One-Time Password (OTP)

A one-time password (OTP) is a code that is valid for a single login or transaction only, usually 4 to 8 digits long and valid for between 30 seconds and 10 minutes. It is generated by an authenticator app or sent via WhatsApp, SMS or email, and is the most common second factor in two-factor authentication.

What is a one-time password?

A one-time password (OTP) is a code that works exactly once: for one login, one payment confirmation or one phone number verification. After it is used or after it expires, it is worthless. That is what makes it secure: even if someone sees the code later, they cannot do anything with it.

Typical OTPs are 4 to 8 digits long. Their validity ranges from 30 seconds for app-generated codes to around 10 minutes for codes sent by message. OTPs are the most common second factor in two-factor authentication (2FA), and they are also used for passwordless login, account recovery and confirming sensitive actions such as changing bank details.

OTP variants

• HOTP (HMAC-based OTP, RFC 4226): the code is calculated from a shared secret and a counter that increases with every use. Common in older hardware tokens.
• TOTP (time-based OTP, RFC 6238): the code is calculated from a shared secret and the current time, and changes every 30 seconds. This is what authenticator apps use.
• Sent OTPs: the server generates a random code, stores it briefly and delivers it to the user via WhatsApp, SMS or email. No setup is needed on the user’s side, which is why this is the most common form for consumer apps.

OTP channels compared

For sent OTPs, the channel decides both the cost and the security. Typical all-in prices per code in 2026, net, ranging from the API Only rate to the Basic plan beyond its included messages (Meta or network rate plus SendSeven’s fee per outbound message):

Since 1 October 2026, Meta charges for every outbound WhatsApp message, and authentication messages are billed at the market’s authentication rate. More in 2FA cost 2026: SMS vs. WhatsApp.

OTP security best practice

• Never share: tell users in every message that your team will never ask for the code.
• Short validity: a few minutes is enough for sent codes.
• Single use: invalidate the code immediately after it is used, and when a new one is requested.
• Limit attempts: lock or slow down after 3 to 5 wrong entries to stop guessing.
• Separate channels: deliver the code on a different channel from the one used to log in, so one compromised channel is not enough.
• Store securely: keep only a hash of the code on the server, never the plain code in logs.

OTPs on WhatsApp: the authentication template

On WhatsApp, business-initiated OTPs are sent with a dedicated authentication template. Meta keeps the format strict: the message contains the code, an optional security notice and expiry time, and a copy-code or one-tap button. Links, media and promotional content are not allowed. In return, these messages are billed at the authentication rate of the recipient’s market rather than the higher marketing rate.

OTPs with SendSeven

SendSeven sends OTPs via WhatsApp authentication templates, SMS and email through one REST API. Delivery receipts come back via webhooks, so your app knows whether a code arrived. On the Professional plan and above, the Flow Builder lets you set up a fallback from WhatsApp to SMS without code. If you only need the API, the API Only plan starts at €9 per channel per month, including 1,000 messages per channel; Flow Builder is not part of API Only.

The platform is hosted in the EU (Frankfurt), encrypted in transit and at rest, and a DPA under Article 28 GDPR is available. Meta’s authentication rate applies to every WhatsApp code, and SendSeven charges its own fee per outbound message on top. All plans are on the pricing page.