A login code looks like a small thing. Until you build it: generate a secure number, store it without leaving it in plain sight, send it, resend it when the customer doesn't see it, expire it, limit wrong guesses, and stop anyone from using it to flood someone else's phone with messages.
Boom now takes care of all of that. You make two API calls: one to ask for the code and one to check what your customer typed.
How it works
- Ask for the code. Your backend calls
POST /api/v1/otp/sendwith your customer's phone or their external ID. Boom creates the code, sends it on WhatsApp and answers with anotpId. - Your customer gets it on WhatsApp with a Copy code button, and types it into your app.
- Check it. Your backend calls
POST /api/v1/otp/verifywith theotpIdand the code. Boom tells you whether it's valid.
What a valid code unlocks stays in your app: Boom only tells you whether the code is right.
What Boom takes care of
- Resends without a new code. If you ask again while the code is still valid, Boom resends the same code with the same
otpId, so the first message keeps working. - Limits against abuse. A wait between resends and a cap on sends per number each hour. After several wrong guesses, the code locks.
- Expiry. The code expires when your WhatsApp template says it does.
- Shared phones. If two patients or customers use the same number, each one gets their own code.
- The code stays out of sight. It's stored encrypted only while it can still be used. In the inbox and for your AI agents it shows up hidden, and the agent can still answer if your customer replies to the message.
- It arrives even when they opted out. A code is something the person just asked for, not a marketing message, so it reaches them even if they're on your Do Not Contact list. Each of those sends is recorded.
Set it up in minutes
Go to Transactional › One-time codes:
- Choose the WhatsApp number codes are sent from.
- Choose or create the code template. WhatsApp writes the text; you pick the language, the expiry and whether to add the security line. Approval usually takes a few minutes, and the page checks for it on its own.
- Adjust the code rules: length, wrong attempts before it locks, the wait before resending and sends per hour.
- Send a test code to your phone and verify it from the same page.
The Connect your app card shows both calls ready to copy. Any API key in your workspace works.
What it costs
Each code that WhatsApp delivers is billed as an authentication template message, and so is each delivered resend. The test code on the page is a real send too, and it's billed.
Available now
One-time codes are available in every workspace. All you need is a connected WhatsApp number. For now codes go out on WhatsApp; the docs cover every response and error.
