Send one-time passwords over your own WhatsApp number — from the REST API, or with no code at all through the WordPress plugin's login and two-factor.
The endpoints
Send — generate a six-digit code and deliver it as a WhatsApp message.
Verify — check the code the customer typed; compared timing-safely against a hash.
Resend — issue a fresh code when the first did not arrive.
Status — check whether a pending code is still valid.
The rules
Codes are six digits and expire after five minutes, with three verification attempts.
Codes are stored as a hash, never in plain text.
Delivery is not guaranteed: the linked phone must be online, so keep a fallback for critical logins.
Messages send from your own WhatsApp number, linked by scanning a QR code the way WhatsApp Web is linked. This is not the official WhatsApp Business API: there is no Meta approval queue and no template review, and in exchange the linked phone must stay online and only people who opted in should be messaged. See how it works.