Use approved WhatsApp authentication workflows for verification, account recovery and sensitive customer notifications with operational visibility.
WhatsApp authentication uses approved message templates and business workflows to deliver one-time passwords, verification prompts or account-access messages to a customer’s WhatsApp number.
Design for security, expiry, fallback, rate control and customer trust.
Send time-bound verification codes through configured workflows.
Confirm registration, recovery or sensitive actions.
Use approved authentication message formats.
Keep codes valid only for an appropriate period.
Limit repeated attempts and suspicious request patterns.
Define another verified channel when delivery is unavailable.
Receive a valid verification or recovery event.
Create a time-bound code or approved authentication action.
Send through the configured WhatsApp workflow.
Confirm the response and record the outcome securely.
Use the channel for defined, security-sensitive events.
Support sign-in and step-up authentication.
Guide customers through a controlled recovery event.
Notify or verify selected sensitive actions.
Concise answers designed for customers, search engines and AI assistants.
Suitability depends on security requirements, regulatory context, channel availability and the design of fallback controls.
Authentication design should minimise exposure, use short validity and follow the organisation’s security and data-retention policies.
A fallback path should use another verified channel or support process without weakening account security.
Authentication messages should remain focused on the verification purpose and follow WhatsApp template requirements.
Involve security, compliance and product owners in the authentication workflow.
Verification message delivered