Guide · Templates · For the owner whose app sends login codes by SMS

WhatsApp authentication templates: sending login and verification codes the way Meta requires

If your app or website lets people receive a login code or verification code on WhatsApp, Meta requires a specific kind of template for it. The wording is fixed, the only choices are two optional lines and the kind of button, and the message is delivered only to the customer's main phone. In return the code can fill itself into your app with one tap, or with no tap at all on Android. Here is what Meta's pages allow, what they forbid, and what to decide before switching codes from SMS to WhatsApp.

Published 1 October 2026 · Updated 15 October 2026

What an authentication template is

Meta's page opens with the rule: an app that offers one-time passwords or verification codes over WhatsApp must use an authentication template. It is one of the three template categories, and unlike the other two you do not write its text. Every authentication template is built from the same parts.

Fixed text: The code, followed by Meta's own wording that it is your verification code. Translated by Meta into each language you create the template in. Not editable.
Optional security line: A sentence asking the customer not to share the code. On or off; the wording is Meta's.
Optional expiry line: A footer saying the code expires in a given number of minutes. You choose the number, from 1 to 90.
The button: A one-tap autofill button, a copy-code button, or no visible button when the code is delivered straight into an Android app. The copy-code label can be your own, up to 25 characters, or Meta's default in the template's language.

What cannot go in

Links, images, documents and emoji are not supported in authentication templates. There is no room for a logo, a promotion or a second sentence. That is the point: a code message that always looks the same is harder to fake.

How the code reaches your app

Meta describes four ways the customer gets from the WhatsApp message to the field in your app, and which one happens depends on the button you chose and the phone they hold.

Copy code: The customer taps the button, WhatsApp copies the code to the clipboard, and they paste it into your app. Works on every phone. The simplest to set up.
One-tap autofill: On Android, the button opens your app and hands it the code. Meta's preferred option, because the customer never has to leave your app for long. It needs changes to your Android app's code, and Meta's page says the older Android handshake method is retired on 15 October 2026 in favour of its OTP Android SDK.
Zero-tap: Android only. The code is broadcast to your app the moment it arrives and the customer sees nothing to tap. If the phone is not Android, or the checks fail, WhatsApp shows a copy-code or autofill button instead, which is why a zero-tap template must still define both.
iOS keyboard suggestion: Since 15 June 2026, on iOS 26 and later, iOS reads the code from the WhatsApp notification and offers it above the keyboard, the way it already does for SMS codes. Meta's page says this needs no integration and is on for every authentication template.

When autofill quietly becomes copy code

Meta's Android error signals page, updated in June 2026, explains a complaint businesses raise often: customers see a copy-code button where the autofill button should be. If a message fails WhatsApp's checks, WhatsApp swaps the autofill button for copy code rather than leaving the customer stuck. The reasons Meta lists are ordinary ones: your app did not start the handshake before the code was sent; more than 10 minutes passed after the handshake, or longer than the expiry set on the template; the phone runs a very old Android version; the customer switched off WhatsApp notifications, in WhatsApp or in the phone's settings; or several of your apps asked for a code at once. Your Android developer can listen for these signals and see which one applied, instead of guessing.

Two protections Meta applies for you

Only the main phone gets the code: Meta calls it linked device security. An authentication message is delivered to the customer's primary WhatsApp device only; on a linked laptop or tablet it is masked with a prompt to look at the phone. It is on by default, cannot be turned off or adjusted, and applies to numbers on the Cloud API.
An "I didn't request a code" button: Meta's copy-code page says this button is in beta and reaching businesses gradually. When a customer taps it, your system is told, so a code someone else triggered becomes a signal rather than a mystery.

When Meta charges the international rate for login codes: the 18 markets, the 30-day notice and your Primary Business Location

Authentication is its own category on Meta's rate card, priced per message by the customer's country. The guide to how Meta charges explains the categories; the figures are Meta's to publish. On top of that, some markets have a second rate for login codes, which Meta calls the authentication-international rate. It is not a general charge for every code sent abroad. Meta's page says it applies to a delivered code message only when three things are all true.

Your business is eligible. A business becomes eligible once it sends more than 750,000 messages outside customer service windows in any moving 30-day period, counted across all of its WhatsApp accounts, to people in the markets that have this rate. Meta's page adds that eligibility is permanent.
Your business is based in another country. Meta's example: an Indonesian business sending a code to an Indonesian number pays the normal authentication rate. An Indian business sending a code to the same number pays the international rate, if it meets the other two conditions.
The message was delivered on or after your start time for that country. Meta sets the start times 30 days after a business becomes eligible, so there is always 30 days' notice.

The markets: Indonesia since 1 June 2024 and India since 1 July 2024. The United Arab Emirates, Saudi Arabia, Egypt, Pakistan, Malaysia, Nigeria and South Africa since 1 February 2025. On 27 May 2026 Meta announced nine more, which started on 1 October 2026: Kuwait, Oman, Iraq, Bangladesh, Kazakhstan, Morocco, Nepal, Sri Lanka and Ukraine. Meta's pricing page says these new rates are higher than the utility and authentication rates in those markets.
18 markets, not 9: From 1 September 2026 Meta judged eligibility on messages across all 18 markets instead of the first 9. From 1 October 2026 a business that was already eligible could be charged the international rate in up to 9 more markets.
The 30-day notice: When a business becomes eligible, Meta sends an email with the start time for each country and, if Meta was able to work it out, the country it set as the business's Primary Business Location. The email goes to every admin of the business's WhatsApp accounts and to anyone the accounts are shared with, such as the company that runs your WhatsApp system. Meta's pricing page says the notice exists to give businesses time to set their Primary Business Location.
Primary Business Location: The country where your business has its headquarters and keeps its bookkeeping records. Meta tries to work it out from public information, such as where the business may be listed on a stock exchange and its corporate structure. It shows in Business Settings, in the Primary Business Location field, with a status of Verified, Pending verification or Rejected. You can edit it there and answer Meta's questions; the check can take up to 3 business days, and you cannot change it while it is under review.
Your home country: Meta always charges the normal domestic rate for codes to your Primary Business Location country. But its page also warns that if the location is not verified once a country's start time has passed, codes to users in that country are billed at the international rate. Our reading: that can include your own country, so verify the field early.
Mid-month switches: If the international rate starts partway through a month, the messages you already sent that month keep counting toward Meta's monthly volume discounts, and from the start day those discounts apply to the international rate. Meta's delivery reports and pricing analytics mark which messages were billed at the international rate.

Our reading

Most shops will never send 750,000 such messages in 30 days, so this rule matters mainly to apps and services with a large customer base across several countries. If you are one, say a business headquartered in the UAE sending login codes to customers in Saudi Arabia or Kuwait, and Meta's eligibility email arrives, check the Primary Business Location field in Business Settings before the 30 days are up. If someone else runs your WhatsApp system, they may see the email first; ask them to forward it to you.

BitByteCore is a verified Meta Tech Provider (since 9 September 2026). This guide repeats Meta's pages as we read them on 15 October 2026, and is not legal advice.

What to decide before switching codes from SMS

Before switching codes from SMS to WhatsApp, Meta's own best-practice list is worth following to the letter.

Confirm the WhatsApp number first. Meta says to verify that the number the customer gave you is their WhatsApp number before sending a code to it. A code sent to the wrong number is a security incident, not a delivery failure.
Offer a choice, and say where the code is going. If the customer can choose between SMS, email and WhatsApp, make it obvious which one they picked. Meta's zero-tap page adds: do not make WhatsApp the default method. Meta's OTP guide on its WhatsApp for Business blog says WhatsApp codes work particularly well in markets where WhatsApp is widely used, and that on Android your app can check whether WhatsApp is installed before suggesting it.
Confirm when the code was captured. Whether the customer pasted it or your app received it on its own, show them it worked.
Keep the template honest with the expiry. If the footer says ten minutes, your system should reject the code at ten minutes. The same OTP guide also recommends limiting how many attempts someone can make in a given time. The template quality guide explains what blocks and reports do to a template over time.

Questions

Can we put our company name or a link in the code message?

No. Meta fixes the text and forbids links, media and emoji. The customer sees your display name at the top of the chat; the message itself is the code and Meta's wording.

Does the customer have to leave our app to get the code?

On Android, not necessarily: one-tap autofill brings the code back into the app, and zero-tap delivers it without a tap. On iPhone, iOS 26 offers the code above the keyboard from the notification. On anything else the customer copies and pastes.

Will the code show on the customer's laptop WhatsApp?

No. Meta delivers authentication messages to the primary phone only and masks them on linked devices. This is on by default and cannot be changed.

Is a code cheaper than a marketing message?

Authentication has its own rate per country, separate from marketing and utility. The figures are on Meta's pricing page; the categories are explained in our guide to how Meta charges.

Do we pay more for codes sent to customers in another Gulf country?

Only if three things are true: your business is eligible (more than 750,000 messages outside customer service windows in a moving 30 days, to people in the markets with this rate), your business is based in a different country (Meta goes by the Primary Business Location field, and if that is not verified, codes are billed at the international rate anyway), and your start time for that country has passed. So check that field when Meta's email arrives. The UAE, Saudi Arabia, Kuwait and Oman are among the 18 markets; Qatar and Bahrain are not. Meta gives 30 days' notice by email first.

Who is BitByteCore?

BitByteCore is a verified Meta Tech Provider (since 9 September 2026). This guide repeats Meta's own pages, and is not legal advice.

Sources

Meta's developer documentation: Authentication templates, read 1 October 2026.
Meta's developer documentation: Copy code authentication templates, read 1 October 2026.
Meta's developer documentation: Zero-tap authentication templates, read 1 October 2026.
Meta's developer documentation: Authentication template error signals, read 3 October 2026.
Meta's developer documentation: Authentication-international rates, read 15 October 2026.
Meta's developer documentation: Pricing on the WhatsApp Business Platform, read 15 October 2026.
Meta's WhatsApp for Business blog: What is a One-Time Password (OTP) and How Do They Work?, read 15 October 2026.

More plain-language notes like this one are on the guides page.

Thinking of moving login codes from SMS to WhatsApp?

We set up a business's WhatsApp number on a proper system, create the authentication templates in every language you need, and wire the code delivery so it is confirmed, expires on time and is sent only to a number the customer confirmed. A short call is the easiest way to see whether it fits your business.

Book a demo