Skip to content
BitByteCore ConnectBook a demo
Open the product menu
ProductSolutionsPricingHow it worksFAQCompany

Guide · Login codes · For the owner whose customers can't find the code

Your customer says the WhatsApp login code never came: the primary-phone rule, autofill on Android and iPhone, and offering another way to get it

Your app or website sends sign-in codes through WhatsApp, and a customer messages your team: the code never came. WhatsApp's Help Center has four short articles written for that customer, and Meta's developer pages explain what they see on Android and iPhone. This guide puts them in order, so your team knows what to ask first and what to tell the customer to try.

Published 15 October 2026

The code shows only on the phone that registered WhatsApp

WhatsApp's article About receiving security codes on linked devices says that, for security, one-time passcodes received on WhatsApp appear only on the customer's primary device: the phone they used to register their WhatsApp account. On every linked device the customer sees this message instead:

What a linked device shows

You received a one-time passcode. For added security, you can only see it on your primary device for WhatsApp.

WhatsApp's advice to a customer who sees it is simple: check your primary device. Meta's developer page Authentication templates calls this linked device security. It says the feature is on by default, cannot be configured or customized, and is only available on Cloud API.

Our reading

When a customer says the code never came, the first question is where they were looking. Someone signing in on a laptop with WhatsApp Web open beside it will see the masked message, not the code, and may read that as 'nothing arrived'. Ask them to pick up the phone that WhatsApp is registered on. WhatsApp Web on a computer is a linked device; how linked computers work for your own team is in Answering customers from a computer.

What WhatsApp tells the customer to try

WhatsApp's article Can't receive security codes or one-time passcodes from other apps on WhatsApp (read in its Android and iPhone versions) uses Instagram as its example of an app that sends a sign-in code through WhatsApp. Its steps:

Check the connection
Check the phone's internet connection. Try mobile data if you are on Wi-Fi, or Wi-Fi if you are on mobile data.
Ask for it again
Ask the app to send another code to WhatsApp. You might also be able to choose another delivery method, such as email.
Update WhatsApp
Make sure you are on the latest version of WhatsApp: from the Google Play store on Android, or the Apple App Store on iPhone.
Use the primary phone
You can only receive a security code on the phone you used to register your WhatsApp account. Anywhere else you see the masked message instead.
Restart
Turn the phone off and back on.
Check the phone is supported
On Android, WhatsApp supports Android 5.0 and newer; on iPhone, iOS 15.1 and newer; in both cases a phone that can receive SMS messages or calls.

Our reading

These steps make a good reply your team can paste when a customer asks, in your own words and in Arabic as well as English. Put 'use the phone WhatsApp is registered on' and 'ask for the code another way' near the top, because they are the two your team can act on straight away.

Autofill: when the code fills itself in

WhatsApp's article About autofilling security codes on WhatsApp says that when your app is on the same phone as the customer's WhatsApp account, they may see an 'autofill' prompt on the notification or on the message in WhatsApp. Tapping it shares the code directly with the right app.

Typing it still works
If the customer chooses not to let WhatsApp autofill the code, they can still enter it into the app themselves.
Some apps submit it for you
About security codes that automatically fill on WhatsApp says certain apps may set things up so the code sent through WhatsApp is submitted automatically on the customer's behalf.
The message stays private
The same article says message content is always protected: no one outside the chat, not even WhatsApp, can read it.

Meta's developer page Authentication templates describes the three ways a business can send the code, as the customer meets them:

Copy code
The customer taps the button, WhatsApp copies the code, and they switch back to your app and paste it.
One-tap autofill (Android)
The customer taps the button and WhatsApp opens your app and hands it the code. Meta calls this the preferred option, and it needs changes to your Android app. On iPhone, Meta says the operating system handles this through keyboard suggestions instead.
Zero-tap (Android only)
No button: the code reaches your app without the customer leaving it.

On iPhone: the code above the keyboard

Meta's developer page Keyboard suggestions says iOS 26 added native code autofill for third-party messaging apps, including WhatsApp. When the code arrives, iOS reads it from the WhatsApp notification and offers it in the keyboard, so the customer taps it into your app. The copy code button stays in the WhatsApp message as a fallback. The same page says this works automatically with existing authentication templates: the business does not need to create new templates or change its setup.

iOS 26 or later
Customers on earlier iOS versions are not affected. Meta's Authentication templates page says earlier iOS versions do not support autofill, and suggests copy code templates for those customers. Android has its own keyboard suggestions and is not affected either.
Notifications on
Settings > Notifications > WhatsApp > Allow Notifications.
Autofill on
Settings > Passwords > Password Options > Autofill Security Codes.
Numbers only
iOS only spots numeric codes of 3 to 8 digits. Codes with letters are not offered.
Not with WhatsApp open
It does not appear while WhatsApp is open on screen, because iOS reads the code from the notification.

If the phone is below iOS 26, or either setting is off, Meta says the customer won't see the keyboard prompt, but can still use the copy code button in the WhatsApp message.

The switch you control

The same page says the keyboard suggestion is on by default for every authentication template. The business can turn it off for one template by opening it in the template editor, deselecting Allow autofill on iOS and saving, and can turn it back on the same way. That toggle is only in WhatsApp Manager.

Meta's own example is turning it off for high-security flows like financial transactions or account recovery, while keeping it for standard logins.

Our reading

For an ordinary shop login, leave it on: it saves the customer a switch between apps. If the same code approves a payment or resets an account, ask whoever runs your app whether that template should be the exception. Why a WhatsApp number on its own isn't proof of who someone is, and Meta's other advice for those cases, is in Is a WhatsApp login code safe?.

Always offer another way to get the code

Both WhatsApp articles on autofill say apps should always ask for permission before sending a code through someone's WhatsApp account, and that a customer who does not want a one-time passcode over WhatsApp can select another delivery method that the business offers in its app.

Meta's Authentication templates page adds three habits: confirm the customer's WhatsApp number before sending the code, make it clear the code is going to WhatsApp (especially when you offer more than one way to receive it), and show the customer when your app has captured the code.

Our reading

WhatsApp's own help text tells customers to ask the app for another code, and says they might be able to choose another delivery method, such as email. That only helps if your app has another way. Keep SMS or email as a second option, show which number the code is going to, and say plainly on screen that it will arrive in WhatsApp. How the templates themselves work is in WhatsApp authentication templates, and the wider permission rules are in WhatsApp opt-in: permission before messaging.

What this means for your shop

BitByteCore is a verified Meta Tech Provider (since 9 September 2026). This guide repeats WhatsApp's Help Center and Meta's developer documentation as we read them on 15 October 2026, and is not legal advice.

Our reading

Most 'the code never came' messages can be answered with two questions: which phone were you looking at, and would you like it another way? Give your team those two, and keep a second delivery method in your app. If Meta's AI agent answers your chats, how it checks it is talking to the account holder is in How Meta's AI agent checks it is talking to the account holder.

Questions

Why can't my customer see the WhatsApp code on a linked device?

WhatsApp shows one-time passcodes only on the primary device, the phone used to register the account. Every linked device shows a message saying the code can only be seen on the primary device.

What should a customer try when the code doesn't arrive?

WhatsApp's Help Center lists: check the internet connection, ask the app to send the code again or another way such as email, update WhatsApp, use the primary phone, restart the phone, and check the phone is supported.

How does autofill work on iPhone?

Meta's developer page says that on iOS 26 and later, iOS reads a numeric code of 3 to 8 digits from the WhatsApp notification and offers it in the keyboard. WhatsApp notifications and Autofill Security Codes must be on, and it doesn't appear while WhatsApp is open on screen.

Can I turn off the iPhone keyboard suggestion?

Yes, per template. Deselect Allow autofill on iOS in the template editor in WhatsApp Manager. Meta's example is high-security flows like financial transactions or account recovery.

Does a customer have to get codes on WhatsApp?

Not if the business offers another way. WhatsApp's Help Center says apps should always ask permission before sending a code through WhatsApp, and that a customer who doesn't want codes over WhatsApp can select another delivery method the business offers in its app.

Who is BitByteCore?

BitByteCore is a verified Meta Tech Provider (since 9 September 2026). This guide repeats Meta's pages, and is not legal advice.

Sources

This guide describes Meta's pages as we read them, and is not legal advice. More plain-language notes like this one are on the guides page.

Want customer conversations in one place you own?

We set up a business's WhatsApp number on a system its team runs, so every customer conversation sits in one place the business owns. A short call is the easiest way to see how that would work for you.

Book a demo