One-time codes are now an API you can call
Verification codes used to be something WA.cr did for its own sign-in and nothing else. Your app can now ask for one over WhatsApp or email, check it, send it again, and set the workspace's defaults for how codes are made and delivered.
Released 9 September 2026
Your app can now ask WA.cr for a one-time code, deliver it over WhatsApp or email, and verify it — with the workspace deciding how long codes are, how long they last and how many wrong tries you allow.
What's new
One-time codes are a proper part of the /v1 API:
- Ask for a code.
POST /v1/otpsends one to a phone number or an email address. WA.cr generates it, or you supply your own if you'd rather keep that part. - Check it.
POST /v1/otp/{id}/verifytells you whether the code somebody typed is the right one, and counts the wrong tries against the limit you set. - Send it again.
POST /v1/otp/{id}/resendissues a fresh code on the same request, with a short wait between sends and a cap on how many times. - See what happened. Every request records each delivery it attempted, in order, with the reason anything was skipped or refused.
Your defaults, in the console
Developers → One-time codes is where the workspace decides what a code looks like when a request doesn't say:
- which channels to try, and in what order — the next one is only tried if the one above refuses outright
- how many digits the code has (4–8)
- how long it lasts (up to 15 minutes)
- how many wrong attempts you allow (3–10)
A workspace that hasn't touched the card runs on WA.cr's defaults and moves when they move. Reset to defaults puts it back into that state.
Codes are not readable, unless you say so
WA.cr stores only a hash of a generated code. The code itself exists for the length of one API call and is never logged or kept — verifying is the only way to check it.
If your app genuinely needs the code back, that now takes two deliberate yeses: the key must hold the otp:reveal scope, and a workspace owner must switch on Allow keys to reveal generated codes. Neither one is enough alone, both are recorded in your audit log, and an owner can withdraw the second at any time.
Good to know
- Codes are billed per delivery attempted, at your plan's rate for authentication messages. A code that falls through from WhatsApp to email is two sends.
- SMS and voice appear in the channel list already and are refused for now. They are next, and requests written against them today will start working without a change on your side.
- One-time codes need a plan that includes them. If yours doesn't, the card on the Developers page says so.
Full reference, including error codes and resend limits, at api.wa.cr/docs. A walkthrough of the settings is in Set your one-time-code defaults.