Building a Production WhatsApp OTP Verification Service in Node.js

SMS has long been the default channel for One-Time Password (OTP) verification and two-factor authentication (2FA). However, SMS OTP delivery faces major systemic challenges today:

High Delivery Failure Rates: Telecom carrier filtering, SS7 vulnerabilities, and SIM-swap attacks.
High Latency: SMS OTPs frequently take 60 to 180 seconds to arrive in international regions, causing user registration abandonment.
Rising Carrier Costs: International A2P SMS rates continue to escalate globally.

By switching your authentication pipeline to WhatsApp Business Cloud API, OTPs arrive via encrypted push notifications in under 5 seconds with a 99.8% delivery success rate.

In this guide, we walk through building a resilient WhatsApp OTP authentication microservice using Node.js, Redis, and Meta's official Authentication template API.

Understanding Meta's Authentication Template Rules

Meta enforces strict security policies for Authentication conversations:

Templates must contain only an alphanumeric verification code and an optional one-tap autofill button (COPY_CODE or ONE_TAP).
URLs, images, media, and marketing text are strictly prohibited within Authentication templates.
Pricing is significantly discounted: Meta prices Authentication conversations substantially lower than marketing broadcasts (see exact regional pricing in the Meta Per-Message Cost Guide).

Step 1: Generating and Storing the OTP in Redis

import crypto from "crypto"; import Redis from "ioredis"; const redis = new Redis(process.env.REDIS_URL); export async function generateOtp(phoneNumber) { // Generate a cryptographically secure 6-digit numeric code const code = crypto.randomInt(100000, 999999).toString(); // Store in Redis with a 5-minute (300 seconds) expiration window const otpKey = `otp:${phoneNumber}`; await redis.set(otpKey, code, "EX", 300); return code; }

Step 2: Dispatching the WhatsApp Authentication Template

When sending an OTP, use Meta's standardized authentication template payload:

import axios from "axios"; export async function sendWhatsAppOtp(recipientPhone, otpCode) { const url = `https://graph.facebook.com/v21.0/${process.env.WHATSAPP_PHONE_ID}/messages`; const payload = { messaging_product: "whatsapp", recipient_type: "individual", to: recipientPhone, type: "template", template: { name: "auth_otp_code", language: { code: "en_US" }, components: [ { type: "body", parameters: [ { type: "text", text: otpCode } // Injects OTP into the template body ] }, { type: "button", sub_type: "url", index: "0", parameters: [ { type: "text", text: otpCode } // Enables 1-tap "Copy Code" button ] } ] } }; const response = await axios.post(url, payload, { headers: { Authorization: `Bearer ${process.env.WHATSAPP_ACCESS_TOKEN}`, "Content-Type": "application/json" } }); return response.data; }

Step 3: Verifying the User's Submitted Code

export async function verifyOtp(phoneNumber, submittedCode) { const otpKey = `otp:${phoneNumber}`; const storedCode = await redis.get(otpKey); if (!storedCode) { return { success: false, message: "OTP has expired or does not exist." }; } // Constant-time string comparison to prevent timing attacks const isValid = crypto.timingSafeEqual(Buffer.from(storedCode), Buffer.from(submittedCode)); if (isValid) { // Delete immediately after successful verification (single-use token) await redis.del(otpKey); return { success: true, message: "Phone number verified successfully!" }; } return { success: false, message: "Invalid verification code." }; }

Enterprise Authentication with AI Soul

If you don't want to manage WhatsApp template approvals, Redis clusters, and carrier delivery status callbacks manually, modern platforms like AI Soul provide a complete messaging layer.

AI Soul connects directly to Meta Cloud API, enabling automated WhatsApp Drip Campaigns, transactional order alerts, and customer notifications with 0% platform markup on Meta's base message rates.