One-Time Passcodes

The one category this product is not built for

SMS delivery for login codes is expensive and unreliable in many markets, and WhatsApp is read faster. So the question comes up constantly: can we send our login codes here.

Yes, WhatsApp supports it — Authentication is one of Meta’s three template categories and exists solely for one-time passcodes. But it needs to fire from your authentication system within seconds of a login attempt, which is not what PingPlug is. This page explains the category honestly rather than selling you something that would not fit.

Which kind of message this is

Authentication. A distinct category from utility and marketing, tightly constrained in what the message may contain — the rigid format is what makes a code recognisable and hard to spoof. A template that is not genuinely a passcode will not be approved as one.

How to set it up

1
Create an authentication template in Meta’s WhatsApp Manager
The category is chosen at creation. Authentication templates have a fixed shape with the code as the variable — there is little to write.
2
Send it from whatever handles your logins
The code has to leave within seconds of the attempt, from the system that generated it. That is a direct Cloud API call from your auth service.
3
Expire codes quickly and never reuse them
Standard practice, and nothing about WhatsApp changes it.

What goes wrong

— Routing passcodes through a CRM. Every extra hop is latency on a code with a short life, and a queue is exactly the wrong place for it.
— Using a utility template because authentication looked restrictive. The constraints are the point — they are what make a code look like a code.
— Assuming WhatsApp replaces SMS everywhere. It only reaches people who use WhatsApp, so most services need both.

Questions

Can I send login codes with PingPlug?

Not sensibly, and we would rather say so. Passcodes have to leave within seconds of a login attempt from the system that generated the code. PingPlug is a CRM for customer conversations — routing authentication through it adds latency and a dependency where neither belongs. Call the Cloud API directly from your auth service.

What makes authentication templates different?

They are tightly constrained in what the text may contain. That rigidity is deliberate: a recognisable, consistent format is what makes a passcode hard to spoof, which is the entire security value.

Is it cheaper than SMS?

Often, in markets where SMS is expensive — but Meta prices per country and has restructured its pricing more than once, so check their current rate card against your SMS costs for the countries you actually serve rather than trusting a general claim.

Try it on your own numbers

Free plan, 100 contacts, no card required.

Start free