WhatsApp Authentication Message Pricing (2026): OTP Costs

Moving one-time passcodes from SMS to WhatsApp usually starts with a spreadsheet showing a much lower cost per code. Then two things complicate it: some of your users live in markets where Meta charges foreign senders a far higher "authentication-international" rate, and every resend a user taps is another billed message.

WhatsApp authentication message pricing is simple at its core: one charge per delivered OTP template, at a rate set by the recipient's country. The detail is in who counts as international, how volume tiers apply, and how your login flow drives the number of codes you pay for.

This guide covers October 2026 rates for all 18 markets with an international rate, the eligibility rules, the button types, and how to keep resends down.

What an authentication message costs

Authentication templates are the only templates allowed to carry a one-time passcode, and Meta charges for each one delivered. Undelivered codes cost nothing. In every market, the authentication list rate equals the utility rate. A sample of list rates in USD, read from Meta's interactive rate table on business.whatsapp.com on October 29, 2026:

Authentication templates are also the most restricted. They use Meta's preset text ("123456 is your verification code."), with an optional security disclaimer and expiry warning, plus a one-time password button. URLs, media and emojis aren't allowed, and parameters are limited to 15 characters. Meta also delivers authentication messages only to the user's primary WhatsApp device; linked devices show a prompt to check the phone instead. Rates change quarterly, so confirm against the current rate card.

Authentication-international rates in 18 markets

Some markets have a second, higher authentication rate that applies when the sending business is based in a different country. As of October 1, 2026 there are 18 such markets, nine of them added that day. Here are both rates in USD, as of October 2026:

The gap can be enormous. A code to an Indian number costs a foreign sender about 22 times the domestic rate; to Sri Lanka, about 72 times.

Per Meta's authentication-international page, three conditions must all hold for the higher rate to apply:

1. Your business is eligible. Meta deems you eligible once you send more than 750,000 messages outside customer service windows in a moving 30-day period, across all your messaging accounts, to users in markets that have an international rate. Eligibility is permanent once set.
2. Your business is based in another country than the recipient, judged by your Primary Business Location in Business Manager.
3. The message is delivered after your start time, which Meta sets 30 days after eligibility and announces by email and webhook.

Your Primary Business Location matters: an Indonesian business sending to +62 numbers pays the standard rate, while an Indian business sending to the same numbers pays the international one. If your location isn't verified by your start time, the international rate applies anyway. You can read your start times through the API (use the current Graph API version from Meta's changelog):

curl "https://graph.facebook.com/v23.0/WABA_ID?fields=auth_international_rate_eligibility" \
  -H "Authorization: Bearer $WHATSAPP_TOKEN"

If it returns a start_time, plan for the higher rate from that date, and check exception_countries for any market with a different start.

Copy code, one-tap and zero-tap: same price, different results

Meta charges by category, so the button type doesn't change what a code costs. What it changes is how many users finish signing in with the first code, and that decides how many codes you pay for.

Meta calls one-tap the preferred option, and it requires extra work in your Android app. Copy code is the fallback that works everywhere. Sending a copy code template looks like this, with the code passed to both the body and the button:

curl "https://graph.facebook.com/v23.0/PHONE_NUMBER_ID/messages" \
  -H "Authorization: Bearer $WHATSAPP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "messaging_product": "whatsapp",
    "to": "919811122233",
    "type": "template",
    "template": {
      "name": "login_code",
      "language": { "code": "en_US" },
      "components": [
        { "type": "body", "parameters": [{ "type": "text", "text": "482913" }] },
        { "type": "button", "sub_type": "url", "index": "0",
          "parameters": [{ "type": "text", "text": "482913" }] }
      ]
    }
  }'

Implementation details, including the Android handshake for one-tap, are in our guide to the WhatsApp OTP API.

Volume tiers for authentication

Authentication gets volume discounts, counted per market each month across your business portfolio. Its thresholds differ from utility's: in North America, the first authentication tier covers 100,000 messages (utility's covers 80,000), and in India the first authentication tier ends at 750,000 while utility's runs to 25 million. India's authentication tiers in INR, as of October 2026:

Authentication-international rates have their own tiers too: India's international rate starts at ₹2.4971 and falls to ₹1.748 above 100 million. If you become subject to the international rate mid-month, Meta keeps counting your volume for that month and applies the tier you've reached to the international rate from your start time. Our guide to WhatsApp API volume tiers covers the mechanics.

Keeping OTP spend under control

Most avoidable OTP cost comes from codes that didn't need to be sent.

• Throttle resends. Disable the resend button for 30 to 60 seconds and cap attempts per number per hour. Every delivered resend is billed.
• Rate-limit code requests per phone number and per IP, so bots hammering your sign-up form can't run up a bill.
• Confirm the number before sending, as Meta recommends, and say clearly that the code will arrive on WhatsApp.
• Add an expiry warning so users don't request a fresh code for one that is still valid.
• Fall back to SMS only on failure, using the failed status webhook, rather than sending both by default.
• Check your Primary Business Location if you send OTPs abroad, before Meta's 30-day notice runs out.

How WhatsApp compares with SMS on cost and delivery is in our WhatsApp API vs SMS comparison, and the rest of the platform is in our complete guide to the WhatsApp API.

Where Tenashi fits

For OTPs, Tenashi is not the right tool, and we'd rather say so plainly. Login codes need Meta's authentication templates, delivery within seconds and very high volume, which is exactly what the Cloud API (directly or through a provider) is built for. Tenashi runs on your own WhatsApp number as a linked device, paces every send at 4 to 12 seconds, and has no templates.

Where it helps is the human side of login trouble: the customer who never got the code, the locked account, the "is this message really from you?" question. Tenashi gives your support team one shared inbox on the number customers already message, with tickets, SLAs and a CRM under every chat, from $18/mo.

See every feature · Get started

FAQ

How much does a WhatsApp OTP cost?

It depends on the recipient's country and, in 18 markets, on where your business is based. As of October 2026, Meta's authentication list rate is $0.0014 for India, $0.0034 for North America and $0.022 for the UK. Eligible foreign senders pay the international rate, $0.0304 for India. Only delivered codes are charged.

What is the WhatsApp authentication-international rate?

It is a higher authentication rate that applies in 18 markets when the sender is based in another country. It applies only once your business is eligible, after sending more than 750,000 messages outside customer service windows in a moving 30-day period to those markets, and only after the start time Meta announces.

Do one-tap and copy code templates cost the same?

Yes. Meta prices authentication messages by category and market, not by button type, so copy code, one-tap autofill and zero-tap templates cost the same per delivered message. The difference is conversion: options that fill the code automatically mean fewer users request resends, so you pay for fewer codes overall.

Do authentication messages get volume discounts?

Yes. Authentication is one of two categories with volume tiers, counted per market each month across your business portfolio. Thresholds differ from utility: India's first authentication tier ends at 750,000 messages, while its first utility tier runs to 25 million. International rates have their own tiers as well.

Can I use a utility or marketing template to send an OTP?

No. Meta's guidelines say only authentication templates may carry a one-time passcode for identity verification. If Meta finds an approved marketing or utility template that should be authentication, it gives notice and then rejects that template at the start of the following month, so it can no longer send.

---

Price your OTP flow per market, check your business location, and design the login so one code is enough. For everything that happens after sign-in, see how Tenashi works.