Sends a WhatsApp authentication template message containing a one-time passcode (OTP).

Use cases: WhatsApp-based two-factor authentication (2FA) for user login verification,
transaction confirmation, account recovery, or phone number verification during sign-up.

Prerequisites

1. Configure your authentication template in Wax under
   Settings → WhatsApp → Authentication template:
   pick the button type (copy code / one-tap / zero-tap autofill), languages, and code expiration.
   Wax generates the template and submits it to Meta for approval (usually a few minutes).
2. Get your API key from Settings → Organization → API requests
   and pass it in the Authorization header.

How it works

1. You call this endpoint with the recipient's phone_number — and optionally your own code.
2. If you omit code, Wax generates a random 6-digit code for you.
3. Wax creates an authentication request and responds immediately with its id, the code,
   and its expiration — so your backend always knows which code to verify, without waiting for
   WhatsApp delivery.
4. Delivery runs asynchronously through your authentication flow, whose first step is always
   the WhatsApp authentication template. The code is injected into the template placeholder and
   the copy-code / autofill button, and the contact is created automatically if unknown.

Fallbacks (RCS / SMS / webhook)

On the settings page, one click adds RCS and/or SMS fallbacks: when the WhatsApp message cannot
be delivered (invalid WhatsApp account, messaging limits, etc.), the code is automatically
re-sent over the fallback channel with the same text. Custom branches (e.g. calling your
webhook) can be added in the flow editor.

Verifying the code

Wax always returns the code (yours or the generated one) in the response, so verification
happens on your side: compare the code the user typed with the one returned here, and honor
expires_at (derived from your template's code expiration setting, 10 minutes by default).
For security, Wax erases stored codes once they expire.

Example

const sendOtp = async (phoneNumber) => {
  const response = await fetch('https://api.getwax.io/v1/authentication_templates', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      Authorization: 'Bearer YOUR_API_KEY',
    },
    // Omit `code` to let Wax generate a 6-digit one
    body: JSON.stringify({ phone_number: phoneNumber }),
  });

  const { id, code, status, expires_at } = await response.json();
  // Store `code` (and `expires_at`) server-side, then compare with the user's input.
  return { id, code, expiresAt: expires_at };
};

Rate limit: 500 requests per minute per API key.