Send WhatsApp OTP Code
For businesses running their own OTP engine — your own generation, storage, expiry and verification — who only need Sendexa to solve WhatsApp's delivery problem.
You keep the code
Sendexa never generates, stores, hashes or checks the code — it's yours end to end. This endpoint only delivers it.
Delivers outside the window
A plain WhatsApp text is classified MARKETING and silently dropped once the 24-hour conversation window is closed. This wraps your code in an approved AUTHENTICATION template so it goes through regardless.
Your WABA, or ours
Uses your connected WhatsApp Business Account and approved AUTHENTICATION template if you have one, falling back to Sendexa's platform number otherwise.
Authentication required
Use Basic Auth with an API key that has the
whatsapp.write scope. Grant it in Dashboard → Developers → API Keys.This is not /v1/otp/*
/v1/otp/request/whatsapp has Sendexa generate, store and verify the code for you (see OTP & Verification). This endpoint does none of that — /v1/otp/verify does not apply to a code sent through here. Use it only if you already run your own OTP flow and just need WhatsApp delivery.POST
/v1/whatsapp/send-otp
Request Body
application/json
JSON
{"to": "233240000000","code": "482913"}
Response
JSON
{"success": true,"message": "Code delivered via WhatsApp","data": {"messageId": "exa_wa_123456789_abc123def"}}
Implementation Examples
Bash
curl -X POST 'https://api.sendexa.co/v1/whatsapp/send-otp' \-H 'Content-Type: application/json' \-H 'Authorization: Basic YOUR_API_TOKEN' \-d '{"to": "233240000000","code": "482913"}'
Best practices
- Generate, hash and expire the code on your own side — this endpoint only delivers it.
- Only send to a number the recipient supplied for this specific action, right before sending.
- A code should go to exactly one recipient — never duplicate a send to a second number.
- Rate-limit requests per recipient on your side to avoid spamming a number that isn't responding.