العربيةGet started

Mobile number verification · over WhatsApp

Verifying your customers’ numbers
Over WhatsApp

A one-time verification code is a temporary code sent to the customer in a WhatsApp message from your verified business number. They tap “Copy code” and paste it into your system, and your system verifies it with a single call.

Start verifying nowSee the integration code
API calls
Just two
Code digits
4 to 8
The plain code
Never stored
A WhatsApp conversation showing a six-digit verification code with a Copy code button and a stated expiry
Your own system
Enter the verification code
We sent a code to +966 5•• ••• •29
Waiting for the code…
2
API calls, that is all
Send, then verify
4–8
configurable digits
By how sensitive the action is
3
layers of protection
Cooldown, daily cap, and an API limit
30
requests a minute
The API limit per key
The verification lifecycle

How verification works

Every verification passes through five states that the API returns. The first three are about delivering the message; the last two are about the customer entering the code.

  1. Verification requested

    Your system calls ‎/v1/verify/start‎ with the customer’s number. We generate the code and store only its hash.

    pending

  2. Sent over WhatsApp

    The code goes out in a Meta-approved authentication template, from your verified business number.

    sent

  3. Reached the device

    WhatsApp confirms the message reached the customer’s device. The state appears in ‎delivery_status‎.

    delivered

  4. The customer read it

    They opened the chat and tapped “Copy code”. Nothing typed by hand, nothing mistyped.

    read

  5. Verified

    Your system calls ‎/v1/verify/check‎ with the code. The comparison runs in constant time.

    approved
A man and a woman using WhatsApp OTP verification: an API sending the code, a WhatsApp message carrying a six-digit verification code, and a phone showing the conversation with a Copy code button and a success tick
Capabilities

What the service does

No add-ons afterwards and no modules bought separately. Set what suits the sensitivity of your operations from the dashboard.

Code length, lifetime and attempt limits are all set from the dashboard.

A code of 4 to 8 digits

Four digits for a faster experience, eight for banking. Changed in settings immediately, with no deployment.

code_length

A configurable lifetime

Set how many seconds the code stays valid. After that it becomes ‎expired‎ and accepts no attempt.

ttl_seconds

A cap on entry attempts

After a set number of wrong attempts the verification becomes ‎denied‎. That closes the door on brute-force guessing.

max_attempts

Arabic and English

The language is set per verification, or left to the platform default.

locale
The button

Two buttons, one difference: who types the code?

Every verification message carries a button. Choose between copying the code by hand, or filling it into your app automatically.

Copy codeDefault

COPY_CODE

Works on every device, with nothing to set up.

The code arrives with a “Copy” button. The customer taps it, the code goes to the clipboard, and they paste it into your screen. No app needed and no technical setup on your side — this is our default.

  1. The code arrives on WhatsApp
  2. The customer taps “Copy”
  3. They paste it into your site or app
What you need to prepare
The button text, and nothing else

Auto-fill

ONE_TAP

Puts the code into your app without the customer typing anything.

The customer taps one button and WhatsApp hands the code straight to your app, completing the verification with no copying or pasting. It needs an Android app, because we send Meta its package name and signing hash. Anyone opening the message on a device that does not support auto-fill gets the copy behaviour instead, so nobody is stuck.

  1. The code arrives on WhatsApp
  2. The customer taps once
  3. Your app opens with the code already entered
What you need to prepare
The app package name (package_name)The app signing hash (signature_hash)
Settings that apply to both
Button text
Up to 25 characters

The words shown on the button inside the message.

button_text
Code lifetime
From 1 to 90 minutes

Shown inside the message itself, so the customer knows when the code expires.

code_expiration_minutes
The security line
Optional

Adds “Do not share this code with anyone” to the message text.

show_security_recommendation
The integration

The integration

Send the code, then verify it. The dashboard generates these examples with your real key and number, ready to copy.

Send the code
POST /v1/verify/start
curl -X POST https://api.saei.automize.sa/v1/verify/start \
  -H "Authorization: Bearer sk_live_<your_key>" \
  -H "Content-Type: application/json" \
  -d '{"to":"+9665XXXXXXXX","locale":"en"}'
Verify the code
POST /v1/verify/check
curl -X POST https://api.saei.automize.sa/v1/verify/check \
  -H "Authorization: Bearer sk_live_<your_key>" \
  -H "Content-Type: application/json" \
  -d '{"verification_id":123,"code":"123456"}'
Receive the result on your server (optional)
otp.verification.updated
POST /your/webhook            HTTP/1.1
X-OTP-Event:      otp.verification.updated
X-OTP-Timestamp:  1786600000
X-OTP-Signature:  sha256=9f2c…

{
  "verification_id": 123,
  "status":          "approved",
  "to":              "+9665XXXXXXXX",
  "channel":         "whatsapp",
  "delivery_status": "read",
  "attempts":        1
}

Every notification carries the signature X-OTP-Signature computed with your secret. Compute the signature over the request body and compare, and you reject anything we did not send.

WhatsApp versus SMS

WhatsApp versus SMS

The whole picture, including the one case where SMS still wins.

Over WhatsAppBy SMS
Cost per verificationOne authentication message at a fixed, known priceBilled by segment, and Arabic text counts as three segments
Entering the codeA one-tap “Copy code” button, nothing typedRead the message, then type the code out
Delivery confirmationSent, then delivered, then read — per messageA delivery report only, and its accuracy varies by operator
Sender identityYour verified business name with the green tickA text sender ID that is easy to spoof
CoverageAnyone with WhatsApp on their deviceAny mobile number, even with no internet
Use cases

Use cases

Four moments where the same question comes up: does this number belong to its owner? Pick the one closest to yours.

Verify the number before it becomes an account.

Sign-up without verification fills your database with wrong numbers and fake accounts. One code before the account is created proves the number is real and belongs to the person, and gives you a confirmed channel from day one.

  • Correct numbers in your database instead of typos
  • Fewer fake accounts and less automated sign-up
  • A proven channel before your first marketing message
Online storesMobile appsEducation platformsAssociations
Before you enable it

Who can enable verification?

Verification runs on the WhatsApp Business platform, so the same Meta account conditions govern it. Check the three points below before you start.

Business verification

Your business must be verified inside Meta Business Manager with your commercial registration documents. That is Meta’s condition rather than ours, and it is what unlocks the higher sending tiers.

A sending tier of 2,000 conversations or above

We enable verification for numbers that have reached the 2,000 conversations a day tier or higher. Business verification alone usually lifts you to that tier, and Meta’s ladder runs 250 → 2,000 → 10,000 → 100,000.

A healthy quality rating

Keep your number’s quality rating at “high” or “medium”. A low rating does not just block the upgrade — it can drop your number to a lower tier and affect whether verification codes arrive at all.

Read your current tier from: Meta Business Suite → WhatsApp Manager → Account tools → Messaging limits.

The full guides

A 3D illustration: an official document carrying a green verification mark with a protection shield and a phone showing the verification stateWhatsApp Business basics

Business verification on Meta: the documents and the steps

Step by step through verifying your business in Meta Business Suite, with the list of documents accepted in Saudi Arabia.

7 min readRead the article
A 3D illustration: four ascending plinths carrying the messaging-limit tiers 250, then 1,000, then 10,000, then 100,000WhatsApp Business basics

Messaging limits on WhatsApp Business: your complete guide to the 2025 tiers

How many conversations can you start a day? The tiers (250 → 100,000) and how to raise yours safely.

8 min readRead the article
Frequently asked

Frequently asked questions

How long does it take to wire verification into my system?

Two calls: ‎/v1/verify/start‎ to send the code, and ‎/v1/verify/check‎ to verify it. The dashboard generates copy-ready examples with your real key and number, and you can try sending and verifying inside the platform before writing any code. The integration itself is usually under an hour.

Do you store the verification code?

No. The plain code is generated, handed to the send path, and never stored or logged anywhere. What the database keeps is an HMAC-SHA256 hash, and verification compares in constant time. Even if the database leaked, no code could be recovered from it.

What if the code never reaches the customer?

You see the real delivery state for every attempt: sent, delivered, or read. That separates “the customer did not enter the code” from “the message never arrived”. You can also receive a signed notification on your server the moment the state changes, and decide automatically: resend, or move the customer to another route.

How do you protect my account from message-pumping attacks?

Three layers run before any message is sent: a cooldown between requests to the same number, a daily cap per number over 24 hours, and a general API limit of 30 requests a minute per key. Because the check comes before the call, a rejected request costs you no message and does not affect your number’s quality rating with Meta.

Do I need a verified WhatsApp Business number?

Yes. Verification sends through a Meta-approved authentication template from your verified business number, and that is exactly what makes the customer trust the message: your real business name instead of an unknown sender ID. The platform walks you through verification, creating the template, and getting it approved.

Can I use more than one number, or more than one template?

Yes. If you have several WhatsApp numbers you can set the sender and the template per verification through the ‎from‎ and ‎template_id‎ fields, or leave them empty and let the platform use the default. The platform blocks in advance any attempt to pair a number with a template from a different business account.

What is the difference between WhatsApp verification and SMS?

WhatsApp gives you a one-tap “Copy code” button, so entry failures drop; it gives a real read receipt; and it shows your verified business name. SMS is billed by segment, and Arabic text is encoded so that one message counts as three segments. SMS stays useful as a fallback for anyone without WhatsApp.

Is the service on every plan?

Verification is part of the Pro plan. It includes the full API, key management and rotation, signed result notifications, and a dashboard for following verifications.

Send a real code to your own number in minutes.

Create your account, enable verification, and send a code from the dashboard before you write a line of code.