
user action
Delivered
Backend validates and persists the verified number.
delivered

Technical implementation

Prerequisites

1MSG API Key · How to get API Key
WhatsApp Business account · How to Connect WABA
WhatsApp Template · How to Approve WABA Template
Customer opt-in · How to Manage Customers Consent

Code examples

#!/usr/bin/env bash
set -euo pipefail

# === Configuration (replace "___" placeholders) ===

API_BASE_URL="https://api.1msg.io"        # production 1MSG API base URL
CHANNEL_ID="___"                           # channel ID from 1MSG dashboard
API_TOKEN="___"                            # channel JWT token (Bearer)

TEMPLATE_NAME="___"                        # approved template name
TEMPLATE_NAMESPACE="___"                   # template namespace (required — send fails without it)
TEMPLATE_LANGUAGE="___"                    # template language code, e.g. "en"



# === Test data ===
TEST_PHONE="___"                 # client phone in international format
TEST_CODE="___"         # {{1}} otp code

PHONE_NORM="$(printf '%s' "$TEST_PHONE" | tr -cd '0-9')"

for pair in "CHANNEL_ID=$CHANNEL_ID" "API_TOKEN=$API_TOKEN" \
            "TEMPLATE_NAME=$TEMPLATE_NAME" "TEMPLATE_NAMESPACE=$TEMPLATE_NAMESPACE" \
            "TEMPLATE_LANGUAGE=$TEMPLATE_LANGUAGE" "TEST_PHONE=$TEST_PHONE" \
            "TEST_CODE=$TEST_CODE"; do
    val="${pair#*=}"
    if [ -z "$val" ] || [ "$val" = "___" ]; then
        echo "Missing configuration value: ${pair%%=*}" >&2
        exit 1
    fi
done

if [ -z "$PHONE_NORM" ]; then
    echo "Error: phone number has no digits after normalization" >&2
    exit 1
fi

URL="${API_BASE_URL%/}/${CHANNEL_ID}/sendTemplate"

# params carries body and button blocks.

# {{1}} otp code → ${TEST_CODE}
read -r -d '' PAYLOAD <<JSON || true
{
  "phone": "${PHONE_NORM}",
  "template": "${TEMPLATE_NAME}",
  "namespace": "${TEMPLATE_NAMESPACE}",
  "language": { "policy": "deterministic", "code": "${TEMPLATE_LANGUAGE}" },
  "params": [
    {
      "type": "body",
      "parameters": [
        { "type": "text", "text": "${TEST_CODE}" }
      ]
    },
    {
      "type": "button",
      "sub_type": "url",
      "index": "0",
      "parameters": [ { "type": "text", "text": "${TEST_CODE}" } ]
    }

  ]
}
JSON

RESPONSE="$(curl -s -w '\n%{http_code}' -X POST "$URL" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -d "$PAYLOAD")"

HTTP_CODE="$(printf '%s' "$RESPONSE" | tail -n1)"
BODY="$(printf '%s' "$RESPONSE" | sed '$d')"

case "$BODY" in
    *'"sent":true'*) ok=1 ;;
    *) ok=0 ;;
esac

if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ] && [ "$ok" -eq 1 ]; then
    echo "Message sent to client."
    echo "API response: $BODY"
else
    echo "Send failed. HTTP status: $HTTP_CODE" >&2
    echo "$BODY" >&2
    exit 1
fi

Response and delivery status

HTTP 2xx and JSON "sent": true mean 1MSG accepted the message for sending — not that it already reached the customer's phone. Save the id field (looks like wamid.…) to correlate delivery callbacks.

200 OKResponse

{
  "sent": true,
  "message": "Sent to [email protected]",
  "description": "Message has been sent to the provider",
  "id": "wamid.HBgLMzgwNjM5..."
}

sent
Accepted for sending — not yet on the customer's phone
id
Store it; delivery callbacks and hookInfo are keyed on this

Delivery statuses and webhooks →

Common errors

Status	API response	Cause	Fix
200	Message was not sent: template is not defined	namespace, template or language is missing from the request body.	Send all three. Take namespace and the exact template name from GET /templates; language is an object: {"policy": "deterministic", "code": "en"}.
200	template name (…) does not exist in <language>	The template is approved in a different language than the one requested.	Use the exact language code the template was approved in (for example es_MX is not the same as es). Check it in GET /templates.
200	Message was not sent: provide chatId, phone, bsuid, or username	No recipient the channel could resolve.	Pass exactly one recipient: phone (country code plus number, digits only), chatId (for example [email protected]) or bsuid.